CVE-2026-74487
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access when removing an entry Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filp_close() but never restores write access, leaving the inode's i_writecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache. Commit 90f601b497d7 ("binfmt_misc: restore write access before closing files opened by open_exec()") fixed the same imbalance in the error path of bm_register_write() but the actual removal path has been leaking the write denial since the introduction of the flag. Restore write access in put_binfmt_handler() before closing the interpreter file.
Affected versions
Linux kernel versions
4.8
and later are affected. Fixed in
5.10.266,
5.15.217,
6.1.184,
6.6.153,
6.12.105,
6.18.44,
7.1.8,
7.2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-74487?
CVE-2026-74487 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.8 onward and has been patched in 5.10.266, 5.15.217, 6.1.184 and others. CVE-2026-74487 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74487?
Yes. CVE-2026-74487 has been patched. Fixed versions include 5.10.266, 5.15.217, 6.1.184 and others. If you are running Linux kernel 4.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74487 actively exploited?
No. CVE-2026-74487 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.