In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL, #include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdlib.h> int main() { const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd; fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror("Error opening file"); return 1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); } if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } close(fd); return 0; }

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50006 advisory.

    - xfrm: delete x->tunnel as we delete x (Sabrina Dubroca)   {CVE-2025-40215}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM     are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in     security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after     booting the kernel with ima_appraise=fix evm=fix ima_policy=appraise_tcb and installing rpm-plugin-ima,     installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash     is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This     happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As     a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file     close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA     file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C     reproducer which sets security.selinux as the last step which can also replaced by removing security.evm     or setting ACL, #include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include     <string.h> #include <stdlib.h> int main() { const char* file_path = /usr/sbin/test_binary; const char*     hex_string = 030204d33204490066306402304; int length = strlen(hex_string); char* ima_attr_value; int fd;
    fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror(Error opening file); return     1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) {     sscanf(hex_string + i, %2hhx, &ima_attr_value[j]); } if (fsetxattr(fd, security.ima, ima_attr_value,     length/2, 0) == -1) { perror(Error setting extended attribute); close(fd); return 1; } const char*     selinux_value= system_u:object_r:bin_t:s0; if (fsetxattr(fd, security.selinux, selinux_value,     strlen(selinux_value), 0) == -1) { perror(Error setting extended attribute); close(fd); return 1; }     close(fd); return 0; } (CVE-2025-68183)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
296680	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2026:0293-1)	Nessus	SuSE Local Security Checks	high
296676	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0281-1)	Nessus	SuSE Local Security Checks	high
296481	SUSE SLES15 Security Update : kernel (SUSE-SU-2026:0278-1)	Nessus	SuSE Local Security Checks	high
284515	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50006)	Nessus	Oracle Linux Local Security Checks	high
278894	Linux Distros Unpatched Vulnerability : CVE-2025-68183	Nessus	Misc.	high

Detections

Analytics

CVE-2025-68183

medium

Tenable Plugins

high

high

high

high

high