CVE-2025-71306

Description

A flaw was found in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem. This vulnerability involves a stack-out-of-bounds access within the ima_appraise_measurement function during the processing of bprm_creds for execution. An attacker could potentially trigger this flaw by causing an incorrect memory offset calculation. This could lead to information disclosure or a denial of service (DoS) due to memory corruption.

Understanding the Weakness (CWE)

CWE-823

Confidentiality

Technical Impact: Read Memory

If the untrusted pointer is used in a read operation, an attacker might be able to read sensitive portions of memory.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

If the untrusted pointer references a memory location that is not accessible to the program, or points to a location that is "malformed" or larger than expected by a read or write operation, the application may terminate unexpectedly.

Integrity,Confidentiality,Availability

Technical Impact: Execute Unauthorized Code or Commands; Modify Memory

If the untrusted pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.