Cloudanix VulnDB

CVE-2026-80913

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux security policy handling could let a bad policy crash the whole system instead of being safely rejected.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in SELinux boolean array handling when a policy declares more booleans than are actually defined, causing crashes on dereference in cond_evaluate_expr, security_get_bools, security_get_bool_value, and security_set_bools.

Why it matters to the business

Denial of service on Linux systems enforcing SELinux policies, potentially disrupting workloads that rely on mandatory access control and requiring restarts or policy reloads.

How an attack unfolds

An attacker supplies or triggers loading of a non-conforming SELinux policy image containing a boolean value count larger than the defined booleans; the kernel builds a sparse bool_val_to_struct array with NULL entries that are later dereferenced during access-vector decisions or selinuxfs operations.

How to fix it

Apply the upstream kernel patch that rejects undefined boolean values at policy load time in cond_index_bool; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the cond_index_bool and policydb_read logic for the new early rejection of sparse boolean values; test with a deliberately malformed policy to verify rejection instead of NULL dereference.

Typical attack path

  1. Obtain or craft a SELinux policy binary with mismatched p_bools.nprim and actual boolean definitions
  2. Cause the target kernel to load or parse the policy (via setsebool, policy load, or filesystem mount)
  3. Trigger boolean evaluation or query paths that walk the array and dereference NULL entries
  4. Induce kernel panic or process crash

How to detect it

Review kernel logs for NULL pointer dereference oopses during policy load or boolean operations; correlate with selinuxfs accesses or setsebool invocations preceding the crash.

What your security team should do

  • Prioritize kernel updates on systems with SELinux enabled in enforcing mode
  • Audit custom or third-party policy modules for conformance before deployment
  • Monitor for policy load failures after patching to detect non-conforming policies

The record

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.

Affected packages

Ecosystem Package Introduced Fixed