Improper resource shutdown or release in Linux kernel - CVE-2026-74484

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in binfmt_misc 'F' entries when registering an entry whose interpreter points at the instance itself or uses the instance as an overlayfs lower layer. A local user can register a crafted binfmt_misc entry to cause a denial of service.

The issue can pin the binfmt_misc superblock and the user namespace, causing persistent resource consumption after the mount namespace is gone.

Affected software

How to mitigate CVE-2026-74484

External References

• https://git.kernel.org/stable/c/098e92fe0f1bde5af99c8cf504f13f01ef139f85
• https://git.kernel.org/stable/c/1cc2decee06acc939337304e9b3f737fd5d8c4bd
• https://git.kernel.org/stable/c/4dad8ca637d44d5a6d5c23fa80c9e2e455198c2b
• https://git.kernel.org/stable/c/79055d82772b9584f259b747fe40ff56a076678d

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel fs
• Debian update for linux