CVE-2026-74486

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the

registered interpreter file and denies write access to the clone via

plain deny_write_access(). The clone is installed as

bprm->interpreter and later released by the exec machinery through

exe_file_allow_write_access() which skips the i_writecount increment

for files with FMODE_FSNOTIFY_HSM set.

The deny and allow side can therefore come to different conclusions

when pre-content watches are in play: if a pre-content watch is added

to the interpreter after registration every subsequent exec through

that entry takes a write denial on the clone that is never paired

with a write allowance, driving the interpreter inode's i_writecount

further down with each exec and leaving the interpreter unwritable

even after the entry and all its users are gone.

Take the write denial via exe_file_deny_w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References