CVE-2025-68239

Root

Cause

The vulnerability resides in the bm_register_write() function of the Linux kernel's binfmt_misc module. When opening an executable file using open_exec(), the kernel internally calls do_open_execat(), which denies write access to the file to prevent modification during execution. However, if an error occurs later in bm_register_write(), the file is closed directly via filp_close() without first restoring the write permission. This leaves the file in a state where subsequent write operations are denied.

Exploitation

An attacker must be able to trigger an error condition in bm_register_write() while the function holds a file descriptor opened by open_exec(). This requires local access to the system and the ability to invoke the binfmt_misc filesystem operations, typically via writing to /proc/sys/fs/binfmt_misc/register. No special privileges are needed beyond the ability to write to that interface for the target file.

Impact

Successful exploitation results in a denial of service (DoS) for write operations on the affected executable file. Any subsequent attempt to modify or overwrite the file will fail, potentially preventing software updates, configuration changes, or other legitimate writes. This can persist until the file descriptor is properly closed with permission restoration, or the system is rebooted.

Mitigation

The fix introduces a call to exe_file_allow_write_access() before filp_close() in the error path, ensuring write permission is restored. The patch has been applied to stable kernel branches. Users should update to the latest patched kernel version to mitigate the issue.