CVE-2026-74671
ima: fix out-of-bounds read in xattr_verify()
Description
In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr_verify() The digest-length check in xattr_verify() mixes int and size_t: if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length) sizeof() yields size_t, so the usual arithmetic conversions promote the whole left-hand side to unsigned 64-bit before the subtraction runs. For a truncated xattr this underflows instead of going negative: a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1) turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length. The check then passes and the following memcmp() reads iint->ima_hash->length bytes starting past the end of the buffer vfs_getxattr_alloc() allocated for it. Nothing upstream clamps xattr_len back into a safe range first: ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than failing when no HMAC key is loaded, so a truncated security.ima value reaches the length check as-is. Rewrite the comparison so every operand stays a signed int and no implicit conversion to size_t can occur.
INFO
Published Date :
Aug. 22, 2026, 4:16 p.m.
Last Modified :
Aug. 22, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74671
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the latest version.
- Apply the kernel patch for the xattr_verify function.
- Ensure all operands are signed integers for comparisons.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74671.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74671 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74671
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74671 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74671 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 22, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': 'd823b5f4557083d1dd92096f796a78a2b1b06d10', 'versionType': 'git'}, {'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': 'caeb105c15ea2431fa8da7ecfa242d0c68272426', 'versionType': 'git'}, {'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': 'a784b4732ac7e51862b9b210c2d8b2ab9e83568c', 'versionType': 'git'}, {'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': 'b6cb134707a2127d90a58d69dd818679cae8033c', 'versionType': 'git'}, {'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': '7e515b6c9aab452a4f0734bd7208e4e780e164ca', 'versionType': 'git'}, {'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': '27f3924061592d0ef6b04e16f48754b6cb6adf27', 'versionType': 'git'}, {'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': 'dd04114af0d451091f7b8cbd26d9e37d011e9131', 'versionType': 'git'}, {'status': 'affected', 'version': '3ea7a56067e663278470c04fd655adf809e72d4d', 'lessThan': '5ff232d31106f45ac87c3b64e1d35a0667777797', 'versionType': 'git'}], 'programFiles': ['security/integrity/ima/ima_appraise.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.13'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.13', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.265', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.216', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['security/integrity/ima/ima_appraise.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattr_verify() The digest-length check in xattr_verify() mixes int and size_t: if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length) sizeof() yields size_t, so the usual arithmetic conversions promote the whole left-hand side to unsigned 64-bit before the subtraction runs. For a truncated xattr this underflows instead of going negative: a 1-byte IMA_XATTR_DIGEST_NG xattr (xattr_len == 1, hash_start == 1) turns "1 - 1 - 1" into SIZE_MAX, which is trivially >= ima_hash->length. The check then passes and the following memcmp() reads iint->ima_hash->length bytes starting past the end of the buffer vfs_getxattr_alloc() allocated for it. Nothing upstream clamps xattr_len back into a safe range first: ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than failing when no HMAC key is loaded, so a truncated security.ima value reaches the length check as-is. Rewrite the comparison so every operand stays a signed int and no implicit conversion to size_t can occur. Added Reference https://git.kernel.org/stable/c/27f3924061592d0ef6b04e16f48754b6cb6adf27 Added Reference https://git.kernel.org/stable/c/5ff232d31106f45ac87c3b64e1d35a0667777797 Added Reference https://git.kernel.org/stable/c/7e515b6c9aab452a4f0734bd7208e4e780e164ca Added Reference https://git.kernel.org/stable/c/a784b4732ac7e51862b9b210c2d8b2ab9e83568c Added Reference https://git.kernel.org/stable/c/b6cb134707a2127d90a58d69dd818679cae8033c Added Reference https://git.kernel.org/stable/c/caeb105c15ea2431fa8da7ecfa242d0c68272426 Added Reference https://git.kernel.org/stable/c/d823b5f4557083d1dd92096f796a78a2b1b06d10 Added Reference https://git.kernel.org/stable/c/dd04114af0d451091f7b8cbd26d9e37d011e9131