CVE-2025-68740

What it actually does

In ima_match_rules(), error returns such as -ENOENT or -ESTALE from ima_filter_rule_match() bypass the success check, forcing a false-positive rule match that causes IMA to measure additional files.

Why it matters to the business

Systems may perform unnecessary file measurements, increasing I/O and storage overhead for integrity logs without improving security posture; the issue is present in widely deployed Linux kernels and downstream packages until patched.

How an attack unfolds

An attacker unloads the SELinux policy module, then triggers an execve or other measurement point before ima_lsm_rules is refreshed; the resulting NULL rule produces -ENOENT which is misinterpreted as a successful match, causing extraneous measurements.

How to fix it

Update the Linux kernel to commit d14e0ec6a6828ee0dffa163fb5d513c9a21f0a51 or later; for affected Chainguard and Wolfi timestamp-authority packages upgrade to version 1.2.4-r6 or newer.

How to confirm the fix worked

Confirm the kernel contains the referenced commit or package version 1.2.4-r6; reproduce the semodule unload + execve sequence and verify that -ENOENT no longer produces a match.

Typical attack path

1. Unload or disable the active SELinux policy module
2. Trigger a process execution or file access that invokes IMA policy evaluation
3. ima_match_rules receives -ENOENT from ima_filter_rule_match on a NULL rule
4. Logic error sets result=true and records an unintended measurement

How to detect it

Review IMA measurement logs and audit records around SELinux policy unload events for entries that do not correspond to active policy rules; correlate with process execution timestamps.

What your security team should do

• Apply the kernel commit or package update 1.2.4-r6 immediately on all affected systems
• Monitor IMA measurement logs for unexpected file entries until patches are deployed
• Prioritize systems that rely on SELinux policy unloading in operational workflows