CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

evm: terminate and bound the evm_xattrs read buffer

evm_read_xattrs() allocates size + 1 bytes, fills them from the list of
enabled xattrs, and then passes strlen(temp) to
simple_read_from_buffer(). When no configured xattrs are enabled, the
fill loop stores nothing and temp[0] remains uninitialized, so strlen()
reads beyond initialized memory.

Explicitly terminate the buffer after allocation, use snprintf() for
each formatted line, and pass the accumulated length, without risk of
truncation, to simple_read_from_buffer().

The Linux kernel CVE team has assigned CVE-2026-74399 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.18 with commit fa516b66a1bfce1d72f1620c54bdfebc493000d1 and fixed in 5.15.212 with commit 8df81954d22a653a8b01d46692cd56f71137269b
	Issue introduced in 4.18 with commit fa516b66a1bfce1d72f1620c54bdfebc493000d1 and fixed in 6.1.178 with commit 0b9f8282b40af4a99d6243d2cb939d14ff36b049
	Issue introduced in 4.18 with commit fa516b66a1bfce1d72f1620c54bdfebc493000d1 and fixed in 6.6.145 with commit a36cbfb85f26e6c6fb6529b1a364331b94dc88f3
	Issue introduced in 4.18 with commit fa516b66a1bfce1d72f1620c54bdfebc493000d1 and fixed in 6.12.97 with commit 12ad52dc45a0c8c9d25e85b4a84201de4c5420ed
	Issue introduced in 4.18 with commit fa516b66a1bfce1d72f1620c54bdfebc493000d1 and fixed in 6.18.40 with commit a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d
	Issue introduced in 4.18 with commit fa516b66a1bfce1d72f1620c54bdfebc493000d1 and fixed in 7.1.5 with commit 38b7d63b23aa9d2ddde7688040e9426d32be4065
	Issue introduced in 4.18 with commit fa516b66a1bfce1d72f1620c54bdfebc493000d1 and fixed in 7.2-rc1 with commit 11143a19f5b8dc8f414deab87571134f9f447313

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74399
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	security/integrity/evm/evm_secfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8df81954d22a653a8b01d46692cd56f71137269b
	https://git.kernel.org/stable/c/0b9f8282b40af4a99d6243d2cb939d14ff36b049
	https://git.kernel.org/stable/c/a36cbfb85f26e6c6fb6529b1a364331b94dc88f3
	https://git.kernel.org/stable/c/12ad52dc45a0c8c9d25e85b4a84201de4c5420ed
	https://git.kernel.org/stable/c/a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d
	https://git.kernel.org/stable/c/38b7d63b23aa9d2ddde7688040e9426d32be4065
	https://git.kernel.org/stable/c/11143a19f5b8dc8f414deab87571134f9f447313