Executive brief
A vulnerability in the Linux kernel's binfmt_misc component could allow a local user to cause a denial-of-service condition for specific files. The system incorrectly locks files against modification even after an error occurs during registration. This results in legitimate applications being unable to write to or update those files, potentially disrupting system operations or software updates.
Technical details
A vulnerability exists in the binfmt_misc module of the Linux kernel within the bm_register_write() function. When registering a new binary format, the kernel uses open_exec(), which internally calls do_open_execat() and denies write access to the target file to prevent modification during execution. If an error occurs during the registration process, the kernel calls filp_close() without first calling exe_file_allow_write_access() (or allow_write_access() in newer versions). This results in the file remaining in a write-denied state even after the file descriptor is closed. A local attacker or a misconfigured application could trigger this error path to prevent subsequent write operations on specific executable files. The issue has been resolved by ensuring write access is restored before closing the file in error paths.
Affected products
- Linux Linux kernel All versions prior to the fix in binfmt_misc
Timeline
- 2025-11-05: disclosed: Initial patch submitted by Zilin Guan
- 2025-12-16: advisory: CVE-2025-68239 published
References
- https://git.kernel.org/stable/c/480ac88431703f2adbb8e6b5bd73c3f3cf9f3d7f
- https://git.kernel.org/stable/c/54274ff90488b6c0f595a6518faed3cf0bc966eb
- https://git.kernel.org/stable/c/6cce7bc7fac8471c832696720d9c8f2a976d9c54
- https://git.kernel.org/stable/c/90f601b497d76f40fa66795c3ecf625b6aced9fd
- https://git.kernel.org/stable/c/e785f552ab04dbca01d31f0334f4561240b04459
- https://git.kernel.org/stable/c/fbab8c08e1a6dbaef81e22d672a7647553101d16