CVE-2026-53038

A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem. When handling unsupported Trusted Platform Module (TPM) hash algorithms, the ima_fs component incorrectly accesses a hash algorithm name array, leading to a read out-of-bounds. This vulnerability could allow a local attacker to cause a system crash, resulting in a denial of service.

This vulnerability is rated as Moderate impact because triggering the condition requires specialized hardware, specifically a Trusted Platform Module (TPM) exposing hash algorithms unsupported by the kernel, limiting the blast radius to a localized denial of service during boot. Systems without a TPM or those operating with standard supported algorithms are unaffected by this out-of-bounds read. Furthermore, earlier enterprise releases including Red Hat Enterprise Linux 8 and 9 do not contain the affected subsystem changes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.