Executive brief
A bug in the Linux kernel's SELinux (Security Enhanced Linux) security subsystem can cause a system crash when attempting to load a SELinux policy for the first time and the load fails during filesystem tree construction. An attacker with write access to the SELinux policy interface (/sys/fs/selinux/load) can trigger a null pointer dereference, causing a denial of service on systems using SELinux.
Technical details
The vulnerability is a null pointer dereference in the selinux_policy_cancel() function. When sel_write_load() attempts to load a SELinux policy and sel_make_policy_nodes() fails, it calls selinux_policy_cancel() to clean up. However, on the first policy load, there is no existing (outgoing) policy in state->policy, yet the code unconditionally dereferences this null pointer when calling sidtab_cancel_convert(oldpolicy->sidtab). The attack vector requires write access to /sys/fs/selinux/load, which is typically restricted but may be accessible in certain configurations. The fix adds a simple null check before dereferencing the oldpolicy pointer, ensuring the cancel operation only proceeds when there is an actual previous policy to cancel.
Affected products
- Linux Linux kernel Multiple versions from 2.6.11 through 7.x (affected versions depend on when the regression was introduced)
Timeline
- 2026-09-03: disclosed: Published in NVD
- 2026-08-23: patched: Fix merged into stable kernel trees