What’s Vulnerable › Vulnerabilities

CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-15 · updated 2026-08-17

Description

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm_xattrs read buffer evm_read_xattrs() allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlen(temp) to simple_read_from_buffer(). When no configured xattrs are enabled, the fill loop stores nothing and temp[0] remains uninitialized, so strlen() reads beyond initialized memory. Explicitly terminate the buffer after allocation, use snprintf() for each formatted line, and pass the accumulated length, without risk of truncation, to simple_read_from_buffer().

Affected products

• Linux kernel: 4.18 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0b9f8282b40af4a99d6243d2cb939d14ff36b049
• https://git.kernel.org/stable/c/11143a19f5b8dc8f414deab87571134f9f447313
• https://git.kernel.org/stable/c/12ad52dc45a0c8c9d25e85b4a84201de4c5420ed
• https://git.kernel.org/stable/c/38b7d63b23aa9d2ddde7688040e9426d32be4065
• https://git.kernel.org/stable/c/8df81954d22a653a8b01d46692cd56f71137269b
• https://git.kernel.org/stable/c/a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d
• https://git.kernel.org/stable/c/a36cbfb85f26e6c6fb6529b1a364331b94dc88f3

Get alerted when CVE-2026-74399 or the next vulnerability affects your stack