{"id":"CVE-2026-74592","state":"PUBLISHED","title":"ima: Instantiate file_truncate and path_truncate hooks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nima: Instantiate file_truncate and path_truncate hooks\n\nInstantiate the file_truncate and path_truncate LSM hooks to reset the\naction cache flags (IMA_DONE_MASK) as soon as truncation is requested,\nso the file, based on policy, is re-collected, re-measured, re-audited,\nand re-appraised on next access.","publishedAt":"2026-08-22T15:31:43.419Z","updatedAt":"2026-10-16T19:05:59.525Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"5f46705d96eb60587aa7035acfcbec977e08d620","versionType":"git"},{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"dd21c96a71e876c8df9ec546b885a2c5f47bbb05","versionType":"git"},{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"0baed1fa2184c81e4baf76f445d3faa4b738c8f7","versionType":"git"},{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"b80bed5c871a80151351342c065579405ce77145","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/integrity/ima/ima_main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.30","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/integrity/ima/ima_main.c"]}],"references":["https://git.kernel.org/stable/c/5f46705d96eb60587aa7035acfcbec977e08d620","https://git.kernel.org/stable/c/dd21c96a71e876c8df9ec546b885a2c5f47bbb05","https://git.kernel.org/stable/c/0baed1fa2184c81e4baf76f445d3faa4b738c8f7","https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74592.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74592","state":"PUBLISHED","datePublished":"2026-08-22T15:31:43.419Z","dateUpdated":"2026-10-16T19:05:59.525Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.919Z"},"containers":{"cna":{"title":"ima: Instantiate file_truncate and path_truncate hooks","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nima: Instantiate file_truncate and path_truncate hooks\n\nInstantiate the file_truncate and path_truncate LSM hooks to reset the\naction cache flags (IMA_DONE_MASK) as soon as truncation is requested,\nso the file, based on policy, is re-collected, re-measured, re-audited,\nand re-appraised on next access."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"5f46705d96eb60587aa7035acfcbec977e08d620","versionType":"git"},{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"dd21c96a71e876c8df9ec546b885a2c5f47bbb05","versionType":"git"},{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"0baed1fa2184c81e4baf76f445d3faa4b738c8f7","versionType":"git"},{"version":"3323eec921efd815178a23107ab63588c605c0b2","status":"affected","lessThan":"b80bed5c871a80151351342c065579405ce77145","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/integrity/ima/ima_main.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.30","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/integrity/ima/ima_main.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/5f46705d96eb60587aa7035acfcbec977e08d620"},{"url":"https://git.kernel.org/stable/c/dd21c96a71e876c8df9ec546b885a2c5f47bbb05"},{"url":"https://git.kernel.org/stable/c/0baed1fa2184c81e4baf76f445d3faa4b738c8f7"},{"url":"https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The missing IMA hook is hit from vfs_truncate() via truncate/ftruncate/O_TRUNC syscalls and from ksmbd vfs_truncate on TCP/445; on IMA-enforced servers a remote SMB client with write access can truncate appraised files without clearing IMA_DONE_MASK, the highest-impact reachable path.\nAC:L - Once IMA policy is active, an attacker with write access can deterministically truncate a target file; security_path_truncate/file_truncate always run before do_truncate, so stale IMA_DONE_MASK persists reliably with no races or special memory layout.\nPR:L - Exploitation requires only standard file write permission (MAY_WRITE) on the target inode—via local truncate/ftruncate or an authenticated ksmbd/NFS client with write ACL—not real root or init-namespace capabilities beyond normal write access to the appraised file.\nUI:N - The attacker directly issues truncate/ftruncate or remote SETATTR/truncate operations; no victim must mount media, open a file, or perform any separate action beyond the attacker's own write/truncate request.\nS:U - The flaw defeats IMA measurement/appraisal caching within the same kernel integrity authority; it does not cross VM, hypervisor, IOMMU, or container sandbox boundaries.\nC:H - Stale IMA_APPRAISED flags let process_measurement() skip re-appraisal on exec/open, so attacker-modified truncated content in hash-appraised executables runs with a cached pass and can access any data reachable by that code.\nI:H - Without clearing IMA_DONE_MASK on truncation, modified file content retains cached IMA_MEASURED/IMA_APPRAISED state and bypasses re-measurement, re-audit, and re-appraisal, defeating the core IMA integrity guarantee for affected files.\nA:N - The bug is a stale-cache integrity bypass with no kernel memory corruption, oops, panic, hang, or deadlock; truncation may change individual file availability but does not inherently crash or deny the host kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-25T05:40:20.017Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.12.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.30","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74592","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:01:38.240831Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:05:59.525Z"}}]}}}