{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "07f6a79415d7d502ee0c7d02ace6594a7be7429a"
            },
            {
              "fixed": "86acb68ebb220b83def94e7f4c33e24e843970e0"
            },
            {
              "fixed": "4d98295357bcacb70874e73117e298a9d7d9b830"
            },
            {
              "fixed": "c6988714c0549e06610635c7a71e88635da6db64"
            },
            {
              "fixed": "8c77312728d07b60fc028f676e42d842df918bcd"
            },
            {
              "fixed": "dce1b66fcfb40c935f426f602c3a41a7b9f62ba4"
            },
            {
              "fixed": "2f29f880e98bf0087215726c45a485afd15b42cf"
            },
            {
              "fixed": "69fc6474236d9edda6983623e4282f2bdfd8e3d8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "5.10.271"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.222"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.189"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.158"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.111"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98885.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: return error early if file xattr cannot be changed\n\nDuring early boot, the filesystem is read-only and any changes\nto xattrs are not allowed. This fails in case of ext4 because\nchanging xattr starts an ext4 transaction which fails with the\nfollowing warning.\n\nWARNING: fs/ext4/ext4_jbd2.c:75 at ext4_journal_check_start+0x63/0xa0 [ext4], CPU#1: systemd-sysroot/561\nCPU: 1 UID: 0 PID: 561 Comm: systemd-sysroot Not tainted 6.19.12-1-default #1 PREEMPT(voluntary) openSUSE Tumbleweed  c2dfc3c9d9f6f1233251c5d4410574fe82a348ee\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\nRIP: 0010:ext4_journal_check_start+0x63/0xa0 [ext4]\nCall Trace:\n  __ext4_journal_start_sb+0x3e/0x180 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n  ext4_xattr_set+0x104/0x150 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n  __vfs_setxattr+0x9a/0xd0\n  __vfs_setxattr_noperm+0x76/0x1f0\n  ima_appraise_measurement+0x23e/0xe40\n  ima_d_path+0x5a/0xd0\n  process_measurement+0xb29/0xc40\n  ? copy_from_kernel_nofault+0x21/0xe0\n  ? fscrypt_file_open+0xc0/0xe0\n  ? ext4_file_open+0x60/0x490 [ext4 6d025f3bc52c89a957b89a89d211fadf5e9434e1]\n  ? bpf_prog_31efb7c56239148b_restrict_filesystems+0xab/0x126\n  ? __bpf_prog_exit+0x23/0xd0\n  ? __bpf_tramp_exit+0xd/0x50\n  ? bpf_trampoline_6442530367+0x9f/0xea\n  ima_file_check+0x57/0x80\n  security_file_post_open+0x50/0xf0\n  path_openat+0x493/0x1650\n  do_filp_open+0xc7/0x170\n\nDetect the state of the file early and return the error.",
  "id": "CVE-2026-98885",
  "modified": "2026-10-28T02:30:25.671575009Z",
  "published": "2026-10-23T11:37:41.736Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2f29f880e98bf0087215726c45a485afd15b42cf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4d98295357bcacb70874e73117e298a9d7d9b830"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/69fc6474236d9edda6983623e4282f2bdfd8e3d8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/86acb68ebb220b83def94e7f4c33e24e843970e0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8c77312728d07b60fc028f676e42d842df918bcd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c6988714c0549e06610635c7a71e88635da6db64"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dce1b66fcfb40c935f426f602c3a41a7b9f62ba4"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98885.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98885"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "ima: return error early if file xattr cannot be changed"
}