CVE-2026-74399

A flaw was found in the Linux kernel's Extended Verification Module (EVM). The evm_read_xattrs() function, when processing extended attributes, fails to properly initialize a buffer. This can lead to an out-of-bounds read when no extended attributes are configured, potentially allowing an attacker to cause a denial of service (DoS) or disclose sensitive information.

A moderate out-of-bounds read flaw was found in the Linux kernel's Extended Verification Module (EVM). The evm_read_xattrs() function, which serves the list of enabled EVM extended attributes through securityfs, allocates a buffer without initializing it and passes strlen() of that buffer to simple_read_from_buffer(). When no EVM extended attributes are configured, the fill loop stores nothing and the buffer remains uninitialized, so strlen() reads beyond initialized memory; a local user able to read the EVM securityfs xattrs file could use this to disclose kernel memory contents or cause a denial of service. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); exploitation requires local access. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are affected. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present in those releases. Fixes for the affected streams are currently deferred; the residual risk until a fix is delivered is limited because triggering the flaw requires local access to the EVM securityfs interface and the primary impact is availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.