Executive brief
The Linux kernel's Extended Verification Module (EVM) contains a buffer handling flaw in the xattrs debug interface. When no extended attributes are enabled, an uninitialized buffer is read by the string length function, potentially exposing kernel memory. This affects the confidentiality of kernel memory and could be exploited to gather information about system configuration or bypass security mechanisms.
Technical details
The vulnerability is an uninitialized buffer read in the evm_read_xattrs() function (security/integrity/evm/evm_secfs.c). The function allocates a buffer but fails to null-terminate it immediately after allocation. When no configured xattrs are enabled, the buffer fill loop stores nothing, leaving temp[0] uninitialized. The code then calls strlen(temp), which reads beyond the initialized memory region, disclosing kernel data. The fix explicitly null-terminates the buffer at allocation time, switches from sprintf() to snprintf() with proper bounds checking, and replaces strlen(temp) with a tracked offset variable to eliminate the uninitialized read.
Affected products
- Linux Linux kernel multiple versions (as indicated by stable kernel branches from 2.6.11.y through 7.2.y)
Timeline
- 2026-08-15: disclosed
- 2026-05-13: patched