selinux: reject a class permission count below its inherited common
Summary
| CVE | CVE-2026-80757 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-03 13:06:15 UTC |
| Updated | 2026-09-03 13:06:15 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common security_get_permissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class_read() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write. Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected. |
Risk And Classification
EPSS: 0.002100000 probability, percentile 0.112190000 (date 2026-09-07)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 2002ff745db64ac83ee1bb9ff78196d2d68bfdb3 git | Not specified |
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 38d91446630a20ce8c2a981810deea81fd61a3b5 git | Not specified |
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 638213f2e6ea52c06a25861616781338d154db35 git | Not specified |
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7 git | Not specified |
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 a63011c009ea79439b800a05602b880eb4adbb05 git | Not specified |
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 acd5b09be98fd38b7392307880156fb0452a7276 git | Not specified |
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 1b995966c3ae5244751bdaee9bfe7e17567d4fbe git | Not specified |
| CNA | Linux | Linux | affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 9a82dcd98b6e6e11cfd162410967951f12152528 git | Not specified |
| CNA | Linux | Linux | affected 2.6.23 | Not specified |
| CNA | Linux | Linux | unaffected 2.6.23 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.266 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.217 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.184 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.153 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.105 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.46 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.10 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.