CVE-2026-74487

A flaw was found in the binfmt_misc component of the Linux kernel. When a binfmt_misc entry is registered with the MISC_FMT_OPEN_FILE flag, it opens an interpreter file and denies write access. Upon removal of this entry, the write access is not properly restored. This oversight can lead to a persistent denial of write access to the interpreter file, causing subsequent attempts to open the file for writing to fail with an 'ETXTBSY' error until the affected inode is eventually evicted from the cache.

A low impact flaw was found in the binfmt_misc subsystem of the Linux kernel. When a binfmt_misc entry registered with the MISC_FMT_OPEN_FILE flag is removed, the kernel closes the interpreter file opened via open_exec() without restoring write access, leaving the inode's i_writecount unbalanced. As a result, subsequent attempts to open the interpreter file for writing fail with ETXTBSY until the affected inode is evicted from the inode cache. This is a local denial of service limited to write access of the interpreter file: registering and removing binfmt_misc entries requires local privileged access, and there is no impact on confidentiality or integrity.

Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are affected, and the fix is currently deferred on these streams given the low security risk; the residual risk is a persistent but local, privileged denial of write access to the affected interpreter file until its inode is evicted from the inode cache. Red Hat Enterprise Linux 7 Extended Lifecycle Support is not affected because the vulnerable code is not present, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope. Although the Red Hat CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a high availability impact, Red Hat assesses the overall severity of this flaw as low because exploitation requires local privileged access and only write access to the interpreter file is denied.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.