diff --git a/security/integrity/digest_cache/Makefile b/security/integrity/digest_cache/Makefile
index d07ac2483504..f8afb85407a0 100644
--- a/security/integrity/digest_cache/Makefile
+++ b/security/integrity/digest_cache/Makefile
@@ -6,6 +6,6 @@ obj-$(CONFIG_INTEGRITY_DIGEST_CACHE) += digest_cache.o
 obj-$(CONFIG_DIGEST_CACHE_TLV_PARSER) += parsers/tlv.o
 
 digest_cache-y := main.o secfs.o htable.o parsers.o populate.o modsig.o \
-		  verif.o dir.o
+		  verif.o dir.o reset.o
 
 CFLAGS_parsers.o += -DPARSERS_DIR=\"$(MODLIB)/kernel/security/integrity/digest_cache/parsers\"
diff --git a/security/integrity/digest_cache/dir.c b/security/integrity/digest_cache/dir.c
index a292a9c25119..d4fd5b5ef8fa 100644
--- a/security/integrity/digest_cache/dir.c
+++ b/security/integrity/digest_cache/dir.c
@@ -206,6 +206,12 @@ digest_cache_dir_lookup_digest(struct dentry *dentry,
 
 	list_for_each_entry(dir_entry, &dir_cache->dir_entries, list) {
 		mutex_lock(&dir_entry->digest_cache_mutex);
+		if (dir_entry->digest_cache &&
+		    test_bit(RESET, &dir_entry->digest_cache->flags)) {
+			digest_cache_put(dir_entry->digest_cache);
+			dir_entry->digest_cache = NULL;
+		}
+
 		if (!dir_entry->digest_cache) {
 			digest_list_path.dentry = NULL;
 			digest_list_path.mnt = NULL;
diff --git a/security/integrity/digest_cache/htable.c b/security/integrity/digest_cache/htable.c
index a01e24d7f198..349aebf91360 100644
--- a/security/integrity/digest_cache/htable.c
+++ b/security/integrity/digest_cache/htable.c
@@ -203,7 +203,8 @@ EXPORT_SYMBOL_GPL(digest_cache_htable_lookup);
  * passed digest cache, obtained with digest_cache_get().
  *
  * Return: A digest cache reference if the digest is found, NULL if not, an
- *         error pointer if dir digest cache changed since last get.
+ *         error pointer if dir digest cache changed since last get, or digest
+ *         cache was reset.
  */
 struct digest_cache *digest_cache_lookup(struct dentry *dentry,
 					 struct digest_cache *digest_cache,
@@ -211,6 +212,9 @@ struct digest_cache *digest_cache_lookup(struct dentry *dentry,
 {
 	int ret;
 
+	if (test_bit(RESET, &digest_cache->flags))
+		return ERR_PTR(-EAGAIN);
+
 	if (test_bit(IS_DIR, &digest_cache->flags))
 		return digest_cache_dir_lookup_digest(dentry, digest_cache,
 						      digest, algo);
diff --git a/security/integrity/digest_cache/internal.h b/security/integrity/digest_cache/internal.h
index 5af7f6e7bdf6..75f8b118c3db 100644
--- a/security/integrity/digest_cache/internal.h
+++ b/security/integrity/digest_cache/internal.h
@@ -21,6 +21,7 @@
 #define DIR_PREFETCH		4	/* Prefetch enabled for dir. */
 #define FILE_PREFETCH		5	/* Prefetch enabled for dir entry. */
 #define FILE_READ		6	/* Digest cache for reading file. */
+#define RESET			7	/* Digest cache to be recreated. */
 
 /**
  * struct readdir_callback - Structure to store information for dir iteration
@@ -267,4 +268,16 @@ int digest_cache_dir_prefetch(struct dentry *dentry,
 			      struct digest_cache *digest_cache);
 void digest_cache_dir_free(struct digest_cache *digest_cache);
 
+/* reset.c */
+int digest_cache_path_truncate(const struct path *path);
+void digest_cache_file_release(struct file *file);
+int digest_cache_inode_unlink(struct inode *dir, struct dentry *dentry);
+int digest_cache_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
+			      struct inode *new_dir, struct dentry *new_dentry);
+void digest_cache_inode_post_setxattr(struct dentry *dentry, const char *name,
+				      const void *value, size_t size,
+				      int flags);
+void digest_cache_inode_post_removexattr(struct dentry *dentry,
+					 const char *name);
+
 #endif /* _DIGEST_CACHE_INTERNAL_H */
diff --git a/security/integrity/digest_cache/main.c b/security/integrity/digest_cache/main.c
index ca1f0bc8ec94..0a167c82e308 100644
--- a/security/integrity/digest_cache/main.c
+++ b/security/integrity/digest_cache/main.c
@@ -436,6 +436,11 @@ struct digest_cache *digest_cache_get(struct file *file)
 
 	/* Serialize accesses to inode for which the digest cache is used. */
 	mutex_lock(&dig_sec->dig_user_mutex);
+	if (dig_sec->dig_user && test_bit(RESET, &dig_sec->dig_user->flags)) {
+		digest_cache_put(dig_sec->dig_user);
+		dig_sec->dig_user = NULL;
+	}
+
 	if (!dig_sec->dig_user) {
 		down_read(&default_path_sem);
 		/* Consume extra reference from digest_cache_create(). */
@@ -553,6 +558,13 @@ static struct security_hook_list digest_cache_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(inode_alloc_security, digest_cache_inode_alloc_security),
 	LSM_HOOK_INIT(inode_free_security_rcu,
 		      digest_cache_inode_free_security_rcu),
+	LSM_HOOK_INIT(path_truncate, digest_cache_path_truncate),
+	LSM_HOOK_INIT(file_release, digest_cache_file_release),
+	LSM_HOOK_INIT(inode_unlink, digest_cache_inode_unlink),
+	LSM_HOOK_INIT(inode_rename, digest_cache_inode_rename),
+	LSM_HOOK_INIT(inode_post_setxattr, digest_cache_inode_post_setxattr),
+	LSM_HOOK_INIT(inode_post_removexattr,
+		      digest_cache_inode_post_removexattr),
 };
 
 /**
diff --git a/security/integrity/digest_cache/reset.c b/security/integrity/digest_cache/reset.c
new file mode 100644
index 000000000000..003c8ee96d72
--- /dev/null
+++ b/security/integrity/digest_cache/reset.c
@@ -0,0 +1,227 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2023-2024 Huawei Technologies Duesseldorf GmbH
+ *
+ * Author: Roberto Sassu <roberto.sassu@huawei.com>
+ *
+ * Reset digest cache on digest lists/directory modifications.
+ */
+
+#define pr_fmt(fmt) "digest_cache: "fmt
+#include "internal.h"
+
+/**
+ * digest_cache_reset_clear_owner - Reset and clear dig_owner
+ * @inode: Inode of the digest list/directory containing the digest list
+ * @reason: Reason for reset and clear
+ *
+ * This function sets the RESET bit of the digest cache referenced by dig_owner
+ * of the passed inode, and puts and clears dig_owner.
+ *
+ * The next time they are called, digest_cache_get() and
+ * digest_cache_dir_lookup_digest() replace respectively dig_user and the digest
+ * cache of the directory entry.
+ */
+static void digest_cache_reset_clear_owner(struct inode *inode,
+					   const char *reason)
+{
+	struct digest_cache_security *dig_sec;
+
+	dig_sec = digest_cache_get_security(inode);
+	if (unlikely(!dig_sec))
+		return;
+
+	mutex_lock(&dig_sec->dig_owner_mutex);
+	if (dig_sec->dig_owner) {
+		pr_debug("Resetting and clearing %s (dig_owner), reason: %s\n",
+			 dig_sec->dig_owner->path_str, reason);
+		set_bit(RESET, &dig_sec->dig_owner->flags);
+		digest_cache_put(dig_sec->dig_owner);
+		dig_sec->dig_owner = NULL;
+	}
+	mutex_unlock(&dig_sec->dig_owner_mutex);
+}
+
+/**
+ * digest_cache_clear_user - Clear dig_user
+ * @inode: Inode of the file using the digest cache
+ * @filename: File name of the affected inode
+ * @reason: Reason for clear
+ *
+ * This function clears dig_user in the inode security blob, so that
+ * digest_cache_get() requests a new digest cache based on the updated digest
+ * list location.
+ */
+static void digest_cache_clear_user(struct inode *inode, const char *filename,
+				    const char *reason)
+{
+	struct digest_cache_security *dig_sec;
+
+	dig_sec = digest_cache_get_security(inode);
+	if (unlikely(!dig_sec))
+		return;
+
+	mutex_lock(&dig_sec->dig_user_mutex);
+	if (dig_sec->dig_user && !test_bit(RESET, &dig_sec->dig_user->flags)) {
+		pr_debug("Clearing %s (dig_user of %s), reason: %s\n",
+			 dig_sec->dig_user->path_str, filename, reason);
+		digest_cache_put(dig_sec->dig_user);
+		dig_sec->dig_user = NULL;
+	}
+	mutex_unlock(&dig_sec->dig_user_mutex);
+}
+
+/**
+ * digest_cache_path_truncate - A file is being truncated
+ * @path: File path
+ *
+ * This function is called when a file is being truncated. If the inode is a
+ * digest list and/or the parent is a directory containing digest lists, it
+ * resets the inode and/or directory dig_owner, to force rebuilding the digest
+ * cache.
+ *
+ * Return: Zero.
+ */
+int digest_cache_path_truncate(const struct path *path)
+{
+	struct inode *inode = d_backing_inode(path->dentry);
+	struct inode *dir = d_backing_inode(path->dentry->d_parent);
+
+	if (!S_ISREG(inode->i_mode))
+		return 0;
+
+	digest_cache_reset_clear_owner(inode, "path_truncate(file)");
+	digest_cache_reset_clear_owner(dir, "path_truncate(dir)");
+	return 0;
+}
+
+/**
+ * digest_cache_file_release - Last reference of a file desc is being released
+ * @file: File descriptor
+ *
+ * This function is called when the last reference of a file descriptor is
+ * being released. If the inode is a regular file and was opened for write or
+ * was created, it resets the inode and the parent directory dig_owner, to
+ * force rebuilding the digest caches.
+ */
+void digest_cache_file_release(struct file *file)
+{
+	struct inode *dir = d_backing_inode(file_dentry(file)->d_parent);
+
+	if (!S_ISREG(file_inode(file)->i_mode) ||
+	    ((!(file->f_mode & FMODE_WRITE)) &&
+	      !(file->f_mode & FMODE_CREATED)))
+		return;
+
+	digest_cache_reset_clear_owner(file_inode(file), "file_release(file)");
+	digest_cache_reset_clear_owner(dir, "file_release(dir)");
+}
+
+/**
+ * digest_cache_inode_unlink - An inode is being removed
+ * @dir: Inode of the affected directory
+ * @dentry: Dentry of the inode being removed
+ *
+ * This function is called when an existing inode is being removed. If the
+ * inode is a digest list/digest list directory, or the parent inode is the
+ * digest list directory and the inode is a regular file, it resets the
+ * affected inode dig_owner, to force rebuilding the digest cache.
+ *
+ * Return: Zero.
+ */
+int digest_cache_inode_unlink(struct inode *dir, struct dentry *dentry)
+{
+	struct inode *inode = d_backing_inode(dentry);
+
+	if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
+		return 0;
+
+	digest_cache_reset_clear_owner(inode, S_ISREG(inode->i_mode) ?
+				       "inode_unlink(file)" :
+				       "inode_unlink(dir)");
+
+	if (S_ISREG(inode->i_mode))
+		digest_cache_reset_clear_owner(dir, "inode_unlink(dir)");
+
+	return 0;
+}
+
+/**
+ * digest_cache_inode_rename - An inode is being renamed
+ * @old_dir: Inode of the directory containing the inode being renamed
+ * @old_dentry: Dentry of the inode being renamed
+ * @new_dir: Directory where the inode will be placed into
+ * @new_dentry: Dentry of the inode after being renamed
+ *
+ * This function is called when an existing inode is being moved from a
+ * directory to another (rename). If the inode is a digest list or the digest
+ * list directory, or that inode is a digest list moved from/to the digest list
+ * directory, it resets the affected inode dig_owner, to force rebuilding the
+ * digest cache.
+ *
+ * Return: Zero.
+ */
+int digest_cache_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
+			      struct inode *new_dir, struct dentry *new_dentry)
+{
+	struct inode *old_inode = d_backing_inode(old_dentry);
+
+	if (!S_ISREG(old_inode->i_mode) && !S_ISDIR(old_inode->i_mode))
+		return 0;
+
+	digest_cache_reset_clear_owner(old_inode, S_ISREG(old_inode->i_mode) ?
+				       "inode_rename(file)" :
+				       "inode_rename(dir)");
+
+	if (S_ISREG(old_inode->i_mode)) {
+		digest_cache_reset_clear_owner(old_dir,
+					       "inode_rename(from_dir)");
+		digest_cache_reset_clear_owner(new_dir,
+					       "inode_rename(to_dir)");
+	}
+
+	return 0;
+}
+
+/**
+ * digest_cache_inode_post_setxattr - An xattr was set
+ * @dentry: File
+ * @name: Xattr name
+ * @value: Xattr value
+ * @size: Size of xattr value
+ * @flags: Flags
+ *
+ * This function is called after an xattr was set on an existing inode. If the
+ * inode points to a digest cache and the xattr set is security.digest_list, it
+ * puts and clears dig_user in the inode security blob, to force retrieving a
+ * fresh digest cache.
+ */
+void digest_cache_inode_post_setxattr(struct dentry *dentry, const char *name,
+				      const void *value, size_t size, int flags)
+{
+	if (strcmp(name, XATTR_NAME_DIGEST_LIST))
+		return;
+
+	digest_cache_clear_user(d_backing_inode(dentry), dentry->d_name.name,
+				"inode_post_setxattr");
+}
+
+/**
+ * digest_cache_inode_post_removexattr - An xattr was removed
+ * @dentry: File
+ * @name: Xattr name
+ *
+ * This function is called after an xattr was removed from an existing inode.
+ * If the inode points to a digest cache and the xattr removed is
+ * security.digest_list, it puts and clears dig_user in the inode security
+ * blob, to force retrieving a fresh digest cache.
+ */
+void digest_cache_inode_post_removexattr(struct dentry *dentry,
+					 const char *name)
+{
+	if (strcmp(name, XATTR_NAME_DIGEST_LIST))
+		return;
+
+	digest_cache_clear_user(d_backing_inode(dentry), dentry->d_name.name,
+				"inode_post_removexattr");
+}
