Executive brief
The Linux kernel's SELinux security module validates policy files during boot or policy loading. A malformed policy file with declared but undefined boolean values could leave null entries in a lookup table, causing the kernel to crash when the security policy is evaluated during file access checks or policy queries. This could lead to a denial of service affecting system availability.
Technical details
The vulnerability is a null pointer dereference in SELinux's policy database indexing logic. The `p_bools.nprim` count from a policy image can exceed the number of actual boolean definitions, causing `cond_index_bool()` to create sparse entries in the `bool_val_to_struct[]` array. Consumers of this array—including `cond_evaluate_expr()` on the access-vector path, and `security_get_bools()`, `security_get_bool_value()`, and `security_set_bools()` behind selinuxfs—walk the array by index and dereference each entry without null checks. The fix adds validation in `policydb_index()` to reject any boolean value that is declared but not defined, preventing sparse arrays. Patches have been committed to stable kernel branches (commit a93d37a09b863810653f93d371fb197457d59deb upstream).
Affected products
- Linux Linux kernel 2.6.12 and later (affecting all versions until patched)
Timeline
- 2026-07-31: other: Patch authored by Bryam Vargas
- 2026-09-04: disclosed: CVE-2026-80913 published
- 2026-08-23: patched: Patch merged to stable kernel branches