{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74487", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.905Z", "datePublished": "2026-08-15T12:27:18.236Z", "dateUpdated": "2026-08-23T12:47:26.657Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:47:26.657Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access when removing an entry\n\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write access to it for as\nlong as the entry exists. Removing the entry closes the interpreter\nfile via filp_close() but never restores write access, leaving the\ninode's i_writecount permanently negative. Opening the interpreter\nfor writing keeps failing with ETXTBSY long after the entry is gone\nuntil the inode is evicted from the inode cache.\n\nCommit 90f601b497d7 (\"binfmt_misc: restore write access before\nclosing files opened by open_exec()\") fixed the same imbalance in the\nerror path of bm_register_write() but the actual removal path has\nbeen leaking the write denial since the introduction of the flag.\n\nRestore write access in put_binfmt_handler() before closing the\ninterpreter file."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/binfmt_misc.c"], "versions": [{"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "7873f987213695e3564c8c259e6db283e4739472", "status": "affected", "versionType": "git"}, {"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "13efc628fdf641d901bdba07caa1c558e1bed046", "status": "affected", "versionType": "git"}, {"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "f1cf67f6be0babc73afa4ee0e27bdedffeeeb095", "status": "affected", "versionType": "git"}, {"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c", "status": "affected", "versionType": "git"}, {"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8", "status": "affected", "versionType": "git"}, {"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "fdc1d702bf3001586221fa07e598e876a0a854c5", "status": "affected", "versionType": "git"}, {"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "3b522487a3a9162b1b519eefde7998d103e3e07b", "status": "affected", "versionType": "git"}, {"version": "948b701a607f123df92ed29084413e5dd8cda2ed", "lessThan": "db1856ea9196cf6e015d12199a34c0b9313c7bfa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/binfmt_misc.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7873f987213695e3564c8c259e6db283e4739472"}, {"url": "https://git.kernel.org/stable/c/13efc628fdf641d901bdba07caa1c558e1bed046"}, {"url": "https://git.kernel.org/stable/c/f1cf67f6be0babc73afa4ee0e27bdedffeeeb095"}, {"url": "https://git.kernel.org/stable/c/dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c"}, {"url": "https://git.kernel.org/stable/c/a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8"}, {"url": "https://git.kernel.org/stable/c/fdc1d702bf3001586221fa07e598e876a0a854c5"}, {"url": "https://git.kernel.org/stable/c/3b522487a3a9162b1b519eefde7998d103e3e07b"}, {"url": "https://git.kernel.org/stable/c/db1856ea9196cf6e015d12199a34c0b9313c7bfa"}], "title": "binfmt_misc: restore write access when removing an entry", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/binfmt_misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7873f987213695e3564c8c259e6db283e4739472", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}, {"lessThan": "13efc628fdf641d901bdba07caa1c558e1bed046", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}, {"lessThan": "f1cf67f6be0babc73afa4ee0e27bdedffeeeb095", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}, {"lessThan": "dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}, {"lessThan": "a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}, {"lessThan": "fdc1d702bf3001586221fa07e598e876a0a854c5", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}, {"lessThan": "3b522487a3a9162b1b519eefde7998d103e3e07b", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}, {"lessThan": "db1856ea9196cf6e015d12199a34c0b9313c7bfa", "status": "affected", "version": "948b701a607f123df92ed29084413e5dd8cda2ed", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/binfmt_misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access when removing an entry\n\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write access to it for as\nlong as the entry exists. Removing the entry closes the interpreter\nfile via filp_close() but never restores write access, leaving the\ninode's i_writecount permanently negative. Opening the interpreter\nfor writing keeps failing with ETXTBSY long after the entry is gone\nuntil the inode is evicted from the inode cache.\n\nCommit 90f601b497d7 (\"binfmt_misc: restore write access before\nclosing files opened by open_exec()\") fixed the same imbalance in the\nerror path of bm_register_write() but the actual removal path has\nbeen leaking the write denial since the introduction of the flag.\n\nRestore write access in put_binfmt_handler() before closing the\ninterpreter file."}], "id": "CVE-2026-74487", "lastModified": "2026-08-23T13:16:44.750", "metrics": {}, "published": "2026-08-15T13:17:53.593", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/13efc628fdf641d901bdba07caa1c558e1bed046"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b522487a3a9162b1b519eefde7998d103e3e07b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7873f987213695e3564c8c259e6db283e4739472"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a50296cca2a1db9d8d21051e7d50f0cf3a4b7ec8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db1856ea9196cf6e015d12199a34c0b9313c7bfa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd9ba32169e73a3c3ba595cf1de1f4c69ceafb3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1cf67f6be0babc73afa4ee0e27bdedffeeeb095"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fdc1d702bf3001586221fa07e598e876a0a854c5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: binfmt_misc: restore write access when removing an entry", "id": "2516980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516980"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbinfmt_misc: restore write access when removing an entry\nRegistering an entry with the MISC_FMT_OPEN_FILE flag opens the\ninterpreter via open_exec() which denies write access to it for as\nlong as the entry exists. Removing the entry closes the interpreter\nfile via filp_close() but never restores write access, leaving the\ninode's i_writecount permanently negative. Opening the interpreter\nfor writing keeps failing with ETXTBSY long after the entry is gone\nuntil the inode is evicted from the inode cache.\nCommit 90f601b497d7 (\"binfmt_misc: restore write access before\nclosing files opened by open_exec()\") fixed the same imbalance in the\nerror path of bm_register_write() but the actual removal path has\nbeen leaking the write denial since the introduction of the flag.\nRestore write access in put_binfmt_handler() before closing the\ninterpreter file.", "A flaw was found in the `binfmt_misc` component of the Linux kernel. When a `binfmt_misc` entry is registered with the `MISC_FMT_OPEN_FILE` flag, it opens an interpreter file and denies write access. Upon removal of this entry, the write access is not properly restored. This oversight can lead to a persistent denial of write access to the interpreter file, causing subsequent attempts to open the file for writing to fail with an 'ETXTBSY' error until the affected inode is eventually evicted from the cache."], "name": "CVE-2026-74487", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74487\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74487\nhttps://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-74487-5fbf@gregkh/T"], "threat_severity": "Low"}