CVE-2026-74487: binfmt_misc: restore write access when removing an entry
In the Linux kernel, the following vulnerability has been resolved:
binfmtmisc: restore write access when removing an entry
Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filpclose() but never restores write access, leaving the inode's iwritecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache.
Commit 90f601b497d7 ("binfmtmisc: restore write access before closing files opened by openexec()") fixed the same imbalance in the error path of bmregisterwrite() but the actual removal path has been leaking the write denial since the introduction of the flag.
Restore write access in putbinfmthandler() before closing the interpreter file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 90f601b497d7 - Compensating control
As a mitigation for ETXTBSY continuing until inode eviction, evict/remediate affected inodes from the inode cache (e.g., by restarting the host/service) so the interpreter inode can be reclaimed and writing is restored.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74487?
CVE-2026-74487 has a severity rating of 10, indicating a critical risk level.
How do I fix CVE-2026-74487?
To address CVE-2026-74487, it is recommended to update the Linux kernel to the latest patched version.
What systems are affected by CVE-2026-74487?
CVE-2026-74487 affects systems running vulnerable versions of the Linux kernel with the binfmt_misc functionality.
What is the impact of CVE-2026-74487?
The impact of CVE-2026-74487 may include unauthorized denial of write access when removing binfmt_misc entries, leading to potential security risks.
When was CVE-2026-74487 published?
CVE-2026-74487 was published on August 15, 2026.