{"id":"CVE-2026-98885","kind":"vulnerability","aliases":["CVE-2026-98885"],"related":[],"title":"Linux kernel: IMA appraisal warns and fails on read-only ext4 at boot","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nima: return error early if file xattr cannot be changed\n\nDuring early boot, the filesystem is read-only and any changes\nto xattrs are not allowed. This fails in case of ext4 because\nchanging xattr starts an ext4 transaction which fails with the\nfollowing warning.\n\nWARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561\nCPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed  c2dfc3c9d9f6f1233251c5d4410574fe82a348ee\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\nRIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]\nCall Trace:\n  __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n  ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n  __vfs_setxattr+0x9a/0xd0\n  __vfs_setxattr_noperm+0x76/0x1f0\n  ima_appraise_measurement+0x23e/0xe40\n  ima_d_path+0x5a/0xd0\n  process_measurement+0xb29/0xc40\n  ? copy_from_kernel_nofault+0x21/0xe0\n  ? fscrypt_file_open+0xc0/0xe0\n  ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n  ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126\n  ? __bpf_prog_exit+0x23/0xd0\n  ? __bpf_tramp_exit+0xd/0x50\n  ? bpf_trampoline_6442530367+0x9f/0xea\n  ima_file_check+0x57/0x80\n  security_file_post_open+0x50/0xf0\n  path_openat+0x493/0x1650\n  do_filp_open+0xc7/0x170\n\nDetect the state of the file early and return the error.","summary":"During early boot, when the filesystem is read-only, IMA appraisal tries to set a file xattr on ext4, which starts a journal transaction and triggers a kernel warning. The fix makes the kernel detect the read-only state and return an error before the write is attempted.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ext4","ima","linux","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:05+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:00:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: IMA appraisal warns and fails on read-only ext4 at boot","impact":"low","summary":"During early boot, when the filesystem is read-only, IMA appraisal tries to set a file xattr on ext4, which starts a journal transaction and triggers a kernel warning. The fix makes the kernel detect the read-only state and return an error before the write is attempted.","category":"runtime","nicknames":[],"who_cares":["linux","ext4","ima"],"confidence":0.4,"needs_auth":"unknown","worst_case":"kernel warning and failed file xattr write during early boot","analyst_note":"Sources give only the kernel commit description; check the upstream stable backport list and affected kernel version ranges at nvd.nist.gov/vuln/detail/CVE-2026-98885.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000593,"input_tokens":4080,"output_tokens":370,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':139C,186C,195C,202C,208C,213C,218C,223C,227C,233C,238C,243C,252C,257C,262C,267C,272C,278C,282C,287C '-1':161C '-2026':16A,19A '-98885':17A,20A '/561':147C '0':151C '0010':181C '02/02/2022':179C '1':143C,149C,163C '2009':176C '31efb7c56239148b':249C '561':153C '6.19.12':160C '6442530367':266C '6d025f3bc52c89a957b89a89d211fadf5e9434e1':198C,205C,246C '75':133C 'allow':111C 'apprais':4A,36B,216C 'attempt':74B 'bio':177C 'boot':14A,27B,97C 'bpf':247C,254C,259C,264C 'c2dfc3c9d9f6f1233251c5d4410574fe82a348ee':168C 'call':189C 'cannot':92C 'case':115C 'chang':94C,106C,119C 'check':137C,184C,271C 'comm':154C 'copi':229C 'cpu':142C,148C 'cve':15A,18A 'd':221C 'default':162C 'detect':60B,289C 'earli':26B,88C,96C,295C 'error':69B,87C,299C 'exit':256C,261C 'ext4':12A,21B,44B,117C,123C,135C,141C,182C,188C,191C,197C,199C,204C,240C,245C 'fail':7A,113C,126C 'file':41B,90C,236C,241C,270C,275C,294C 'filesystem':30B,99C,251C 'filp':285C 'fix':56B 'follow':80C,129C 'fs/ext4/ext4_jbd2.c':132C 'fscrypt':235C 'hardwar':169C 'ich9':175C 'ima':3A,22B,35B,85C,215C,220C,269C 'journal':48B,136C,183C,192C 'kernel':2A,53B,59B,78C,231C 'linux':1A,23B,77C 'make':57B 'measur':217C,226C 'name':170C 'nofault':232C 'noperm':212C 'open':237C,242C,277C,286C 'openat':281C 'opensus':166C 'path':222C,280C 'pc':173C 'pid':152C 'post':276C 'preempt':164C 'process':225C 'prog':248C,255C 'q35':174C 'qemu':171C 'read':10A,33B,63B,102C 'read-on':9A,32B,62B,101C 'resolv':84C 'restrict':250C 'return':67B,86C,297C 'rip':180C 'runtim':24B 'sb':194C 'secur':274C 'set':39B,201C 'setxattr':207C,211C 'standard':172C 'start':46B,121C,138C,185C,193C 'state':65B,291C 'sysroot':146C,157C 'systemd':145C,156C 'systemd-sysroot':144C,155C 'taint':159C 'trace':190C 'tramp':260C 'trampolin':265C 'transact':49B,124C 'tri':37B 'trigger':51B 'tumblewe':167C 'uid':150C 'unknown':178C 'vfs':206C,210C 'voluntari':165C 'vulner':81C 'warn':5A,54B,130C,131C 'write':72B 'x104/0x150':203C 'x21/0xe0':234C 'x23/0xd0':258C 'x23e/0xe40':219C 'x3e/0x180':196C 'x493/0x1650':283C 'x50/0xf0':279C 'x57/0x80':273C 'x5a/0xd0':224C 'x60/0x490':244C 'x63/0xa0':140C,187C 'x76/0x1f0':214C 'x9a/0xd0':209C 'x9f/0xea':268C 'xab/0x126':253C 'xattr':42B,91C,108C,120C,200C 'xb29/0xc40':228C 'xc0/0xe0':239C 'xc7/0x170':288C 'xd/0x50':263C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98885","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98885","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98885","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}