The Linux kernel flaw allowed file truncation operations to overlook the integrity assessment engine (IMA). When a file was truncated, the IMA action cache flags were not reset, meaning that the file could be accessed again without re‑collecting or re‑measuring its contents. Consequently, changes to critical files might go undetected, undermining the system’s ability to detect tampering or unauthorized modifications. This weakness essentially lets corrupted or malicious changes persist after truncation, preserving an outdated integrity state until the next full audit.

All Linux kernel versions that lacked the commit introducing file_truncate and path_truncate hooks for IMA. The vulnerability is tied to the IMA subsystem in the Linux kernel and would affect any system using IMA‑enabled kernel builds prior to the patch, regardless of distribution, because the affected code resides in the core kernel. The exact kernel release numbers are not listed in the CVE data, so any common or long‑lived kernel branch could have been impacted until the patch was applied.

The vulnerability is mitigated by the kernel patch; no known exploit exists and the EPSS score is not available, so the active exploitation probability cannot be quantified. The CVSS score is not reported, but the impact on integrity suggests a medium‑to‑high severity if unchanged. Attacks would require the ability to trigger a file trim operation to a monitored file, so the attack vector is likely local or includes elevated privileges, but this is inferred from the kernel context and not explicitly stated in the CVE description. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, providing no evidence of active exploitation.