GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2025-68239

Vulnerability from fkie_nvd - Published: 2025-12-16 15:15 - Updated: 2026-06-17 09:58
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: restore write access before closing files opened by open_exec() bm_register_write() opens an executable file using open_exec(), which internally calls do_open_execat() and denies write access on the file to avoid modification while it is being executed. However, when an error occurs, bm_register_write() closes the file using filp_close() directly. This does not restore the write permission, which may cause subsequent write operations on the same file to fail. Fix this by calling exe_file_allow_write_access() before filp_close() to restore the write permission properly.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/480ac88431703f2adbb8e6b5bd73c3f3cf9f3d7f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/54274ff90488b6c0f595a6518faed3cf0bc966eb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6cce7bc7fac8471c832696720d9c8f2a976d9c54
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/90f601b497d76f40fa66795c3ecf625b6aced9fd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e785f552ab04dbca01d31f0334f4561240b04459
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fbab8c08e1a6dbaef81e22d672a7647553101d16
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "54274ff90488b6c0f595a6518faed3cf0bc966eb",
              "status": "affected",
              "version": "e7850f4d844e0acfac7e570af611d89deade3146",
              "versionType": "git"
            },
            {
              "lessThan": "480ac88431703f2adbb8e6b5bd73c3f3cf9f3d7f",
              "status": "affected",
              "version": "e7850f4d844e0acfac7e570af611d89deade3146",
              "versionType": "git"
            },
            {
              "lessThan": "fbab8c08e1a6dbaef81e22d672a7647553101d16",
              "status": "affected",
              "version": "e7850f4d844e0acfac7e570af611d89deade3146",
              "versionType": "git"
            },
            {
              "lessThan": "6cce7bc7fac8471c832696720d9c8f2a976d9c54",
              "status": "affected",
              "version": "e7850f4d844e0acfac7e570af611d89deade3146",
              "versionType": "git"
            },
            {
              "lessThan": "e785f552ab04dbca01d31f0334f4561240b04459",
              "status": "affected",
              "version": "e7850f4d844e0acfac7e570af611d89deade3146",
              "versionType": "git"
            },
            {
              "lessThan": "90f601b497d76f40fa66795c3ecf625b6aced9fd",
              "status": "affected",
              "version": "e7850f4d844e0acfac7e570af611d89deade3146",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "467a50d5db7deaf656e18a1f633be9ecd94b393a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4a8b4124ea4156ca52918b66c750a69c6d932aa5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fe116e33a855bbfdd32dc207e9be2a41e3ed3a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c0e0ab60d0b15469e69db93215dad009999f5a5b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5ab9464a2a3c538eedbb438f1802f2fd98d0953f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d28492be82e19fc69cc69975fc2052b37ef0c821",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.262",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.226",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.181",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.106",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: restore write access before closing files opened by open_exec()\n\nbm_register_write() opens an executable file using open_exec(), which\ninternally calls do_open_execat() and denies write access on the file to\navoid modification while it is being executed.\n\nHowever, when an error occurs, bm_register_write() closes the file using\nfilp_close() directly. This does not restore the write permission, which\nmay cause subsequent write operations on the same file to fail.\n\nFix this by calling exe_file_allow_write_access() before filp_close() to\nrestore the write permission properly."
    }
  ],
  "id": "CVE-2025-68239",
  "lastModified": "2026-06-17T09:58:47.200",
  "metrics": {},
  "published": "2025-12-16T15:15:53.063",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/480ac88431703f2adbb8e6b5bd73c3f3cf9f3d7f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/54274ff90488b6c0f595a6518faed3cf0bc966eb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6cce7bc7fac8471c832696720d9c8f2a976d9c54"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/90f601b497d76f40fa66795c3ecf625b6aced9fd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e785f552ab04dbca01d31f0334f4561240b04459"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fbab8c08e1a6dbaef81e22d672a7647553101d16"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.