mqueue_flush_file() removes an mq_notify() registration only when the
closing task belongs to the thread group stored in notify_owner.

A task in a separate thread group created with CLONE_FILES can register
SIGEV_THREAD notification and exit without closing the shared file table.
If another thread group then unlinks and last-closes the queue, ->flush()
skips the registration and inode eviction loses the only pointers to its
resources.

The orphaned registration permanently retains the notification skb, its
netlink socket, a pid reference and a user namespace reference. An
unprivileged process can repeat the sequence with new queues and sockets.

No inode users remain during eviction. Remove any stale registration there
after dropping info->lock, since netlink_sendskb() may release the final
socket reference.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
---
A reproducer and regression selftest are available on request.

Tested on x86_64 KASAN at the stated base. The unpatched oracle reproduced
3/3 and the patched oracle passed 3/3, with no KASAN report, WARNING splat,
Oops or panic.

 ipc/mqueue.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index d1dd36a651b0..d1a1965c9811 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -528,6 +528,13 @@ static void mqueue_evict_inode(struct inode *inode)
 		list_add_tail(&msg->m_list, &tmp_msg);
 	kfree(info->node_cache);
 	spin_unlock(&info->lock);
+	/*
+	 * A shared file table can let the notification owner exit without
+	 * running ->flush(). No users of the inode remain during eviction, so
+	 * tear down any stale notification after dropping info->lock because
+	 * netlink_sendskb() may release the final socket reference.
+	 */
+	remove_notification(info);
 
 	list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
 		list_del(&msg->m_list);

base-commit: 4352b8aee98005853aa63f57d6377282de17a33f
-- 
2.54.0

On Mon, 24 Aug 2026 13:23:59 +0900, Daehyeon Ko wrote:
> mqueue_flush_file() removes an mq_notify() registration only when the
> closing task belongs to the thread group stored in notify_owner.
> 
> A task in a separate thread group created with CLONE_FILES can register
> SIGEV_THREAD notification and exit without closing the shared file table.
> If another thread group then unlinks and last-closes the queue, ->flush()
> skips the registration and inode eviction loses the only pointers to its
> resources.
> 
> [...]

Applied to the ipc-7.4.misc branch of the vfs/vfs.git tree.
Patches in the ipc-7.4.misc branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: master

[1/1] ipc/mqueue: release notification resources during inode eviction
      https://git.kernel.org/vfs/vfs/c/7add7d60ff30

On Mon, 24 Aug 2026 13:23:59 +0900 Daehyeon Ko <4ncienth@gmail.com> wrote:

> mqueue_flush_file() removes an mq_notify() registration only when the
> closing task belongs to the thread group stored in notify_owner.
> 
> A task in a separate thread group created with CLONE_FILES can register
> SIGEV_THREAD notification and exit without closing the shared file table.
> If another thread group then unlinks and last-closes the queue, ->flush()
> skips the registration and inode eviction loses the only pointers to its
> resources.
> 
> The orphaned registration permanently retains the notification skb, its
> netlink socket, a pid reference and a user namespace reference. An
> unprivileged process can repeat the sequence with new queues and sockets.
> 
> No inode users remain during eviction. Remove any stale registration there
> after dropping info->lock, since netlink_sendskb() may release the final
> socket reference.

Thanks.

> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org

Pity the poor -stable maintainers (and others downstream from them)
wondering "why was I sent this".

To answer this, please, in all bugfix changelogs, provide a concise
description of the userspace-visible runtime effects of the bug.

I asked Gemini that exact question and was told

  This bug creates an unkillable kernel resource leak by failing to
  free netlink socket, PID, and user namespace references when a POSIX
  message queue is evicted.  An unprivileged process can exploit this
  leak repeatedly to cause kernel memory exhaustion and lead to a
  Denial of Service (DoS).

which I'll paste into the changelog.

> Assisted-by: LLM

OK ;)

> A reproducer and regression selftest are available on request.
> 
> Tested on x86_64 KASAN at the stated base. The unpatched oracle reproduced
> 3/3 and the patched oracle passed 3/3, with no KASAN report, WARNING splat,
> Oops or panic.

Useful info, thanks for including.