In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown…
CVE-2026-99175
In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks() keeps a reference to its current mark while it drops conn->lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a new mark from being inserted before it. For example, an inotify watch re-added after INIGNORED sorts before the old, detached mark for the same group. The walk can miss the replacement and then detach the entire connector from the object. The replacement is still on its group's markslist and, for inotify, in the watch IDR. The group mutex no longer protects the connector's object from disappearing. An unprivileged fdinfo read racing the final detach can consequently call igrab(NULL): BUG: KASAN: null-ptr-deref in igrab+0x24/0x100 Write of size 4 at addr 0000000000000148 Call Trace: igrab+0x24/0x100 inotifyshowfdinfo+0x1dc/0x5e0 seqshow+0x397/0x690 Set a DESTROYING flag under conn->lock before starting the walk, and reject new marks on that connector with -ENOENT. The existing add-mark error paths undo the temporary group-list entry and the backend's watch allocation. Do not wait for…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 30 October 2026
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
At the source
References
- https://git.kernel.org/stable/c/36ebddca56b9d8993d6dc984fdecc748ee1f5e06
- https://git.kernel.org/stable/c/472589eacdf10b5f9bd10b333957ed5291b2544b
- https://git.kernel.org/stable/c/587d80966dcce2824f13fd32dab83bf882acf66f
- https://git.kernel.org/stable/c/61133f15773b907bada651a02d9c6d38eae37c48
- https://git.kernel.org/stable/c/952501bfc6e5e654ac4a17ec9d90c1ec614bd9f1
- https://git.kernel.org/stable/c/d28a460a2237220d9ccbdd3baac6eaead44e96cb
- https://git.kernel.org/stable/c/da2f9aa89ef1b1fe7a7c6e1a8ddacd9c975e86aa
- https://git.kernel.org/stable/c/f7def717c06aea7004905e4d1568c3691ef9825d
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99175