CVE-2026-74483

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: don't leak the user namespace when the mount fails

bm_get_tree() takes a reference to the user namespace and hands it to

get_tree_keyed() as the sget key. sget_fc() moves that reference into

sb->s_fs_info and clears fc->s_fs_info, so from that point on the

superblock owns it and bm_free() doesn't see it anymore.

The superblock drops it in ->put_super(). But generic_shutdown_super()

only calls ->put_super() from inside the if (sb->s_root) branch, so

nothing releases it when bm_fill_super() fails:

- The kzalloc_obj() failure leaves s_root NULL and the whole branch is

skipped.

- A simple_fill_super() failure in the file loop leaves s_root set, but

s_op still points at simple_super_operations, which has no

->put_super(). bm_fill_super() installs s_ops only once

simple_fill_super() returned success, and installing it earlier

wouldn't help either because simple_fill_super() overwrites s_op.

Either way vfs_get_super() calls deactivate_locked_super() and the

reference is gone for good. binfmt_misc mounts are available in a user

namespace and both the inode and the dentry cache are SLAB_ACCOUNT, so

an unprivileged caller under a tight memory cgroup can fail

simple_fill_super() on demand and leak one user namespace per attempt.

Drop the reference in ->kill_sb() instead, which runs unconditionally,

the same way nfsd and rpc_pipefs release their keyed s_fs_info.

That also stops ->put_super() from clearing s_fs_info while the

superblock is still on @fs_supers. generic_shutdown_super() leaves it

there on purpose so that sget_fc() keeps finding it until kill_sb() has

run, but a NULL s_fs_info makes test_keyed_super() miss it, so a

concurrent mount for the same user namespace skips the grab_super()

wait and creates a second superblock for a namespace that is still

being torn down.