The vulnerability in the Linux kernel's fsnotify subsystem arises from a race condition when multiple fanotify or inotify marks on the same connector are updated concurrently. When a mark receives a new event bit, the system may skip recalculating the object mask if the cached aggregate already contains that bit. However, concurrent scans and updates can interleave such that the recalculation is skipped incorrectly, leaving the object mask stale and causing missed event notifications. This was demonstrated with two fanotify groups watching the same inode, where concurrent removal and addition of FAN_MODIFY bits led to lost FAN_MODIFY events. The fix involves always recalculating the mask when raw mark masks change or when updating existing watches to avoid transient stale states.

The impact is that event notifications for file modifications (e.g., FAN_MODIFY or IN_MODIFY) may be lost due to stale object masks after concurrent updates. This can cause monitoring tools relying on fanotify or inotify to miss file system events, potentially affecting security monitoring or system behavior dependent on accurate event notifications. There is no indication of direct privilege escalation or code execution from this issue.

A fix has been implemented in the Linux kernel to address this race condition by ensuring recalculation of object masks after mark updates. Users should apply the official kernel update that includes this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No additional mitigation steps are indicated.