CVE-2026-74671: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74671 Overview

CVE-2026-74671 is an out-of-bounds read vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem. The flaw resides in xattr_verify(), where a type-mixing bug between int and size_t operands causes an integer underflow when validating the length of a truncated security.ima extended attribute. A malicious or corrupt xattr can bypass the digest-length check, causing memcmp() to read past the allocated buffer boundary.

Critical Impact
A truncated security.ima value can trigger an out-of-bounds read of iint->ima_hash->length bytes past the end of a kernel buffer, potentially leaking adjacent kernel memory or causing kernel instability on systems using IMA appraisal.

Affected Products

Linux kernel (upstream) versions containing the vulnerable IMA xattr_verify() implementation
Linux distributions shipping affected stable kernel branches
Systems with IMA appraisal enabled and extended attribute support (CONFIG_IMA_APPRAISAL)

Discovery Timeline

2026-08-22 - CVE-2026-74671 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74671

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] triggered by an integer underflow [CWE-191] in the digest-length validation logic of xattr_verify(). IMA calls this function to compare the digest stored in a file's security.ima extended attribute against a freshly computed hash. When the check is bypassed, memcmp() proceeds to read iint->ima_hash->length bytes starting past the end of the buffer that vfs_getxattr_alloc() allocated to hold the xattr value.

Because IMA operates in kernel context, a successful read can expose adjacent slab memory to the integrity subsystem's decision path and can also destabilize the kernel. Systems using IMA appraisal to gate file execution are the primary exposure surface.

Root Cause

The defective check mixes signed and unsigned types:

if (xattr_len - sizeof(xattr_value->type) - hash_start >= iint->ima_hash->length)

sizeof() returns size_t, so C's usual arithmetic conversions promote the entire left-hand expression to unsigned 64-bit before the subtraction executes. For a 1-byte IMA_XATTR_DIGEST_NG xattr where xattr_len == 1 and hash_start == 1, the arithmetic 1 - 1 - 1 underflows to SIZE_MAX instead of yielding a negative value. SIZE_MAX is trivially greater than or equal to ima_hash->length, so the sanity check passes and the vulnerable memcmp() proceeds.

Upstream code paths do not clamp xattr_len beforehand. ima_get_hash_algo() only special-cases xattr_len < 2 to pick a default algorithm, and evm_verifyxattr() returns INTEGRITY_UNKNOWN rather than failing when no HMAC key is loaded. A truncated security.ima value therefore reaches the length check unfiltered.

Attack Vector

An attacker capable of writing extended attributes to a file, or of presenting a filesystem with a crafted truncated security.ima xattr, can trigger the vulnerable code path when IMA next appraises the file. The fix rewrites the comparison so every operand remains a signed int, preventing implicit promotion to size_t.

No public proof-of-concept or code example is available beyond the upstream kernel commits. Refer to the Linux Kernel Commit 27f3924 for the corrected comparison logic.

Detection Methods for CVE-2026-74671

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing xattr_verify, ima_appraise_measurement, or memcmp in the IMA call chain
Unexpected INTEGRITY_FAIL or INTEGRITY_UNKNOWN audit records tied to files with abnormally short security.ima xattr values
Files whose security.ima extended attribute is one byte in length or otherwise shorter than the declared digest algorithm requires

Detection Strategies

Enable KASAN or KMSAN on test kernels to surface the out-of-bounds read during IMA appraisal of malformed xattrs
Audit filesystems mounted with user-writable xattrs for security.ima values with lengths inconsistent with IMA_XATTR_DIGEST_NG header expectations
Correlate IMA audit subsystem messages (type=INTEGRITY_DATA) with kernel ring buffer entries indicating memory faults

Monitoring Recommendations

Ingest kernel audit logs and dmesg output into a centralized log platform and alert on IMA-related faults
Monitor deployment of new kernel images across the fleet to confirm patched versions replace vulnerable builds
Track EPSS and vendor advisory updates for stable branch backports referencing this CVE

How to Mitigate CVE-2026-74671

Immediate Actions Required

Apply the upstream fix or your distribution's backported kernel update as soon as vendor packages are available
Inventory hosts running IMA appraisal (ima_appraise=enforce or fix) and prioritize them for patching
Restrict the ability of untrusted users and containers to set security.ima extended attributes on shared filesystems

Patch Information

The fix rewrites the digest-length comparison in xattr_verify() so every operand remains a signed int, preventing the size_t promotion that enabled the underflow. Relevant stable-tree commits include Linux Kernel Commit 27f3924, Linux Kernel Commit 5ff232d, Linux Kernel Commit 7e515b6, Linux Kernel Commit a784b47, Linux Kernel Commit b6cb134, Linux Kernel Commit caeb105, Linux Kernel Commit d823b5f, and Linux Kernel Commit dd04114.

Workarounds

If patching is not immediately possible, disable IMA appraisal by removing ima_appraise=enforce and related parameters from the kernel command line where policy allows
Deny untrusted principals the CAP_SYS_ADMIN capability required to set security.* xattrs on filesystems they can write to
Avoid mounting untrusted images or removable media that may contain crafted security.ima values on IMA-enforcing hosts

bash

# Verify running kernel version and IMA policy status
uname -r
cat /sys/kernel/security/ima/policy 2>/dev/null | head
grep -E 'ima_appraise|ima_policy' /proc/cmdline