CVE-2026-74592 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ima: Instantiate file_truncate and path_truncate hooks
Instantiate the file_truncate and path_truncate LSM hooks to reset the action cache flags (IMA_DONE_MASK) as soon as truncation is requested, so the file, based on policy, is re-collected, re-measured, re-audited, and re-appraised on next access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The Linux Integrity Measurement Architecture serves as a critical security subsystem within the kernel, responsible for ensuring that files have not been tampered with by measuring their content against known good values stored in the secure boot chain or other trusted sources. A significant operational gap existed regarding how IMA handled file truncation operations, specifically through the vfs_truncate and related path-based truncate calls. When a file was truncated, its size was reduced, potentially discarding data that had previously been measured and appraised by IMA. However, the existing implementation did not adequately reset the internal state flags associated with these files before or during this process. This oversight meant that if an attacker could modify the remaining portion of a truncated file without triggering a full re-evaluation cycle immediately, they might bypass integrity checks because the kernel would still consider the file as having passed its initial appraisal based on stale metadata or cached states.
To address this vulnerability, developers implemented instantiation for both the file_truncate and path_truncate Linux Security Module hooks within the IMA subsystem. These hooks are triggered whenever a truncation operation is requested on a file system object. The core technical fix involves resetting the action cache flags, specifically clearing the IMA_DONE_MASK bitmask associated with the inode or dentry involved in the truncate operation. By explicitly marking these actions as incomplete upon truncation request, the kernel ensures that any subsequent access to the file will force a re-collection of its current state. This mechanism guarantees that the new size and content are measured against the integrity policy before allowing further read operations, thereby maintaining the chain of trust even when files shrink in size.
The operational impact of this flaw was substantial for systems relying on IMA for mandatory access control or compliance auditing. Without proper truncation handling, an adversary could exploit file truncation to evade detection mechanisms designed to catch unauthorized modifications. For instance, if a sensitive configuration file were truncated and then rewritten with malicious content, the system might continue to treat it as valid based on previous measurements that no longer applied due to the size change. This creates a window for privilege escalation or data integrity compromise where security policies are effectively bypassed through simple file manipulation techniques rather than complex exploitation of memory corruption bugs.
Mitigation strategies primarily involve applying kernel updates that include this specific patch series, which ensures proper hook instantiation and state management during truncation events. Administrators should verify their kernel versions against vendor advisories to confirm the presence of these LSM hooks for IMA. Additionally, organizations relying on strict integrity monitoring should audit their file system configurations to ensure that truncate operations are logged and monitored appropriately within their security information and event management systems. Regular patching cycles remain essential as this fix addresses a logical flaw in state tracking rather than a memory safety issue, highlighting the importance of comprehensive code review practices for kernel subsystems involved in security enforcement.
This vulnerability aligns with CWE-20 Improper Input Validation, as the system failed to properly validate and update its internal integrity state when file attributes changed significantly via truncation. It also relates to ATT&CK technique T1564 Hide Execution Artifacts or potentially T1070 Indicator Removal on Host if an attacker used truncation to manipulate logs or measurement databases without triggering alerts. By enforcing re-measurement upon truncation, the fix ensures that integrity checks remain consistent with the actual file state, closing a gap where policy enforcement could be circumvented through size manipulation.