CVE-2026-74487

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: restore write access when removing an entry

Registering an entry with the MISC_FMT_OPEN_FILE flag opens the

interpreter via open_exec() which denies write access to it for as

long as the entry exists. Removing the entry closes the interpreter

file via filp_close() but never restores write access, leaving the

inode's i_writecount permanently negative. Opening the interpreter

for writing keeps failing with ETXTBSY long after the entry is gone

until the inode is evicted from the inode cache.

Commit 90f601b497d7 ("binfmt_misc: restore write access before

closing files opened by open_exec()") fixed the same imbalance in the

error path of bm_register_write() but the actual removal path has

been leaking the write denial since the introduction of the flag.

Restore write access in put_binfmt_handler() before closing the

interpreter file.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References