Executive brief
The Linux kernel's IMA (Integrity Measurement Architecture) feature, which validates file integrity on systems, contains a bounds-checking flaw. An attacker with the ability to set a truncated extended attribute on a file could bypass validation checks and trigger an out-of-bounds memory read, potentially exposing kernel memory or causing a system crash.
Technical details
The vulnerability is an integer underflow in the xattr_verify() function of security/integrity/ima/ima_appraise.c. The digest-length check incorrectly mixes signed int and unsigned size_t types: `(xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length)`. When sizeof() is involved, arithmetic conversions promote the left-hand side to unsigned 64-bit, causing a truncated xattr (e.g., 1 byte) to underflow to SIZE_MAX instead of becoming negative, bypassing the bounds check. The subsequent memcmp() then reads past the allocated buffer. The root cause is that ima_get_hash_algo() does not clamp truncated xattr_len values to a safe range before xattr_verify() is called. The fix rewrites the comparison using addition rather than subtraction to ensure all operands remain signed integers.
Affected products
- Linux Linux kernel 3.0 and later (patch backported to multiple stable branches from 5.4.y through 7.2.y)
Timeline
- 2026-08-22: disclosed: CVE-2026-74671 published
- 2026-08-04: patched: Upstream patch merged (5ff232d31106f45ac87c3b64e1d35a0667777797)