CVE-2026-74483

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: don't leak the user namespace when the mount fails

bm_get_tree() takes a reference to the user namespace and hands it to

get_tree_keyed() as the sget key. sget_fc() moves that reference into

sb->s_fs_info and clears fc->s_fs_info, so from that point on the

superblock owns it and bm_free() doesn't see it anymore.

The superblock drops it in ->put_super(). But generic_shutdown_super()

only calls ->put_super() from inside the if (sb->s_root) branch, so

nothing releases it when bm_fill_super() fails:

- The kzalloc_obj() failure leaves s_root NULL and the whole branch is

skipped.

- A simple_fill_super() failure in the file loop leaves s_root set, but

s_op still points at simple_super_operations, which has no

->put_super(). bm_fill_super() installs s_ops only once

simple_fill_super() returned success, and installing it earlier

wouldn't help either because simple_fill_super() overwrites s_op.

Eithe

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References