CVE-2026-80757

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a class permission count below its inherited common

security_get_permissions() maps an inherited common's permissions into

an array sized by the class's own permissions.nprim, but class_read()

takes that nprim verbatim from the policy image and never checks that it

covers the common. A class that inherits a common of N permissions while

declaring a smaller nprim is accepted, and on load the common's

permissions are written past the class-sized array -- an out-of-bounds

heap write.

Reject a class whose permission count is below its inherited common's.

Well-formed policies, where the class count already includes the

inherited permissions, are unaffected.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References