CVE-2025-68239

What it actually does

The flaw occurs when bm_register_write() opens a file via open_exec() (denying write access) and later closes it with filp_close() on error paths without calling exe_file_allow_write_access(), leaving the file permanently non-writable.

Why it matters to the business

Systems may experience unexpected failures when attempting to modify executable files registered with binfmt_misc after certain error conditions, potentially disrupting application updates, packaging, or runtime operations on Linux hosts.

How an attack unfolds

An attacker with local access could trigger error paths in bm_register_write() to cause write permission to remain denied on targeted files, leading to operational interference; no public exploitation or threat actor campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit e785f552ab04dbca01d31f0334f4561240b04459 or later; for k8sgpt packages update to 0.3.48-r5 or newer.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary, and verify that write access is restored after error paths in binfmt_misc registration by inspecting exe_file_allow_write_access() calls.

Typical attack path

1. Identify or create conditions that cause bm_register_write() to hit an error after open_exec()
2. Allow the error handler to invoke filp_close() without restoring write access
3. Attempt subsequent write operations on the affected file to observe failures

How to detect it

Search kernel logs and audit trails for binfmt_misc registration errors followed by unexpected EACCES or permission-denied events on files that should remain writable; examine process traces involving open_exec and filp_close.

What your security team should do

• Prioritize kernel updates on all affected Linux distributions within standard patching cycles
• Monitor for downstream package updates in container images and embedded systems
• Review binfmt_misc usage in custom workloads for any reliance on file writability after registration attempts