CVE-2026-74486 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

Not scored Published 15 Aug 2026 Updated 23 Aug 2026

A local attacker can cause a denial of service by making the binfmt_misc interpreter unwritable through repeated executions when pre-content watches are active.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-74486?

CVE-2026-74486 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the registered interpreter file and denies write access to the clone via plain deny_write_access(). The clone is installed as bprm->interpreter and later released by the exec machinery through exe_file_allow_write_access() which skips the i_writecount increment for files with FMODE_FSNOTIFY_HSM set.

The deny and allow side can therefore come to different conclusions when pre-content watches are in play: if a pre-content watch is added to the interpreter after registration every subsequent exec through that entry takes a write denial on the clone that is never paired with a write allowance, driving the interpreter inode's i_writecount further down with each exec and leaving the interpreter unwritable even after the entry and all its users are gone.

Take the write denial via exe_file_deny_write_access() so both sides of the pairing base their decision on the same file mode, and propagate failure instead of silently ignoring it: an interpreter that is concurrently open for writing now fails the exec with ETXTBSY, exactly like an interpreter freshly opened via open_exec() would.

Which versions are affected by CVE-2026-74486?

How do I fix CVE-2026-74486?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-74486 being exploited?

There is no known exploitation of CVE-2026-74486 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-74486, DEBIAN-CVE-2026-74486, GHSA-jmvv-89q4-p2wr, UBUNTU-CVE-2026-74486.