Executive brief
The Linux kernel's SELinux security module contains a heap buffer overflow in its permission parsing logic. A malicious or malformed SELinux policy file can specify permission values that exceed the declared class permission count, causing an out-of-bounds write to kernel heap memory. This could allow a local attacker with the ability to load a policy to corrupt kernel memory and potentially achieve code execution.
Technical details
The vulnerability is a heap out-of-bounds write in the SELinux policy database parser. The perm_read() function validates permission values against SEL_VEC_MAX but fails to validate against the nprim (permission count) of the owning class. When security_get_permissions() later indexes a kmalloc-allocated array of size nprim with an unchecked permission value, it writes out-of-bounds. The attack vector requires loading a crafted SELinux policy file, typically available only to privileged users. The fix adds validation to reject any permission value exceeding the class's declared permission count. Well-formed policies are unaffected by this check.
Affected products
- Linux Linux kernel All versions with SELinux policy query support (from 55fcf09b3fe4 onwards)
Timeline
- 2026-09-03: disclosed: CVE-2026-80755 published
- 2026-09-02: patched: Fix merged to stable kernel branches