CVE-2026-74483: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-w5mr-gvg4-c3ph
Share
Published
Advisory Summary

CVE-2026-74483 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-74483 at a Glance

CVE Identifier CVE-2026-74483
GHSA Identifier GHSA-w5mr-gvg4-c3ph
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-74483

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-74483, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: don't leak the user namespace when the mount fails bm_get_tree() takes a reference to the user namespace and hands it to get_tree_keyed() as the sget key. sget_fc() moves that reference into sb->s_fs_info and clears fc->s_fs_info, so from that point on the superblock owns it and bm_free() doesn't see it anymore. The superblock drops it in ->put_super(). But generic_shutdown_super() only calls ->put_super() from inside the if (sb->s_root) branch, so nothing releases it when bm_fill_super() fails: - The kzalloc_obj() failure leaves s_root NULL and the whole branch is skipped. - A simple_fill_super() failure in the file loop leaves s_root set, but s_op still points at simple_super_operations, which has no ->put_super(). bm_fill_super() installs s_ops only once simple_fill_super() returned success, and installing it earlier wouldn't help either because simple_fill_super() overwrites s_op. Either way vfs_get_super() calls deactivate_locked_super() and the reference is gone for good. binfmt_misc mounts are available in a user namespace and both the inode and the dentry cache are SLAB_ACCOUNT, so an unprivileged caller under a tight memory cgroup can fail simple_fill_super() on demand and leak one user namespace per attempt. Drop the reference in ->kill_sb() instead, which runs unconditionally, the same way nfsd and rpc_pipefs release their keyed s_fs_info. That also stops ->put_super() from clearing s_fs_info while the superblock is still on @fs_supers. generic_shutdown_super() leaves it there on purpose so that sget_fc() keeps finding it until kill_sb() has run, but a NULL s_fs_info makes test_keyed_super() miss it, so a concurrent mount for the same user namespace skips the grab_super() wait and creates a second superblock for a namespace that is still being torn down.

References

NVD — CVE-2026-74483 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-74483
git.kernel.org/stable/c/867aed6a48... WEB
https://git.kernel.org/stable/c/867aed6a4848761190d5ebdedf9642648f97bceb
git.kernel.org/stable/c/87a4eb9bbb... WEB
https://git.kernel.org/stable/c/87a4eb9bbb3497f749bbac612af22ddaa62d7b0d
git.kernel.org/stable/c/b8206f516f... WEB
https://git.kernel.org/stable/c/b8206f516fe7cbe785cf44bf09c17c438d7c3cad
git.kernel.org/stable/c/ffec017158... WEB
https://git.kernel.org/stable/c/ffec017158d3aad8a6ffca1dfad63d63bde9caad

Frequently Asked Questions

What is CVE-2026-74483?
CVE-2026-74483 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-74483?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-74483?
CVE-2026-74483 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-74483?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w5mr-gvg4-c3ph",
  "modified" : "2026-08-23T15:33:02Z",
  "published" : "2026-08-15T15:30:34Z",
  "aliases" : [ "CVE-2026-74483" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: don't leak the user namespace when the mount fails\n\nbm_get_tree() takes a reference to the user namespace and hands it to\nget_tree_keyed() as the sget key. sget_fc() moves that reference into\nsb->s_fs_info and clears fc->s_fs_info, so from that point on the\nsuperblock owns it and bm_free() doesn't see it anymore.\n\nThe superblock drops it in ->put_super(). But generic_shutdown_super()\nonly calls ->put_super() from inside the if (sb->s_root) branch, so\nnothing releases it when bm_fill_super() fails:\n\n- The kzalloc_obj() failure leaves s_root NULL and the whole branch is\n  skipped.\n\n- A simple_fill_super() failure in the file loop leaves s_root set, but\n  s_op still points at simple_super_operations, which has no\n  ->put_super(). bm_fill_super() installs s_ops only once\n  simple_fill_super() returned success, and installing it earlier\n  wouldn't help either because simple_fill_super() overwrites s_op.\n\nEither way vfs_get_super() calls deactivate_locked_super() and the\nreference is gone for good. binfmt_misc mounts are available in a user\nnamespace and both the inode and the dentry cache are SLAB_ACCOUNT, so\nan unprivileged caller under a tight memory cgroup can fail\nsimple_fill_super() on demand and leak one user namespace per attempt.\n\nDrop the reference in ->kill_sb() instead, which runs unconditionally,\nthe same way nfsd and rpc_pipefs release their keyed s_fs_info.\n\nThat also stops ->put_super() from clearing s_fs_info while the\nsuperblock is still on @fs_supers. generic_shutdown_super() leaves it\nthere on purpose so that sget_fc() keeps finding it until kill_sb() has\nrun, but a NULL s_fs_info makes test_keyed_super() miss it, so a\nconcurrent mount for the same user namespace skips the grab_super()\nwait and creates a second superblock for a namespace that is still\nbeing torn down.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-74483"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/867aed6a4848761190d5ebdedf9642648f97bceb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/87a4eb9bbb3497f749bbac612af22ddaa62d7b0d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b8206f516fe7cbe785cf44bf09c17c438d7c3cad"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ffec017158d3aad8a6ffca1dfad63d63bde9caad"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-15T13:17:53Z"
  }
}