The Linux kernel’s binfmt_elf_fdpic module contains a flaw in its handling of multiple PT_INTERP headers in an ELF binary. During the parsing loop, a break inside a nested switch only exits the switch and not the outer loop, causing the module to reprocess additional PT_INTERP entries. This leads to the interpreter name and reference being overwritten, leaking the previous allocations, and, more critically, leaving a write denial on the interpreter file that remains in effect as long as the system runs. An unprivileged user can craft a binary containing multiple PT_INTERP segments and trigger this behavior repeatedly, resulting in a denial of write access to an interpreter and potential denial of service.

The vulnerability originates in the Linux kernel and affects all Linux distributions that include the binfmt_elf_fdpic module starting from kernel version 2.6.11, the initial commit that introduced FDPIC ELF support. Any system running a kernel that has not applied the fix for CVE‑2026‑68151 is susceptible. The fix is in the stable kernel branches, so all downstream vendors should update their kernel packages.

The flaw can be exploited locally by any unprivileged user who can upload or execute a malicious ELF file with multiple PT_INTERP entries. While the EPSS score is not available, the absence of a KEV listing suggests no widespread exploitation has been reported at the time of analysis. The attack vector is purely local, requiring the ability to run a crafted binary. The severity is significant because it results in a persistent denial of write access to an interpreter file, which can interfere with system updates or other binaries that rely on the same interpreter. The mitigations rely on applying the kernel patch or disabling the vulnerable module.