In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a class permission count below its inherited common

security_get_permissions() maps an inherited common's permissions into
an array sized by the class's own permissions.nprim, but class_read()
takes that nprim verbatim from the policy image and never checks that it
covers the common. A class that inherits a common of N permissions while
declaring a smaller nprim is accepted, and on load the common's
permissions are written past the class-sized array -- an out-of-bounds
heap write.

Reject a class whose permission count is below its inherited common's.
Well-formed policies, where the class count already includes the
inherited permissions, are unaffected.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe cve-icon cve-icon
https://git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3 cve-icon cve-icon
https://git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7 cve-icon cve-icon
https://git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5 cve-icon cve-icon
https://git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35 cve-icon cve-icon
https://git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528 cve-icon cve-icon
https://git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05 cve-icon cve-icon
https://git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276 cve-icon cve-icon
History

Thu, 03 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122

Thu, 03 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common security_get_permissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class_read() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write. Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected.
Title selinux: reject a class permission count below its inherited common
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-03T08:26:35.005Z

Reserved: 2026-08-26T14:34:25.791Z

Link: CVE-2026-80757

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T13:06:15.493

Modified: 2026-09-03T13:06:15.493

Link: CVE-2026-80757

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T13:30:04Z

Weaknesses