LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23241: audit: add missing syscalls to read class

In the Linux kernel, the following vulnerability has been resolved: audit: add missing syscalls to read class The "at" variant of getxattr() and listxattr() are missing from the audit read class. Calling getxattrat() or listxattrat() on a file to read its extended attributes will bypass audit rules such as: -w /tmp/test -p rwa -k test_rwa The current patch adds missing syscalls to the audit read class.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23241 is a Linux kernel audit logging gap. Certain extended-attribute read operations can bypass audit rules that should record file reads. This does not indicate code execution or privilege escalation, but it can weaken monitoring, forensics, and compliance evidence on systems relying on Linux audit rules.

Executive priority

Treat as a monitoring integrity issue. Patch in normal security maintenance, with higher priority for regulated, high-assurance, or forensic-sensitive environments where audit completeness matters.

Technical view

The kernel audit subsystem omitted getxattrat() and listxattrat() from the audit read class. Reads of file extended attributes through these syscall variants may not trigger rules such as path watches with read permissions. The referenced kernel patches add the missing syscalls to the audit read class.

Likely exposure

Exposure is most relevant to Linux systems using auditd or kernel audit rules for file-read monitoring. The CVE record lists affected Linux kernel versions, but downstream distribution package mapping is not provided in the source bundle.

Exploitation context

No KEV listing or cited source states active exploitation. A local process capable of invoking the affected syscall variants could avoid expected audit read events for extended attributes. The issue is an audit visibility bypass, not a documented remote compromise path.

Researcher notes

Sources describe a missing audit class mapping and corresponding stable commits. CVSS, CWE, and precise distro-level affected ranges are not included. Avoid assuming broader impact beyond audit rule bypass for getxattrat() and listxattrat().

Mitigation direction

  • Apply Linux kernel updates that include the referenced stable audit fixes.
  • Check your Linux distribution vendor advisory for affected package versions.
  • Prioritize systems where audit logs support compliance, detection, or investigations.
  • Do not rely solely on affected audit rules until patched.

Validation and detection

  • Identify kernels running on systems that use Linux audit rules.
  • Confirm whether the referenced stable commits are present in the running kernel.
  • Review audit policies for file-read watches involving extended attributes.
  • After updating, verify expected audit events are generated for xattr reads.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23241 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6140be90ec70c39fa844741ca3cc807dd0866394, 6140be90ec70c39fa844741ca3cc807dd0866394, 6140be90ec70c39fa844741ca3cc807dd0866394unaffected
LinuxLinux6.13, 0, 6.18.16, 6.19.6, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.