In the Linux kernel's inotify subsystem, a defect occurs when fsnotify_add_inode_mark_locked() fails during a new watch operation. The error path does not decrement a previously incremented inotify watch counter, resulting in a leaked watch count. Consequentially, repeated failures can cumulatively increase the counter until the kernel's max_user_watches limit is reached, causing subsequent watch creation attempts to fail with -ENOSPC. This resource exhaustion can lead to denial of service for applications relying on inotify watches.

The vulnerability affects all Linux kernel versions that contain the inotify watch counter logic before the fix commit (1cce1eea0aff). Specific vendor and product details are Linux kernel builds produced by the Linux Foundation, operating systems that ship with these kernels have the issue if they have not applied the patch. Exact affected kernel releases are not enumerated in the advisory, so any system relying on the inotify feature before the patch may be impacted.

The potential impact is significant if an attacker can trigger repeated failures, as the malicious user can exhaust the max_user_watches resource, causing denial of service for processes that need to add inotify watches. The CVSS score is 5.5, but the scenario involves a local user path that can manipulate watch creation; thus the likely attack vector is local user or application. Exploitability is moderate; no publicly documented exploits exist and the EPSS score is unavailable. The vulnerability is not listed in CISA's KEV catalog, so it is not a known exploited vulnerability at this time.