Linux kernel IMA: integer underflow in xattr_verify() causes out-of-bounds read on truncated security.ima

Impact

A truncated security.ima extended attribute makes the digest-length check underflow to SIZE_MAX, so the following memcmp() reads past the end of the buffer allocated for the xattr value. On a GPU node this matters where IMA appraisal is part of the attested boot chain used to convince tenants the host is what it claims to be: the out-of-bounds read is an integrity-measurement code path, and the record does not establish anything beyond an out-of-bounds read (information disclosure or oops). Nodes with IMA appraisal disabled are not affected at all. Where it is enabled, an attacker able to write a short security.ima value on a file that gets measured reaches the flawed check directly.

Who can reach it

Local, and only on kernels built and booted with IMA appraisal active. Requires the ability to set a truncated security.ima xattr on a file that IMA later verifies, which normally means CAP_SYS_ADMIN on the filesystem in question. Not reachable remotely and not reachable from an unprivileged tenant container without that capability.

What to do

Take the stable-tree fix for your kernel series - it is a pure arithmetic-signedness change in security/integrity/ima/ima_appraise.c with no ABI impact. Applying it means installing a patched kernel and rebooting each node, which for a GPU fleet means draining tenant workloads first; there is no livepatch published in the record. Fleets that do not enable IMA appraisal can defer to the next scheduled kernel roll.

References

Related entries

• Linux kernel mm/vmalloc: use-after-free when vmap huge-page promotion frees a page table under a concurrent ptdump walkCVE-2026-74672 · Linux kernel mm/vmalloc (huge vmap promotion vs ptdump page-table walk)Unscored
• Linux kernel mm: page-table reclaim flushes the wrong address, allowing reuse of a still-cached page tableCVE-2026-74674 · Linux kernel mm (zap_pte_range TLB flush address on direct page-table reclaim)Unscored
• Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup): vhost_scsi_setup_vq_cmds() sizes each command'sCVE-2026-74702 · Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup)Unscored
• Linux kernel vhost-scsi: malformed guest request with T10 protection bytes panics the hostCVE-2026-74703 · Linux kernel vhost-scsi (T10 PI scatterlist count validation)Unscored
• Linux kernel mlx5 vDPA: memory-region key creation reads past the firmware command bufferCVE-2026-74712 · Linux kernel mlx5_vdpa (create_direct_keys input buffer length)Unscored
• Linux kernel BPF TCP iterator: stolen reference on a half-published request socket ends in use-after-freeCVE-2026-74714 · Linux kernel BPF TCP iterator (bpf_iter_tcp_established_batch refcount)Unscored