CVE-2026-74486 (GCVE-0-2026-74486)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-23 12:47
VLAI
Title
binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
Summary
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the registered interpreter file and denies write access to the clone via plain deny_write_access(). The clone is installed as bprm->interpreter and later released by the exec machinery through exe_file_allow_write_access() which skips the i_writecount increment for files with FMODE_FSNOTIFY_HSM set. The deny and allow side can therefore come to different conclusions when pre-content watches are in play: if a pre-content watch is added to the interpreter after registration every subsequent exec through that entry takes a write denial on the clone that is never paired with a write allowance, driving the interpreter inode's i_writecount further down with each exec and leaving the interpreter unwritable even after the entry and all its users are gone. Take the write denial via exe_file_deny_write_access() so both sides of the pairing base their decision on the same file mode, and propagate failure instead of silently ignoring it: an interpreter that is concurrently open for writing now fails the exec with ETXTBSY, exactly like an interpreter freshly opened via open_exec() would.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5b432413f7bbbc8b935138490a57be05c1921684 , < c65eb018c12179b5e2c7afe1f0956298576fecec (git)
Affected: bb4715098d8e340bbbdd3a874b31f89867c8067e , < 2bd860b7e752a51185960143cab9fec7bf32c84e (git)
Affected: c152be5adc0975c75cc4f50891c9072d52d60b47 , < eea4b7c7711b1e425272d23352af157f45f4c3e3 (git)
Affected: bf5ed2ef5cdb7b47ce606e3d48ea6eb803b31503 , < 2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9 (git)
Affected: 483217fd6f7ccd98b3ed2531a54f75ed144b4499 , < f1e7ea3c8e070f19771cdaef55bbeda1359ad490 (git)
Affected: 0357ef03c94ef835bd44a0658b8edb672a9dbf51 , < 255a758697da87a205e072e0cfc35897b8f743b1 (git)
Affected: 0357ef03c94ef835bd44a0658b8edb672a9dbf51 , < f0edbaf487e4653a680a7abb91c1df94cb7886aa (git)
Affected: 0357ef03c94ef835bd44a0658b8edb672a9dbf51 , < fa5990ca8fd917003e526036bcc50413edb9722c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c65eb018c12179b5e2c7afe1f0956298576fecec",
              "status": "affected",
              "version": "5b432413f7bbbc8b935138490a57be05c1921684",
              "versionType": "git"
            },
            {
              "lessThan": "2bd860b7e752a51185960143cab9fec7bf32c84e",
              "status": "affected",
              "version": "bb4715098d8e340bbbdd3a874b31f89867c8067e",
              "versionType": "git"
            },
            {
              "lessThan": "eea4b7c7711b1e425272d23352af157f45f4c3e3",
              "status": "affected",
              "version": "c152be5adc0975c75cc4f50891c9072d52d60b47",
              "versionType": "git"
            },
            {
              "lessThan": "2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9",
              "status": "affected",
              "version": "bf5ed2ef5cdb7b47ce606e3d48ea6eb803b31503",
              "versionType": "git"
            },
            {
              "lessThan": "f1e7ea3c8e070f19771cdaef55bbeda1359ad490",
              "status": "affected",
              "version": "483217fd6f7ccd98b3ed2531a54f75ed144b4499",
              "versionType": "git"
            },
            {
              "lessThan": "255a758697da87a205e072e0cfc35897b8f743b1",
              "status": "affected",
              "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51",
              "versionType": "git"
            },
            {
              "lessThan": "f0edbaf487e4653a680a7abb91c1df94cb7886aa",
              "status": "affected",
              "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51",
              "versionType": "git"
            },
            {
              "lessThan": "fa5990ca8fd917003e526036bcc50413edb9722c",
              "status": "affected",
              "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: use exe_file_deny_write_access() for the interpreter clone\n\nFor MISC_FMT_OPEN_FILE entries load_misc_binary() clones the\nregistered interpreter file and denies write access to the clone via\nplain deny_write_access(). The clone is installed as\nbprm-\u003einterpreter and later released by the exec machinery through\nexe_file_allow_write_access() which skips the i_writecount increment\nfor files with FMODE_FSNOTIFY_HSM set.\n\nThe deny and allow side can therefore come to different conclusions\nwhen pre-content watches are in play: if a pre-content watch is added\nto the interpreter after registration every subsequent exec through\nthat entry takes a write denial on the clone that is never paired\nwith a write allowance, driving the interpreter inode\u0027s i_writecount\nfurther down with each exec and leaving the interpreter unwritable\neven after the entry and all its users are gone.\n\nTake the write denial via exe_file_deny_write_access() so both sides\nof the pairing base their decision on the same file mode, and\npropagate failure instead of silently ignoring it: an interpreter\nthat is concurrently open for writing now fails the exec with\nETXTBSY, exactly like an interpreter freshly opened via open_exec()\nwould."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:25.566Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c65eb018c12179b5e2c7afe1f0956298576fecec"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bd860b7e752a51185960143cab9fec7bf32c84e"
        },
        {
          "url": "https://git.kernel.org/stable/c/eea4b7c7711b1e425272d23352af157f45f4c3e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1e7ea3c8e070f19771cdaef55bbeda1359ad490"
        },
        {
          "url": "https://git.kernel.org/stable/c/255a758697da87a205e072e0cfc35897b8f743b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0edbaf487e4653a680a7abb91c1df94cb7886aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa5990ca8fd917003e526036bcc50413edb9722c"
        }
      ],
      "title": "binfmt_misc: use exe_file_deny_write_access() for the interpreter clone",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74486",
    "datePublished": "2026-08-15T12:27:17.609Z",
    "dateReserved": "2026-08-15T05:44:03.905Z",
    "dateUpdated": "2026-08-23T12:47:25.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74486",
      "date": "2026-09-21",
      "epss": "0.00177",
      "percentile": "0.07456"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/binfmt_misc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c65eb018c12179b5e2c7afe1f0956298576fecec",
                    "status": "affected",
                    "version": "5b432413f7bbbc8b935138490a57be05c1921684",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2bd860b7e752a51185960143cab9fec7bf32c84e",
                    "status": "affected",
                    "version": "bb4715098d8e340bbbdd3a874b31f89867c8067e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eea4b7c7711b1e425272d23352af157f45f4c3e3",
                    "status": "affected",
                    "version": "c152be5adc0975c75cc4f50891c9072d52d60b47",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9",
                    "status": "affected",
                    "version": "bf5ed2ef5cdb7b47ce606e3d48ea6eb803b31503",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1e7ea3c8e070f19771cdaef55bbeda1359ad490",
                    "status": "affected",
                    "version": "483217fd6f7ccd98b3ed2531a54f75ed144b4499",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "255a758697da87a205e072e0cfc35897b8f743b1",
                    "status": "affected",
                    "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0edbaf487e4653a680a7abb91c1df94cb7886aa",
                    "status": "affected",
                    "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fa5990ca8fd917003e526036bcc50413edb9722c",
                    "status": "affected",
                    "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/binfmt_misc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: use exe_file_deny_write_access() for the interpreter clone\n\nFor MISC_FMT_OPEN_FILE entries load_misc_binary() clones the\nregistered interpreter file and denies write access to the clone via\nplain deny_write_access(). The clone is installed as\nbprm-\u003einterpreter and later released by the exec machinery through\nexe_file_allow_write_access() which skips the i_writecount increment\nfor files with FMODE_FSNOTIFY_HSM set.\n\nThe deny and allow side can therefore come to different conclusions\nwhen pre-content watches are in play: if a pre-content watch is added\nto the interpreter after registration every subsequent exec through\nthat entry takes a write denial on the clone that is never paired\nwith a write allowance, driving the interpreter inode\u0027s i_writecount\nfurther down with each exec and leaving the interpreter unwritable\neven after the entry and all its users are gone.\n\nTake the write denial via exe_file_deny_write_access() so both sides\nof the pairing base their decision on the same file mode, and\npropagate failure instead of silently ignoring it: an interpreter\nthat is concurrently open for writing now fails the exec with\nETXTBSY, exactly like an interpreter freshly opened via open_exec()\nwould."
          }
        ],
        "id": "CVE-2026-74486",
        "lastModified": "2026-08-23T13:16:44.640",
        "metrics": {},
        "published": "2026-08-15T13:17:53.497",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/255a758697da87a205e072e0cfc35897b8f743b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2bd860b7e752a51185960143cab9fec7bf32c84e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c65eb018c12179b5e2c7afe1f0956298576fecec"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eea4b7c7711b1e425272d23352af157f45f4c3e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f0edbaf487e4653a680a7abb91c1df94cb7886aa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1e7ea3c8e070f19771cdaef55bbeda1359ad490"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fa5990ca8fd917003e526036bcc50413edb9722c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-01T10:42:43+00:00",
      "cve": "CVE-2026-74486",
      "id": "CVE-2026-74486",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74486.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-22T00:53:08Z",
      "cve": "CVE-2026-74486",
      "id": "CVE-2026-74486",
      "initial_release_date": "2026-08-15T23:51:56Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74486",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74486.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.