---
id: CVE-2026-74487
title: 'binfmt_misc: restore write access when removing an entry'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  binfmt_misc: restore write access when removing an entry

  Registering an entry with the MISC_FMT_OPEN_FILE flag opens the
  interpreter via open_exec() which denies write…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    7873f987213695e3564c8c259e6db283e4739472
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    13efc628fdf641d901bdba07caa1c558e1bed046
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    f1cf67f6be0babc73afa4ee0e27bdedffeeeb095
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    fdc1d702bf3001586221fa07e598e876a0a854c5
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    3b522487a3a9162b1b519eefde7998d103e3e07b
  - >-
    Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed <
    db1856ea9196cf6e015d12199a34c0b9313c7bfa
  - Linux 4.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:58:10.653549Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:47.321Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74487'
references:
  - url: 'https://git.kernel.org/stable/c/7873f987213695e3564c8c259e6db283e4739472'
  - url: 'https://git.kernel.org/stable/c/13efc628fdf641d901bdba07caa1c558e1bed046'
  - url: 'https://git.kernel.org/stable/c/f1cf67f6be0babc73afa4ee0e27bdedffeeeb095'
  - url: 'https://git.kernel.org/stable/c/dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c'
  - url: 'https://git.kernel.org/stable/c/a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8'
  - url: 'https://git.kernel.org/stable/c/fdc1d702bf3001586221fa07e598e876a0a854c5'
  - url: 'https://git.kernel.org/stable/c/3b522487a3a9162b1b519eefde7998d103e3e07b'
  - url: 'https://git.kernel.org/stable/c/db1856ea9196cf6e015d12199a34c0b9313c7bfa'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.07256
ingestedAt: '2026-11-06T18:00:12.550Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: restore write access when removing an entry

Registering an entry with the MISC_FMT_OPEN_FILE flag opens the
interpreter via open_exec() which denies write access to it for as
long as the entry exists. Removing the entry closes the interpreter
file via filp_close() but never restores write access, leaving the
inode's i_writecount permanently negative. Opening the interpreter
for writing keeps failing with ETXTBSY long after the entry is gone
until the inode is evicted from the inode cache.

Commit 90f601b497d7 ("binfmt_misc: restore write access before
closing files opened by open_exec()") fixed the same imbalance in the
error path of bm_register_write() but the actual removal path has
been leaking the write denial since the introduction of the flag.

Restore write access in put_binfmt_handler() before closing the
interpreter file.

## Affected

- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 7873f987213695e3564c8c259e6db283e4739472`
- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 13efc628fdf641d901bdba07caa1c558e1bed046`
- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < f1cf67f6be0babc73afa4ee0e27bdedffeeeb095`
- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c`
- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8`
- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < fdc1d702bf3001586221fa07e598e876a0a854c5`
- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < 3b522487a3a9162b1b519eefde7998d103e3e07b`
- `Linux >= 948b701a607f123df92ed29084413e5dd8cda2ed < db1856ea9196cf6e015d12199a34c0b9313c7bfa`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.