CVE-2026-74618: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74618 Overview

CVE-2026-74618 is a Linux kernel flaw in the binfmt_misc filesystem that lets an unprivileged local user trigger a WARN_ON() in bm_fill_super(). The condition arises when a filesystem context created with fsopen("binfmt_misc") in one user namespace is finalized with fsconfig(FSCONFIG_CMD_CREATE) from a different user namespace. The warning is not rate-limited, so a user can raise it in a loop to taint the kernel, flood logs, and crash systems booted with panic_on_warn.

Critical Impact
Any local user with access to unshare(1) can taint the kernel, spam kernel logs, or panic hosts configured with panic_on_warn, producing a local denial-of-service condition.

Affected Products

Linux kernel builds shipping the binfmt_misc module prior to the fix commits
Distributions inheriting the upstream binfmt_misc implementation
Kernels booted with panic_on_warn enabled (elevated impact)

Discovery Timeline

2026-08-22 - CVE-2026-74618 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74618

Vulnerability Analysis

The issue is a kernel denial-of-service in the binfmt_misc filesystem mount path. fsopen() records the caller's user namespace in fc->user_ns and returns a regular file descriptor. Nothing binds the task calling fsconfig(FSCONFIG_CMD_CREATE) to the task that originally created the context. The descriptor can be inherited across fork() and exec(), or passed to another process over a Unix socket.

Completing the mount from a different user namespace is permitted by design. vfs_cmd_create() authorizes creation through mount_capable(), which for FS_USERNS_MOUNT calls ns_capable(fc->user_ns, CAP_SYS_ADMIN). That check succeeds when the caller holds CAP_SYS_ADMIN in any ancestor of fc->user_ns. As a result, an unprivileged process reaches bm_fill_super() where an unconditional WARN_ON() at fs/binfmt_misc.c:938 fires because the two namespaces do not match.

Root Cause

The WARN_ON() in bm_fill_super() assumes the calling task's user namespace matches sb->s_user_ns. That assumption is invalid: fsopen() and fsconfig() can legitimately execute in different user namespaces, and bm_fill_super() derives all state from sb->s_user_ns anyway. Using WARN_ON() instead of WARN_ON_ONCE() makes the reachable path a repeatable log-flooding and kernel-taint primitive [CWE-754].

Attack Vector

A local unprivileged user runs unshare -Ur to enter new user and mount namespaces. Inside, the process calls fsopen("binfmt_misc", 0) and passes the returned file descriptor to a parent process over a Unix socket or through inheritance. The parent then invokes fsconfig(fd, FSCONFIG_CMD_CREATE, ...) from a different user namespace. The kernel logs the warning and, when panic_on_warn is set, panics. Repeating the sequence in a loop drives kernel taint and log exhaustion. No capabilities are required in the initial namespace.

Refer to the kernel commit references for the exact code path and fix implementation.

Detection Methods for CVE-2026-74618

Indicators of Compromise

Kernel log entries containing WARNING: fs/binfmt_misc.c:938 at bm_fill_super from non-root UIDs
Repeated bm_get_tree and vfs_cmd_create frames in dmesg call traces from the same PID or comm
Unexpected kernel panics on hosts booted with panic_on_warn=1

Detection Strategies

Monitor /dev/kmsg and journalctl -k for bm_fill_super warnings and correlate with the originating UID and process name.
Audit fsopen, fsconfig, and unshare syscalls using auditd or eBPF to flag unprivileged callers targeting binfmt_misc.
Alert when the same non-root user triggers repeated kernel taints (/proc/sys/kernel/tainted value changes).

Monitoring Recommendations

Forward kernel ring buffer entries to a centralized log platform and alert on binfmt_misc warning signatures.
Track kernel taint flag transitions per host and investigate any change on production systems.
Baseline expected use of user namespaces and flag unusual unshare activity from interactive user sessions.

How to Mitigate CVE-2026-74618

Immediate Actions Required

Apply the upstream binfmt_misc fix commits listed in the kernel references and reboot into the patched kernel.
Disable panic_on_warn on production hosts until the patched kernel is deployed to prevent panics from this warning.
Restrict unprivileged user namespaces where operationally acceptable by setting kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0.

Patch Information

The fix removes the incorrect WARN_ON() and continues to refuse the mount when appropriate, since bm_fill_super() derives its state from sb->s_user_ns rather than the caller's namespace. Patched commits are available in the stable tree: 047f927f54c6, 24e95a24f151, 37cf5cf1320a, and 79fdf39f1a31.

Workarounds

Unload the binfmt_misc module (modprobe -r binfmt_misc) and blacklist it where the feature is not required.
Disable unprivileged user namespaces via sysctl to remove the precondition that allows the cross-namespace call.
Remove panic_on_warn from kernel command lines on exposed hosts until patching completes.

bash

# Configuration example
# Reduce exposure until the patched kernel is deployed
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w user.max_user_namespaces=0
modprobe -r binfmt_misc && echo 'blacklist binfmt_misc' > /etc/modprobe.d/binfmt_misc.conf