CVE-2026-23241: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23241 is a security feature bypass vulnerability in the Linux kernel's audit subsystem, where the getxattrat() and listxattrat() syscalls were missing from the audit read class. This omission allows local users to read extended attributes on files without triggering configured audit rules (e.g., -w /tmp/test -p rwa -k test_rwa), effectively evading file access monitoring. The vulnerability was published on March 17, 2026, and affects Linux kernel versions 6.13 through 6.18.x (fixed in 6.18.16) and 6.19.x (fixed in 6.19.6), as well as Microsoft's Azure Linux 3 kernel. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Microsoft MSRC).

The root cause is an incomplete registration of syscalls in the Linux kernel audit framework (CWE-284: Improper Access Control / security feature bypass). When the getxattrat() and listxattrat() syscalls were introduced as "at"-variant counterparts to getxattr() and listxattr(), they were not added to the audit read class, meaning the audit subsystem does not generate log entries when these calls are made. An attacker with local, low-privileged access can invoke these syscalls directly to read extended attributes from any accessible file, bypassing audit rules that administrators rely on to detect such access. The fix adds both syscalls to the audit read class in the kernel source (Red Hat Advisory, Kernel Patch).

The primary impact is a loss of audit visibility: a local user with low privileges can silently read extended attributes (such as SELinux labels, capabilities, or application-specific metadata) from files without generating any audit log entries, undermining security monitoring and compliance controls. This does not grant the attacker access to data they could not otherwise read — the bypass is limited to evading detection rather than escalating privileges or accessing unauthorized data. However, in environments relying on audit logs for intrusion detection or forensic investigation, this gap could allow reconnaissance activity to go undetected (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability requires local access with low privileges and no user interaction, making it accessible to any authenticated local user on an affected system. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Apply the upstream kernel patches that add getxattrat() and listxattrat() to the audit read class. Fixed versions include Linux kernel 6.18.16 (for 6.13–6.18.x series), 6.19.6 (for 6.19.x series), and corresponding stable backport versions (6.1.165, 6.6.128, 6.12.75, 5.15.202, 5.10.252). Microsoft has also released a patch for the Azure Linux 3 kernel. As a defense-in-depth measure, consider deploying file integrity monitoring solutions that operate independently of the kernel audit syscall logging framework to detect unauthorized access to sensitive file metadata (Red Hat Advisory, Microsoft MSRC, Kernel Patch).

Red Hat and Microsoft both acknowledged the vulnerability and published advisories shortly after disclosure on March 17–18, 2026. A technical blog post was published at bencteux.fr providing additional context on the missing syscalls and their audit implications. Community coverage was limited to standard vulnerability database aggregators (VulnDB, CVEfeed, ENISA EUVD), with no notable researcher controversy or significant social media discussion observed (Red Hat Advisory, Microsoft MSRC).