Description

In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter: memset(buf + count, del, 8); Most fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters 'P', 'O', 'C' and 'F' and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan. If the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character. For example registering PaPEPPxPPiP with 'P' as the delimiter (name "a", type extension, magic "x", interpreter "i", empty flags) leaves the flag scan running off the end of the buffer. The registration is rejected in the end because the parser does not stop exactly at buf + count, but only after the out of bounds read has already happened. With an unlucky allocation layout the scan can walk into an unmapped page; under KASAN it is reported as a slab out of bounds read. binfmt_misc mounts are available to unprivileged users in a user namespace so the read is reachable without privileges. Reject a delimiter that is one of the flag characters up front. Such a registration was always rejected anyway, only after the out of bounds read, so no valid registration string changes meaning.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-15T13:17:53.380Z",
  "pubdate": "2026-08-15T13:17:53.380Z",
  "executiveSummary": "A vulnerability exists in the binfmt_misc subsystem of the Linux kernel, specifically within the parsing logic for registration strings. The vulnerability type is an out-of-bounds read caused by improper input validation of the field delimiter.\nThe flaw allows unprivileged local users or users within a user namespace to trigger a slab out-of-bounds read by supplying a registration string where the chosen field delimiter conflicts with a valid flag character.\nWhile the registration attempt ultimately fails, the out-of-bounds read occurs during the parsing phase. Depending on the memory layout, this can result in kernel memory exposure or a kernel crash due to reading unmapped memory.\nNo special privileges are required to exploit this issue beyond the ability to access binfmt_misc mounts, which are available to unprivileged users within a user namespace.\nThe risk implication is primarily localized denial of service or potential information disclosure, mitigated by rejecting conflicting delimiters upfront.",
  "technicalDetails": "The vulnerability resides in the binfmt_misc registration handler function create_entry() and the flag parsing function check_special_flags() within the Linux kernel.\nThe registration string format relies on a user-chosen delimiter character to separate individual fields. To ensure parsers terminate safely on truncated inputs, create_entry() pads the internal buffer with eight instances of the delimiter using memset(buf + count, del, 8).\nWhile standard fields utilize string scanning functions like strchr() and scanarg() which safely terminate upon encountering the delimiter padding, the flags field parsing logic implemented in check_special_flags() operates differently. Instead of scanning for the delimiter, it consumes specific valid flag characters ('P', 'O', 'C', and 'F') and continues execution until it encounters a byte that does not match any of these flag characters, implicitly relying on the trailing delimiter padding to halt the scan.\nWhen a user defines the field delimiter itself as one of the valid flag characters (e.g., 'P'), the padding mechanism fails to act as a terminator. Consequently, the flag scan consumes all eight padding bytes and reads past the allocated boundary of the buffer until it encounters an arbitrary non-flag byte in adjacent kernel memory.\nStep-by-step attack flow: 1. An attacker crafts a malicious binfmt_misc registration string using a flag character (such as 'P') as the field delimiter (e.g., PaPEPPxPPiP). 2. The kernel copies the input into a dynamically allocated buffer and applies the delimiter padding. 3. The parser evaluates the flags field via check_special_flags(). 4. Because the delimiter matches a flag character, the parser treats the padding as valid flag input and reads past the heap allocation boundary (slab out-of-bounds read). 5. The parser eventually fails the registration because it does not stop precisely at the expected buffer boundary, but the out-of-bounds read has already executed.\nAuthentication and privilege requirements are minimal; binfmt_misc mounts are accessible to unprivileged users inside a user namespace, enabling local exploitation without elevated capabilities."
}