CVE-2026-74484

A flaw was found in the Linux kernel's binfmt_misc component. A local attacker can exploit this vulnerability by registering an 'F' entry that points to its own instance or uses it as an overlayfs lower layer. This self-pinning prevents the associated file from being closed, leading to a resource exhaustion issue. Repeated exploitation can result in a Denial of Service (DoS) by consuming user namespace charges and leaking superblocks, potentially making the system unresponsive.

Red Hat rates this flaw in the Linux kernel's binfmt_misc filesystem as MODERATE severity for Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 2, as a local denial of service with no impact to confidentiality or integrity (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5). A binfmt_misc entry registered with the 'F' flag opens its interpreter at registration time and holds that file open until the entry is freed. A local attacker who can mount a private binfmt_misc instance, for example inside an unprivileged user namespace, can register an 'F' entry whose interpreter points to the instance itself, or use the instance as an overlayfs lower layer. This creates a self-pinning reference cycle between the binfmt_misc superblock, its entries, the interpreter file, and the underlying mount: the interpreter file is never closed, and once the mount namespace is gone there is no remaining path to unregister the entry. Every iteration permanently leaks a superblock and mount objects and consumes one of the caller's user namespace charges, so repeated exploitation exhausts kernel resources and can render the system unresponsive. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in those kernels, and Red Hat Enterprise Linux 6 is out of support scope. Because this flaw is a local denial of service only, fixes for the affected Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS streams are deferred to a future update; the residual risk is limited to availability, as a local unprivileged attacker could consume user namespace charges and leak kernel memory until the system becomes unresponsive, with no impact to confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.