CVE-2026-80755

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a permission value exceeding the class permission count

perm_read() bounds a permission value by SEL_VEC_MAX but never by the

nprim of the owning class or common, which is taken verbatim from the

policy image. security_get_permissions() then writes perms[value - 1]

into an nprim-sized kcalloc() array, so a class declaring fewer

permissions than its largest permission value drives an out-of-bounds

heap write. The top-level symbol tables are validated this way; the

nested per-class permission table is not.

Reject a permission whose value exceeds nprim, which is already set when

perm_read() runs. Well-formed policies are unaffected.

[PM: tweak comment for line length]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References