Executive brief
A vulnerability was identified in the Linux kernel's Integrity Measurement Architecture (IMA), a security component that ensures files have not been tampered with. An error in how the system processes file execution requests could lead to a system crash or memory corruption. This issue primarily affects the stability and security enforcement of the operating system during routine tasks like running programs with elevated privileges.
Technical details
A stack-out-of-bounds access vulnerability exists in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem. The root cause is an incorrect use of the 'container_of' macro on a file pointer within the 'is_bprm_creds_for_exec' function, leading to invalid offset calculations on the stack. This was detected by KASAN during 'ima_appraise_measurement' operations. An attacker with local access could potentially trigger this out-of-bounds read during process execution (e.g., using sudo), potentially leading to a kernel panic or local privilege escalation. The fix involves refactoring 'process_measurement' to explicitly pass a boolean flag ('bprm_is_check') instead of relying on the buggy pointer arithmetic.
Affected products
- Linux Linux Kernel Fixed in commits 377cae9851e8559e9d8b82a78c1ac0abeb18839c and ab3d16da982a4ebb715d487dbf9dd66e3990d935
Timeline
- 2025-12-27: other: Patch authored
- 2026-05-27: disclosed: CVE published