CVE-2023-54119

inotify: Avoid reporting event with invalid wd

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

inotify: Avoid reporting event with invalid wd

When inotify_freeing_mark() races with inotify_handle_inode_event() it can happen that inotify_handle_inode_event() sees that i_mark->wd got already reset to -1 and reports this value to userspace which can confuse the inotify listener. Avoid the problem by validating that wd is sensible (and pretend the mark got removed before the event got generated otherwise).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 8fb33166aed888769ea63d6af49515893f8a1f14Affected 7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 2d65c97777e5b4a845637800d5d7b648f5772106Affected 7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 17ad86d8c12220de97e80d88b5b4c934a40e1812Affected 7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 145f54ea336b06cf4f92eeee996f2ffca939ea43Affected 7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before fb3294998489d39835006240e9c6e6b2ac62022eAffected 7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before a48bacee05860c6089c3482bcdc80720b0ee5732Affected 7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before c915d8f5918bea7c3962b09b8884ca128bfd9b0cAffected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.4.243 through 5.4.Not affected 5.10.180 through 5.10.Not affected 5.15.112 through 5.15.Not affected 6.1.29 through 6.1.Not affected 6.2.16 through 6.2.Not affected 6.3.3 through 6.3.Not affected 6.4 and laterNot affected

Product

Versions

LinuxLinux

7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 8fb33166aed888769ea63d6af49515893f8a1f14Affected
7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 2d65c97777e5b4a845637800d5d7b648f5772106Affected
7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 17ad86d8c12220de97e80d88b5b4c934a40e1812Affected
7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before 145f54ea336b06cf4f92eeee996f2ffca939ea43Affected
7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before fb3294998489d39835006240e9c6e6b2ac62022eAffected
7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before a48bacee05860c6089c3482bcdc80720b0ee5732Affected
7e790dd5fc937bc8d2400c30a05e32a9e9eef276 to before c915d8f5918bea7c3962b09b8884ca128bfd9b0cAffected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.4.243 through 5.4.*Not affected
5.10.180 through 5.10.*Not affected
5.15.112 through 5.15.*Not affected
6.1.29 through 6.1.*Not affected
6.2.16 through 6.2.*Not affected
6.3.3 through 6.3.*Not affected
6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.