CVE-2026-98885
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning. WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170 Detect the state of the file early and return the error.
View original CVE JSON
{
"id": "CVE-2026-98885",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-23T12:18:22.213",
"lastModified": "2026-10-26T07:17:13.470",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: return error early if file xattr cannot be changed\n\nDuring early boot, the filesystem is read-only and any changes\nto xattrs are not allowed. This fails in case of ext4 because\nchanging xattr starts an ext4 transaction which fails with the\nfollowing warning.\n\nWARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561\nCPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\nRIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]\nCall Trace:\n __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n __vfs_setxattr+0x9a/0xd0\n __vfs_setxattr_noperm+0x76/0x1f0\n ima_appraise_measurement+0x23e/0xe40\n ima_d_path+0x5a/0xd0\n process_measurement+0xb29/0xc40\n ? copy_from_kernel_nofault+0x21/0xe0\n ? fscrypt_file_open+0xc0/0xe0\n ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126\n ? __bpf_prog_exit+0x23/0xd0\n ? __bpf_tramp_exit+0xd/0x50\n ? bpf_trampoline_6442530367+0x9f/0xea\n ima_file_check+0x57/0x80\n security_file_post_open+0x50/0xf0\n path_openat+0x493/0x1650\n do_filp_open+0xc7/0x170\n\nDetect the state of the file early and return the error."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"security/integrity/ima/ima_appraise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "07f6a79415d7d502ee0c7d02ace6594a7be7429a",
"lessThan": "86acb68ebb220b83def94e7f4c33e24e843970e0",
"versionType": "git",
"status": "affected"
},
{
"version": "07f6a79415d7d502ee0c7d02ace6594a7be7429a",
"lessThan": "4d98295357bcacb70874e73117e298a9d7d9b830",
"versionType": "git",
"status": "affected"
},
{
"version": "07f6a79415d7d502ee0c7d02ace6594a7be7429a",
"lessThan": "c6988714c0549e06610635c7a71e88635da6db64",
"versionType": "git",
"status": "affected"
},
{
"version": "07f6a79415d7d502ee0c7d02ace6594a7be7429a",
"lessThan": "8c77312728d07b60fc028f676e42d842df918bcd",
"versionType": "git",
"status": "affected"
},
{
"version": "07f6a79415d7d502ee0c7d02ace6594a7be7429a",
"lessThan": "dce1b66fcfb40c935f426f602c3a41a7b9f62ba4",
"versionType": "git",
"status": "affected"
},
{
"version": "07f6a79415d7d502ee0c7d02ace6594a7be7429a",
"lessThan": "2f29f880e98bf0087215726c45a485afd15b42cf",
"versionType": "git",
"status": "affected"
},
{
"version": "07f6a79415d7d502ee0c7d02ace6594a7be7429a",
"lessThan": "69fc6474236d9edda6983623e4282f2bdfd8e3d8",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"security/integrity/ima/ima_appraise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "3.7",
"status": "affected"
},
{
"version": "0",
"lessThan": "3.7",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.271",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f29f880e98bf0087215726c45a485afd15b42cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4d98295357bcacb70874e73117e298a9d7d9b830",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/69fc6474236d9edda6983623e4282f2bdfd8e3d8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/86acb68ebb220b83def94e7f4c33e24e843970e0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8c77312728d07b60fc028f676e42d842df918bcd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c6988714c0549e06610635c7a71e88635da6db64",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dce1b66fcfb40c935f426f602c3a41a7b9f62ba4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}