In the Linux kernel, the IMA subsystem attempted to change an extended attribute on a file during the very early boot phase when the root filesystem is still read‑only. Because ext4 begins a journal transaction when setting an xattr, the transaction failed, generating a warning from ext4_journal_check_start. The bug caused the kernel to return an error too late, potentially leading to a boot failure or erroneous IMA measurements. This issue is a flaw in the kernel’s error‑handling path for filesystem attributes.

The vulnerability affects all Linux kernel builds that include the unpatched IMA logic, regardless of distribution vendor. The patch is applied in kernel releases newer than 6.19.12 in openSUSE Tumbleweed and similar by other vendors once they incorporate the fix. No specific product version list is provided, so any kernel that predates the commit should be considered susceptible.

There is no known CVSS or EPSS scoring, and the vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in the wild. Because the defect requires the system to be in an early boot state and interacts only with the read‑only filesystem, remote exploitation is implausible. The primary risk is local denial of service by preventing successful boot or compromising IMA integrity, so the urgency is moderate for systems that depend on secure boot measurements.