CVE-2026-74486

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74486", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.905Z", "datePublished": "2026-08-15T12:27:17.609Z", "dateUpdated": "2026-11-06T17:05:47.188Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:25.566Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: use exe_file_deny_write_access() for the interpreter clone\n\nFor MISC_FMT_OPEN_FILE entries load_misc_binary() clones the\nregistered interpreter file and denies write access to the clone via\nplain deny_write_access(). The clone is installed as\nbprm->interpreter and later released by the exec machinery through\nexe_file_allow_write_access() which skips the i_writecount increment\nfor files with FMODE_FSNOTIFY_HSM set.\n\nThe deny and allow side can therefore come to different conclusions\nwhen pre-content watches are in play: if a pre-content watch is added\nto the interpreter after registration every subsequent exec through\nthat entry takes a write denial on the clone that is never paired\nwith a write allowance, driving the interpreter inode's i_writecount\nfurther down with each exec and leaving the interpreter unwritable\neven after the entry and all its users are gone.\n\nTake the write denial via exe_file_deny_write_access() so both sides\nof the pairing base their decision on the same file mode, and\npropagate failure instead of silently ignoring it: an interpreter\nthat is concurrently open for writing now fails the exec with\nETXTBSY, exactly like an interpreter freshly opened via open_exec()\nwould."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/binfmt_misc.c"], "versions": [{"version": "5b432413f7bbbc8b935138490a57be05c1921684", "lessThan": "c65eb018c12179b5e2c7afe1f0956298576fecec", "status": "affected", "versionType": "git"}, {"version": "bb4715098d8e340bbbdd3a874b31f89867c8067e", "lessThan": "2bd860b7e752a51185960143cab9fec7bf32c84e", "status": "affected", "versionType": "git"}, {"version": "c152be5adc0975c75cc4f50891c9072d52d60b47", "lessThan": "eea4b7c7711b1e425272d23352af157f45f4c3e3", "status": "affected", "versionType": "git"}, {"version": "bf5ed2ef5cdb7b47ce606e3d48ea6eb803b31503", "lessThan": "2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9", "status": "affected", "versionType": "git"}, {"version": "483217fd6f7ccd98b3ed2531a54f75ed144b4499", "lessThan": "f1e7ea3c8e070f19771cdaef55bbeda1359ad490", "status": "affected", "versionType": "git"}, {"version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "lessThan": "255a758697da87a205e072e0cfc35897b8f743b1", "status": "affected", "versionType": "git"}, {"version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "lessThan": "f0edbaf487e4653a680a7abb91c1df94cb7886aa", "status": "affected", "versionType": "git"}, {"version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "lessThan": "fa5990ca8fd917003e526036bcc50413edb9722c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/binfmt_misc.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c65eb018c12179b5e2c7afe1f0956298576fecec"}, {"url": "https://git.kernel.org/stable/c/2bd860b7e752a51185960143cab9fec7bf32c84e"}, {"url": "https://git.kernel.org/stable/c/eea4b7c7711b1e425272d23352af157f45f4c3e3"}, {"url": "https://git.kernel.org/stable/c/2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9"}, {"url": "https://git.kernel.org/stable/c/f1e7ea3c8e070f19771cdaef55bbeda1359ad490"}, {"url": "https://git.kernel.org/stable/c/255a758697da87a205e072e0cfc35897b8f743b1"}, {"url": "https://git.kernel.org/stable/c/f0edbaf487e4653a680a7abb91c1df94cb7886aa"}, {"url": "https://git.kernel.org/stable/c/fa5990ca8fd917003e526036bcc50413edb9722c"}], "title": "binfmt_misc: use exe_file_deny_write_access() for the interpreter clone", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:58:04.544658Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:05:47.188Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:58:04.544658Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:58:05.870Z"}}], "cna": {"title": "binfmt_misc: use exe_file_deny_write_access() for the interpreter clone", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5b432413f7bbbc8b935138490a57be05c1921684", "lessThan": "c65eb018c12179b5e2c7afe1f0956298576fecec", "versionType": "git"}, {"status": "affected", "version": "bb4715098d8e340bbbdd3a874b31f89867c8067e", "lessThan": "2bd860b7e752a51185960143cab9fec7bf32c84e", "versionType": "git"}, {"status": "affected", "version": "c152be5adc0975c75cc4f50891c9072d52d60b47", "lessThan": "eea4b7c7711b1e425272d23352af157f45f4c3e3", "versionType": "git"}, {"status": "affected", "version": "bf5ed2ef5cdb7b47ce606e3d48ea6eb803b31503", "lessThan": "2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9", "versionType": "git"}, {"status": "affected", "version": "483217fd6f7ccd98b3ed2531a54f75ed144b4499", "lessThan": "f1e7ea3c8e070f19771cdaef55bbeda1359ad490", "versionType": "git"}, {"status": "affected", "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "lessThan": "255a758697da87a205e072e0cfc35897b8f743b1", "versionType": "git"}, {"status": "affected", "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "lessThan": "f0edbaf487e4653a680a7abb91c1df94cb7886aa", "versionType": "git"}, {"status": "affected", "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "lessThan": "fa5990ca8fd917003e526036bcc50413edb9722c", "versionType": "git"}], "programFiles": ["fs/binfmt_misc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/binfmt_misc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c65eb018c12179b5e2c7afe1f0956298576fecec"}, {"url": "https://git.kernel.org/stable/c/2bd860b7e752a51185960143cab9fec7bf32c84e"}, {"url": "https://git.kernel.org/stable/c/eea4b7c7711b1e425272d23352af157f45f4c3e3"}, {"url": "https://git.kernel.org/stable/c/2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9"}, {"url": "https://git.kernel.org/stable/c/f1e7ea3c8e070f19771cdaef55bbeda1359ad490"}, {"url": "https://git.kernel.org/stable/c/255a758697da87a205e072e0cfc35897b8f743b1"}, {"url": "https://git.kernel.org/stable/c/f0edbaf487e4653a680a7abb91c1df94cb7886aa"}, {"url": "https://git.kernel.org/stable/c/fa5990ca8fd917003e526036bcc50413edb9722c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: use exe_file_deny_write_access() for the interpreter clone\n\nFor MISC_FMT_OPEN_FILE entries load_misc_binary() clones the\nregistered interpreter file and denies write access to the clone via\nplain deny_write_access(). The clone is installed as\nbprm->interpreter and later released by the exec machinery through\nexe_file_allow_write_access() which skips the i_writecount increment\nfor files with FMODE_FSNOTIFY_HSM set.\n\nThe deny and allow side can therefore come to different conclusions\nwhen pre-content watches are in play: if a pre-content watch is added\nto the interpreter after registration every subsequent exec through\nthat entry takes a write denial on the clone that is never paired\nwith a write allowance, driving the interpreter inode's i_writecount\nfurther down with each exec and leaving the interpreter unwritable\neven after the entry and all its users are gone.\n\nTake the write denial via exe_file_deny_write_access() so both sides\nof the pairing base their decision on the same file mode, and\npropagate failure instead of silently ignoring it: an interpreter\nthat is concurrently open for writing now fails the exec with\nETXTBSY, exactly like an interpreter freshly opened via open_exec()\nwould."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:25.566Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74486", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:05:47.188Z", "dateReserved": "2026-08-15T05:44:03.905Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T12:27:17.609Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/binfmt_misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c65eb018c12179b5e2c7afe1f0956298576fecec", "status": "affected", "version": "5b432413f7bbbc8b935138490a57be05c1921684", "versionType": "git"}, {"lessThan": "2bd860b7e752a51185960143cab9fec7bf32c84e", "status": "affected", "version": "bb4715098d8e340bbbdd3a874b31f89867c8067e", "versionType": "git"}, {"lessThan": "eea4b7c7711b1e425272d23352af157f45f4c3e3", "status": "affected", "version": "c152be5adc0975c75cc4f50891c9072d52d60b47", "versionType": "git"}, {"lessThan": "2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9", "status": "affected", "version": "bf5ed2ef5cdb7b47ce606e3d48ea6eb803b31503", "versionType": "git"}, {"lessThan": "f1e7ea3c8e070f19771cdaef55bbeda1359ad490", "status": "affected", "version": "483217fd6f7ccd98b3ed2531a54f75ed144b4499", "versionType": "git"}, {"lessThan": "255a758697da87a205e072e0cfc35897b8f743b1", "status": "affected", "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "versionType": "git"}, {"lessThan": "f0edbaf487e4653a680a7abb91c1df94cb7886aa", "status": "affected", "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "versionType": "git"}, {"lessThan": "fa5990ca8fd917003e526036bcc50413edb9722c", "status": "affected", "version": "0357ef03c94ef835bd44a0658b8edb672a9dbf51", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/binfmt_misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: use exe_file_deny_write_access() for the interpreter clone\n\nFor MISC_FMT_OPEN_FILE entries load_misc_binary() clones the\nregistered interpreter file and denies write access to the clone via\nplain deny_write_access(). The clone is installed as\nbprm->interpreter and later released by the exec machinery through\nexe_file_allow_write_access() which skips the i_writecount increment\nfor files with FMODE_FSNOTIFY_HSM set.\n\nThe deny and allow side can therefore come to different conclusions\nwhen pre-content watches are in play: if a pre-content watch is added\nto the interpreter after registration every subsequent exec through\nthat entry takes a write denial on the clone that is never paired\nwith a write allowance, driving the interpreter inode's i_writecount\nfurther down with each exec and leaving the interpreter unwritable\neven after the entry and all its users are gone.\n\nTake the write denial via exe_file_deny_write_access() so both sides\nof the pairing base their decision on the same file mode, and\npropagate failure instead of silently ignoring it: an interpreter\nthat is concurrently open for writing now fails the exec with\nETXTBSY, exactly like an interpreter freshly opened via open_exec()\nwould."}], "id": "CVE-2026-74486", "lastModified": "2026-11-06T17:19:49.430", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74486", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:58:04.544658Z", "version": "2.0.3"}}]}, "published": "2026-08-15T13:17:53.497", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/255a758697da87a205e072e0cfc35897b8f743b1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2bd860b7e752a51185960143cab9fec7bf32c84e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2fdf8b07bee5ef99ec77773a6be05fbb8ee5cdb9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c65eb018c12179b5e2c7afe1f0956298576fecec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eea4b7c7711b1e425272d23352af157f45f4c3e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f0edbaf487e4653a680a7abb91c1df94cb7886aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1e7ea3c8e070f19771cdaef55bbeda1359ad490"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa5990ca8fd917003e526036bcc50413edb9722c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone", "id": "2517041", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517041"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbinfmt_misc: use exe_file_deny_write_access() for the interpreter clone\nFor MISC_FMT_OPEN_FILE entries load_misc_binary() clones the\nregistered interpreter file and denies write access to the clone via\nplain deny_write_access(). The clone is installed as\nbprm->interpreter and later released by the exec machinery through\nexe_file_allow_write_access() which skips the i_writecount increment\nfor files with FMODE_FSNOTIFY_HSM set.\nThe deny and allow side can therefore come to different conclusions\nwhen pre-content watches are in play: if a pre-content watch is added\nto the interpreter after registration every subsequent exec through\nthat entry takes a write denial on the clone that is never paired\nwith a write allowance, driving the interpreter inode's i_writecount\nfurther down with each exec and leaving the interpreter unwritable\neven after the entry and all its users are gone.\nTake the write denial via exe_file_deny_write_access() so both sides\nof the pairing base their decision on the same file mode, and\npropagate failure instead of silently ignoring it: an interpreter\nthat is concurrently open for writing now fails the exec with\nETXTBSY, exactly like an interpreter freshly opened via open_exec()\nwould.", "A flaw was found in the Linux kernel's `binfmt_misc` component. This vulnerability arises from an inconsistency in how write access is managed for cloned interpreter files. When a pre-content watch is applied to an interpreter after its registration, subsequent executions through that entry can lead to an imbalance in write access denials and allowances. This can cause the interpreter file to become permanently unwritable, resulting in a Denial of Service (DoS) where the interpreter cannot be executed."], "name": "CVE-2026-74486", "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74486\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74486\nhttps://lore.kernel.org/linux-cve-announce/2026081537-CVE-2026-74486-cbfc@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0357ef03c94ef835bd44a0658b8edb672a9dbf51,255a758697da87a205e072e0cfc35897b8f743b1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0357ef03c94ef835bd44a0658b8edb672a9dbf51,f0edbaf487e4653a680a7abb91c1df94cb7886aa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0357ef03c94ef835bd44a0658b8edb672a9dbf51,fa5990ca8fd917003e526036bcc50413edb9722c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T15:15:03.214603+00:00", "updated": "2026-08-21T23:30:17.181883+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}