From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 659AF399001 for ; Sat, 22 Aug 2026 15:37:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787413066; cv=none; b=CZol1NIn1EVUFTgjWoFT+FR70rFyrR9kQRfhb0sufivyQ5mg1ZzsXvZLhhjicj7F4N+Yk7mxjbvdgD9xarDK3OijY5pQ23udLUPic4tc9ZfccZhVryok8+JDQkpwU6pBTYMLP74G2khetYBJexQyazx2B9+PfIMTN9/GU1TZ2Yk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787413066; c=relaxed/simple; bh=qyTZOUDhx9O6bJdo47h+LxwJNCvduY4NGjVF3F9ehqM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=p64FzVusSxGLWx3wZsZY6MSnUDFagdQkznk8kND6nV1NzGU8LwwI+Uj53npBRL85MeaIocVADTXkdyrgscmcABn92YOyH51yekC75oe6DkdxpxGiKfSxRoYcZFLUCt6MAr1EbI0t1PM0IBup/j3XxMRpVhu7A5tzt44l3SRNdaE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JUsnMbZ2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JUsnMbZ2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E37A1F00A3A; Sat, 22 Aug 2026 15:37:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787413061; bh=ybX7OZu4/qRCgDVRlROqOp3WzD2ghxxzge82wmM56/o=; h=From:To:Cc:Subject:Date:Reply-To; b=JUsnMbZ2qoF13AWY7cv4K2eJYhJL2OgtxCoXFPpXRMKQ32cb8Dq1R7fdjFE2tt0J2 x7Gg9A8c8wJ0T05DrvtEZ00ftzftLYz0GrhHFvjlt28FAwGREG6suVy2nLMQdHvUUM ZKPsM77xKVJkzTQwey9hcuRqQOvkV/Xz0s+s8I90= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74671: ima: fix out-of-bounds read in xattr_verify() Date: Sat, 22 Aug 2026 17:32:35 +0200 Message-ID: <2026082229-CVE-2026-74671-bdc4@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4237; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=WCxhPgsD+2V0cKdQ2KFDfe4MKK+yXvo+8WbmSEJtmP4=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmdBy6llFznFNst9el8zoN78o2pIvxSDCFBKX7ZG+X0V D4aW7B3xLIwCDIxyIopsnzZxnN0f8UhRS9D29Mwc1iZQIYwcHEKwEReMzMsaGcoOfmv+GRPcMl5 xZlGZkoC93qXMczhetTjvP65wnePv6k1+m3Lo1RYLJkB X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr_verify() The digest-length check in xattr_verify() mixes int and size_t: if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length) sizeof() yields size_t, so the usual arithmetic conversions promote the whole left-hand side to unsigned 64-bit before the subtraction runs. For a truncated xattr this underflows instead of going negative: a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1) turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length. The check then passes and the following memcmp() reads iint->ima_hash->length bytes starting past the end of the buffer vfs_getxattr_alloc() allocated for it. Nothing upstream clamps xattr_len back into a safe range first: ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than failing when no HMAC key is loaded, so a truncated security.ima value reaches the length check as-is. Rewrite the comparison so every operand stays a signed int and no implicit conversion to size_t can occur. The Linux kernel CVE team has assigned CVE-2026-74671 to this issue. Affected and fixed versions =========================== Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 5.10.265 with commit d823b5f4557083d1dd92096f796a78a2b1b06d10 Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 5.15.216 with commit caeb105c15ea2431fa8da7ecfa242d0c68272426 Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.1.183 with commit a784b4732ac7e51862b9b210c2d8b2ab9e83568c Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.6.152 with commit b6cb134707a2127d90a58d69dd818679cae8033c Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.12.104 with commit 7e515b6c9aab452a4f0734bd7208e4e780e164ca Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 6.18.45 with commit 27f3924061592d0ef6b04e16f48754b6cb6adf27 Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 7.1.9 with commit dd04114af0d451091f7b8cbd26d9e37d011e9131 Issue introduced in 3.13 with commit 3ea7a56067e663278470c04fd655adf809e72d4d and fixed in 7.2 with commit 5ff232d31106f45ac87c3b64e1d35a0667777797 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74671 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: security/integrity/ima/ima_appraise.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d823b5f4557083d1dd92096f796a78a2b1b06d10 https://git.kernel.org/stable/c/caeb105c15ea2431fa8da7ecfa242d0c68272426 https://git.kernel.org/stable/c/a784b4732ac7e51862b9b210c2d8b2ab9e83568c https://git.kernel.org/stable/c/b6cb134707a2127d90a58d69dd818679cae8033c https://git.kernel.org/stable/c/7e515b6c9aab452a4f0734bd7208e4e780e164ca https://git.kernel.org/stable/c/27f3924061592d0ef6b04e16f48754b6cb6adf27 https://git.kernel.org/stable/c/dd04114af0d451091f7b8cbd26d9e37d011e9131 https://git.kernel.org/stable/c/5ff232d31106f45ac87c3b64e1d35a0667777797