CVE-2026-53038: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53038 Overview

CVE-2026-53038 is a Linux kernel vulnerability in the Integrity Measurement Architecture (IMA) filesystem subsystem. The flaw resides in create_securityfs_measurement_lists(), which reads from the global hash_algo_name[] array using an index derived from ima_tpm_chip->allocated_banks[i].crypto_id. When a Trusted Platform Module (TPM) advertises a bank with an algorithm the kernel does not recognize, such as TPM_ALG_SHA3_256 (0x0027), the crypto_id is set to HASH_ALGO__LAST. Code paths that assume the value is valid then perform a global out-of-bounds read, as confirmed by Kernel Address Sanitizer (KASAN) reports on kernel 6.12.40.

Critical Impact
A global out-of-bounds read in the IMA initialization path triggers during early boot on systems with TPM chips reporting unsupported hash banks, potentially leading to information disclosure or denial of service via kernel panic.

Affected Products

Linux kernel (IMA subsystem, security/integrity/ima/ima_fs.c)
Confirmed reproduction on Linux kernel 6.12.40
Systems with TPM 2.0 chips exposing unsupported algorithm banks (for example, TPM_ALG_SHA3_256)

Discovery Timeline

2026-06-24 - CVE-2026-53038 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53038

Vulnerability Analysis

The Linux IMA subsystem creates securityfs entries to expose runtime measurement lists per TPM hash bank. During initialization, create_securityfs_measurement_lists() iterates over ima_tpm_chip->allocated_banks[] and indexes into the global hash_algo_name[] table using each bank's crypto_id. The TPM core sets crypto_id to HASH_ALGO__LAST when the firmware reports an algorithm identifier not present in the kernel's tpm_algorithms table.

Because HASH_ALGO__LAST is the size marker of the hash_algo_name[] array, dereferencing it reads memory immediately past the array boundary. KASAN flagged this as a global-out-of-bounds read of 8 bytes against the hash_algo_name symbol during ima_fs_init(). The condition triggers on boot for hardware that exposes newer TPM algorithms such as SHA3-256.

Root Cause

The root cause is a missing validation between the TPM bank algorithm enumeration and the kernel's hash_algo_name[] lookup table. The code assumes crypto_id is always a valid index, but the TPM core legitimately produces HASH_ALGO__LAST for banks it cannot map. This is an Out-of-Bounds Read defect classed under improper validation of array index.

Attack Vector

The vulnerability is reachable only during kernel initialization and is gated by the presence of a TPM chip reporting an unsupported algorithm bank. There is no documented remote or unprivileged user-space trigger. The practical impact is observed as a KASAN-detected out-of-bounds read at boot, with potential for kernel-memory disclosure into securityfs filenames or instability on hardware with TPMs exposing algorithms newer than the kernel's tpm_algorithms list. The upstream fix renames the securityfs entries with a _tpm_alg_<ID> suffix when no crypto_id mapping exists, avoiding the bad index entirely.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream commits referenced below. See the Linux Kernel Commit b6766b1 and Linux Kernel Commit d7bd8cf for the authoritative patch sources.

Detection Methods for CVE-2026-53038

Indicators of Compromise

Kernel log entries similar to tpm tpm0: TPM with unsupported bank algorithm 0x0027 indicating an unmapped TPM bank
KASAN reports referencing global-out-of-bounds in create_securityfs_measurement_lists during early boot
Missing or malformed ascii_runtime_measurements_* and binary_runtime_measurements_* entries under /sys/kernel/security/ima/

Detection Strategies

Inventory Linux hosts running affected kernel versions, particularly stable 6.12.x builds prior to the fix, with TPM 2.0 hardware
Parse dmesg and journalctl -k output for unsupported bank algorithm messages and IMA initialization warnings
Enumerate /sys/kernel/security/ima/ to confirm expected per-bank measurement files are present and well-formed

Monitoring Recommendations

Centralize kernel log collection and alert on KASAN reports referencing ima_fs or create_securityfs_measurement_lists
Track kernel package versions across the fleet and flag hosts that have not received the stable backport commits
Monitor TPM event logs for algorithm advertisements outside the kernel's supported set

How to Mitigate CVE-2026-53038

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce the _tpm_alg_<ID> filename fallback in ima_fs.c
Update to a stable kernel release containing commits 081b557, 88d4e89, b6766b1, or d7bd8cf as appropriate for the maintained branch
Validate IMA initialization on TPM-equipped hosts after patching by inspecting /sys/kernel/security/ima/ and kernel logs

Patch Information

The fix is distributed across multiple stable trees in the following commits: Linux Kernel Commit 081b557, Linux Kernel Commit 88d4e89, Linux Kernel Commit b6766b1, and Linux Kernel Commit d7bd8cf. The fix creates securityfs files using a _tpm_alg_<ID> postfix when crypto_id is uninitialized, eliminating the out-of-bounds index into hash_algo_name[].

Workarounds

Disable IMA at boot via the ima=off kernel command-line parameter on hosts that do not require runtime measurement, until patched kernels are deployed
Where feasible, update TPM firmware or use platform configuration to suppress unsupported algorithm banks reported to the OS
Restrict deployment of affected kernels to hardware whose TPM banks are known to map to algorithms present in the kernel's tpm_algorithms table

bash

# Verify kernel version and inspect IMA securityfs after patching
uname -r
ls -1 /sys/kernel/security/ima/
dmesg | grep -Ei 'ima|tpm|unsupported bank algorithm'