CVE-2026-80755: selinux: reject a permission value exceeding the class permission count
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject a permission value exceeding the class permission count
permread() bounds a permission value by SELVECMAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. securitygetpermissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not.
Reject a permission whose value exceeds nprim, which is already set when permread() runs. Well-formed policies are unaffected.
[PM: tweak comment for line length]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.13-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.108 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.49 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What must an attacker control to trigger the out-of-bounds write?
They need to supply or cause the kernel to load an SELinux policy containing a nested per-class permission whose numeric value is greater than that class or common's declared permission count (nprim). The vulnerability is in parsing malformed policy data rather than normal permission checks.
Are ordinary, well-formed SELinux policies affected?
No. The fix explicitly preserves well-formed policies; the vulnerable condition requires a class to declare fewer permissions than the largest permission value listed in its nested permission table.
What can be done if the kernel update cannot be applied immediately?
Avoid loading untrusted or malformed SELinux policy images, and restrict policy creation, modification, and loading to trusted administrative workflows. The provided information does not identify another mitigation in the kernel.
How can administrators determine whether a policy could trigger this issue?
Inspect policy generation or validation processes for per-class and common permission entries whose numeric permission value exceeds the declared nprim permission count. Such a policy is malformed and is rejected by the resolved code.