CVE-2026-80913: selinux: require every boolean value to be defined
In the Linux kernel, the following vulnerability has been resolved:
selinux: require every boolean value to be defined
pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool() fills boolvaltostruct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: condevaluateexpr() on the access-vector path, securitygetbools() and securitygetboolvalue() behind selinuxfs, and securitysetbools(). A sparse class value is absorbed by policydbclassisvalid() and its siblings; booleans have no such predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/align SELinux policy handling so that every boolean value encountered is rejected unless it is defined (i.e., ensure no undefined boolean values are accepted during cond_evaluate_expr() evaluation on the access-vector path).
SELinux require every boolean value to be defined = true
Event History
Frequently Asked Questions
What policy condition is required to trigger the issue?
The loaded SELinux policy must declare more boolean values in p_bools.nprim than are actually defined. This leaves NULL entries in the boolean value lookup array.
Which kernel paths can dereference the missing boolean entries?
The access-vector path can reach them through cond_evaluate_expr(). SELinux filesystem operations using security_get_bools(), security_get_bool_value(), or security_set_bools() can also dereference the entries.
Are normal SELinux policies affected?
Conforming policies that define every boolean they declare are unaffected. The fix rejects a boolean value that has no corresponding boolean definition while building the array.