CVE-2025-68740

Root

Cause

In the Linux kernel's Integrity Measurement Architecture (IMA), the function ima_match_rules() uses if (!rc) to check the return value of ima_filter_rule_match(). When ima_filter_rule_match() returns a negative error code such as -ENOENT (indicating the rule is NULL), the check !rc evaluates to false, causing the code to incorrectly treat this as a rule match. This occurs because -ENOENT is a negative integer, which is truthy in C, so the !rc condition is not met, and the function proceeds to set result = true inadvertently [1].

Exploitation

Scenario

An attacker or administrator can trigger the bug by unloading the SELinux policy module using semodule -d. After this action, if an IMA measurement is triggered before ima_lsm_rules is updated, the first call to ima_filter_rule_match() returns -ESTALE. The code enters a retry path via ima_lsm_copy_rule(), but because the SELinux module has been removed, the copied rule becomes NULL. The subsequent call then returns -ENOENT, which the existing if (!rc) check fails to handle, resulting in a false match [1]. The call trace shows the vulnerability propagates from ima_match_rules() through the IMA policy matching chain to process_measurement() [1].

Impact

When the false match occurs, IMA incorrectly considers the LSM rule as applicable, causing extra files to be measured by IMA. This can lead to unintended measurements of files that should not have been measured, potentially violating security policies and increasing audit log volume. The issue affects the integrity of IMA's measurement decisions, as it may include or exclude files inappropriately [1].

Mitigation

The fix requires changing if (!rc) to if (rc <= 0) in ima_match_rules(), ensuring that error codes like -ENOENT do not bypass the check. This correction has been applied to the Linux kernel stable branches via commit c2238d487a64 [2] and related commits [1][3]. Users should apply the latest kernel updates to resolve the vulnerability. No workaround is available beyond updating the kernel.