Executive brief
A vulnerability in the Linux kernel's audit subsystem allows users to bypass security monitoring rules. The audit system, which tracks file access for security compliance, fails to log certain newer methods of reading file attributes. This means an attacker or unauthorized user could inspect sensitive file metadata without leaving a trace in the system's security logs, potentially undermining regulatory compliance and forensic investigations.
Technical details
The Linux kernel audit subsystem uses 'classes' of system calls to implement filesystem watches (e.g., -p r). The 'at' variants of extended attribute system calls, specifically getxattrat() and listxattrat(), were omitted from the audit_read.h class definition. A local attacker can utilize these system calls to read extended attributes of a monitored file without triggering a SYSCALL audit event, effectively bypassing auditd rules configured to monitor read access. The issue is resolved by adding these syscalls to the audit read class in include/asm-generic/audit_read.h.
Affected products
- Linux Linux Kernel 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-12-27: other: Patch authored
- 2026-03-08: disclosed: Detailed technical blog post published by researcher
- 2026-03-17: advisory: CVE-2026-23241 published
- 2026-03-18: patched: Kernel stable tree updates confirmed