{"id":"CVE-2026-74399","title":"evm: terminate and bound the evm_xattrs read buffer","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nevm: terminate and bound the evm_xattrs read buffer\n\nevm_read_xattrs() allocates size + 1 bytes, fills them from the list of\nenabled xattrs, and then passes strlen(temp…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 8df81954d22a653a8b01d46692cd56f71137269b","Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 0b9f8282b40af4a99d6243d2cb939d14ff36b049","Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < a36cbfb85f26e6c6fb6529b1a364331b94dc88f3","Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 12ad52dc45a0c8c9d25e85b4a84201de4c5420ed","Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d","Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 38b7d63b23aa9d2ddde7688040e9426d32be4065","Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 11143a19f5b8dc8f414deab87571134f9f447313","Linux 4.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:56:55.812669Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:45.450Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74399","references":[{"url":"https://git.kernel.org/stable/c/8df81954d22a653a8b01d46692cd56f71137269b"},{"url":"https://git.kernel.org/stable/c/0b9f8282b40af4a99d6243d2cb939d14ff36b049"},{"url":"https://git.kernel.org/stable/c/a36cbfb85f26e6c6fb6529b1a364331b94dc88f3"},{"url":"https://git.kernel.org/stable/c/12ad52dc45a0c8c9d25e85b4a84201de4c5420ed"},{"url":"https://git.kernel.org/stable/c/a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d"},{"url":"https://git.kernel.org/stable/c/38b7d63b23aa9d2ddde7688040e9426d32be4065"},{"url":"https://git.kernel.org/stable/c/11143a19f5b8dc8f414deab87571134f9f447313"}],"tags":["cve.org"],"epss":0.00215,"epssPercentile":0.11904,"ingestedAt":"2026-11-06T18:00:12.560Z","slug":"CVE-2026-74399","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nevm: terminate and bound the evm_xattrs read buffer\n\nevm_read_xattrs() allocates size + 1 bytes, fills them from the list of\nenabled xattrs, and then passes strlen(temp) to\nsimple_read_from_buffer(). When no configured xattrs are enabled, the\nfill loop stores nothing and temp[0] remains uninitialized, so strlen()\nreads beyond initialized memory.\n\nExplicitly terminate the buffer after allocation, use snprintf() for\neach formatted line, and pass the accumulated length, without risk of\ntruncation, to simple_read_from_buffer().\n\n## Affected\n\n- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 8df81954d22a653a8b01d46692cd56f71137269b`\n- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 0b9f8282b40af4a99d6243d2cb939d14ff36b049`\n- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < a36cbfb85f26e6c6fb6529b1a364331b94dc88f3`\n- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 12ad52dc45a0c8c9d25e85b4a84201de4c5420ed`\n- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d`\n- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 38b7d63b23aa9d2ddde7688040e9426d32be4065`\n- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 11143a19f5b8dc8f414deab87571134f9f447313`\n- `Linux 4.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}