CVE-2026-89989: ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
In the Linux kernel, the following vulnerability has been resolved:
ima: Check for ERRPTR from dentrypath() in validatehashalgo()
dentrypath() returns ERRPTR(-ENAMETOOLONG) when the path exceeds the buffer. validatehashalgo() passes the result straight to integrityauditmsg() without checking. ERRPTR is not NULL, so integrityauditmessage() sees a valid pointer and calls strlen() on it, which faults:
BUG: unable to handle page fault for address: ffffffffffffffdc RIP: 0010:strlen+0x30/0xa0 Call Trace: auditloguntrustedstring+0x19/0x30 integrityauditmessage+0x366/0x4f0 imainodesetxattr+0x512/0x5f0
Check for ISERR() and use NULL instead, which makes the audit message skip the name= field instead of crashing.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the crash?
The path supplied to dentry_path() must exceed its buffer, causing dentry_path() to return ERR_PTR(-ENAMETOOLONG). The affected validate_hash_algo() path must then pass that error pointer into the integrity audit logging code, which calls strlen() on it and faults.
What operation is implicated by the reported call trace?
The call trace shows the fault occurring during ima_inode_setxattr(). This indicates exposure when IMA processes an inode extended-attribute operation under the oversized-path condition.
What is the effect of the fix if the path cannot be represented in the buffer?
The fix checks for an error return from dentry_path() and uses NULL instead. The audit message then omits the name= field rather than dereferencing the error pointer and crashing.