CVE-2026-74596: fs,fsverity: remove check for fsverity being enabled in setattr_prepare()

Published Aug 22, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

fs,fsverity: remove check for fsverity being enabled in setattrprepare()

The check that fs-verity is available in the kernel is not necessary here. Filesystems could have fsverity files even without fs-verity enabled. In that case, truncate on fsverity file will succeed, what this check is trying to prevent.

Affected Software

1 affected component

Linux Linux kernel

Event History

Aug 22, 2026

CVE Published

via MITRE·03:31 PM

Data Sourced

via MITRE·03:31 PM

Description

Frequently Asked Questions

Which systems are exposed to the unsafe truncate behavior?

Systems with filesystem-resident fs-verity files are affected when fs-verity is not enabled in the running kernel. The issue exists because the availability check allowed truncation of those files in that situation.

What operation triggers the issue?

An attempt to truncate an fs-verity file triggers the problematic behavior. The provided data does not identify any other required attacker capability or access level.

How can I determine whether my system may be affected?

Check whether the filesystem contains fs-verity files and whether fs-verity is disabled or unavailable in the running kernel. Affected behavior is indicated if truncation of such a file succeeds despite its fs-verity status.

CVE-2026-74596: fs,fsverity: remove check for fsverity being enabled in setattr_prepare()

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to the unsafe truncate behavior?

What operation triggers the issue?

How can I determine whether my system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to the unsafe truncate behavior?

What operation triggers the issue?

How can I determine whether my system may be affected?