CVE-2025-68740: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68740 is a logic error vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem, specifically in the ima_match_rules() function, that allows a local attacker with low privileges to cause a Denial of Service via resource exhaustion. The flaw was published on December 24, 2025, with a patch released by Microsoft on December 25, 2025. Affected products include the Linux kernel as shipped in Azure Linux 3 (kernel versions 6.6.117.1-1 and 6.6.119.3-3), as well as broader upstream Linux kernel versions addressed by Debian, Ubuntu, Amazon Linux, and Oracle Linux updates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is an improper error-handling logic error (CWE-754: Improper Check for Unusual or Exceptional Conditions) in ima_match_rules(). When ima_filter_rule_match() returns -ENOENT (because the LSM rule is NULL after a SELinux policy module is unloaded via semodule -d), the existing check if (!rc) does not catch negative error codes, causing the function to incorrectly treat the result as a successful match. The specific trigger sequence is: (1) ima_filter_rule_match() returns -ESTALE on first call, (2) the code enters the stale-rule retry block and calls ima_lsm_copy_rule(), (3) since SELinux is removed, the rule becomes NULL, and (4) the second call returns -ENOENT, which bypasses the match check and sets result = true. The fix changes the condition from if (!rc) to if (rc <= 0) to properly handle all non-positive return codes (Feedly, Linux Kernel Git).

Successful exploitation causes IMA to measure unintended files, leading to resource exhaustion as extra files are unnecessarily added to the measurement list. This results in a Denial of Service condition affecting system stability and performance. There is no confidentiality or integrity impact; the vulnerability is limited to availability on the local system (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability requires local access with low privileges and is reproducible by unloading a SELinux policy module and triggering IMA measurements before ima_lsm_rules is updated. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Anomalous entries in IMA measurement logs (/sys/kernel/security/ima/ascii_runtime_measurements) showing unexpected or excessive file measurements not consistent with normal policy.
• System Behavior: Unusual resource consumption (CPU, memory) on systems where SELinux policy modules are being loaded or unloaded, correlated with IMA measurement activity.
• Audit Logs: Kernel audit log entries showing repeated calls through ima_bprm_check → process_measurement → ima_match_policy with unexpected matches during SELinux module transitions.

Apply the available kernel patches immediately. Microsoft released a patch on December 25, 2025, for Azure Linux 3 (kernel versions 6.6.117.1-1 and 6.6.119.3-3) (Microsoft MSRC). Upstream fixes are available in the Linux stable kernel tree (commits 88cd5fbf, 738c9738, 32952c4f, c2238d48). Downstream distributions including Debian (linux 6.1.162-1), Ubuntu (USN-8179-x, USN-8184-1, USN-8185-x, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098), and Oracle Linux have also released updates. As a temporary workaround, limit operations that trigger IMA measurements on systems where SELinux modules are frequently loaded or unloaded until patches are applied (Feedly).