CVE-2026-68186 (GCVE-0-2026-68186)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-08-19 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: set have_execfd only once the interpreter is opened
load_misc_binary() raises bprm->have_execfd as soon as it sees the 'O'
(or 'C') flag. This happens well before it opens the interpreter. If
that open fails the flag stays set on the bprm. binfmt_misc is at the
head of the format list so an interpreter open failure that returns
-ENOEXEC lets the search fall through to a later format. This means it
runs the matched binary directly having never staged an interpreter. So
bprm->executable is NULL while have_execfd falsely claims a descriptor
is present.
Consequently, begin_new_exec() dereferences the missing executable:
would_dump(bprm, bprm->executable);
and NULL derefs. Had it not, the hand-off later in the same function
would have failed anyway. FD_ADD(0, bprm->executable) rejects a NULL
file with -ENOMEM. Both sites are past the point of no return so the
exec cannot be unwound either way.
This can be reached by unprivileged users as binfmt_misc can be mounted
in user namespaces. So a user can register an 'O' entry whose
interpreter lives on a FUSE mount, have the FUSE server fail the open
with -ENOEXEC and execute a native ELF file that matches the entry.
have_execfd only means anything alongside the executable it describes
which is not set until the interpreter has been opened and staged.
So lets raise it there, next to execfd_creds, which is already set at
that point. An open failure now leaves it clear, so the fallback format
derives credentials from the binary and emits no AT_EXECFD, as it would
for any native exec. The argv rewrite load_misc_binary() performs before
the open is still not undone. This means the binary sees the interpreter
path in argv[0] and its own path in argv[1] but that predates this
change and only became observable once the exec stopped faulting.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 Version: bc2bf338d54b7aadaed49bb45b9e10d4592b2a46 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/binfmt_misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a8e9e9450df44e9dd529ec5beff283f48f4f4b97",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
},
{
"lessThan": "a261dc49d99681c9c71f38d16e31812dc3e30412",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
},
{
"lessThan": "40c09b7a1d4e0a4866042c87c2bd911bb57566c8",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
},
{
"lessThan": "0f19d54e2524f0bf183b82f365ae4e49b4a2f788",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
},
{
"lessThan": "2dd0298905e97795a9c5ec30cf5b41975f821632",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
},
{
"lessThan": "1cd4e9b7967dab48c9f79a00b06ffff7208c0993",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
},
{
"lessThan": "5ccc99d58f94fad258c9c375715b3974e48620e8",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
},
{
"lessThan": "bbf5f639918dc011aaf60aab8480218758ee68c5",
"status": "affected",
"version": "bc2bf338d54b7aadaed49bb45b9e10d4592b2a46",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/binfmt_misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: set have_execfd only once the interpreter is opened\n\nload_misc_binary() raises bprm-\u003ehave_execfd as soon as it sees the \u0027O\u0027\n(or \u0027C\u0027) flag. This happens well before it opens the interpreter. If\nthat open fails the flag stays set on the bprm. binfmt_misc is at the\nhead of the format list so an interpreter open failure that returns\n-ENOEXEC lets the search fall through to a later format. This means it\nruns the matched binary directly having never staged an interpreter. So\nbprm-\u003eexecutable is NULL while have_execfd falsely claims a descriptor\nis present.\n\nConsequently, begin_new_exec() dereferences the missing executable:\n\n would_dump(bprm, bprm-\u003eexecutable);\n\nand NULL derefs. Had it not, the hand-off later in the same function\nwould have failed anyway. FD_ADD(0, bprm-\u003eexecutable) rejects a NULL\nfile with -ENOMEM. Both sites are past the point of no return so the\nexec cannot be unwound either way.\n\nThis can be reached by unprivileged users as binfmt_misc can be mounted\nin user namespaces. So a user can register an \u0027O\u0027 entry whose\ninterpreter lives on a FUSE mount, have the FUSE server fail the open\nwith -ENOEXEC and execute a native ELF file that matches the entry.\n\nhave_execfd only means anything alongside the executable it describes\nwhich is not set until the interpreter has been opened and staged.\nSo lets raise it there, next to execfd_creds, which is already set at\nthat point. An open failure now leaves it clear, so the fallback format\nderives credentials from the binary and emits no AT_EXECFD, as it would\nfor any native exec. The argv rewrite load_misc_binary() performs before\nthe open is still not undone. This means the binary sees the interpreter\npath in argv[0] and its own path in argv[1] but that predates this\nchange and only became observable once the exec stopped faulting."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:54.269Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a8e9e9450df44e9dd529ec5beff283f48f4f4b97"
},
{
"url": "https://git.kernel.org/stable/c/a261dc49d99681c9c71f38d16e31812dc3e30412"
},
{
"url": "https://git.kernel.org/stable/c/40c09b7a1d4e0a4866042c87c2bd911bb57566c8"
},
{
"url": "https://git.kernel.org/stable/c/0f19d54e2524f0bf183b82f365ae4e49b4a2f788"
},
{
"url": "https://git.kernel.org/stable/c/2dd0298905e97795a9c5ec30cf5b41975f821632"
},
{
"url": "https://git.kernel.org/stable/c/1cd4e9b7967dab48c9f79a00b06ffff7208c0993"
},
{
"url": "https://git.kernel.org/stable/c/5ccc99d58f94fad258c9c375715b3974e48620e8"
},
{
"url": "https://git.kernel.org/stable/c/bbf5f639918dc011aaf60aab8480218758ee68c5"
}
],
"title": "binfmt_misc: set have_execfd only once the interpreter is opened",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68186",
"datePublished": "2026-08-10T11:59:58.299Z",
"dateReserved": "2026-07-30T09:28:09.373Z",
"dateUpdated": "2026-08-19T16:30:54.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…