In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the… (CVE-2026-98885)

The Linux kernel vulnerability (CVE-2026-98885) involves the IMA (Integrity Measurement Architecture) subsystem attempting to change file extended attributes (xattrs) during early boot when the filesystem is read-only. On ext4 filesystems, changing xattrs initiates an ext4 journal transaction that fails, causing kernel warnings and potential instability. The patch modifies IMA to detect the read-only state early and return an error before attempting to change xattrs, preventing the failed transaction and associated warnings.

This vulnerability can cause kernel warnings and failed ext4 transactions during early boot on systems using ext4 filesystems with IMA enabled. While it does not indicate direct exploitation or compromise, it may affect system stability or boot reliability in affected configurations.

A fix has been implemented in the Linux kernel to address this issue by returning an error early if file xattrs cannot be changed during early boot. Users should update to the fixed kernel version once available. Since this is a kernel-level fix, applying the official kernel update from the distribution vendor is the recommended remediation.