CVE-2026-80912

What it actually does

NULL pointer dereference in d_alloc_name() triggered when security_get_classes() builds an array from a sparse SELinux class symbol table containing an undefined class value.

Why it matters to the business

Kernel panic or denial of service on systems enforcing SELinux policies that contain undeclared classes, with potential for local privilege escalation if the dereference is turned into a write primitive.

How an attack unfolds

An attacker with the ability to load or influence a non-conforming SELinux policy triggers security_get_classes() or sel_make_classes() with an unclaimed class value, causing the kernel to dereference a NULL pointer during directory entry allocation.

How to fix it

Update to a Linux kernel containing the fix that rejects unclaimed class values in security_get_classes(). Rebuild and reload conforming SELinux policies if custom modules are in use.

How to confirm the fix worked

Confirm the presence of the upstream patch that adds a predicate check before indexing the class array; test by loading a deliberately sparse policy and verifying that security_get_classes() now returns an error instead of a NULL entry.

Typical attack path

1. Craft or load a SELinux policy with a class symbol table that leaves a declared class value undefined
2. Invoke security_get_classes() or code paths that call sel_make_classes()
3. Trigger d_alloc_name() on the resulting NULL entry
4. Cause kernel crash or attempt to leverage the NULL dereference for code execution

How to detect it

Search kernel logs for NULL pointer dereference oops mentioning selinux, d_alloc_name, or security_get_classes shortly after policy load events; examine audit logs for unusual class queries.

What your security team should do

• Prioritize kernel updates on all systems that enforce SELinux
• Audit custom or third-party SELinux policies for sparse class tables
• Enable kernel crash reporting and monitor for SELinux-related oops in system logs
• Restrict unprivileged policy loading where possible