A vulnerability in the Linux kernel Integrity Measurement Architecture allows for the bypass of security policy enforcement, posing a high risk of data integrity compromise.

This flaw involves the improper instantiation of file_truncate and path_truncate LSM hooks, which prevents the IMA_DONE_MASK flags from resetting upon file truncation. An attacker with low-level privileges can leverage this to ensure files are not correctly re-measured, re-audited, or re-appraised according to system policy upon subsequent access.

The inability to consistently enforce integrity measurement policies can lead to unauthorized modification of sensitive files without detection. Given the CVSS score of 8.1, the risk of integrity and confidentiality compromise is significant, as attackers may manipulate system binaries or configuration files while bypassing security auditing mechanisms. This could result in prolonged unauthorized access or the persistence of malicious code within a production environment.

Immediate Action: Update the Linux kernel to version 6.12.104, 6.18.45, 7.1.9, or later, depending on the specific branch in use.

Proactive Monitoring: Monitor system integrity logs and IMA audit events for unexpected gaps in measurement data or signs of unauthorized file access.

Compensating Controls: Ensure that mandatory access control frameworks, such as SELinux or AppArmor, are strictly configured to limit the impact of potential bypasses in the integrity measurement subsystem.

Public Exploit Available: Unknown

This vulnerability represents a critical failure in the security instrumentation of the Linux kernel. Administrators must prioritize patching affected systems to ensure that the Integrity Measurement Architecture functions correctly and prevents policy evasion. Failure to apply these updates leaves the system susceptible to undetected file manipulation.