In the Linux kernel, the IMA subsystem attempts to change an extended attribute on a file during the early boot phase when the root filesystem is still read‑only. This initiates an ext4 journal transaction, which fails and emits a warning. The kernel returns an error too late, potentially causing an incorrect boot process or corrupted IMA measurements. The problem is an improper error handling flaw (CWE‑617).

All Linux kernel builds that include the unpatched IMA code are susceptible. The weakness exists in any kernel release prior to the commit that added early‑boot error checking; it affects all distributions until the patch is incorporated.

The CVSS score of 3.3 and an EPSS score of <1% indicate low severity and a low likelihood of exploitation. The flaw requires the system to be in an early‑boot state and involves only the read‑only filesystem, making remote exploitation unlikely. The primary risk is a local denial of service or boot failure due to measurement errors. The vulnerability is not listed in the CISA KEV catalog, suggesting no current weaponized usage.