CVE-2026-23241
MediumSummary
A vulnerability has been identified in the Linux kernel regarding missing syscalls in the audit read class. The missing 'at' variants of getxattr() and listxattr() may allow bypassing audit rules when reading file extended attributes.
Risk Assessment
Organizations may be at risk of unauthorized data access as certain operations may not be logged in the audit. This could lead to difficulties in detecting security breaches.
Recommendation
It is recommended to update the Linux kernel to the latest version to patch this vulnerability and ensure that all operations are properly logged in the audit.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: audit: add missing syscalls to read class The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its extended attributes will bypass audit rule