{"id":"CVE-2026-74483","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-74483","generatedAt":"2026-10-28T13:12:01.106Z","title":"In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when the mount fails bm_get_tree() takes a reference to the user namespace and hands it to get_tree_keyed() as the sget key. sget_fc() moves…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: don't leak the user namespace when the mount fails\n\nbm_get_tree() takes a reference to the user namespace and hands it to\nget_tree_keyed() as the sget key. sget_fc() moves that reference into\nsb->s_fs_info and clears fc->s_fs_info, so from that point on the\nsuperblock owns it and bm_free() doesn't see it anymore.\n\nThe superblock drops it in ->put_super(). But generic_shutdown_super()\nonly calls ->put_super() from inside the if (sb->s_root) branch, so\nnothing releases it when bm_fill_super() fails:\n\n- The kzalloc_obj() failure leaves s_root NULL and the whole branch is\n  skipped.\n\n- A simple_fill_super() failure in the file loop leaves s_root set, but\n  s_op still points at simple_super_operations, which has no\n  ->put_super(). bm_fill_super() installs s_ops only once\n  simple_fill_super() returned success, and installing it earlier\n  wouldn't help either because simple_fill_super() overwrites s_op.\n\nEither way vfs_get_super() calls deactivate_locked_super() and the\nreference is gone for good. binfmt_misc mounts are available in a user\nnamespace and both the inode and the dentry cache are SLAB_ACCOUNT, so\nan unprivileged caller under a tight memory cgroup can fail\nsimple_fill_super() on demand and leak one user namespace per attempt.\n\nDrop the reference in ->kill_sb() instead, which runs unconditionally,\nthe same way nfsd and rpc_pipefs release their keyed s_fs_info.\n\nThat also stops ->put_super() from clearing s_fs_info while the\nsuperblock is still on @fs_supers. generic_shutdown_super() leaves it\nthere on purpose so that sget_fc() keeps finding it until kill_sb() has\nrun, but a NULL s_fs_info makes test_keyed_super() miss it, so a\nconcurrent mount for the same user namespace skips the grab_super()\nwait and creates a second superblock for a namespace that is still\nbeing torn down.","published":"2026-08-15T13:17:53.000Z","lastModified":"2026-08-23T13:16:45.000Z","status":"Received","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":null,"cwe":[],"affected":[],"epss":{"score":0.00168,"percentile":0.06019,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/867aed6a4848761190d5ebdedf9642648f97bceb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87a4eb9bbb3497f749bbac612af22ddaa62d7b0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8206f516fe7cbe785cf44bf09c17c438d7c3cad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ffec017158d3aad8a6ffca1dfad63d63bde9caad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74483","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}