CVE-2026-74483
Received Received - Intake

Memory Leak in Linux Kernel binfmt_misc

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when the mount fails bm_get_tree() takes a reference to the user namespace and hands it to get_tree_keyed() as the sget key. sget_fc() moves that reference into sb->s_fs_info and clears fc->s_fs_info, so from that point on the superblock owns it and bm_free() doesn't see it anymore. The superblock drops it in ->put_super(). But generic_shutdown_super() only calls ->put_super() from inside the if (sb->s_root) branch, so nothing releases it when bm_fill_super() fails: - The kzalloc_obj() failure leaves s_root NULL and the whole branch is skipped. - A simple_fill_super() failure in the file loop leaves s_root set, but s_op still points at simple_super_operations, which has no ->put_super(). bm_fill_super() installs s_ops only once simple_fill_super() returned success, and installing it earlier wouldn't help either because simple_fill_super() overwrites s_op. Either way vfs_get_super() calls deactivate_locked_super() and the reference is gone for good. binfmt_misc mounts are available in a user namespace and both the inode and the dentry cache are SLAB_ACCOUNT, so an unprivileged caller under a tight memory cgroup can fail simple_fill_super() on demand and leak one user namespace per attempt. Drop the reference in ->kill_sb() instead, which runs unconditionally, the same way nfsd and rpc_pipefs release their keyed s_fs_info. That also stops ->put_super() from clearing s_fs_info while the superblock is still on @fs_supers. generic_shutdown_super() leaves it there on purpose so that sget_fc() keeps finding it until kill_sb() has run, but a NULL s_fs_info makes test_keyed_super() miss it, so a concurrent mount for the same user namespace skips the grab_super() wait and creates a second superblock for a namespace that is still being torn down.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74483
EUVD
EUVD-2026-59676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a user namespace leak when a binfmt_misc mount fails. The issue occurs because the user namespace reference is not properly released when the mount operation fails, leading to a memory leak. The fix suggests moving the reference release to the kill_sb() function to ensure it runs unconditionally.

Detection Guidance

This vulnerability is specific to the Linux kernel's binfmt_misc module and involves user namespace leaks during mount failures. Detection requires checking kernel logs for failed binfmt_misc mount attempts or user namespace exhaustion events. Commands like 'dmesg | grep binfmt_misc' or 'journalctl -k | grep binfmt_misc' may reveal related errors. Monitor for OOM conditions in user namespaces or slab cache growth in SLAB_ACCOUNT caches.

Impact Analysis

An unprivileged attacker in a user namespace could exploit this to leak user namespace references by repeatedly failing mount operations. This could lead to resource exhaustion, particularly under tight memory constraints, potentially causing system instability or denial of service.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. If immediate patching is not possible, restrict unprivileged user namespace creation via sysctl settings (e.g., 'kernel.unprivileged_userns_clone=0') or disable binfmt_misc mounts if not required. Monitor system logs for failed mount attempts as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74483. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart