Look up another CVE · open CVE-2026-74592 in the interactive tracker
CVE-2026-74592
ima: Instantiate file_truncate and path_truncate hooks
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem security/integrity. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74592 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
security/integrity/ima/ima_main.c
- What this is
- INTEGRITY MEASUREMENT ARCHITECTURE (IMA)MAINTAINERS section matched on security/integrity/ima/ · linux-integrity@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_IMA|CONFIG_INTEGRITY' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switches
- CONFIG_IMA, CONFIG_INTEGRITY
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.34%, higher than 26.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- security/integrity
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.30 | 6.12.104 | 5f46705d96eb |
| 2.6.30 | 6.18.45 | dd21c96a71e8 |
| 2.6.30 | 7.1.9 | 0baed1fa2184 |
| 2.6.30 | 7.2 | b80bed5c871a |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The missing IMA hook is hit from vfs_truncate() via truncate/ftruncate/O_TRUNC syscalls and from ksmbd vfs_truncate on TCP/445; on IMA-enforced servers a remote SMB client with write access can truncate appraised files without clearing IMA_DONE_MASK, the highest-impact reachable path.
- AC:LAttack complexity, low
- Once IMA policy is active, an attacker with write access can deterministically truncate a target file; security_path_truncate/file_truncate always run before do_truncate, so stale IMA_DONE_MASK persists reliably with no races or special memory layout.
- PR:LPrivileges required, low
- Exploitation requires only standard file write permission (MAY_WRITE) on the target inode—via local truncate/ftruncate or an authenticated ksmbd/NFS client with write ACL—not real root or init-namespace capabilities beyond normal write access to the appraised file.
- UI:NUser interaction, none
- The attacker directly issues truncate/ftruncate or remote SETATTR/truncate operations; no victim must mount media, open a file, or perform any separate action beyond the attacker's own write/truncate request.
- S:UScope, unchanged
- The flaw defeats IMA measurement/appraisal caching within the same kernel integrity authority; it does not cross VM, hypervisor, IOMMU, or container sandbox boundaries.
- C:HConfidentiality impact, high
- Stale IMA_APPRAISED flags let process_measurement() skip re-appraisal on exec/open, so attacker-modified truncated content in hash-appraised executables runs with a cached pass and can access any data reachable by that code.
- I:HIntegrity impact, high
- Without clearing IMA_DONE_MASK on truncation, modified file content retains cached IMA_MEASURED/IMA_APPRAISED state and bypasses re-measurement, re-audit, and re-appraisal, defeating the core IMA integrity guarantee for affected files.
- A:NAvailability impact, none
- The bug is a stale-cache integrity bypass with no kernel memory corruption, oops, panic, hang, or deadlock; truncation may change individual file availability but does not inherently crash or deny the host kernel.