Skip to main content

Linux Kernel CVE-2026-53038

| EUVDEUVD-2026-38906 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-24 Linux GHSA-h68q-3g2m-9w2f
Buffer Overflow Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Hardware dependency on a TPM chip with an unsupported algorithm bank warrants AC:H over the NVD-assigned AC:L; no confidentiality or integrity impact from the availability-only kernel panic.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.1 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:49 vuln.today
CVSS changed
Jul 14, 2026 - 19:38 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ima_fs: Correctly create securityfs files for unsupported hash algos

ima_tpm_chip->allocated_banks[i].crypto_id is initialized to HASH_ALGO__LAST if the TPM algorithm is not supported. However there are places relying on the algorithm to be valid because it is accessed by hash_algo_name[].

On 6.12.40 I observe the following read out-of-bounds in hash_algo_name: ============== BUG: KASAN: global-out-of-bounds in create_securityfs_measurement_lists+0x396/0x440 Read of size 8 at addr ffffffff83e18138 by task swapper/0/1

CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #3 Call Trace: <TASK> dump_stack_lvl+0x61/0x90 print_report+0xc4/0x580 ? kasan_addr_to_slab+0x26/0x80 ? create_securityfs_measurement_lists+0x396/0x440 kasan_report+0xc2/0x100 ? create_securityfs_measurement_lists+0x396/0x440 create_securityfs_measurement_lists+0x396/0x440 ima_fs_init+0xa3/0x300 ima_init+0x7d/0xd0 init_ima+0x28/0x100 do_one_initcall+0xa6/0x3e0 kernel_init_freeable+0x455/0x740 kernel_init+0x24/0x1d0 ret_from_fork+0x38/0x80 ret_from_fork_asm+0x11/0x20 </TASK>

The buggy address belongs to the variable: hash_algo_name+0xb8/0x420

Memory state around the buggy address: ffffffff83e18000: 00 01 f9 f9 f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9 ffffffff83e18080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff83e18100: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 05 f9 f9 ^ ffffffff83e18180: f9 f9 f9 f9 00 00 00 00 00 00 00 04 f9 f9 f9 f9 ffffffff83e18200: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 ==============

Seems like the TPM chip supports sha3_256, which isn't yet in tpm_algorithms: tpm tpm0: TPM with unsupported bank algorithm 0x0027

That's TPM_ALG_SHA3_256 == 0x0027 from "Trusted Platform Module 2.0 Library Part 2: Structures", page 51 [1]. See also the related U-Boot algorithms update [2].

Thus solve the problem by creating a file name with "_tpm_alg_<ID>" postfix if the crypto algorithm isn't initialized.

This is how it looks on the test machine (patch ported to v6.12 release):

ls -1 /sys/kernel/security/ima/

ascii_runtime_measurements ascii_runtime_measurements_tpm_alg_27 ascii_runtime_measurements_sha1 ascii_runtime_measurements_sha256 binary_runtime_measurements binary_runtime_measurements_tpm_alg_27 binary_runtime_measurements_sha1 binary_runtime_measurements_sha256 policy runtime_measurements_count violations

[1]: https://trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-2.0-Library-Part-2-Version-184_pub.pdf [2]: https://lists.denx.de/pipermail/u-boot/2024-July/558835.html

AnalysisAI

Out-of-bounds read in the Linux kernel's IMA (Integrity Measurement Architecture) filesystem subsystem causes a kernel panic during boot on systems with TPM chips advertising hash algorithms unsupported by the kernel. Specifically, when ima_tpm_chip->allocated_banks[i].crypto_id is set to the sentinel HASH_ALGO__LAST for an unmapped TPM algorithm (demonstrated with TPM_ALG_SHA3_256 = 0x0027), the create_securityfs_measurement_lists function dereferences the out-of-range index into hash_algo_name[], triggering a KASAN-detected global-out-of-bounds read and kernel crash. No public exploit has been identified and EPSS is 0.17% (6th percentile), making deliberate exploitation unlikely; the primary risk is inadvertent boot-time denial of service on hardware with qualifying TPM chips.

Technical ContextAI

The vulnerability resides in the Linux kernel's ima_fs.c, specifically the create_securityfs_measurement_lists function within the IMA subsystem. During kernel initialization (ima_fs_init → ima_init → init_ima), IMA iterates over TPM PCR banks to create securityfs measurement list entries under /sys/kernel/security/ima/. For each bank, it reads allocated_banks[i].crypto_id to look up the algorithm name in the global hash_algo_name[] array. When a TPM 2.0 chip reports an algorithm with no corresponding Linux crypto mapping, the kernel sets crypto_id to HASH_ALGO__LAST - a sentinel value beyond the array's valid bounds. The missing bounds check before indexing hash_algo_name[crypto_id] triggers CWE-125 (Out-of-bounds Read) at a global memory address (confirmed KASAN report: read of 8 bytes at ffffffff83e18138). The specific triggering algorithm, TPM_ALG_SHA3_256 (0x0027), is defined in TCG TPM 2.0 Library Part 2: Structures (page 51) but is absent from the kernel's tpm_algorithms mapping at the time of the bug. The fix creates securityfs files with a _tpm_alg_<ID> suffix for unmapped algorithms instead of attempting a hash_algo_name lookup.

RemediationAI

Upgrade to a patched kernel release: Linux 6.12.91 or later for the 6.12 stable series, Linux 6.18.33 or later for the 6.18 series, Linux 7.0.10 or later for the 7.0 series, or Linux 7.1 for the 7.1 series. Patch commits are available directly at git.kernel.org/stable (see references). Ubuntu users should apply USN-8568-1 or USN-8566-1 via standard package management. As a compensating control where immediate kernel upgrade is not feasible, IMA can be disabled at boot by appending ima=off to the kernel command line in GRUB or the bootloader configuration; this eliminates the vulnerable code path entirely but removes runtime integrity measurement, which may conflict with compliance requirements or Secure Boot attestation policies. Systems can be assessed for vulnerability without rebooting by inspecting dmesg | grep 'unsupported bank algorithm' - absence of this message indicates the trigger condition is not present on current hardware.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53038 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy