CVE-2026-53038: Linux Kernel IMA Out-of-Bounds Read Denial of Service

Technical summary

CVE-2026-53038 is an out-of-bounds read in the Linux kernel's IMA securityfs initialization code. When a TPM chip's crypto_id for an unsupported hash algorithm is set to HASH_ALGO__LAST (an invalid sentinel value), the create_securityfs_measurement_lists() function passes this value directly to hash_algo_name[], which is a statically allocated array with a fixed upper bound. KASAN (Kernel Address Sanitizer) detects this as a global buffer over-read. The root cause is that TPM algorithms (particularly TPM_ALG_SHA3_256, value 0x0027) may be present in newer TPM 2.0 implementations but not yet enumerated in the kernel's hash algorithm definitions. The patch resolves this by gracefully handling unsupported algorithms by creating securityfs files with a fallback naming scheme (_tpm_alg_<ID>) rather than attempting to dereference the algorithm name array.

Business impact

This vulnerability causes kernel panic during initialization on systems with newer TPM 2.0 chips that support algorithms not yet recognized by the kernel version in use. For organizations relying on IMA for kernel integrity measurement and attestation, this bug can prevent systems from booting or functioning, resulting in availability loss. The denial of service occurs at boot time, making it a blocking issue for deployment of affected kernel versions on hardware with advanced TPM implementations. However, the impact is limited to local access and requires the system to already be in a state where the TPM reports an unsupported algorithm.

Affected systems

The vulnerability affects the Linux kernel across versions that include the vulnerable IMA securityfs code path. Based on the description, the issue was observed on kernel 6.12.40. The vulnerability is triggered specifically on systems equipped with TPM 2.0 chips that support newer hash algorithms (such as SHA3-256) that are not yet included in the kernel's algorithm enumeration. This is most relevant for newer hardware or systems updated with the latest TPM firmware that supports additional algorithms. Older systems with TPM 1.2 or TPM 2.0 chips supporting only traditional algorithms (SHA-1, SHA-256) are unaffected.

Exploitability

This is not a remotely exploitable vulnerability. It requires local access and manifests as a kernel panic triggered automatically during the boot process when the vulnerable code path is executed. There is no user interaction required, and no privilege escalation component—the crash occurs in kernel initialization before normal access controls are established. An attacker cannot weaponize this for remote code execution. The practical exploitability is limited: an attacker with the ability to provision hardware with TPM firmware supporting unrecognized algorithms could force a denial of service on a target system, but this is a niche scenario. The real-world impact is primarily as a stability issue for legitimate administrators deploying on newer hardware.

Remediation

The Linux kernel maintainers have resolved this by modifying the securityfs file creation logic to detect when an algorithm is unsupported (crypto_id == HASH_ALGO__LAST) and create securityfs measurement list files with a fallback naming convention (_tpm_alg_<hex_id>) rather than attempting to look up the invalid algorithm name in the hash_algo_name array. This allows the system to boot successfully and still expose the TPM's reported banks via securityfs, albeit with generic names. Organizations should apply kernel patches that include this fix. The fix is backwards compatible and does not require changes to userspace tools, though tools that parse /sys/kernel/security/ima/ should be aware that file names may include the _tpm_alg_* pattern for newer algorithms.

Patch guidance

Apply the kernel patch that resolves the out-of-bounds array access in the IMA securityfs initialization. This fix has been integrated into mainline kernel development following the 6.12.40 release. Verify the specific kernel versions in your distribution's advisory for exact patch versions. The patch modifies create_securityfs_measurement_lists() and related functions to check algorithm validity before array access. No kernel command-line parameters or configuration changes are required to benefit from this patch. A kernel reboot is necessary to activate the patched code.

Detection guidance

Systems running the vulnerable kernel on hardware with newer TPM chips may exhibit kernel panics or boot failures with KASAN output showing 'global-out-of-bounds in create_securityfs_measurement_lists'. Check kernel logs (dmesg, journalctl) for the specific KASAN report referencing hash_algo_name array access. TPM kernel log messages stating 'TPM with unsupported bank algorithm 0x0027' (or similar) preceding the crash are a strong indicator. Monitor system boot success rates on new hardware deployments; unexpected failures during initialization warrant investigation. Once patched, verify that /sys/kernel/security/ima/ contains securityfs files; the presence of files with _tpm_alg_* names indicates the graceful fallback is working.

Why prioritize this

Prioritize patching systems that will be deployed on newer hardware with TPM 2.0 chips, or those receiving firmware updates that enable additional TPM algorithms. While the CVSS score is moderate (5.5 MEDIUM), the practical severity for affected systems is high because it blocks boot. Organizations with strict uptime requirements and those managing large fleets of similar hardware should prioritize this fix to prevent deployment blockers. Systems already running without TPM support or with older TPM hardware supporting only legacy algorithms can be deprioritized. The fix is safe and non-disruptive, making it suitable for immediate application upon release.

Risk score, explained

CVSS 3.1 Score: 5.5 (MEDIUM). The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects: Attack Vector Local (kernel panic requires local system access/execution), Access Complexity Low (triggered automatically during boot on affected hardware), Privileges Required Low (occurs during kernel initialization before normal privilege checks), User Interaction None (automatic), Scope Unchanged (impact limited to the affected system), Confidentiality None (no information disclosure), Integrity None (no data corruption), Availability High (kernel crash/denial of service). The score appropriately reflects a denial-of-service impact without escalation potential, moderated by the local-only attack vector.

Frequently asked questions