CVE-2026-89595 - Vulnerability Details

- fsnotify: Fix stale object mask after concurrent mark updates

Description

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: Fix stale object mask after concurrent mark updates

When a mark gets a new event bit, fanotify and inotify may avoid
recalculating the object mask if the cached aggregate already contains that
bit. This is racy with a recalculation triggered by a concurrent update to
another mark on the same connector.

The concurrent scan can read the mark before the new bit is added, while
the updater reads the old aggregate before that scan publishes its result.
The updater then skips recalculation and the scan publishes a mask without
the bit, leaving the object mask stale after both updates complete.

This can be reproduced with two fanotify groups watching the same inode:
one thread removes FAN_MODIFY from one existing mark while another thread
adds FAN_MODIFY to the other mark. After both fanotify_mark() calls return,
writes can fail to produce FAN_MODIFY for the group whose mark now contains
the bit. This was reproduced on an unmodified v6.12.95 kernel. The
equivalent inotify interleaving loses IN_MODIFY events.

For normal fanotify additions, recalculate whenever the raw mark mask
changes. The normal mask is not cleared asynchronously, so an unchanged
addition cannot introduce missing interest. Always recalculate ignore-mask
updates because FS_MODIFY handling may clear the ignore mask without taking
mark->lock, making snapshot comparisons unreliable.

Always recalculate after updating an existing inotify watch. Its replace
path temporarily sets mark->mask to zero, so a concurrent scan can observe
zero even when the old and final masks are equal. Assigning the replacement
mask directly would avoid the transient zero, but existing-watch updates
are infrequent, so unconditional recalculation is simpler.

Published: 2026-09-11

Score: 2.5 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a race condition in the Linux kernel’s fsnotify subsystem that occurs when two fanotify or inotify marks on the same connector are modified concurrently. The kernel may skip recomputing the aggregate object mask if the cached aggregate already contains the newly added event bit, leading to a stale mask that omits the bit. As a result, applications receive a missed FAN_MODIFY or IN_MODIFY event when a file changes, which can cause incorrect application behavior or data loss. This is a non‑privilege‑escalation issue that only affects notification semantics.

Affected Systems

All Linux kernel distributions that include the pre‑fixed fsnotify code, specifically kernels up through the unmodified v6.12.95 release and any kernel that has not applied the upstream patch, are impacted. The affected CPE is Linux kernel and the flaw exists regardless of distribution or build options.

Risk and Exploitability

The CVSS base score is 2.5, indicating low severity, and the EPSS score is less than 1%, suggesting a very low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. An attacker would need to control two threads that modify fanotify or inotify marks on the same connector, which requires local or privileged execution on the system. The issue does not provide privilege escalation or remote code execution; it merely causes missed notifications. Given the low EPSS and the need for local execution, the overall risk is low to moderate, but missing notifications could impact services that rely on real‑time change tracking.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< 27d172b60eeca5c8fd51b246f9fb959067cf102b
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< 2f09f08d602647fc4e328fc27ecb4c3008d10338
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< de75382d6e354b2b055df4896d12a91969f12090
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< 343ae18e960f6c5f1d34d58a69750c62cd463228
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< 92289e66639f62abc754c6f3bce5ead7e98e4ee2
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< 947400af98b9e63841929d079a2c3ea0a8ba227b
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< ac8d8b599d466a129122bded77db3d0f8b96b461
`63c882a05416e18de6fb59f7dd6da48f3bbe8273`	affected	< e422777fdd4746de1109575c51e65038d4c5c1be

Linux

affected

Version	Status	Constraints
`2.6.31`	affected	—
`0`	unaffected	< 2.6.31
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[63c882a05416e18de6fb59f7dd6da48f3bbe8273,947400af98b9e63841929d079a2c3ea0a8ba227b)`	affected	code_commit	—
`[63c882a05416e18de6fb59f7dd6da48f3bbe8273,ac8d8b599d466a129122bded77db3d0f8b96b461)`	affected	code_commit	—
`[63c882a05416e18de6fb59f7dd6da48f3bbe8273,e422777fdd4746de1109575c51e65038d4c5c1be)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.31`	affected	semver	—
`[0,2.6.31)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the upstream fsnotify patch, such as 6.13 or later, using the distribution’s security updates.
If the distribution has not yet back‑ported the fix, rebuild or install an upstream kernel that contains the patch.
Until a patch is available, avoid mission‑critical workloads that depend on FAN_MODIFY or IN_MODIFY notifications, or configure applications to tolerably handle occasional missed events.

Generated by OpenCVE AI on September 15, 2026 at 22:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/27d172b60eeca5c8fd51b246f9fb959067cf102b
https://git.kernel.org/stable/c/2f09f08d602647fc4e328fc27ecb4c3008d10338
https://git.kernel.org/stable/c/343ae18e960f6c5f1d34d58a69750c62cd463228
https://git.kernel.org/stable/c/92289e66639f62abc754c6f3bce5ead7e98e4ee2
https://git.kernel.org/stable/c/947400af98b9e63841929d079a2c3ea0a8ba227b
https://git.kernel.org/stable/c/ac8d8b599d466a129122bded77db3d0f8b96b461
https://git.kernel.org/stable/c/de75382d6e354b2b055df4896d12a91969f12090
https://git.kernel.org/stable/c/e422777fdd4746de1109575c51e65038d4c5c1be
https://nvd.nist.gov/vuln/detail/CVE-2026-89595
https://www.cve.org/CVERecord?id=CVE-2026-89595

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/27d172b60eeca5c8fd51b246f9fb959067cf102b https://git.kernel.org/stable/c/2f09f08d602647fc4e328fc27ecb4c3008d10338 https://git.kernel.org/stable/c/343ae18e960f6c5f1d34d58a69750c62cd463228 https://git.kernel.org/stable/c/92289e66639f62abc754c6f3bce5ead7e98e4ee2 https://git.kernel.org/stable/c/de75382d6e354b2b055df4896d12a91969f12090

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89595 https://www.cve.org/CVERecord?id=CVE-2026-89595
Metrics	threat_severity `None`	cvssV3_1 `{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Low`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a recalculation triggered by a concurrent update to another mark on the same connector. The concurrent scan can read the mark before the new bit is added, while the updater reads the old aggregate before that scan publishes its result. The updater then skips recalculation and the scan publishes a mask without the bit, leaving the object mask stale after both updates complete. This can be reproduced with two fanotify groups watching the same inode: one thread removes FAN_MODIFY from one existing mark while another thread adds FAN_MODIFY to the other mark. After both fanotify_mark() calls return, writes can fail to produce FAN_MODIFY for the group whose mark now contains the bit. This was reproduced on an unmodified v6.12.95 kernel. The equivalent inotify interleaving loses IN_MODIFY events. For normal fanotify additions, recalculate whenever the raw mark mask changes. The normal mask is not cleared asynchronously, so an unchanged addition cannot introduce missing interest. Always recalculate ignore-mask updates because FS_MODIFY handling may clear the ignore mask without taking mark->lock, making snapshot comparisons unreliable. Always recalculate after updating an existing inotify watch. Its replace path temporarily sets mark->mask to zero, so a concurrent scan can observe zero even when the old and final masks are equal. Assigning the replacement mask directly would avoid the transient zero, but existing-watch updates are infrequent, so unconditional recalculation is simpler.
Title		fsnotify: Fix stale object mask after concurrent mark updates
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/947400af98b9e63841929d079a2c3ea0a8ba227b https://git.kernel.org/stable/c/ac8d8b599d466a129122bded77db3d0f8b96b461 https://git.kernel.org/stable/c/e422777fdd4746de1109575c51e65038d4c5c1be

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:58.057Z

Updated: 2026-09-14T12:01:18.174Z

Reserved: 2026-09-11T19:38:34.730Z

Link: CVE-2026-89595

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:44.177

Modified: 2026-09-14T13:19:13.490

Link: CVE-2026-89595

Redhat

Severity : Low

Publid Date: 2026-09-11T19:44:58Z

Links: CVE-2026-89595 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:15:17Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object