CVE-2025-68183: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68183 is a logic flaw in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem where the IMA_DIGSIG flag is incorrectly cleared when a non-IMA security extended attribute (xattr) is set or removed. This causes IMA to replace a previously stored file signature with a weaker file hash upon file close, undermining file integrity guarantees. The vulnerability affects the Linux kernel and was published on December 16, 2025 (Feedly). No CVSS score has been assigned as of the time of this report (Feedly).

The root cause is an improper state management issue (CWE-664: Improper Control of a Resource Through its Lifetime) in the IMA subsystem. When both IMA and EVM are operating in "fix" mode, writing or removing an unrelated security xattr (e.g., security.selinux, security.evm, or an ACL) triggers a code path that clears the IMA_DIGSIG flag. As a result, when the file is subsequently closed, IMA generates a file hash (security.ima=0x0404...) instead of preserving the previously written IMA signature, silently downgrading the integrity protection. The fix prevents the IMA_DIGSIG flag from being reset by operations on non-IMA xattrs (Feedly). Upstream patches are referenced at commits 02aa671c08a4, 88b4cbcf6b04, d2993a7e98eb, and edd824eb45e4 in the stable kernel tree.

The primary impact is an integrity bypass: IMA file signatures — which are used to verify that binaries and files have not been tampered with — can be silently replaced with weaker file hashes without any explicit attacker action, simply as a side effect of normal package management operations (e.g., RPM installation via rpm-plugin-ima on Fedora). This undermines the trust chain enforced by IMA appraisal policies, potentially allowing modified or malicious binaries to pass integrity checks that would otherwise reject them. The vulnerability does not directly grant code execution or privilege escalation, but it weakens a security control that other defenses depend upon (Feedly).

Apply the upstream Linux kernel patches that prevent the IMA_DIGSIG flag from being cleared by non-IMA xattr operations. The fixes are available in the stable kernel tree at commits 02aa671c08a4, 88b4cbcf6b04, d2993a7e98eb, and edd824eb45e4. Red Hat has issued security advisories (RHSA-2026:21556, RHSA-2026:21557, RHSA-2026:21706, RHSA-2026:21745) addressing this issue for RHEL systems (Red Hat); AlmaLinux and Rocky Linux have issued corresponding errata as well. As a workaround, avoid running both IMA and EVM simultaneously in fix mode on production systems where IMA signature integrity is critical.