In the Linux kernel, the following vulnerability has been resolved:

ima: return error early if file xattr cannot be changed

During early boot, the filesystem is read-only and any changes
to xattrs are not allowed. This fails in case of ext4 because
changing xattr starts an ext4 transaction which fails with the
following warning.

WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561
CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]
Call Trace:
__ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
__vfs_setxattr+0x9a/0xd0
__vfs_setxattr_noperm+0x76/0x1f0
ima_appraise_measurement+0x23e/0xe40
ima_d_path+0x5a/0xd0
process_measurement+0xb29/0xc40
? copy_from_kernel_nofault+0x21/0xe0
? fscrypt_file_open+0xc0/0xe0
? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]
? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126
? __bpf_prog_exit+0x23/0xd0
? __bpf_tramp_exit+0xd/0x50
? bpf_trampoline_6442530367+0x9f/0xea
ima_file_check+0x57/0x80
security_file_post_open+0x50/0xf0
path_openat+0x493/0x1650
do_filp_open+0xc7/0x170

Detect the state of the file early and return the error.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 86acb68ebb220b83def94e7f4c33e24e843970e0
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 4d98295357bcacb70874e73117e298a9d7d9b830
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < c6988714c0549e06610635c7a71e88635da6db64
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 8c77312728d07b60fc028f676e42d842df918bcd
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < dce1b66fcfb40c935f426f602c3a41a7b9f62ba4
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 2f29f880e98bf0087215726c45a485afd15b42cf
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 69fc6474236d9edda6983623e4282f2bdfd8e3d8
0 affected < 5.10.271
0 affected < 5.15.222
0 affected < 6.1.189
0 affected < 6.6.158
0 affected < 6.12.111
0 affected < 6.18.53
Linux Linux affected
Version Status Constraints
5.10.271 unaffected ≤ 5.10.*
5.15.222 unaffected ≤ 5.15.*
6.1.189 unaffected ≤ 6.1.*
6.6.158 unaffected ≤ 6.6.*
6.12.111 unaffected ≤ 6.12.*
6.18.53 unaffected ≤ 6.18.*
7.2 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2f29f880e98bf0087215726c45a485afd15b42cf cve-icon cve-icon
https://git.kernel.org/stable/c/4d98295357bcacb70874e73117e298a9d7d9b830 cve-icon cve-icon
https://git.kernel.org/stable/c/69fc6474236d9edda6983623e4282f2bdfd8e3d8 cve-icon cve-icon
https://git.kernel.org/stable/c/86acb68ebb220b83def94e7f4c33e24e843970e0 cve-icon cve-icon
https://git.kernel.org/stable/c/8c77312728d07b60fc028f676e42d842df918bcd cve-icon cve-icon
https://git.kernel.org/stable/c/c6988714c0549e06610635c7a71e88635da6db64 cve-icon cve-icon
https://git.kernel.org/stable/c/dce1b66fcfb40c935f426f602c3a41a7b9f62ba4 cve-icon cve-icon
History

Fri, 23 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux linux
Vendors & Products Linux linux

Fri, 23 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-703

Fri, 23 Oct 2026 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning. WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170 Detect the state of the file early and return the error.
Title ima: return error early if file xattr cannot be changed
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-23T11:37:41.736Z

Reserved: 2026-09-25T10:25:14.378Z

Link: CVE-2026-98885

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T12:18:22.213

Modified: 2026-10-23T12:18:22.213

Link: CVE-2026-98885

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T17:15:06Z

Weaknesses