UBUNTU-CVE-2026-80913: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool() fills boolvaltostruct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: condevaluateexpr() on the access-vector path, securitygetbools() and securitygetboolvalue() behind selinuxfs, and securitysetbools(). A sparse class value is absorbed by policydbclassisvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.