GHSA-P85H-X79C-C6PV
Vulnerability from github – Published: 2026-10-23 12:31 – Updated: 2026-10-23 12:31In the Linux kernel, the following vulnerability has been resolved:
ima: return error early if file xattr cannot be changed
During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which fails with the following warning.
WARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561 CPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4] Call Trace: __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] __vfs_setxattr+0x9a/0xd0 __vfs_setxattr_noperm+0x76/0x1f0 ima_appraise_measurement+0x23e/0xe40 ima_d_path+0x5a/0xd0 process_measurement+0xb29/0xc40 ? copy_from_kernel_nofault+0x21/0xe0 ? fscrypt_file_open+0xc0/0xe0 ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1] ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126 ? __bpf_prog_exit+0x23/0xd0 ? __bpf_tramp_exit+0xd/0x50 ? bpf_trampoline_6442530367+0x9f/0xea ima_file_check+0x57/0x80 security_file_post_open+0x50/0xf0 path_openat+0x493/0x1650 do_filp_open+0xc7/0x170
Detect the state of the file early and return the error.
{
"affected": [],
"aliases": [
"CVE-2026-98885"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-23T12:18:22Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: return error early if file xattr cannot be changed\n\nDuring early boot, the filesystem is read-only and any changes\nto xattrs are not allowed. This fails in case of ext4 because\nchanging xattr starts an ext4 transaction which fails with the\nfollowing warning.\n\nWARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561\nCPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed c2dfc3c9d9f6f1233251c5d4410574fe82a348ee\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\nRIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]\nCall Trace:\n __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n __vfs_setxattr+0x9a/0xd0\n __vfs_setxattr_noperm+0x76/0x1f0\n ima_appraise_measurement+0x23e/0xe40\n ima_d_path+0x5a/0xd0\n process_measurement+0xb29/0xc40\n ? copy_from_kernel_nofault+0x21/0xe0\n ? fscrypt_file_open+0xc0/0xe0\n ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126\n ? __bpf_prog_exit+0x23/0xd0\n ? __bpf_tramp_exit+0xd/0x50\n ? bpf_trampoline_6442530367+0x9f/0xea\n ima_file_check+0x57/0x80\n security_file_post_open+0x50/0xf0\n path_openat+0x493/0x1650\n do_filp_open+0xc7/0x170\n\nDetect the state of the file early and return the error.",
"id": "GHSA-p85h-x79c-c6pv",
"modified": "2026-10-23T12:31:36Z",
"published": "2026-10-23T12:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98885"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f29f880e98bf0087215726c45a485afd15b42cf"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4d98295357bcacb70874e73117e298a9d7d9b830"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/69fc6474236d9edda6983623e4282f2bdfd8e3d8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/86acb68ebb220b83def94e7f4c33e24e843970e0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c77312728d07b60fc028f676e42d842df918bcd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c6988714c0549e06610635c7a71e88635da6db64"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dce1b66fcfb40c935f426f602c3a41a7b9f62ba4"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.