All vulnerabilities
CVE-2026-98885

Linux: ima: return error early if file xattr cannot be changed

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in86acb68ebb220b83def94e7f4c33e24e843970e0Also 4d98295357bcacb70874e73117e298a9d7d9b830, 8c77312728d07b60fc028f676e42d842df918bcd and 8 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 86acb68ebb220b83def94e7f4c33e24e843970e0LinuxCVE List
  • 4d98295357bcacb70874e73117e298a9d7d9b830LinuxCVE List
  • 8c77312728d07b60fc028f676e42d842df918bcdLinuxCVE List
  • 2f29f880e98bf0087215726c45a485afd15b42cfLinuxCVE List
  • 69fc6474236d9edda6983623e4282f2bdfd8e3d8LinuxCVE List
  • 5.10.271LinuxCVE List
Show all 11 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ima: return error early if file xattr cannot be changed

During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning.

WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170

Detect the state of the file early and return the error.

Text from CVE List

Affected versions 20

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 86acb68ebb220b83def94e7f4c33e24e843970e0CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4d98295357bcacb70874e73117e298a9d7d9b830CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c6988714c0549e06610635c7a71e88635da6db64CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8c77312728d07b60fc028f676e42d842df918bcdCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before dce1b66fcfb40c935f426f602c3a41a7b9f62ba4CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2f29f880e98bf0087215726c45a485afd15b42cfCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 69fc6474236d9edda6983623e4282f2bdfd8e3d8CVE List
  • Linuxaffected: all versions before 5.10.271CVE List
  • Linuxaffected: all versions before 5.15.222CVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7