If inotify_init is unable to allocate a new file for the new inotify group we leak the new group. Acknowledgements: Red Hat would like to thank Vegard Nossum for reporting this issue.
This was fixed by commit a2ae4cc9a16e211c8a128ba10d22a85431f093ab upstream. Also, this vulnerability is not in the NVD, it says 'ERROR, "CVE-2010-4250" is valid CVE format, but CVE was not found.': http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4250
Thanks Chuck. That website usually takes some time to be updated. Reproducer: http://lkml.org/lkml/2010/11/23/418 Upstream commit: http://git.kernel.org/linus/a2ae4cc9a16e211c8a128ba10d22a85431f093ab
This issue has been addressed in following products: MRG for RHEL-5 Via RHSA-2011:0330 https://rhn.redhat.com/errata/RHSA-2011-0330.html
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5. It was addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0330.html. A future kernel update in Red Hat Enterprise Linux 6 may address this flaw.
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0498 https://rhn.redhat.com/errata/RHSA-2011-0498.html