Out-of-bounds read in Linux kernel - CVE-2026-74485

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the binfmt_misc registration parser when processing a crafted registration string with a flag character used as the field delimiter. A remote attacker can submit a specially crafted registration string to disclose sensitive information.

The issue is reachable by unprivileged users in a user namespace through binfmt_misc mounts.

Affected software

How to mitigate CVE-2026-74485

External References

• https://git.kernel.org/stable/c/1819f82dee766c58295ecaacdac02cdf6837d7a4
• https://git.kernel.org/stable/c/1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc
• https://git.kernel.org/stable/c/840bb9c49c3e75fb32b593d67ab32f6b77122262
• https://git.kernel.org/stable/c/8e85d50ba1117fd446bf9a250bd8a97d48384bdc
• https://git.kernel.org/stable/c/9a2d87db3898b5993b64fd258d0334e0eba9ee0d

Related Security Bulletins

• Out-of-bounds read in Linux kernel fs
• Debian update for linux