{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.8-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  binfmt_misc: don't leak the user namespace when the mount fails  bm_get_tree() takes a reference to the user namespace and hands it to get_tree_keyed() as the sget key. sget_fc() moves that reference into sb-\u003es_fs_info and clears fc-\u003es_fs_info, so from that point on the superblock owns it and bm_free() doesn't see it anymore.  The superblock drops it in -\u003eput_super(). But generic_shutdown_super() only calls -\u003eput_super() from inside the if (sb-\u003es_root) branch, so nothing releases it when bm_fill_super() fails:  - The kzalloc_obj() failure leaves s_root NULL and the whole branch is   skipped.  - A simple_fill_super() failure in the file loop leaves s_root set, but   s_op still points at simple_super_operations, which has no   -\u003eput_super(). bm_fill_super() installs s_ops only once   simple_fill_super() returned success, and installing it earlier   wouldn't help either because simple_fill_super() overwrites s_op.  Either way vfs_get_super() calls deactivate_locked_super() and the reference is gone for good. binfmt_misc mounts are available in a user namespace and both the inode and the dentry cache are SLAB_ACCOUNT, so an unprivileged caller under a tight memory cgroup can fail simple_fill_super() on demand and leak one user namespace per attempt.  Drop the reference in -\u003ekill_sb() instead, which runs unconditionally, the same way nfsd and rpc_pipefs release their keyed s_fs_info.  That also stops -\u003eput_super() from clearing s_fs_info while the superblock is still on @fs_supers. generic_shutdown_super() leaves it there on purpose so that sget_fc() keeps finding it until kill_sb() has run, but a NULL s_fs_info makes test_keyed_super() miss it, so a concurrent mount for the same user namespace skips the grab_super() wait and creates a second superblock for a namespace that is still being torn down.",
  "id": "DEBIAN-CVE-2026-74483",
  "modified": "2026-09-19T21:47:31.963906959Z",
  "published": "2026-08-15T13:17:53.163Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74483"
    }
  ],
  "upstream": [
    "CVE-2026-74483"
  ]
}