CVE-2026-98413

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

selinux: always fill AVC decision in avc_has_perm_noaudit()

avc_has_perm_noaudit() is documented to return a copy of the access

decision in @avd, but its early return for an empty requested permission

set leaves the buffer untouched. All callers pass an uninitialized

stack variable and afterwards feed it to avc_audit(), and the inode hook

even stores it in the per-task decision cache.

Fill in a deny-all, audit-all decision, similar to avd_init(), so every

caller receives a defined value at no cost on the hot path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References