CVE-2026-80757

selinux: reject a class permission count below its inherited common

Published Sep 3, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a class permission count below its inherited common

security_get_permissions() maps an inherited common's permissions into
an array sized by the class's own permissions.nprim, but class_read()
takes that nprim verbatim from the policy image and never checks that it
covers the common. A class that inherits a common of N permissions while
declaring a smaller nprim is accepted, and on load the common's
permissions are written past the class-sized array -- an out-of-bounds
heap write.

Reject a class whose permission count is below its inherited common's.
Well-formed policies, where the class count already includes the
inherited permissions, are unaffected.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< 2002ff745db64ac83ee1bb9ff78196d2d68bfdb3
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< 38d91446630a20ce8c2a981810deea81fd61a3b5
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< 638213f2e6ea52c06a25861616781338d154db35
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< 2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< a63011c009ea79439b800a05602b880eb4adbb05
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< acd5b09be98fd38b7392307880156fb0452a7276
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< 1b995966c3ae5244751bdaee9bfe7e17567d4fbe
`55fcf09b3fe4325c9395ebbb0322a547a157ebc7`	affected	< 9a82dcd98b6e6e11cfd162410967951f12152528

Linux

affected

Version	Status	Constraints
`2.6.23`	affected	—
`0`	unaffected	< 2.6.23
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,2002ff745db64ac83ee1bb9ff78196d2d68bfdb3)`	affected	code_commit	—
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,38d91446630a20ce8c2a981810deea81fd61a3b5)`	affected	code_commit	—
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,638213f2e6ea52c06a25861616781338d154db35)`	affected	code_commit	—
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7)`	affected	code_commit	—
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,a63011c009ea79439b800a05602b880eb4adbb05)`	affected	code_commit	—
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,acd5b09be98fd38b7392307880156fb0452a7276)`	affected	code_commit	—
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,1b995966c3ae5244751bdaee9bfe7e17567d4fbe)`	affected	code_commit	—
`[55fcf09b3fe4325c9395ebbb0322a547a157ebc7,9a82dcd98b6e6e11cfd162410967951f12152528)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.23`	affected	semver	—
`[0,2.6.23)`	unaffected	semver	—
`[5.10.266,5.11.0)`	unaffected	semver	—
`[5.15.217,5.16.0)`	unaffected	semver	—
`[6.1.184,6.2.0)`	unaffected	semver	—
`[6.6.153,6.7.0)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe
https://git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3
https://git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7
https://git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5
https://git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35
https://git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528
https://git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05
https://git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 3, 2026 1:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-122

Sep 3, 2026 7:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common security_get_permissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class_read() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write. Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected.
Title		selinux: reject a class permission count below its inherited common
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe https://git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3 https://git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7 https://git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5 https://git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35 https://git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528 https://git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05 https://git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276