CVE-2025-68740

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ima: Handle error code returned by ima_filter_rule_match()

In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to

the rule being NULL, the function incorrectly skips the 'if (!rc)' check

and sets 'result = true'. The LSM rule is considered a match, causing

extra files to be measured by IMA.

This issue can be reproduced in the following scenario:

After unloading the SELinux policy module via 'semodule -d', if an IMA

measurement is triggered before ima_lsm_rules is updated,

in ima_match_rules(), the first call to ima_filter_rule_match() returns

-ESTALE. This causes the code to enter the 'if (rc == -ESTALE &&

!rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In

ima_lsm_copy_rule(), since the SELinux module has been removed, the rule

becomes NULL, and the second call to ima_filter_rule_match() returns

-ENOENT. This bypasses the 'if (!rc)' check and results in a false match.

Call trace

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References