CVE-2026-23241None▾ Sunlit

audit: add missing syscalls to read class

In the Linux kernel, the following vulnerability has been resolved: audit: add missing syscalls to read class The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() o…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 17, 2026

Updated

Nov 5, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.13% · p3

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-11-05

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 5.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 233 days

Mar 17, 2026Published
Disclosed via CVEORG
Nov 5, 2026Record revised
Last analysed / modified upstream
Nov 5, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < a2e8c144299c31d3972295ed80d4cb908daf4f6f
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < ad37505ce869a8100ff23f24eea117de7a7516bf
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < bcb90a2834c7393c26df9609b889a3097b7700cd
Linux 6.13

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

audit: add missing syscalls to read class

The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its extended attributes will bypass audit rules such as:

-w /tmp/test -p rwa -k test_rwa

The current patch adds missing syscalls to the audit read class.

Affected

Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < a2e8c144299c31d3972295ed80d4cb908daf4f6f
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < ad37505ce869a8100ff23f24eea117de7a7516bf
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < bcb90a2834c7393c26df9609b889a3097b7700cd
Linux 6.13

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

← Back to feed

CVE-2026-23241None▾ Sunlit

audit: add missing syscalls to read class

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 17, 2026

Updated

Nov 5, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.13% · p3

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-11-05

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 5.

0.1% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 233 days

Mar 17, 2026Published
Disclosed via CVEORG
Nov 5, 2026Record revised
Last analysed / modified upstream
Nov 5, 2026EPSS first tracked
0.1%

Linux #cve.org

Affected

Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < a2e8c144299c31d3972295ed80d4cb908daf4f6f
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < ad37505ce869a8100ff23f24eea117de7a7516bf
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < bcb90a2834c7393c26df9609b889a3097b7700cd
Linux 6.13

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

audit: add missing syscalls to read class

The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its extended attributes will bypass audit rules such as:

-w /tmp/test -p rwa -k test_rwa

The current patch adds missing syscalls to the audit read class.

Affected

Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < a2e8c144299c31d3972295ed80d4cb908daf4f6f
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < ad37505ce869a8100ff23f24eea117de7a7516bf
Linux >= 6140be90ec70c39fa844741ca3cc807dd0866394 < bcb90a2834c7393c26df9609b889a3097b7700cd
Linux 6.13

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org