The Linux kernel vulnerability CVE-2026-74671 is an out-of-bounds read in the IMA subsystem's xattr_verify() function. The root cause is a digest-length check that mixes signed int and size_t types, leading to an unsigned underflow when processing truncated extended attributes (xattr). Specifically, when xattr_len is small (e.g., 1), the arithmetic underflows and the check incorrectly passes, causing memcmp() to read beyond the allocated buffer size. The vulnerability stems from the lack of clamping xattr_len to a safe range before the check. The fix involves rewriting the comparison to use only signed int operands, preventing implicit unsigned conversions and underflow.

This vulnerability allows an out-of-bounds read in kernel memory during integrity measurement verification, which could lead to information disclosure or system instability. However, no known exploits are reported in the wild. The impact is limited to the IMA subsystem's handling of extended attributes related to security measurements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates. No specific workaround is provided in the available data.