Cloudanix VulnDB

CVE-2026-98413

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Linux security checks could occasionally rely on random leftover data instead of proper rules, potentially allowing unintended access or causing system problems.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

avc_has_perm_noaudit() returns without initializing the access decision structure when the requested permission set is empty, causing callers to use uninitialized stack data in avc_audit() and per-task decision caches.

Why it matters to the business

Unpredictable SELinux authorization decisions on Linux systems can lead to policy bypass risks or kernel instability affecting system reliability and security posture.

How an attack unfolds

An attacker invokes SELinux permission checks that pass an empty permission set, triggering the early return path that leaves the decision buffer uninitialized and subsequently processed by audit and caching logic.

How to fix it

Apply the upstream kernel patch that initializes a deny-all, audit-all decision in avc_has_perm_noaudit() before the early return; update to a patched Linux kernel release.

How to confirm the fix worked

Inspect kernel source for the initialization fix in avc_has_perm_noaudit(), or confirm deployment of updated kernel packages containing the SELinux AVC decision change.

Typical attack path

  1. Invoke SELinux hooks or permission checks with empty requested permissions
  2. Trigger early return in avc_has_perm_noaudit() leaving avd uninitialized
  3. Feed uninitialized decision to avc_audit() or store in per-task cache

How to detect it

Review kernel audit logs and SELinux AVC records for unexpected decision patterns or errors originating from avc_audit calls; correlate with processes invoking permission checks.

What your security team should do

  • Prioritize kernel updates on all Linux systems using SELinux
  • Test patched kernels in staging before broad rollout
  • Monitor kernel logs for SELinux-related anomalies during transition

The record

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.

Affected packages

Ecosystem Package Introduced Fixed