CVE-2026-74483

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the binfmt misc module when a mount fails. The bm get tree() function takes a reference to the user namespace and passes it to get tree keyed() as the sget key, which is then moved into sb->s fs info. If bm fill super() fails—either due to a kzalloc obj() failure leaving s root NULL or a simple fill super() failure—the reference is not released because generic shutdown super() only calls ->put super() if sb->s root is present. An unprivileged user within a restricted memory cgroup can trigger this failure repeatedly to leak user namespaces. Additionally, if ->put super() clears s fs info while the superblock is still in @fs supers, a concurrent mount for the same user namespace may bypass the grab super() wait and create a duplicate superblock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.