Is there a patch available for CVE-2026-98885?

Yes, a patch is available for CVE-2026-98885. Update the affected software to the latest version immediately.

Linux CVE-2026-98885

EUVD-2026-108679

2026-10-23 Linux

GHSA-p85h-x79c-c6pv

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ima: return error early if file xattr cannot be changed

During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning.

WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170

Detect the state of the file early and return the error.

Affected VersionsENISA

Linux patch: 6.6.158

Linux 0 <6.6.158

Linux 0 <6.1.189

Linux 0 <6.12.111

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <86acb68ebb220b83def94e7f4c33e24e843970e0

Linux 0 <5.15.222

Linux patch: 6.12.111

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <69fc6474236d9edda6983623e4282f2bdfd8e3d8

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2f29f880e98bf0087215726c45a485afd15b42cf

Linux 0 <5.10.271

Linux 0 <6.18.53

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <dce1b66fcfb40c935f426f602c3a41a7b9f62ba4

Linux patch: 6.18.53

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4d98295357bcacb70874e73117e298a9d7d9b830

Linux patch: 6.1.189

Linux patch: 5.15.222

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8c77312728d07b60fc028f676e42d842df918bcd

Linux patch: 5.10.271

Linux patch: 7.2

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c6988714c0549e06610635c7a71e88635da6db64

Affected Packages

euvd linux fix: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 23, 2026 - 12:16 EUVD

CVE Published

Oct 23, 2026 - 11:37 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.