CVE-2025-68183

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw related to the Integrity Measurement Architecture (IMA). When both IMA and Extended Verification Module (EVM) are in fix mode, the IMA signature can be reset to an IMA hash if a program first stores an IMA signature in security.ima and then writes or removes other security extended attributes for the file. This can occur when setting security.selinux, removing security.evm, or setting/removing Access Control Lists (ACLs). The issue arises because the IMA DIGSIG flag is cleared when setting security.selinux, leading to the generation of an IMA hash instead of the expected signature upon file closure. The flaw can be triggered by setting the security.selinux attribute as the final step, or by removing security.evm or modifying ACLs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.