CVE-2026-74485: binfmt_misc: reject a flag character as the field delimiter
binfmtmisc: reject a flag character as the field delimiter
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1 - Configuration
Update the kernel so binfmt_misc rejects a delimiter that is one of the flag characters up front (e.g., 'P', 'O', 'C', 'F') to ensure field parsers terminate correctly and do not scan past the end.
Linux kernel binfmt_misc field delimiter validation = reject delimiter if it is one of the flag characters ('P', 'O', 'C', 'F')
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74485?
The severity of CVE-2026-74485 is rated as 37 on the risk scale.
How do I fix CVE-2026-74485?
To fix CVE-2026-74485, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-74485?
CVE-2026-74485 affects systems running vulnerable versions of the Linux kernel that utilize the binfmt_misc functionality.
What is binfmt_misc in relation to CVE-2026-74485?
Binfmt_misc is a Linux kernel feature that allows the registration of various executable file formats and is the context in which CVE-2026-74485 was identified.
What types of attacks could exploit CVE-2026-74485?
CVE-2026-74485 could potentially be exploited to manipulate field parsing in user-defined delimiters, leading to security risks.