CVE-2026-74487 binfmt_misc: restore write access when removing an entry
A local attacker with high privileges can cause a denial of service by preventing write access to interpreter binaries after removing binfmt_misc entries.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74487?
CVE-2026-74487 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: restore write access when removing an entry
Registering an entry with the MISC_FMT_OPEN_FILE flag opens the interpreter via open_exec() which denies write access to it for as long as the entry exists. Removing the entry closes the interpreter file via filp_close() but never restores write access, leaving the inode's i_writecount permanently negative. Opening the interpreter for writing keeps failing with ETXTBSY long after the entry is gone until the inode is evicted from the inode cache.
Commit 90f601b497d7 ("binfmt_misc: restore write access before closing files opened by open_exec()") fixed the same imbalance in the error path of bm_register_write() but the actual removal path has been leaking the write denial since the introduction of the flag.
Restore write access in put_binfmt_handler() before closing the interpreter file.
Which versions are affected by CVE-2026-74487?
How do I fix CVE-2026-74487?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74487 being exploited?
There is no known exploitation of CVE-2026-74487 in the wild and no public exploit code.
Sources
Also known as AZL-96344, BELL-CVE-2026-74487, DEBIAN-CVE-2026-74487, GHSA-fq4p-qqh8-rhh7, UBUNTU-CVE-2026-74487.