Executive brief
SELinux is a mandatory access control mechanism in the Linux kernel that enforces security policies. A flaw in policy parsing allows a specially crafted SELinux policy file to declare a class with fewer permissions than its inherited common, causing kernel memory corruption when the policy is loaded. An attacker with the ability to load a custom SELinux policy could cause a kernel crash or potentially achieve code execution.
Technical details
The vulnerability is a heap buffer overflow in the SELinux policy loader (security/selinux/ss/policydb.c). The class_read() function accepts a permission count (nprim) from the policy image without validating that it covers the permissions inherited from a common definition. Later, security_get_permissions() maps inherited common permissions into an array sized by the class's nprim, writing past the allocated buffer when nprim is smaller than the common's permission count. This results in an out-of-bounds heap write. The fix adds validation to reject any class whose permission count is below its inherited common's count. The vulnerability requires the ability to load a malformed SELinux policy file.
Affected products
- Linux Linux Kernel 2.6.11 through 6.x (prior to fix in 2026-08-23)
Timeline
- 2026-09-03: disclosed: CVE-2026-80757 published
- 2026-08-23: patched: Fix committed to stable kernel branches by Greg Kroah-Hartman
- 2026-07-27: other: Original upstream patch authored by Bryam Vargas