CVE-2026-74487
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access when removing an entry Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filp_close() but never restores write access, leaving the inode's i_writecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache. Commit 90f601b497d7 ("binfmt_misc: restore write access before closing files opened by open_exec()") fixed the same imbalance in the error path of bm_register_write() but the actual removal path has been leaking the write denial since the introduction of the flag. Restore write access in put_binfmt_handler() before closing the interpreter file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74487
EUVD
EUVD-2026-59680

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 90f601b497d7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the binfmt_misc module where write access to an interpreter file is not properly restored after removing an entry. When an entry with the MISC_FMT_OPEN_FILE flag is registered, the interpreter's write access is denied. Removing the entry closes the interpreter file but fails to restore write access, causing the inode's write count to remain negative. This leads to persistent write failures with ETXTBSY errors until the inode is evicted from the cache.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to the binfmt_misc module. Detection requires checking the kernel version and the presence of the affected code path. Use 'uname -a' to check the kernel version and 'lsmod | grep binfmt_misc' to verify if the module is loaded.

Impact Analysis

This vulnerability could cause applications relying on binfmt_misc to fail when attempting to write to interpreter files, even after the associated entry is removed. It may lead to system instability or unexpected behavior in processes using these interpreters, potentially disrupting normal operations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the vulnerability. If an update is not immediately available, consider disabling the binfmt_misc module temporarily using 'sudo modprobe -r binfmt_misc' until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart