Not yet scoredPublished Oct 23, 2026

CVE-2026-98885ima: return error early if file xattr cannot be changed

Updated under an hour ago (Oct 27, 2026, 11:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning. WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170 Detect the state of the file early and return the error.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 26, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 07f6a79415d7d502ee0c7d02ace6594a7be7429a before 86acb68ebb220b83def94e7f4c33e24e843970e0; 07f6a79415d7d502ee0c7d02ace6594a7be7429a builds before 4d98295357bcacb70874e73117e298a9d7d9b830; from 07f6a79415d7d502ee0c7d02ace6594a7be7429a before c6988714c0549e06610635c7a71e88635da6db64; from 07f6a79415d7d502ee0c7d02ace6594a7be7429a before 8c77312728d07b60fc028f676e42d842df918bcd; from 07f6a79415d7d502ee0c7d02ace6594a7be7429a before dce1b66fcfb40c935f426f602c3a41a7b9f62ba4; 07f6a79415d7d502ee0c7d02ace6594a7be7429a builds before 2f29f880e98bf0087215726c45a485afd15b42cf; from 07f6a79415d7d502ee0c7d02ace6594a7be7429a before 69fc6474236d9edda6983623e4282f2bdfd8e3d8	CNA record

References

References

https://git.kernel.org/stable/c/86acb68ebb220b83def94e7f4c33e24e843970e0
https://git.kernel.org/stable/c/4d98295357bcacb70874e73117e298a9d7d9b830
https://git.kernel.org/stable/c/c6988714c0549e06610635c7a71e88635da6db64
https://git.kernel.org/stable/c/8c77312728d07b60fc028f676e42d842df918bcd
https://git.kernel.org/stable/c/dce1b66fcfb40c935f426f602c3a41a7b9f62ba4
https://git.kernel.org/stable/c/2f29f880e98bf0087215726c45a485afd15b42cf
https://git.kernel.org/stable/c/69fc6474236d9edda6983623e4282f2bdfd8e3d8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.