Executive brief
The Linux kernel's Integrity Measurement Architecture (IMA) module crashes when processing extended file attributes on paths longer than system limits. An attacker with the ability to set extended attributes (xattr) on files with very long paths can trigger a kernel panic, causing denial of service to the system.
Technical details
The vulnerability is a null pointer dereference in the validate_hash_algo() function within the IMA appraise module (security/integrity/ima/ima_appraise.c). When dentry_path() returns an ERR_PTR (error pointer) due to a path exceeding PATH_MAX, the code failed to check for this error condition and instead passed the invalid pointer to integrity_audit_msg(). The audit function then called strlen() on the error pointer, triggering a page fault. The fix adds an IS_ERR() check and substitutes NULL for the error pointer, allowing the audit message to skip the pathname field gracefully instead of crashing.
Affected products
- Linux Linux kernel multiple stable series (4.4.y through 6.18.y and later)
Timeline
- 2026-09-16: disclosed: CVE-2026-89989 published
- 2026-09-14: patched: Fix merged into linux-6.1.y and other stable branches