Executive brief
A vulnerability was identified in the Linux kernel's Integrity Measurement Architecture (IMA) component, which is responsible for verifying the integrity of files. When a computer uses a security chip (TPM) with a newer or unsupported mathematical algorithm, the system could experience a crash or memory error during startup. This could lead to system instability or a denial of service, potentially impacting the reliability of secure boot and system monitoring operations.
Technical details
A global out-of-bounds read exists in the `ima_fs` component of the Linux kernel. The vulnerability occurs in `create_securityfs_measurement_lists` when the system attempts to access the `hash_algo_name[]` array using an index initialized to `HASH_ALGO__LAST`. This happens when a TPM chip reports an allocated bank with a hash algorithm (such as SHA3-256) that is not yet supported by the kernel's internal algorithm list. An attacker with high privileges or a specific hardware configuration could trigger this out-of-bounds read during kernel initialization, leading to a kernel panic (DoS). The fix introduces a fallback naming convention (`_tpm_alg_<ID>`) for securityfs files when the algorithm is unrecognized, preventing the invalid array access.
Affected products
- Linux Linux Kernel 6.12.40
Timeline
- 2026-03-10: patched: Initial patch authored
- 2026-06-24: advisory: CVE-2026-53038 published