CVE-2026-74487None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access when removing an entry Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: restore write access when removing an entry
Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filp_close() but never restores write access, leaving the inode's i_writecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache.
Commit 90f601b497d7 ("binfmt_misc: restore write access before closing files opened by open_exec()") fixed the same imbalance in the error path of bm_register_write() but the actual removal path has been leaking the write denial since the introduction of the flag.
Restore write access in put_binfmt_handler() before closing the interpreter file.
Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 7873f987213695e3564c8c259e6db283e4739472Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 13efc628fdf641d901bdba07caa1c558e1bed046Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < f1cf67f6be0babc73afa4ee0e27bdedffeeeb095Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3cLinux >= 948b701a607f123df92ed29084413e5dd8cda2ed < a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < fdc1d702bf3001586221fa07e598e876a0a854c5Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 3b522487a3a9162b1b519eefde7998d103e3e07bLinux >= 948b701a607f123df92ed29084413e5dd8cda2ed < db1856ea9196cf6e015d12199a34c0b9313c7bfaLinux 4.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses