{"id":"CVE-2026-74487","title":"binfmt_misc: restore write access when removing an entry","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access when removing an entry\n\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 7873f987213695e3564c8c259e6db283e4739472","Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 13efc628fdf641d901bdba07caa1c558e1bed046","Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < f1cf67f6be0babc73afa4ee0e27bdedffeeeb095","Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c","Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8","Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < fdc1d702bf3001586221fa07e598e876a0a854c5","Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 3b522487a3a9162b1b519eefde7998d103e3e07b","Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < db1856ea9196cf6e015d12199a34c0b9313c7bfa","Linux 4.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:58:10.653549Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:47.321Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74487","references":[{"url":"https://git.kernel.org/stable/c/7873f987213695e3564c8c259e6db283e4739472"},{"url":"https://git.kernel.org/stable/c/13efc628fdf641d901bdba07caa1c558e1bed046"},{"url":"https://git.kernel.org/stable/c/f1cf67f6be0babc73afa4ee0e27bdedffeeeb095"},{"url":"https://git.kernel.org/stable/c/dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c"},{"url":"https://git.kernel.org/stable/c/a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8"},{"url":"https://git.kernel.org/stable/c/fdc1d702bf3001586221fa07e598e876a0a854c5"},{"url":"https://git.kernel.org/stable/c/3b522487a3a9162b1b519eefde7998d103e3e07b"},{"url":"https://git.kernel.org/stable/c/db1856ea9196cf6e015d12199a34c0b9313c7bfa"}],"tags":["cve.org"],"epss":0.00177,"epssPercentile":0.07256,"ingestedAt":"2026-11-06T18:00:12.550Z","slug":"CVE-2026-74487","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access when removing an entry\n\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write access to it for as\nlong as the entry exists. Removing the entry closes the interpreter\nfile via filp_close() but never restores write access, leaving the\ninode's i_writecount permanently negative. Opening the interpreter\nfor writing keeps failing with ETXTBSY long after the entry is gone\nuntil the inode is evicted from the inode cache.\n\nCommit 90f601b497d7 (\"binfmt_misc: restore write access before\nclosing files opened by open_exec()\") fixed the same imbalance in the\nerror path of bm_register_write() but the actual removal path has\nbeen leaking the write denial since the introduction of the flag.\n\nRestore write access in put_binfmt_handler() before closing the\ninterpreter file.\n\n## Affected\n\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 7873f987213695e3564c8c259e6db283e4739472`\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 13efc628fdf641d901bdba07caa1c558e1bed046`\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < f1cf67f6be0babc73afa4ee0e27bdedffeeeb095`\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c`\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8`\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < fdc1d702bf3001586221fa07e598e876a0a854c5`\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 3b522487a3a9162b1b519eefde7998d103e3e07b`\n- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < db1856ea9196cf6e015d12199a34c0b9313c7bfa`\n- `Linux 4.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}