In the Linux kernel, a flaw in the Integrity Measurement Architecture (IMA) subsystem allows an attacker to bypass integrity verification for files that have been truncated. When a file is truncated, the kernel previously failed to reset the IMA_DONE_MASK flags, so the file continues to be considered measured and trustworthy based on stale data. This means a modified file may still be accessed without re‑measuring or re‑appraising it, effectively compromising the integrity guarantees that IMA provides. The weakness is rooted in improper access control (CWE-222).

All Linux kernel versions that lack the commit adding the file_truncate and path_truncate hooks for IMA. The vulnerability affects every system running an IMA‑enabled kernel where the default configuration does not reset the action cache flags on truncation. Common long‑lived branches such as 6.x and 5.x could be impacted until the patch is deployed.

The CVSS score of 8.1 classifies the flaw as high severity, indicating significant integrity loss. The EPSS score of less than 1% implies a very low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must be able to execute a file truncate operation on a monitored file—most likely requiring local or elevated privileges—to trigger the vulnerability. Once the cached integrity state persists, the attacker can read or execute the altered file with the old trust level. Although no public exploits exist, the risk could increase if a local privilege escalation vector is discovered.