CVE-2026-80757: selinux: reject a class permission count below its inherited common
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject a class permission count below its inherited common
securitygetpermissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but classread() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write.
Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that load an SELinux policy image containing a class that inherits permissions from a common while declaring a smaller permission count are exposed. Well-formed policies whose class permission count includes inherited permissions are unaffected.
What does an attacker need to exploit it?
Exploitation requires a malformed SELinux policy image with an inherited common permission count larger than the class permission count. Loading that policy causes an out-of-bounds heap write.
How can I tell whether a policy is affected?
Inspect classes that inherit a common and compare the class permission count with the inherited common's permission count. A class count below its inherited common's count is malformed and affected by this condition.