Home

Description

In the Linux kernel, the following vulnerability has been resolved: audit: add missing syscalls to read class The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its extended attributes will bypass audit rules such as: -w /tmp/test -p rwa -k test_rwa The current patch adds missing syscalls to the audit read class.

PUBLISHED Reserved 2026-01-13 | Published 2026-03-17 | Updated 2026-04-13 | Assigner Linux

Product status

Default status
unaffected

6140be90ec70c39fa844741ca3cc807dd0866394 (git) before a2e8c144299c31d3972295ed80d4cb908daf4f6f
affected

6140be90ec70c39fa844741ca3cc807dd0866394 (git) before ad37505ce869a8100ff23f24eea117de7a7516bf
affected

6140be90ec70c39fa844741ca3cc807dd0866394 (git) before bcb90a2834c7393c26df9609b889a3097b7700cd
affected

Default status
affected

6.13
affected

Any version before 6.13
unaffected

6.18.16 (semver)
unaffected

6.19.6 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/a2e8c144299c31d3972295ed80d4cb908daf4f6f

git.kernel.org/...c/ad37505ce869a8100ff23f24eea117de7a7516bf

git.kernel.org/...c/bcb90a2834c7393c26df9609b889a3097b7700cd

www.bencteux.fr/posts/missing_syscalls_audit/

cve.org (CVE-2026-23241)

nvd.nist.gov (CVE-2026-23241)

Download JSON