CVE-2026-80913selinux: require every boolean value to be defined
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4d0ece18e648bd4362704fd087249ac697f2b7fb; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4dfb997c60f7951011d3dcbee926e3a7f80d8a76; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 740012aebdb8311332bf66e2aabf453ba73c2c45; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 42a7107f99d86a7524c37f108047dfa3db096ab5; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a93d37a09b863810653f93d371fb197457d59deb | CNA record |
References
- https://git.kernel.org/stable/c/4d0ece18e648bd4362704fd087249ac697f2b7fb
- https://git.kernel.org/stable/c/3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8
- https://git.kernel.org/stable/c/4dfb997c60f7951011d3dcbee926e3a7f80d8a76
- https://git.kernel.org/stable/c/3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40
- https://git.kernel.org/stable/c/740012aebdb8311332bf66e2aabf453ba73c2c45
- https://git.kernel.org/stable/c/42a7107f99d86a7524c37f108047dfa3db096ab5
- https://git.kernel.org/stable/c/ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec
- https://git.kernel.org/stable/c/a93d37a09b863810653f93d371fb197457d59deb
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.