CVE-2026-80912
Received Received - Intake

SELinux Class Value Rejection in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80912
EUVD
EUVD-2026-71615

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where security_get_classes() fails to handle unclaimed class values properly. It creates an array based on p_classes.nprim and fills it at value - 1, leaving NULL for undefined classes. sel_make_classes() then passes these entries to sel_make_dir(), which dereferences NULL like the permission array, causing a potential crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's SELinux implementation and requires kernel-level inspection. Detection involves checking SELinux policy and kernel logs for class value handling issues. Use commands like 'dmesg | grep -i selinux' or 'ausearch -m avc -ts recent' to look for SELinux-related errors. Verify kernel version with 'uname -r' and check SELinux status with 'getenforce'.

Impact Analysis

This vulnerability could allow a local attacker to crash the system by triggering a NULL pointer dereference in the SELinux subsystem. This may lead to denial-of-service conditions affecting system availability.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this CVE. Ensure SELinux is properly configured and policies are validated. Monitor system logs for any SELinux denials or errors post-update. If using custom policies, validate them with 'checkpolicy' or similar tools.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80912. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart