{"apiVersion":"1.0","identifier":"CVE-2026-74483","description":"In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don-t leak the user namespace when the mount fails bm_get_tree() takes a reference to the user namespace and hands it to get_tree_keyed() as the sget key. sget_fc() moves that reference into sb->s_fs_info and clears fc->s_fs_info, so from that point on the superblock owns it and bm_free() doesn-t see it anymore. The superblock drops it in ->put_super(). But generic_shutdown_super() only calls ->put_super() from inside the if (sb->s_root) branch, so nothing releases it when bm_fill_super() fails: - The kzalloc_obj() failure leaves s_root NULL and the whole branch is skipped. - A simple_fill_super() failure in the file loop leaves s_root set, but s_op still points at simple_super_operations, which has no ->put_super(). bm_fill_super() installs s_ops only once simple_fill_super() returned success, and installing it earlier wouldn-t help either because simple_fill_super() overwrites s_op. Either way vfs_get_super() calls deactivate_locked_super() and the reference is gone for good. binfmt_misc mounts are available in a user namespace and both the inode and the dentry cache are SLAB_ACCOUNT, so an unprivileged caller under a tight memory cgroup can fail simple_fill_super() on demand and leak one user namespace per attempt. Drop the reference in ->kill_sb() instead, which runs unconditionally, the same way nfsd and rpc_pipefs release their keyed s_fs_info. That also stops ->put_super() from clearing s_fs_info while the superblock is still on @fs_supers. generic_shutdown_super() leaves it there on purpose so that sget_fc() keeps finding it until kill_sb() has run, but a NULL s_fs_info makes test_keyed_super() miss it, so a concurrent mount for the same user namespace skips the grab_super() wait and creates a second superblock for a namespace that is still being torn down.","publishedAt":"2026-08-15T13:17:53","lastModifiedAt":"2026-08-23T13:16:44","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74483","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00168,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74483","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74483","en":"https://www.redsauce.net/en/cves/CVE-2026-74483","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74483","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74483","de":"https://www.redsauce.net/de/cves/CVE-2026-74483","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74483","el":"https://www.redsauce.net/el/cves/CVE-2026-74483"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74483"}}