CVE-2026-74485

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: reject a flag character as the field delimiter

The registration string starts with a user chosen delimiter that

separates the individual fields. So that the field parsers terminate

even on a truncated string create_entry() pads the buffer with that

same delimiter:

memset(buf + count, del, 8);

Most fields are scanned for the delimiter with strchr()/scanarg() and

happily stop on the padding. The flags field is different: instead of

scanning for the delimiter check_special_flags() consumes the flag

characters 'P', 'O', 'C' and 'F' and stops at the first byte that is

none of them, relying on the trailing delimiter to end the scan.

If the delimiter is itself a flag character the padding no longer acts

as a terminator. The scan swallows all eight padding bytes and keeps

reading past the end of the allocation until it hits a byte that is

not a flag character. For example registering

PaPEPPxPPiP

with 'P'

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References