CVE-2026-74483 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of Linux systems with unprivileged user namespace usage. These parties should be aware of the potential for user namespace leaks and take steps to mitigate the vulnerability. This includes monitoring memory cgroup usage, implementing compensating controls, and ensuring proper cleanup of user namespaces.

Technical summary

The Linux kernel's binfmt_misc subsystem does not properly release user namespaces when a mount operation fails. This allows an unprivileged caller to leak one user namespace per failed mount attempt. The issue arises from the fact that generic_shutdown_super() only calls ->put_super() from inside the if (sb->s_root) branch, which can lead to a reference leak when bm_fill_super() fails. To address this, the reference should be dropped in ->kill_sb() instead, which runs unconditionally.

Defensive priority

This vulnerability allows an unprivileged caller under a tight memory cgroup to leak one user namespace per attempt. Monitor for suspicious activity related to binfmt_misc mounts and ensure proper cleanup of user namespaces.

Recommended defensive actions

• Verify Linux kernel version and patch level
• Monitor memory cgroup usage and user namespace creation
• Implement compensating controls for user namespace management
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The Linux kernel's binfmt_misc subsystem does not properly release user namespaces when a mount operation fails. Evidence is limited; verify user namespace cleanup in Linux kernel. Check kernel.org for updates. Monitor memory cgroup usage and suspicious activity related to binfmt_misc mounts. This could involve tracking user namespace creation and deletion, as well as memory cgroup usage patterns. Verify affected product deployments and assign an owner for follow-up.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.