{"apiVersion":"1.0","identifier":"CVE-2026-74485","description":"In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter: memset(buf + count, del, 8); Most fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters -P-, -O-, -C- and -F- and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan. If the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character. For example registering PaPEPPxPPiP with -P- as the delimiter (name -a-, type extension, magic -x-, interpreter -i-, empty flags) leaves the flag scan running off the end of the buffer. The registration is rejected in the end because the parser does not stop exactly at buf + count, but only after the out of bounds read has already happened. With an unlucky allocation layout the scan can walk into an unmapped page; under KASAN it is reported as a slab out of bounds read. binfmt_misc mounts are available to unprivileged users in a user namespace so the read is reachable without privileges. Reject a delimiter that is one of the flag characters up front. Such a registration was always rejected anyway, only after the out of bounds read, so no valid registration string changes meaning.","publishedAt":"2026-08-15T13:17:53","lastModifiedAt":"2026-08-19T17:21:05","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74485","cvssScore":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","epssProbability":0.00126,"riskScore":0.72,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74485","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74485","en":"https://www.redsauce.net/en/cves/CVE-2026-74485","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74485","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74485","de":"https://www.redsauce.net/de/cves/CVE-2026-74485","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74485","el":"https://www.redsauce.net/el/cves/CVE-2026-74485"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74485"}}