Homepage

Improper Validation of Integrity Check Value The advisory has been revoked - it doesn't affect any version of package kernel  (opens in a new tab)

Threat Intelligence

EPSS
0.03% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-KERNEL-14453072
  • published17 Dec 2025
  • disclosed16 Dec 2025
Report a new vulnerability Found a mistake?

Introduced: 16 Dec 2025

CVE-2025-68183  (opens in a new tab)
CWE-354  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel package and not the kernel package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file.

For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated,

# getfattr -m - -d -e hex /usr/bin/bash
# file: usr/bin/bash
security.ima=0x0404...

This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed.

Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL.

Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset.

Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL,

#include <stdio.h>
#include <sys/xattr.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>


int main() {
    const char* file_path = "/usr/sbin/test_binary";
    const char* hex_string = "030204d33204490066306402304";
    int length = strlen(hex_string);
    char* ima_attr_value;
    int fd;


fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);
if (fd == -1) {
    perror("Error opening file");
    return 1;
}

ima_attr_value = (char*)malloc(length / 2 );
for (int i = 0, j = 0; i < length; i += 2, j++) {
    sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]);
}

if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) {
    perror("Error setting extended attribute");
    close(fd);
    return 1;
}

const char* selinux_value= "system_u:object_r:bin_t:s0";
if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) {
    perror("Error setting extended attribute");
    close(fd);
    return 1;
}

close(fd);

return 0;



}