Executive brief
A vulnerability in the Linux kernel's SELinux component could allow a local user to prevent other processes from reading the system's security policy. By keeping the policy file open, a malicious or malfunctioning application can block legitimate security tools from functioning correctly. This issue primarily impacts the availability of security auditing and management tools on the system.
Technical details
A flaw in security/selinux/selinuxfs.c in the Linux kernel utilized a global 'policy_opened' flag to restrict /sys/fs/selinux/policy to a single concurrent open caller. A local attacker with permission to read the policy could open the file and hold the descriptor indefinitely, preventing other authorized processes (such as security scanners or policy managers) from reading the kernel policy. The fix eliminates the policy_opened flag and optimizes the critical section protected by the policy_mutex to allow multiple concurrent readers. This is classified as a local denial-of-service (DoS) vulnerability.
Affected products
- Linux Linux Kernel All versions prior to the fix in June 2026
Timeline
- 2026-05-05: patched: Initial patch authored by Stephen Smalley
- 2026-06-08: disclosed: CVE published in NVD dataset