CVE-2026-74618

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the binfmt misc module where an unprivileged task can trigger a WARN ON() condition in the bm fill super() function. This occurs because fsopen() records the caller's user namespace in fc->user ns, but there is no restriction tying the task that calls fsconfig(FSCONFIG CMD CREATE) to the task that created the context. An attacker can create a user and mount namespace in a child process, call fsopen("binfmt misc"), and pass the resulting file descriptor to a parent process to issue the FSCONFIG CMD CREATE command. Since the condition is triggered by WARN ON() rather than WARN ON ONCE(), it can be executed in a loop to flood system logs, taint the kernel, or cause a kernel panic on systems configured with panic on warn.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.