Executive brief
A vulnerability in the Linux kernel's auditing system allows certain file permission changes to go unrecorded. The audit system is used by organizations to track sensitive file access and modifications for security compliance. An attacker or malicious process could use a specific system command to modify file attributes without triggering security alerts, potentially hiding unauthorized activity.
Technical details
The fchmodat2() system call, introduced in Linux kernel version 6.6, was not correctly added to the 'change attribute' class within the audit subsystem. Consequently, audit rules designed to monitor file attribute changes (such as those using the -w flag with write/attribute permissions) are not triggered when fchmodat2() is used, even though they are triggered by similar calls like chmod() or fchmodat(). This allows a local attacker to modify file permissions while evading detection by the audit daemon. The issue has been resolved by adding fchmodat2() to the audit_change_attr.h definitions across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.6 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-11-24: other: Patch authored
- 2026-03-17: disclosed: CVE published
- 2026-03-17: advisory
References
- https://git.kernel.org/stable/c/3e762a03713e8c25ca0108c075d662c897fc0623
- https://git.kernel.org/stable/c/4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc
- https://git.kernel.org/stable/c/4fed776ca86378da7dd743a7b648e20b025ba8ef
- https://git.kernel.org/stable/c/91e27bc79c3bca93c06bf5a471d47df9a35b3741
- https://git.kernel.org/stable/c/c4334c0d0e7d6f02ed93756fd4ba807e3d00c05f
- https://www.bencteux.fr/posts/missing_syscalls_audit/