CVE-2026-80756: selinux: do not cancel a policy conversion that never started
In the Linux kernel, the following vulnerability has been resolved:
selinux: do not cancel a policy conversion that never started
selwriteload() calls selinuxpolicycancel() when selmakepolicynodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy: securityloadpolicy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinuxpolicycancel(), reached from a write(2) to /sys/fs/selinux/load.
Skip the cancel when there is no old policy, mirroring the check securityloadpolicy() already makes before it converts.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this flaw be triggered?
It requires the first SELinux policy load to fail while sel_make_policy_nodes() is building the selinuxfs tree. The failing load is reached through a write(2) to /sys/fs/selinux/load.
What is the impact when the issue is triggered?
The kernel takes a NULL-pointer dereference in selinux_policy_cancel() because there is no outgoing policy during the first policy load. The description identifies this as a failure path rather than a successful policy-load path.
Are systems with an existing SELinux policy already loaded affected by this specific path?
The described NULL dereference is specific to the first policy load, when state->policy is still NULL and no old policy exists. The data does not indicate that subsequent policy reloads use the same NULL-policy condition.
What change addresses the problem?
The fix skips selinux_policy_cancel() when no old policy exists, matching the existing check in security_load_policy() before policy conversion. Referenced stable-kernel commits contain the remediation.