CVE-2026-74618

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: don't warn when the mount is completed from another user namespace

fsopen() records the caller's user namespace in fc->user_ns and hands

back an ordinary file descriptor. Nothing ties the task that calls

fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The

fd is inherited across fork() and exec() and it can be passed over a

unix socket.

Completing a context from another user namespace is allowed on purpose.

vfs_cmd_create() authorizes the create with mount_capable(), which for

FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that

succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns.

So an unprivileged task can reach the WARN_ON() in bm_fill_super():

create a user and a mount namespace in a child, call

fsopen("binfmt_misc") there, send the fscontext fd to the parent and let

the parent issue FSCONFIG_CMD_CREATE. Both namespaces come from a plain

unsh

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References