CVE-2026-74487

What the bug is

Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filp_close() but never restores write access, leaving the inode's i_writecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache. Commit 90f601b497d7 ("binfmt_misc: restore write access before closing files opened by open_exec()") fixed the same imbalance in the error path of bm_register_write() but the actual removal path has been leaking the write denial since the introduction of the flag. Restore write access in put_binfmt_handler() before closing the interpreter file.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/binfmt_misc.c

What this is

EXEC & BINFMT API, ELFMAINTAINERS section matched on fs/*binfmt_*.c · linux-mm@kvack.org · Supported

Kernel module

binfmt_misc

Check it on the machine

grep -w CONFIG_BINFMT_MISC /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w binfmt_misc

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

• bookworm, trixie, forky, sid, bookworm · linux-6.12m

m

a loadable module on every flavour - check lsmod, can be blacklisted

Build switch

CONFIG_BINFMT_MISC

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-08-15 (2 months ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.18%, higher than 6.8% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

fs

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.8	5.10.266	7873f9872136
4.8	5.15.217	13efc628fdf6
4.8	6.1.184	f1cf67f6be0b
4.8	6.6.153	dd9ba32169e7
4.8	6.12.105	a50296cca2a1
4.8	6.18.44	fdc1d702bf30
4.8	7.1.8	3b522487a3a9
4.8	7.2	db1856ea9196

Debian advisories