CVE-2026-98885

ima: return error early if file xattr cannot be changed

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 26, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ima: return error early if file xattr cannot be changed

During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning.

WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170

Detect the state of the file early and return the error.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 86acb68ebb220b83def94e7f4c33e24e843970e0Affected 07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 4d98295357bcacb70874e73117e298a9d7d9b830Affected 07f6a79415d7d502ee0c7d02ace6594a7be7429a to before c6988714c0549e06610635c7a71e88635da6db64Affected 07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 8c77312728d07b60fc028f676e42d842df918bcdAffected 07f6a79415d7d502ee0c7d02ace6594a7be7429a to before dce1b66fcfb40c935f426f602c3a41a7b9f62ba4Affected 07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 2f29f880e98bf0087215726c45a485afd15b42cfAffected 07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 69fc6474236d9edda6983623e4282f2bdfd8e3d8Affected
LinuxLinux	3.7Affected before 3.7Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 86acb68ebb220b83def94e7f4c33e24e843970e0Affected
07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 4d98295357bcacb70874e73117e298a9d7d9b830Affected
07f6a79415d7d502ee0c7d02ace6594a7be7429a to before c6988714c0549e06610635c7a71e88635da6db64Affected
07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 8c77312728d07b60fc028f676e42d842df918bcdAffected
07f6a79415d7d502ee0c7d02ace6594a7be7429a to before dce1b66fcfb40c935f426f602c3a41a7b9f62ba4Affected
07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 2f29f880e98bf0087215726c45a485afd15b42cfAffected
07f6a79415d7d502ee0c7d02ace6594a7be7429a to before 69fc6474236d9edda6983623e4282f2bdfd8e3d8Affected

LinuxLinux

3.7Affected
before 3.7Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.