CVE-2026-80755selinux: reject a permission value exceeding the class permission count
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count perm_read() bounds a permission value by SEL_VEC_MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. security_get_permissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not. Reject a permission whose value exceeds nprim, which is already set when perm_read() runs. Well-formed policies are unaffected. [PM: tweak comment for line length]
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 builds before 6c2ab7c4549f4f2305848df834e784651dbf1676; from 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 before dfc59a062c386d3d4415ecdab781065a645f33cc; from 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 before a7f3d4f22d920dc3c7d75f02ece0f7bf2c58437e; from 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 before d14b5d0e97fccd27974fedc03b903408872907fd | CNA record |
References
- https://git.kernel.org/stable/c/6c2ab7c4549f4f2305848df834e784651dbf1676
- https://git.kernel.org/stable/c/dfc59a062c386d3d4415ecdab781065a645f33cc
- https://git.kernel.org/stable/c/a7f3d4f22d920dc3c7d75f02ece0f7bf2c58437e
- https://git.kernel.org/stable/c/d14b5d0e97fccd27974fedc03b903408872907fd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.