CVE-2026-80913
Received Received - Intake

SELinux Policy Boolean Validation Bypass

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80913
EUVD
EUVD-2026-71616

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of boolean values in SELinux policies. The issue occurs when the number of boolean values in the policy exceeds the defined count, leading to NULL entries in an array. These NULL entries can cause dereferencing errors when accessed by functions like cond_evaluate_expr, security_get_bools, and security_set_bools, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's SELinux implementation and requires checking SELinux boolean definitions. No direct commands are provided in the context, but you can inspect SELinux booleans using 'sestatus', 'getsebool -a', or 'cat /sys/fs/selinux/booleans/*' to verify boolean values. If any boolean lacks a definition, it may indicate exposure.

Impact Analysis

If exploited, this vulnerability could lead to denial-of-service conditions, system crashes, or unauthorized access to sensitive data. Systems relying on SELinux for security enforcement may be particularly affected, as the flaw could bypass intended access controls.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this issue. Ensure SELinux policies are correctly defined and validated to avoid undefined boolean values. Review and correct any custom policies that may declare booleans without proper definitions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart