A missing audit classification for the at‑variants of getxattr() and listxattr() in the Linux kernel allows those syscalls to execute without creating audit records. This omission lets a process read extended file attributes using getxattrat() or listxattrat() while remaining invisible to the kernel’s audit logging, thereby enabling covert information gathering or other malicious actions.

All installations of the Linux kernel that have not incorporated the patch adding getxattrat() and listxattrat() to the audit read class. The information does not specify kernel versions, so any release prior to the application of the cited patch is considered potentially affected.

The CVSS score of 5.5 denotes a moderate severity, and the EPSS score of <1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires local or privileged execution to invoke the affected syscalls; the audit bypass then reduces detection capability across the system.