Linux Kernel CVE-2026-74485

Exploitation requires local system access with at least a low-privilege user account (CVSS PR:L) and the ability to mount a binfmt_misc filesystem - which is available to unprivileged users within a user namespace on distributions that permit unprivileged user namespace creation (kernel.unprivileged_userns_clone=1 or equivalent, the default on Ubuntu, Debian, Arch, and many others). The attacker must write a crafted registration string to the binfmt_misc register file using one of exactly four flag characters ('P', 'O', 'C', or 'F') as the field delimiter. The registration is ultimately rejected by the parser, so the attacker cannot install a persistent binary handler - only the out-of-bounds read occurs. Systems that restrict unprivileged user namespace creation via sysctl or LSM policy are not reachable from an unprivileged context and are effectively not exploitable without a separate privilege escalation.

The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) is consistent with the description: local access at low privilege is sufficient because binfmt_misc mounts are available to unprivileged users within user namespaces on most mainstream distributions. The C:H metric reflects potential exposure of adjacent heap contents; A:H reflects the possibility of a page fault crashing the kernel if the scan crosses into an unmapped region. EPSS at 0.17% (6th percentile) is notably low given the local-privilege-escalation-adjacent attack surface, suggesting the broader research community assesses exploitation as non-trivial or unattractive. The absence of a CISA KEV entry confirms no observed active exploitation at time of analysis. No POC has been identified. Real-world risk is further tempered by the fact that distributions such as RHEL, some Ubuntu configurations, and hardened deployments disable unprivileged user namespaces entirely (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0), which removes the attack path without patching. For environments with unrestricted user namespaces and unpatched kernels, this is a credible local read primitive worth prioritising in the normal patch cycle, not an emergency.

A local user with at least a standard shell account creates a user namespace (available by default on most modern distributions), mounts a binfmt_misc filesystem within it, and writes a registration string such as 'PaPEPPxPPiP' - using 'P' as the delimiter - to the register file. The kernel's check_special_flags() parser consumes the eight 'P' padding bytes appended as terminators and continues reading into adjacent heap memory until it encounters a non-flag byte, exposing potentially sensitive kernel heap data or triggering a crash if the read crosses a page boundary. No public POC has been identified, but the exploit primitive is straightforwardly derivable from the patch commit description alone.