Skip to main content

Linux Kernel CVE-2025-68183

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Boot host with IMA+EVM fix mode
  2. Delivery
    Write IMA signature to security.ima
  3. Exploit
    Set non-IMA xattr (security.selinux)
  4. Execution
    IMA_DIGSIG flag cleared on close
  5. Impact
    Signature replaced by IMA hash

Vulnerability Assessment

Exploitation Conditions

Requires the kernel to be running with IMA appraisal AND EVM both in fix mode with an appraisal policy loaded (as in booting 'ima_appraise=fix evm=fix ima_policy=appraise_tcb') - this is a transient provisioning/labeling configuration, not a typical enforced production state. The trigger is local: a process must have privilege to write security.ima and then set or remove another security xattr (security.selinux, security.evm) or modify an ACL on the same file before it is closed. Limiting factors: no network vector, no default-configuration exposure (fix mode must be explicitly enabled), setting security.* xattrs generally requires CAP_SYS_ADMIN/appropriate privilege, and the outcome is a downgraded integrity attribute rather than code execution or data disclosure.
Impact

The kernel CNA's auto-assigned CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) substantially overstates real-world risk and does not match the described behavior: there is no confidentiality or availability impact, exploitation is not low-complexity, and it is gated on a specific transient configuration (both IMA and EVM in fix mode, an appraisal policy loaded). The 'Information Disclosure' tag also appears mislabeled - this is an integrity/attestation-weakening issue, not disclosure. Supporting signals agree the risk is modest: EPSS 0.17% (7th percentile), no KEV, no evidence of active exploitation. The practical consequence is that a system-management tool (e.g. rpm-plugin-ima on Fedora) fails to lay down good reference signatures during package install, so files that should be signed end up only hashed - a downgrade of the integrity baseline rather than a directly attacker-triggerable compromise. Net priority: low, and materially lower than the raw 7.8 suggests; verify severity against the specific IMA/EVM deployment mode before prioritizing.
Exploit ScenarioDerived

On a system provisioned with IMA appraisal and EVM in fix mode, an administrator or packaging tool writes a valid IMA signature to security.ima on a binary, then (as normal SELinux labeling does) sets security.selinux on the same file; the IMA_DIGSIG flag is cleared and on close the kernel writes back an IMA hash, silently replacing the intended signature. The provided C reproducer demonstrates exactly this sequence, leaving the file with a weaker integrity attribute; there is no remote or unauthenticated path and no public weaponized exploit beyond this functional reproducer.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Integrity protection weakening in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem allows a stored IMA file signature to be silently downgraded to a plain IMA hash. When IMA and EVM run in fix mode (e.g. booting with 'ima_appraise=fix evm=fix ima_policy=appraise_tcb'), the kernel incorrectly clears the IMA_DIGSIG flag whenever a non-IMA security xattr (such as security.selinux or security.evm) or an ACL is set or removed after security.ima was written, so on file close a hash is generated instead of preserving the intended signature. A full C reproducer is embedded in the report, but there is no CISA KEV listing and no public weaponized exploit identified at time of analysis; EPSS is 0.17% (7th percentile).

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that includes the referenced stable commits (git.kernel.org/stable/c/02aa671c08a4834bef5166743a7b88686fbfa023 and the companion backports 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd, d2993a7e98eb70c737c6f5365a190e79c72b8407, edd824eb45e4f7e05ad3ab090dab6dbdb79cd292), which stop IMA from resetting the IMA_DIGSIG flag when non-IMA xattrs or ACLs change. As a workaround until patched, avoid running both IMA and EVM in fix mode simultaneously during signing/labeling and instead generate IMA signatures in a controlled step, setting security.ima last so that no subsequent security.selinux/security.evm/ACL write triggers the downgrade - trade-off is added operational complexity in package/provisioning tooling. After any affected install or relabel, audit files with 'getfattr -m - -d -e hex' and re-sign any whose security.ima begins with a hash marker (0x0404...) rather than a signature (0x0302...); this is a detection/remediation control, not a preventive one.

Affected ProductsAI

The vulnerability is in the mainline Linux kernel IMA subsystem; no exact affected version range or CPE was supplied in the intelligence. Fixes are present as stable-tree commits referenced by NVD (git.kernel.org commits 02aa671c08a4834bef5166743a7b88686fbfa023, 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd, d2993a7e98eb70c737c6f5365a190e79c72b8407, and edd824eb45e4f7e05ad3ab090dab6dbdb79cd292), indicating backports to multiple stable branches; the exact pre-fix version boundaries are not independently confirmed from the provided data. Only kernels built with IMA appraisal and EVM support, and only systems actually running in fix mode with an appraise policy, exhibit the faulty behavior. The reproducer targets a Fedora configuration using rpm-plugin-ima, but the flaw is generic to any distribution enabling the same IMA/EVM fix-mode setup.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Linux kernel's IMA appraisal code, which works alongside EVM (Extended Verification Module) to protect file integrity via extended attributes (security.ima holds the IMA hash or signature, security.evm binds the security xattr set). Each inode's integrity state carries an IMA_DIGSIG flag indicating that security.ima contains a real digital signature rather than a hash. The bug is a state-management/protection-mechanism failure: on any setxattr/removexattr of a non-IMA security attribute or ACL, IMA reset IMA_DIGSIG, so the subsequent close-time evaluation treated the file as unsigned and generated a hash. No CWE was assigned by the CNA; functionally this is closest to a protection-mechanism failure (CWE-693) / improper clearing of security-relevant state (CWE-460). No CPE strings were provided in the intelligence; affected code is upstream mainline and stable kernel trees.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 1.9 LOW

Local only (AV:L), gated on a specific IMA/EVM fix-mode config and xattr-write privilege (AC:H, PR:H), no confidentiality or availability impact, only a low integrity-baseline weakening (I:L).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 7.1 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file.

For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated,

getfattr -m - -d -e hex /usr/bin/bash

file: usr/bin/bash

security.ima=0x0404...

This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed.

Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL.

Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset.

Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL,

#include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdlib.h>

int main() { const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd;

fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror("Error opening file"); return 1; }

ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); }

if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; }

const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; }

close(fd);

return 0; }

Executive ViewAI

Why It Matters

Linux kernel's Integrity Measurement Architecture (IMA) contains a flaw that silently downgrades file security signatures to weaker hashes when file attributes are changed. Systems relying on IMA to verify file integrity in compliance and audit workflows are affected. Unauthorized file modifications could occur without detection, undermining the core integrity guarantees these systems depend on.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable IMA fix mode on systems where operationally feasible; (2) Deploy independent file integrity monitoring (AIDE or Tripwire) to provide compensating integrity verification; (3) Enforce strict permissions on security.ima, security.selinux, and security.evm xattrs via SELinux policy; (4) Enable comprehensive audit logging of file xattr and ACL changes through auditd rules and SIEM alerting.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel runs everywhere, though IMA+EVM fix-mode config is rarely enabled
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:21556 ADVISORY https://access.redhat.com/errata/RHSA-2026:21557 ADVISORY https://access.redhat.com/errata/RHSA-2026:21706 ADVISORY https://access.redhat.com/errata/RHSA-2026:21745 ADVISORY https://access.redhat.com/errata/RHSA-2026:35904 ADVISORY https://access.redhat.com/errata/RHSA-2026:36073 ADVISORY https://access.redhat.com/errata/RHSA-2026:36767 ADVISORY https://access.redhat.com/errata/RHSA-2026:38902 ADVISORY https://access.redhat.com/errata/RHSA-2026:39371 ADVISORY https://access.redhat.com/errata/RHSA-2026:40068 ADVISORY https://access.redhat.com/errata/RHSA-2026:40760 ADVISORY https://access.redhat.com/errata/RHSA-2026:47633 ADVISORY https://vuldb.com/vuln/336765 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0278/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0281/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0293/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0411/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0474/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0496/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0617/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20207/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20220/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20228/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20564/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/02aa671c08a4834bef5166743a7b88686fbfa023 REF https://git.kernel.org/stable/c/7d9ae9d4d45b28c18ca06ae047aabe09d9639643 REF https://git.kernel.org/stable/c/88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd REF https://git.kernel.org/stable/c/d2993a7e98eb70c737c6f5365a190e79c72b8407 REF https://git.kernel.org/stable/c/edd824eb45e4f7e05ad3ab090dab6dbdb79cd292

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy