CVE-2026-80912: selinux: reject an unclaimed class value in security_get_classes()
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject an unclaimed class value in securitygetclasses()
securitygetclasses() sizes an array by pclasses.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. selmakeclasses() passes every entry to selmakedir(), reaching the same dallocname() dereference as the permission array. The class symbol table is allowed to be sparse (policydbclassisvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate.
Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected in practice?
Systems loading an SELinux policy with a declared but unclaimed class value are affected. Conforming policies that define every class they declare are unaffected.
What is required to trigger the issue?
The policy must contain a sparse class symbol table such that a class value within the declared range is not defined. This leaves a NULL entry in the class array returned by security_get_classes(), which can later be dereferenced while creating SELinux class directories.
How can I determine whether my policy is exposed?
Review the loaded or deployed SELinux policy for declared class values that are missing from the policy's class definitions. A policy that defines every declared class is not affected.
What can be done if an updated kernel cannot be deployed immediately?
Use only conforming SELinux policies that define every class they declare, and avoid loading policies with sparse or unclaimed class values.