CVE-2026-74671

A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem. The xattr_verify() function, which verifies extended attributes, incorrectly mixes int and size_t data types in its digest-length check. This can lead to an integer underflow when processing a truncated extended attribute, bypassing a bounds check. As a result, a memory comparison operation reads beyond the allocated buffer, causing an out-of-bounds read that could lead to information disclosure or system instability.

An out-of-bounds read in IMA xattr_verify can occur because a digest length check mixes signed int values with size_t from sizeof. A truncated security.ima xattr can make the subtraction underflow to a large unsigned value, bypassing the bounds check and letting memcmp read past the buffer returned by vfs_getxattr_alloc. For the CVSS the PR:L is used for the paranoid score because a local low privileged actor may be able to trigger appraisal of a crafted file if malformed security.ima metadata is already present or can be introduced through a delegated restore, image import, removable media, or writable trusted path. Typical creation of security.ima still requires administrative control, so the base score uses PR:H. The issue is not directly network reachable. Impact is at least a local denial of service risk and in worst case may allow limited confidentiality or integrity impact due to an OOB read in integrity appraisal logic.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.