CVE-2026-23241

In the Linux kernel, the following vulnerability has been resolved:

audit: add missing syscalls to read class

The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its extended attributes will bypass audit rules such as:

-w /tmp/test -p rwa -k test_rwa

The current patch adds missing syscalls to the audit read class.

Audit rules for the read class could be bypassed because getxattrat and listxattrat were not included in the audit read syscall set. A local process can read extended attributes using the at variants and avoid triggering audit watches such as file path rules configured for reads. Impact is limited to the situations where could be reduced security monitoring and potential evasion of audit based detection and compliance controls.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.