Executive brief
The Linux kernel's SELinux (Security Enhanced Linux) module contains a flaw in how it retrieves security class information from the kernel security policy. When a SELinux policy contains sparse or incomplete class definitions, the kernel can pass a null pointer to internal directory creation functions, potentially causing a kernel crash. This affects system stability on Linux systems using non-standard or malformed SELinux policies.
Technical details
The vulnerability exists in the security_get_classes() function in security/selinux/ss/services.c. The function allocates an array sized by p_classes.nprim and fills it based on hash table entries, but does not validate that all entries in the allocated array are populated. If a SELinux policy defines a class value that is not actually claimed (sparse class symbol table), a NULL pointer remains in the array. This NULL is subsequently passed to sel_make_classes() and then to sel_make_dir(), which dereferences it without null checking. The fix adds validation to reject lookups when unclaimed class values are found, returning an error instead of a null pointer. The attack vector requires a malformed SELinux policy file to be loaded; conforming policies are unaffected.
Affected products
- Linux Linux kernel multiple versions prior to fix commit 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd
Timeline
- 2026-09-04: disclosed: CVE-2026-80912 published
- 2026-08-03: patched: Fix committed upstream by Paul Moore
- 2026-08-23: patched: Fix backported to stable releases by Greg Kroah-Hartman