Linux kernel IMA: truncation does not invalidate cached measurements, leaving stale appraisal state

Impact

IMA caches per-inode action flags (IMA_DONE_MASK) so a file is not re-measured on every access. The truncate paths did not reset those flags, so a file modified by truncation kept its earlier measurement, audit record and appraisal verdict. Where IMA is the mechanism behind measured boot, remote attestation or appraisal-enforced binaries, the log and the PCR quote can describe content that no longer matches what is on disk. On attested GPU fleets - confidential-computing tenants, regulated HPC sites - that weakens exactly the guarantee the measurement chain is deployed to provide.

Who can reach it

Local, and only on hosts that actually run an IMA policy. A user who can truncate a file covered by that policy gets a modified file whose cached measurement or appraisal verdict is not refreshed on the next access.

What to do

Take the patched kernel from the linked stable commits, which instantiate the file_truncate and path_truncate hooks so the cache is invalidated at truncation time. Deploy the kernel and reboot each node; policy edits cannot substitute, because the missing hook is what the policy would have keyed off. Hosts with no IMA policy in force are not affected.

References

Related entries

• Linux kernel sched_ext: lock inversion between scx_cgroup_lock and cgroup_mutex deadlocks the nodeCVE-2026-74593 · Linux kernel sched_ext (scx_cgroup_lock ordering against cgroup_mutex)Unscored
• Linux kernel PSI: rtpoll timer can outlive its cgroup and fire on freed memoryCVE-2026-74594 · Linux kernel sched/psi (rtpoll_timer lifetime vs psi_cgroup_free)Unscored
• Linux kernel page_table_check: unprivileged zero mappings overflow the file map counter and panic the hostCVE-2026-74600 · Linux kernel mm/page_table_check (zero-page and huge-zero PMD accounting)Unscored
• KVM SVM SEV: races between encryption-context move and copy corrupt the mirror list and misdirect a VM referenceCVE-2026-74607 · KVM SVM SEV (owner/mirror VM list serialisation across MOVE_ENC_CONTEXT_FROM and COPY_ENC_CONTEXT_FROM)Unscored
• Linux kernel perf/core: use-after-free on a freed group leader after a sibling is detached during CPU hotplugCVE-2026-74637 · Linux kernel perf/core (perf_group_detach sibling promotion)Unscored
• Linux kernel IMA: integer underflow in xattr_verify() causes out-of-bounds read on truncated security.imaCVE-2026-74671 · Linux kernel IMA (xattr_verify digest-length check)Unscored