---
id: CVE-2026-74399
title: 'evm: terminate and bound the evm_xattrs read buffer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  evm: terminate and bound the evm_xattrs read buffer

  evm_read_xattrs() allocates size + 1 bytes, fills them from the list of
  enabled xattrs, and then passes strlen(temp…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 <
    8df81954d22a653a8b01d46692cd56f71137269b
  - >-
    Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 <
    0b9f8282b40af4a99d6243d2cb939d14ff36b049
  - >-
    Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 <
    a36cbfb85f26e6c6fb6529b1a364331b94dc88f3
  - >-
    Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 <
    12ad52dc45a0c8c9d25e85b4a84201de4c5420ed
  - >-
    Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 <
    a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d
  - >-
    Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 <
    38b7d63b23aa9d2ddde7688040e9426d32be4065
  - >-
    Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 <
    11143a19f5b8dc8f414deab87571134f9f447313
  - Linux 4.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:56:55.812669Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:45.450Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74399'
references:
  - url: 'https://git.kernel.org/stable/c/8df81954d22a653a8b01d46692cd56f71137269b'
  - url: 'https://git.kernel.org/stable/c/0b9f8282b40af4a99d6243d2cb939d14ff36b049'
  - url: 'https://git.kernel.org/stable/c/a36cbfb85f26e6c6fb6529b1a364331b94dc88f3'
  - url: 'https://git.kernel.org/stable/c/12ad52dc45a0c8c9d25e85b4a84201de4c5420ed'
  - url: 'https://git.kernel.org/stable/c/a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d'
  - url: 'https://git.kernel.org/stable/c/38b7d63b23aa9d2ddde7688040e9426d32be4065'
  - url: 'https://git.kernel.org/stable/c/11143a19f5b8dc8f414deab87571134f9f447313'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.11904
ingestedAt: '2026-11-06T18:00:12.560Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

evm: terminate and bound the evm_xattrs read buffer

evm_read_xattrs() allocates size + 1 bytes, fills them from the list of
enabled xattrs, and then passes strlen(temp) to
simple_read_from_buffer(). When no configured xattrs are enabled, the
fill loop stores nothing and temp[0] remains uninitialized, so strlen()
reads beyond initialized memory.

Explicitly terminate the buffer after allocation, use snprintf() for
each formatted line, and pass the accumulated length, without risk of
truncation, to simple_read_from_buffer().

## Affected

- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 8df81954d22a653a8b01d46692cd56f71137269b`
- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 0b9f8282b40af4a99d6243d2cb939d14ff36b049`
- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < a36cbfb85f26e6c6fb6529b1a364331b94dc88f3`
- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 12ad52dc45a0c8c9d25e85b4a84201de4c5420ed`
- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < a0f64cf8bfcb39e533d9e27aeb763a8d81b7f39d`
- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 38b7d63b23aa9d2ddde7688040e9426d32be4065`
- `Linux >= fa516b66a1bfce1d72f1620c54bdfebc493000d1 < 11143a19f5b8dc8f414deab87571134f9f447313`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.