CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify()

CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ima: fix out-of-bounds read in xattr_verify()

The digest-length check in xattr_verify() mixes int and size_t:

	if (xattr_len - sizeof(xattr_value->type) - hash_start >=
			iint->ima_hash->length)

sizeof() yields size_t, so the usual arithmetic conversions promote
the whole left-hand side to unsigned 64-bit before the subtraction
runs. For a truncated xattr this underflows instead of going negative:
a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1)
turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length.
The check then passes and the following memcmp() reads
iint->ima_hash->length bytes starting past the end of the buffer
vfs_getxattr_alloc() allocated for it.

Nothing upstream clamps xattr_len back into a safe range first:
ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default
algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than
failing when no HMAC key is loaded, so a truncated security.ima value
reaches the length check as-is.

Rewrite the comparison so every operand stays a signed int and no
implicit conversion to size_t can occur.

The Linux kernel CVE team has assigned CVE-2026-74671 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 5.10.265 with commit d823b5f4557083d1dd92096f796a78a2b1b06d10
	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 5.15.216 with commit caeb105c15ea2431fa8da7ecfa242d0c68272426
	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.1.183 with commit a784b4732ac7e51862b9b210c2d8b2ab9e83568c
	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.6.152 with commit b6cb134707a2127d90a58d69dd818679cae8033c
	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.12.104 with commit 7e515b6c9aab452a4f0734bd7208e4e780e164ca
	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.18.45 with commit 27f3924061592d0ef6b04e16f48754b6cb6adf27
	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 7.1.9 with commit dd04114af0d451091f7b8cbd26d9e37d011e9131
	Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 7.2 with commit 5ff232d31106f45ac87c3b64e1d35a0667777797

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74671
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	security/integrity/ima/ima_appraise.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d823b5f4557083d1dd92096f796a78a2b1b06d10
	https://git.kernel.org/stable/c/caeb105c15ea2431fa8da7ecfa242d0c68272426
	https://git.kernel.org/stable/c/a784b4732ac7e51862b9b210c2d8b2ab9e83568c
	https://git.kernel.org/stable/c/b6cb134707a2127d90a58d69dd818679cae8033c
	https://git.kernel.org/stable/c/7e515b6c9aab452a4f0734bd7208e4e780e164ca
	https://git.kernel.org/stable/c/27f3924061592d0ef6b04e16f48754b6cb6adf27
	https://git.kernel.org/stable/c/dd04114af0d451091f7b8cbd26d9e37d011e9131
	https://git.kernel.org/stable/c/5ff232d31106f45ac87c3b64e1d35a0667777797