The flaw in the Linux kernel’s binfmt_misc subsystem causes inode write counts to remain negative after an entry tagged with MISC_FMT_OPEN_FILE is removed. As a result, attempts to open the interpreter for writing fail with ETXTBSY indefinitely, effectively denying any subsequent write operations to the file until the inode is evicted from the cache. This is a denial‑of‑service condition that limits the ability of an application or privileged user to overwrite an interpreter used by the system’s executable format handling.

All Linux kernel releases that contain the bug, i.e., any version prior to the inclusion of commit 90f601b497d7, are affected. The issue arises in the binfmt_misc module, a kernel component available in all standard Linux kernel images. No specific product or vendor version list is provided; the problem is present whenever the MISC_FMT_OPEN_FILE flag is used to register a binfmt_misc entry.

The vulnerability is not listed in the CISA KEV catalog, and its EPSS score is less than 1%, indicating a very low probability of exploitation. Nevertheless, the risk is moderate to high for systems that use the MISC_FMT_OPEN_FILE flag, because an attacker with sufficient privileges to modify or remove binfmt_misc entries can lock an interpreter file from being written, disrupting software updates or custom binaries dependent on that interpreter. The attack vector requires kernel‑level or root access, which is typically restricted on production systems. The lack of a publicly available exploit known at the time further reduces the immediacy of the threat, but the persistent denial of writes represents a serious operational issue.