CVE-2025-68183

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Currently when both IMA and EVM are in fix mode, the IMA signature will

be reset to IMA hash if a program first stores IMA signature in

security.ima and then writes/removes some other security xattr for the

file.

For example, on Fedora, after booting the kernel with "ima_appraise=fix

evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima,

installing/reinstalling a package will not make good reference IMA

signature generated. Instead IMA hash is generated,

# getfattr -m - -d -e hex /usr/bin/bash

# file: usr/bin/bash

security.ima=0x0404...

This happens because when setting security.selinux, the IMA_DIGSIG flag

that had been set early was cleared. As a result, IMA hash is generated

when the file is closed.

Similarly, IMA signature can be cleared on file close after removing

security xattr like security.evm or setting/removing

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References