CVE-2026-74485

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: reject a flag character as the field delimiter

The registration string starts with a user chosen delimiter that

separates the individual fields. So that the field parsers terminate

even on a truncated string create_entry() pads the buffer with that

same delimiter:

memset(buf + count, del, 8);

Most fields are scanned for the delimiter with strchr()/scanarg() and

happily stop on the padding. The flags field is different: instead of

scanning for the delimiter check_special_flags() consumes the flag

characters 'P', 'O', 'C' and 'F' and stops at the first byte that is

none of them, relying on the trailing delimiter to end the scan.

If the delimiter is itself a flag character the padding no longer acts

as a terminator. The scan swallows all eight padding bytes and keeps

reading past the end of the allocation until it hits a byte that is

not a flag character. For example registering

PaPEPPxPPiP

with 'P' as the delimiter (name "a", type extension, magic "x",

interpreter "i", empty flags) leaves the flag scan running off the end

of the buffer. The registration is rejected in the end because the

parser does not stop exactly at buf + count, but only after the out of

bounds read has already happened. With an unlucky allocation layout the

scan can walk into an unmapped page; under KASAN it is reported as a

slab out of bounds read. binfmt_misc mounts are available to

unprivileged users in a user namespace so the read is reachable without

privileges.

Reject a delimiter that is one of the flag characters up front. Such a

registration was always rejected anyway, only after the out of bounds

read, so no valid registration string changes meaning.