CVE-2026-74592: Linux Kernel IMA Privilege Escalation Flaw

CVE-2026-74592 Overview

CVE-2026-74592 is a Linux kernel vulnerability in the Integrity Measurement Architecture (IMA) subsystem. The kernel failed to instantiate the file_truncate and path_truncate Linux Security Module (LSM) hooks. As a result, IMA did not reset its action cache flags (IMA_DONE_MASK) when a file was truncated. Files could retain stale measurement, audit, and appraisal state after their contents changed through truncation, undermining runtime integrity guarantees.

Critical Impact
An authenticated local user can truncate a monitored file and bypass IMA re-measurement, re-audit, and re-appraisal on subsequent access, defeating integrity policy enforcement.

Affected Products

Linux kernel branches with IMA enabled prior to the fixes referenced in the stable tree commits
Distributions shipping IMA-based integrity policies for measurement or appraisal
Systems using IMA-Appraisal for runtime file integrity enforcement

Discovery Timeline

2026-08-22 - CVE-2026-74592 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74592

Vulnerability Analysis

The Linux kernel's IMA subsystem measures, audits, and appraises files against policy at access time. To avoid redundant work, IMA caches the completed actions in per-inode state and marks them with IMA_DONE_MASK. When file contents change, this cache must be invalidated so IMA re-evaluates the file on the next access.

The kernel did not implement the file_truncate and path_truncate LSM hooks in IMA. Truncation operations that shortened or emptied a file did not signal IMA to invalidate the cached action state. IMA continued to treat the file as previously measured and appraised, even though its contents no longer matched the earlier evaluation.

The fix instantiates both hooks so IMA clears IMA_DONE_MASK at truncation time. On the next open or execution, IMA re-collects the hash, re-measures, re-audits, and re-appraises the file according to policy.

Root Cause

The root cause is a missing security hook implementation in the IMA LSM, a form of Broken Access Control on integrity state. Truncation is a content-modifying operation but was not wired into IMA's invalidation path. The stale-cache condition allowed integrity decisions to be made against measurements that no longer represented the file's true state.

Attack Vector

An attacker with the ability to invoke truncate(), ftruncate(), or open() with O_TRUNC on a file governed by IMA policy can silently modify content while preserving the cached "already appraised" state. Subsequent accessors of the file rely on stale integrity conclusions. In appraisal-enforcing configurations, this weakens the guarantee that only files matching signed or hashed references execute. In measurement-only configurations, the IMA log and any remote attestation derived from it no longer reflect ground truth.

No verified exploit code is available. Refer to the upstream fixes at Kernel Git Commit 0baed1fa2184, Kernel Git Commit 5f46705d96eb, Kernel Git Commit b80bed5c871a, and Kernel Git Commit dd21c96a71e8 for the code-level changes.

Detection Methods for CVE-2026-74592

Indicators of Compromise

Divergence between file content hashes and the corresponding entries in /sys/kernel/security/ima/ascii_runtime_measurements
Absence of expected IMA audit records after a file that should be re-measured was truncated and reopened
Remote attestation quotes referencing IMA measurements that do not match on-disk state of policy-covered files

Detection Strategies

Compare the IMA measurement log against out-of-band file hashes for policy-covered paths and flag mismatches
Monitor truncate, ftruncate, and openat with O_TRUNC syscalls targeting binaries, libraries, or configuration files under IMA policy
Correlate truncation events with the absence of a subsequent IMA re-measurement record on the same inode

Monitoring Recommendations

Ingest auditd and IMA audit streams into a centralized log platform and alert on truncation of files in appraisal-critical directories
Baseline the kernel version and IMA policy across the fleet to identify hosts still exposed to CVE-2026-74592
Track processes with CAP_DAC_OVERRIDE or write access to IMA-covered files and review their truncation activity

How to Mitigate CVE-2026-74592

Immediate Actions Required

Apply the vendor kernel update that includes the IMA file_truncate and path_truncate hook implementations
Reboot into the patched kernel and confirm the running version with uname -r
Re-baseline IMA measurement logs and attestation references after the patched kernel is deployed

Patch Information

The upstream fixes are available in the stable tree at Kernel Git Commit 0baed1fa2184, Kernel Git Commit 5f46705d96eb, Kernel Git Commit b80bed5c871a, and Kernel Git Commit dd21c96a71e8. Consume the fix through your distribution's kernel update channel to ensure signed builds and matching modules.

Workarounds

Tighten discretionary and mandatory access controls on IMA-covered files so unprivileged users cannot invoke truncation
Restrict write and truncation capabilities on sensitive binaries and configuration files using filesystem permissions and MAC policy
Where feasible, mount partitions containing appraisal-covered files read-only until the patched kernel is deployed

bash

# Verify kernel version and IMA policy status
uname -r
cat /sys/kernel/security/ima/policy 2>/dev/null | head
# Review current IMA measurement log for baseline comparison
wc -l /sys/kernel/security/ima/ascii_runtime_measurements