CVE-2026-74399

Received Received - Intake

Buffer Overflow in Linux Kernel EVM Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: evm: terminate and bound the evm_xattrs read buffer evm_read_xattrs() allocates size + 1 bytes, fills them from the list of enabled xattrs, and then passes strlen(temp) to simple_read_from_buffer(). When no configured xattrs are enabled, the fill loop stores nothing and temp[0] remains uninitialized, so strlen() reads beyond initialized memory. Explicitly terminate the buffer after allocation, use snprintf() for each formatted line, and pass the accumulated length, without risk of truncation, to simple_read_from_buffer().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74399

EUVD

EUVD-2026-59546

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's EVM (Extended Verification Module) component. It involves a buffer handling issue where evm_read_xattrs() allocates memory but fails to initialize it properly when no xattrs are enabled. This leads to reading uninitialized memory when strlen() is called on the buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's EVM (Extended Verification Module) subsystem. Detection requires checking the kernel version and EVM configuration. Use 'uname -a' to check the kernel version and 'dmesg | grep evm' to look for EVM-related errors or warnings.

Impact Analysis

This vulnerability could allow an attacker to read sensitive data from kernel memory if they can trigger the affected function. It may lead to information disclosure or further exploitation depending on the system configuration and kernel version.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory corruption issue in the Linux kernel's EVM (Extended Verification Module) subsystem. It could potentially lead to information disclosure or privilege escalation, which might indirectly impact compliance if exploited. However, no direct evidence links this specific flaw to compliance violations.

Mitigation Strategies

Apply the latest kernel patch that resolves this issue. Update your Linux kernel to a version that includes the fix for CVE-2026-74399. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-74399. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70