CVE-2026-98413

Received Received - Intake

SELinux AVC Decision Filling in Linux Kernel

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98413

EUVD

EUVD-2026-101062

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	e6f2f381e4015386a656a369835f949c26000e6b
Linux	Linux	5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a function called avc_has_perm_noaudit() which is supposed to return an access decision in a buffer but fails to do so when the requested permission set is empty. This leaves the buffer uninitialized, potentially causing undefined behavior or security issues as callers rely on this buffer for auditing and caching.

Detection Guidance

This vulnerability is specific to the Linux kernel's SELinux implementation and requires kernel-level inspection. Detection involves checking the kernel version and SELinux policies for the affected function behavior. No direct network or remote commands are applicable.

Impact Analysis

This vulnerability could lead to incorrect access control decisions, audit logs missing critical information, or potential security bypasses if the uninitialized buffer affects how permissions are enforced or logged on the system.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel SELinux access control flaw. Compliance implications would depend on how the vulnerability is exploited in a specific environment, but the CVE itself does not describe data exposure or unauthorized access scenarios that would directly violate these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the SELinux AVC decision flaw. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70