CVE-2026-23241: Linux Kernel Auth Bypass Vulnerability

CVE-2026-23241 Overview

CVE-2026-23241 is a Linux kernel audit subsystem flaw where the getxattrat() and listxattrat() syscalls were missing from the audit read class. The omission allows local users to read extended attributes of files without triggering audit rules. Existing watch rules such as -w /tmp/test -p rwa -k test_rwa fail to log access performed through these "at" variant syscalls. The issue affects logging integrity in environments that depend on the Linux audit framework for compliance and forensics.

Critical Impact

Local users can bypass audit logging when reading extended attributes via the *at() syscall variants, breaking visibility for monitoring and compliance tooling.

Affected Products

• Linux Kernel (versions supporting getxattrat() and listxattrat() syscalls)
• Distributions shipping kernels with the affected audit class definitions
• Stable kernel trees prior to the referenced fix commits

Discovery Timeline

• 2026-03-17 - CVE-2026-23241 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23241

Vulnerability Analysis

The Linux kernel audit subsystem maintains syscall classes that group related syscalls for filter matching. The read class is used by watch rules with the r permission flag to log file read activity. When getxattrat() and listxattrat() were introduced as "at" variants of getxattr() and listxattr(), they were not registered in the audit read class. As a result, the audit filter logic does not associate these syscalls with read operations, and matching rules never fire.

An attacker with local access can use the *at() variants to enumerate or retrieve extended attributes on watched paths without producing audit records. Extended attributes can contain SELinux labels, ACL data, capability sets, and application metadata. The bypass undermines integrity monitoring, insider threat detection, and audit-based compliance frameworks that rely on watch rules to record read access.

Root Cause

The root cause is incomplete syscall class registration in the kernel audit code. New syscalls were added without corresponding entries in read_class, so the audit filter never classifies them as read operations. The fix adds the missing syscalls to the audit read class so that watch rules apply consistently to old and new variants.

Attack Vector

Exploitation requires local code execution on the target system. An attacker calls getxattrat() or listxattrat() against a path covered by an audit watch rule. The syscall succeeds, returns extended attribute data, and produces no audit record matching the watch's read permission. No elevated privileges beyond standard file access permissions are required.

For technical details and the patch commits, see the Bencteux Blog Post and the upstream fixes at Linux Kernel Commit a2e8c14, Linux Kernel Commit ad37505, and Linux Kernel Commit bcb90a2.

Detection Methods for CVE-2026-23241

Indicators of Compromise

• Absence of expected audit records for read operations on watched paths that hold extended attributes
• Process activity invoking getxattrat or listxattrat syscalls against sensitive files without matching audit events
• Gaps between filesystem access telemetry from other sources and the audit log for the same time window

Detection Strategies

• Compare kernel syscall tracing output (eBPF, perf, strace) against auditd logs to surface syscalls that produce no audit entry
• Deploy syscall-level tracepoints for getxattrat and listxattrat and forward results to a central log store
• Use file integrity monitoring tools that hook at the VFS or LSM layer rather than relying solely on audit watch rules

Monitoring Recommendations

• Ingest auditd events and syscall telemetry into a centralized data lake for correlation across hosts
• Alert on use of *at() extended attribute syscalls by non-administrative users or unexpected processes
• Validate audit rule coverage after each kernel upgrade by running test cases that exercise both legacy and *at() syscall variants

How to Mitigate CVE-2026-23241

Immediate Actions Required

• Apply the upstream Linux kernel patches that add getxattrat() and listxattrat() to the audit read class
• Update to a distribution kernel that includes the referenced fix commits and reboot affected systems
• Audit existing detection rules that depend on watch-based read logging and validate they fire for the *at() syscall variants

Patch Information

The fix is committed upstream in the Linux stable tree. Reference the patch commits: a2e8c144299c, ad37505ce869, and bcb90a2834c7. Track your distribution's security advisories for backported kernel packages.

Workarounds

• Add explicit syscall-based audit rules targeting getxattrat and listxattrat until the kernel patch is deployed
• Supplement audit watch rules with LSM-based or eBPF-based monitoring that observes extended attribute access at the VFS layer
• Restrict local shell access on systems where audit coverage is a compliance requirement

# Temporary audit rule to log the missing syscall variants
# Adjust architecture (b64/b32) to match the target system
auditctl -a always,exit -F arch=b64 -S getxattrat -S listxattrat -k xattr_at_read