Linux kernel IMA: file signature silently downgraded to a hash when another security xattr is written

Impact

IMA clears the IMA_DIGSIG flag when any other security xattr is set or removed on a file that already carries an IMA signature. On close, IMA then writes a plain hash into security.ima instead of keeping the signature. With IMA and EVM in fix mode - the provisioning mode used to generate reference values - installing packages produces hash-only labels, so the fleet-wide appraisal baseline is built without real signatures and signature-enforcing policies have nothing to verify against. The effect is a weakened integrity baseline on nodes that rely on IMA appraisal for boot-time and runtime attestation, not a direct code-execution path. Setting security.selinux, removing security.evm, or setting an ACL after the signature is enough to trigger it.

Who can reach it

Local, on a host with IMA appraisal configured. Any process that can write a security xattr or an ACL on a file after its IMA signature has been set can cause the signature to be replaced by a hash. Operators hit it unintentionally during package installs on nodes booted with ima_appraise=fix evm=fix.

What to do

Patch the kernel to a stable release that stops IMA_DIGSIG from being reset, then reboot. Nodes that do not enable IMA appraisal are unaffected. Any reference IMA labels generated on an unpatched kernel in fix mode should be regenerated after the patch, since existing security.ima values may be hashes where signatures were intended; the advisory does not list a userspace mitigation.

References

Related entries

• Linux kernel NVMe: use-after-free on the admin request_queue during controller teardownCVE-2025-68265 · Linux kernel NVMe driver (admin request_queue lifetime)High
• Linux kernel io_uring zero-copy send: unchecked chained notification context on completionCVE-2025-68317 · Linux kernel io_uring (zero-copy send, chained notification contexts)High
• Linux kernel: integer overflow in asymmetric_key_generate_id can overflow a key-id bufferCVE-2025-68724 · Linux kernel crypto/asymmetric_keys (asymmetric_key_generate_id length arithmetic)High
• Linux kernel (virt/kvm): KVM blocked turning KVM_MEM_GUEST_MEMFD on for an existing memslot but not turning it off, andCVE-2025-68810 · Linux kernel (virt/kvm)High
• Linux kernel on POWER hash MMU: stale hardware SLB entries cause an SLB multi-hit machine checkCVE-2025-71078 · Linux kernel powerpc/64s SLB preload cache (hash MMU)High
• Linux kernel (drivers/iommu): In an SVA context the IOMMU walks and caches the CPU's page tables, and on x86 everyCVE-2025-71089 · Linux kernel (drivers/iommu)High