CVE-2026-68151 binfmt_elf_fdpic: only honour the first PT_INTERP
An unprivileged local attacker can cause a denial of service by repeatedly executing crafted binaries with multiple PT_INTERP headers, leaking resources and locking files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68151?
CVE-2026-68151 is a denial of service vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
binfmt_elf_fdpic: only honour the first PT_INTERP
The program header scan handles PT_INTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PT_INTERP runs the case again and overwrites both interpreter_name and interpreter. The previous name allocation leaks and so does the previous interpreter reference, along with the write denial open_exec() took on it. The denial is never released, so the file stays unwritable for as long as the system runs.
An unprivileged caller reaches this with a crafted binary and repeats it at will. binfmt_elf stops at the first PT_INTERP. Do the same here.
The flaw dates back to the driver's introduction in the pre-git history tree introduced in v2.6.11 by 91808d6ebe39 ("[PATCH] FRV: Add FDPIC ELF binary format driver").
Which versions are affected by CVE-2026-68151?
How do I fix CVE-2026-68151?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-68151 being exploited?
There is no known exploitation of CVE-2026-68151 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68151, DEBIAN-CVE-2026-68151, GHSA-vrxm-q8gm-fcvq, UBUNTU-CVE-2026-68151.