CVE-2026-23241 in Linux
Summary
by MITRE • 03/17/2026
In the Linux kernel, the following vulnerability has been resolved:
audit: add missing syscalls to read class
The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its extended attributes will bypass audit rules such as:
-w /tmp/test -p rwa -k test_rwa
The current patch adds missing syscalls to the audit read class.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
The vulnerability identified as CVE-2026-23241 represents a critical gap in the Linux kernel's auditing framework that undermines the effectiveness of security monitoring controls. This issue affects the audit subsystem's ability to properly track and log specific file system operations, creating a potential blind spot in security monitoring that could be exploited by malicious actors. The flaw specifically impacts how the kernel handles extended attribute operations, which are fundamental components of file system security and integrity verification.
The technical implementation flaw resides in the audit subsystem's classification of system calls within the read class, where the at variants of getxattr() and listxattr() functions are intentionally excluded from proper auditing coverage. These functions, getxattrat() and listxattrat(), serve as enhanced versions of their traditional counterparts by allowing operations on file descriptors or relative paths, providing more granular control over extended attribute access. The missing inclusion of these syscalls means that when security policies are configured using audit rules such as -w /tmp/test -p rwa -k test_rwa, the system fails to properly log these specific extended attribute operations, creating a significant gap in audit coverage.
The operational impact of this vulnerability extends beyond simple logging gaps, as it directly compromises the integrity of security monitoring frameworks that rely on comprehensive audit coverage. When an attacker executes getxattrat() or listxattrat() on targeted files, the system's audit mechanism fails to record these operations, potentially allowing malicious activity to remain undetected while appearing to comply with established security policies. This bypass capability undermines the fundamental principle of least privilege and comprehensive monitoring that security administrators depend upon to detect unauthorized access patterns or privilege escalation attempts. The vulnerability particularly affects environments where extended attribute monitoring is critical for compliance requirements or security hardening measures.
The remediation approach involves patching the kernel audit subsystem to properly include the missing at variants of getxattr() and listxattr() syscalls within the read class, ensuring that all extended attribute operations are properly logged according to existing audit rules. This fix aligns with the broader security principle of comprehensive logging and monitoring, as outlined in various cybersecurity frameworks including the NIST Cybersecurity Framework and ISO 27001 standards. The vulnerability demonstrates the importance of maintaining complete syscall coverage in security monitoring systems, as documented in CWE-778 (Insufficient Logging) and CWE-779 (Logging of Excessive Data) categories, where incomplete audit coverage can lead to significant security gaps. Organizations implementing security monitoring solutions must ensure that their audit configurations account for all relevant system calls, particularly when dealing with file system operations that could provide attackers with valuable information about system state or security configurations.
This vulnerability also highlights the broader ATT&CK framework consideration for T1070.006 (Indicator Removal on Host) and T1562.001 (Disable or Modify Tools), where incomplete audit coverage could mask malicious activities that would otherwise trigger security alerts. The audit subsystem's proper functioning is essential for maintaining the integrity of security monitoring infrastructure, and this flaw represents a failure to maintain comprehensive coverage across all relevant system operations. The fix ensures that all extended attribute read operations, regardless of their specific invocation method, are properly tracked and logged according to established security policies and compliance requirements.