CVE-2026-74487 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: restore write access when removing an entry
Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filp_close() but never restores write access, leaving the inode's i_writecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache.
Commit 90f601b497d7 ("binfmt_misc: restore write access before closing files opened by open_exec()") fixed the same imbalance in the error path of bm_register_write() but the actual removal path has been leaking the write denial since the introduction of the flag.
Restore write access in put_binfmt_handler() before closing the interpreter file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical resource management flaw within the Linux kernel's binary format miscellaneous (binfmt_misc) subsystem that fundamentally impacts file access control and system stability. This issue specifically manifests when entries are registered with the MISC_FMT_OPEN_FILE flag, which triggers a sequence of operations that improperly manage file descriptor permissions. The root cause lies in how the kernel handles the lifecycle of interpreter files when binfmt_misc entries are removed from the system.
The technical implementation flaw occurs during the removal process of binfmt_misc entries where the kernel correctly closes the interpreter file through filp_close() but fails to restore proper write access permissions to the underlying inode. This creates a persistent state where the inode's i_writecount remains permanently negative, effectively denying write operations to the file even after the entry has been successfully removed from the system's binary format handlers. The vulnerability was introduced with the addition of the MISC_FMT_OPEN_FILE flag and has persisted since its implementation due to incomplete cleanup logic in the normal removal path.
The operational impact of this vulnerability extends beyond simple file access denial and creates a systemic issue that affects long-running systems and applications that rely on binfmt_misc functionality. When an interpreter file is opened with write access denied, subsequent attempts to open it for writing will consistently fail with ETXTBSY errors, creating a resource leak that can persist until the inode is eventually evicted from the kernel's inode cache. This behavior represents a form of permission management error that can lead to application instability and system resource exhaustion, particularly in environments where frequent registration and deregistration of binary format handlers occurs.
The fix implemented addresses this imbalance by ensuring that write access is properly restored within the put_binfmt_handler() function before the interpreter file is closed during normal removal operations. This mirrors the existing correction made in the error path of bm_register_write() and restores proper permission semantics to maintain system consistency. The solution aligns with the principle of resource management where every operation that restricts access must have a corresponding operation that restores it, preventing the accumulation of inconsistent permission states within kernel memory structures.
This vulnerability type corresponds to CWE-1276 which addresses improper handling of file permissions and access control in kernel subsystems, while also relating to ATT&CK techniques involving privilege escalation through system resource manipulation. The issue demonstrates how seemingly simple permission management operations can create cascading effects that impact system stability and security posture, particularly when dealing with the kernel's binary format handling mechanisms.
The fix ensures proper cleanup semantics by restoring write access before closing files opened via open_exec(), thereby maintaining the expected behavior of file access control in the Linux kernel. This prevents the leak of write denial states that could affect other processes attempting to modify the same interpreter files, ultimately preserving system integrity and preventing potential denial-of-service conditions through resource exhaustion in the inode cache management system.