CVE-2026-74484: Linux kernel · binfmt_misc: don't let an 'F' entry pin its own instance
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 79055d82772b9584f259b747fe40ff56a076678d : patch Linux kernel soon.
Data as of 6 Nov 2026, 18:02 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in 79055d82772b9584f259b747fe40ff56a076678d, 098e92fe0f1bde5af99c8cf504f13f01ef139f85, 4dad8ca637d44d5a6d5c23fa80c9e2e455198c2b +1
Exploitation evidence
Disclosed: evidence found.
CVE published 15 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade Linux kernel to 79055d82772b9584f259b747fe40ff56a076678d, 098e92fe0f1bde5af99c8cf504f13f01ef139f85, 4dad8ca637d44d5a6d5c23fa80c9e2e455198c2b or 1cc2decee06acc939337304e9b3f737fd5d8c4bd.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in Linux kernel version 6.7 and later. Users should upgrade to the fixed kernel versions to remediate this issue. No additional mitigation steps are indicated or required beyond applying the official fix.
Description
CVE-2026-74484 is a denial-of-service vulnerability in the Linux kernel's binfmt_misc feature. It occurs when an 'F' entry pins its own instance by holding open its interpreter file, causing a reference cycle that prevents cleanup. This leads to resource leaks including user namespace charges, which accumulate and cause denial of service. The issue is fixed by preventing execution of the instance's own files and rejecting overlayfs layers that cause the cycle.
References
- git.kernel.org/stable/c/1cc2decee06acc939337304e9b3f737fd5d8c4bd (opens in a new tab)
- git.kernel.org/stable/c/4dad8ca637d44d5a6d5c23fa80c9e2e455198c2b (opens in a new tab)
- git.kernel.org/stable/c/098e92fe0f1bde5af99c8cf504f13f01ef139f85 (opens in a new tab)
- git.kernel.org/stable/c/79055d82772b9584f259b747fe40ff56a076678d (opens in a new tab)