CVE-2026-74485

A flaw was found in the binfmt_misc component of the Linux kernel. An unprivileged local user, operating within a user namespace, could exploit this vulnerability. By registering a binfmt_misc string where the chosen delimiter character is also a flag character, the system's flag field parser can read beyond the intended memory boundary. This out-of-bounds read could potentially lead to information disclosure or a denial of service (DoS) due to accessing unmapped memory.

binfmt_misc registration can read past the end of an allocated buffer when the user selected field delimiter is also one of the flag characters P O C or F. The flags parser consumes these bytes as valid flags instead of treating the padding as a terminator, so a crafted registration string can drive an out of bounds read beyond the copied user buffer. For the CVSS the PR:L value is used because triggering requires local code execution in a user namespace with access to a binfmt_misc mount, even though no administrator privileges are normally required there. The issue is not network reachable and is triggered through a local filesystem style registration interface. Impact is primarily denial of service because the overread may reach an unmapped page and crash the kernel, while the patch context does not show a write primitive or a direct data disclosure path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.