The Linux kernel Integrity Measurement Architecture contains a flaw in xattr_verify() where an integer subtraction involving a size_t can underflow, letting an attacker craft a truncated xattr that bypasses the length check. The subsequent memcmp then reads beyond the allocated buffer, exposing kernel memory contents. An attacker who can write or manipulate IMA xattrs could gain sensitive data or cause a crash. The weakness is an out‑of‑bounds read (CWE‑125).

All Linux kernel builds before the patch commit are affected. The advisory lists commit references from the kernel git history; any distribution kernel that contains the IMA code without these commits can be vulnerable. Because the fix is in the mainline kernel, any system running an unpatched kernel from the affected range is at risk. Specific vendor or distribution details are not enumerated, but the kernel version span matches any upstream build prior to the commit. No specific affected version information is available.

The vulnerability is not in the CISA KEV catalog. The EPSS score indicates a very low exploitation probability (<1%). No public exploits are known, but the flaw allows a local attacker who can create or modify IMA xattrs to read kernel memory or crash the system. The CVSS score is 5.5, indicating a moderate severity. The potential to read sensitive kernel data classifies the impact as moderate for privileged users until the kernel is patched. Attackers would need local privileged access to write the relevant xattrs. The attack vector is not explicitly stated in the CVE description; it is inferred that local privileged access is required.