---
id: CVE-2022-21505
title: >-
  In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot
  param, lockdown can be defeated with kexec on any machine when Secure Boot is
  disabled or unavailable
summary: >-
  In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot
  param, lockdown can be defeated with kexec on any machine when Secure Boot is
  disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot
  p…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-346
vendor: oracle
product: linux
affected:
  - linux = 7
  - linux = 8
  - linux = 9
published: '2024-12-24'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:25.003'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-21505'
references:
  - url: 'https://git.kernel.org/linus/543ce63b664e2c2f9533d089a4664b559c3e6b5b'
    label: secalert_us@oracle.com
  - url: 'https://linux.oracle.com/cve/CVE-2022-21505.html'
    label: secalert_us@oracle.com
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00201
epssPercentile: 0.0925
ingestedAt: '2026-10-14T16:40:32.049Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-12-27T16:51:57.672286Z'
---

## Overview

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

## Affected

- `linux = 7`
- `linux = 8`
- `linux = 9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.