Executive brief
The Linux kernel's Integrity Measurement Architecture (IMA) is a security component that ensures files have not been modified by verifying cryptographic measurements. A flaw in the truncation handling allowed IMA to bypass re-validation of files after their content was truncated, potentially allowing modified files to avoid re-measurement and re-appraisal checks. An attacker who can truncate files could exploit this to modify file contents while evading integrity verification.
Technical details
The vulnerability exists in the IMA subsystem's handling of file truncation operations. The file_truncate and path_truncate LSM hooks were not properly instantiated, meaning that when files were truncated via truncate() or ftruncate() syscalls, IMA's cached action flags (IMA_DONE_MASK) were not reset. This allowed the IMA cache to retain stale "measurement done" flags, preventing re-collection, re-measurement, re-audit, and re-appraisal of truncated files on subsequent access. An attacker with write access to a file could truncate it to bypass integrity checks. The fix instantiates both LSM hooks to reset IMA_DONE_MASK and measured_pcrs flags when truncation is requested, ensuring files are re-validated. The patch has been merged into Linux kernel stable branches.
Affected products
- Linux Linux Kernel Multiple stable versions (2.6.x through 7.x)
Timeline
- 2026-08-22: disclosed
- 2026-07-27: patched: Patch authored by Mimi Zohar
- 2026-08-19: other: Patch committed to stable tree by Greg Kroah-Hartman