CVE-2026-53038

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ima_fs: Correctly create securityfs files for unsupported hash algos

ima_tpm_chip->allocated_banks[i].crypto_id is initialized to

HASH_ALGO__LAST if the TPM algorithm is not supported. However there

are places relying on the algorithm to be valid because it is accessed

by hash_algo_name[].

On 6.12.40 I observe the following read out-of-bounds in hash_algo_name:

==================================================================

BUG: KASAN: global-out-of-bounds in create_securityfs_measurement_lists+0x396/0x440

Read of size 8 at addr ffffffff83e18138 by task swapper/0/1

CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #3

Call Trace:

<TASK>

dump_stack_lvl+0x61/0x90

print_report+0xc4/0x580

? kasan_addr_to_slab+0x26/0x80

? create_securityfs_measurement_lists+0x396/0x440

kasan_report+0xc2/0x100

? create_securityfs_measurement_lists+0x396/0x440

create_securityfs_measurement_lists+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References