CVE-2026-68186

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: set have_execfd only once the interpreter is opened

load_misc_binary() raises bprm->have_execfd as soon as it sees the O (or C) flag. This happens well before it opens the interpreter. If that open fails the flag stays set on the bprm. binfmt_misc is at the head of the format list so an interpreter open failure that returns -ENOEXEC lets the search fall through to a later format. This means it runs the matched binary directly having never staged an interpreter. So bprm->executable is NULL while have_execfd falsely claims a descriptor is present.

Consequently, begin_new_exec() dereferences the missing executable:

would_dump(bprm, bprm->executable);

and NULL derefs. Had it not, the hand-off later in the same function would have failed anyway. FD_ADD(0, bprm->executable) rejects a NULL file with -ENOMEM. Both sites are past the point of no return so the exec cannot be unwound either way.

This can be reached by unprivileged users as binfmt_misc can be mounted in user namespaces. So a user can register an O entry whose interpreter lives on a FUSE mount, have the FUSE server fail the open with -ENOEXEC and execute a native ELF file that matches the entry.

have_execfd only means anything alongside the executable it describes which is not set until the interpreter has been opened and staged. So lets raise it there, next to execfd_creds, which is already set at that point. An open failure now leaves it clear, so the fallback format derives credentials from the binary and emits no AT_EXECFD, as it would for any native exec. The argv rewrite load_misc_binary() performs before the open is still not undone. This means the binary sees the interpreter path in argv[0] and its own path in argv[1] but that predates this change and only became observable once the exec stopped faulting.

Affected Software

References

• https://git.kernel.org/stable/c/0f19d54e2524f0bf183b82f365ae4e49b4a2f788
• https://git.kernel.org/stable/c/1cd4e9b7967dab48c9f79a00b06ffff7208c0993
• https://git.kernel.org/stable/c/2dd0298905e97795a9c5ec30cf5b41975f821632
• https://git.kernel.org/stable/c/5ccc99d58f94fad258c9c375715b3974e48620e8
• https://git.kernel.org/stable/c/bbf5f639918dc011aaf60aab8480218758ee68c5