CVE-2025-68183 in Linux
Summary
by MITRE • 12/16/2025
In the Linux kernel, the following vulnerability has been resolved:
ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr
Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file.
For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated,
# getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404...
This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed.
Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL.
Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset.
Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL,
#include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdlib.h>
int main() {
const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd;
fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) {
perror("Error opening file"); return 1; }
ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) {
sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]);
}
if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) {
perror("Error setting extended attribute"); close(fd); return 1; }
const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) {
perror("Error setting extended attribute"); close(fd); return 1; }
close(fd);
return 0; }
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability identified as CVE-2025-68183 resides within the Linux kernel's Integrity Measurement Architecture implementation, specifically affecting how the IMA subsystem handles extended attributes when both IMA and EVM (Extended Verification Module) are operating in fix mode. This flaw stems from an improper handling of the IMA_DIGSIG flag during extended attribute operations, leading to the unintended clearing of IMA signatures when non-IMA extended attributes are modified or removed. The technical root cause involves the kernel's failure to preserve the integrity of IMA signatures when other security extended attributes undergo changes, creating a scenario where legitimate IMA signatures are replaced with computed IMA hashes.
The vulnerability manifests when a file undergoes extended attribute modifications that should not affect IMA signatures. During normal operation, when a program first stores an IMA signature in the security.ima extended attribute and subsequently modifies or removes other security extended attributes such as security.selinux, security.evm, or ACLs, the IMA_DIGSIG flag gets cleared. This clearing action forces the kernel to generate a new IMA hash instead of preserving the original signature, effectively undermining the security assurances provided by IMA appraisal mechanisms. The issue is particularly pronounced in environments configured with ima_appraise=fix evm=fix ima_policy=appraise_tcb parameters, where the expected behavior of maintaining IMA signatures during file operations is violated.
The operational impact of this vulnerability extends beyond simple signature replacement, fundamentally compromising the integrity verification capabilities of the IMA subsystem. When package managers like rpm-plugin-ima attempt to install or reinstall packages, the integrity measurements fail to maintain their original signatures, resulting in the generation of new hashes that may not accurately reflect the file's authentic state. This behavior creates a false sense of security while simultaneously weakening the overall security posture by allowing potentially malicious modifications to go undetected. The vulnerability affects system administrators and security personnel who rely on IMA signatures for detecting unauthorized file modifications, as the signatures become unreliable indicators of file integrity. The issue is particularly concerning in environments where strict security policies are enforced, as it undermines the very foundation of integrity measurement that IMA is designed to provide.
The mitigation strategy involves modifying the kernel's IMA implementation to prevent the clearing of the IMA_DIGSIG flag during non-IMA extended attribute operations. This approach aligns with the principle of least privilege and integrity preservation, ensuring that IMA signatures remain intact regardless of modifications to other extended attributes. The fix specifically targets the IMA subsystem's extended attribute handling logic to maintain the IMA_DIGSIG flag's state, thereby preserving the original signature while allowing other security attributes to be modified. This solution addresses the core issue without disrupting the normal operation of other security subsystems. The vulnerability's classification aligns with CWE-254 as it represents a weakness in the security model where the system fails to maintain the integrity of security-relevant data. From an ATT&CK perspective, this vulnerability maps to T1566.001 (Phishing: Spearphishing Attachment) and T1550.002 (Use of Valid Credentials: Passwords) as it enables attackers to potentially bypass integrity checks and modify files without detection. The fix ensures that the kernel's IMA implementation properly separates the concerns of signature validation from extended attribute management, preventing the unintended replacement of IMA signatures with hashes. This remediation approach maintains backward compatibility while strengthening the security guarantees provided by the IMA subsystem. The vulnerability demonstrates a critical flaw in the kernel's security model where the interaction between multiple security subsystems creates unexpected behavior, highlighting the importance of proper state management in security-critical code paths. The impact extends to all systems running Linux kernels with IMA and EVM in fix mode, making this vulnerability particularly significant for enterprise security environments where file integrity monitoring is critical for compliance and threat detection.