CVE-2026-74399 (GCVE-0-2026-74399)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-08-17 05:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
evm: terminate and bound the evm_xattrs read buffer
evm_read_xattrs() allocates size + 1 bytes, fills them from the list of
enabled xattrs, and then passes strlen(temp) to
simple_read_from_buffer(). When no configured xattrs are enabled, the
fill loop stores nothing and temp[0] remains uninitialized, so strlen()
reads beyond initialized memory.
Explicitly terminate the buffer after allocation, use snprintf() for
each formatted line, and pass the accumulated length, without risk of
truncation, to simple_read_from_buffer().
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fa516b66a1bfce1d72f1620c54bdfebc493000d1 Version: fa516b66a1bfce1d72f1620c54bdfebc493000d1 Version: fa516b66a1bfce1d72f1620c54bdfebc493000d1 Version: fa516b66a1bfce1d72f1620c54bdfebc493000d1 Version: fa516b66a1bfce1d72f1620c54bdfebc493000d1 Version: fa516b66a1bfce1d72f1620c54bdfebc493000d1 Version: fa516b66a1bfce1d72f1620c54bdfebc493000d1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/integrity/evm/evm_secfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8df81954d22a653a8b01d46692cd56f71137269b",
"status": "affected",
"version": "fa516b66a1bfce1d72f1620c54bdfebc493000d1",
"versionType": "git"
},
{
"lessThan": "0b9f8282b40af4a99d6243d2cb939d14ff36b049",
"status": "affected",
"version": "fa516b66a1bfce1d72f1620c54bdfebc493000d1",
"versionType": "git"
},
{
"lessThan": "a36cbfb85f26e6c6fb6529b1a364331b94dc88f3",
"status": "affected",
"version": "fa516b66a1bfce1d72f1620c54bdfebc493000d1",
"versionType": "git"
},
{
"lessThan": "12ad52dc45a0c8c9d25e85b4a84201de4c5420ed",
"status": "affected",
"version": "fa516b66a1bfce1d72f1620c54bdfebc493000d1",
"versionType": "git"
},
{
"lessThan": "a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d",
"status": "affected",
"version": "fa516b66a1bfce1d72f1620c54bdfebc493000d1",
"versionType": "git"
},
{
"lessThan": "38b7d63b23aa9d2ddde7688040e9426d32be4065",
"status": "affected",
"version": "fa516b66a1bfce1d72f1620c54bdfebc493000d1",
"versionType": "git"
},
{
"lessThan": "11143a19f5b8dc8f414deab87571134f9f447313",
"status": "affected",
"version": "fa516b66a1bfce1d72f1620c54bdfebc493000d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/integrity/evm/evm_secfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nevm: terminate and bound the evm_xattrs read buffer\n\nevm_read_xattrs() allocates size + 1 bytes, fills them from the list of\nenabled xattrs, and then passes strlen(temp) to\nsimple_read_from_buffer(). When no configured xattrs are enabled, the\nfill loop stores nothing and temp[0] remains uninitialized, so strlen()\nreads beyond initialized memory.\n\nExplicitly terminate the buffer after allocation, use snprintf() for\neach formatted line, and pass the accumulated length, without risk of\ntruncation, to simple_read_from_buffer()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:18:39.008Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8df81954d22a653a8b01d46692cd56f71137269b"
},
{
"url": "https://git.kernel.org/stable/c/0b9f8282b40af4a99d6243d2cb939d14ff36b049"
},
{
"url": "https://git.kernel.org/stable/c/a36cbfb85f26e6c6fb6529b1a364331b94dc88f3"
},
{
"url": "https://git.kernel.org/stable/c/12ad52dc45a0c8c9d25e85b4a84201de4c5420ed"
},
{
"url": "https://git.kernel.org/stable/c/a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d"
},
{
"url": "https://git.kernel.org/stable/c/38b7d63b23aa9d2ddde7688040e9426d32be4065"
},
{
"url": "https://git.kernel.org/stable/c/11143a19f5b8dc8f414deab87571134f9f447313"
}
],
"title": "evm: terminate and bound the evm_xattrs read buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74399",
"datePublished": "2026-08-15T05:59:10.791Z",
"dateReserved": "2026-08-15T05:44:03.891Z",
"dateUpdated": "2026-08-17T05:18:39.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…