The Linux kernel contained an out‑of‑bounds heap write in its SELinux permission handling. When a policy declares a permission value that exceeds the number of permissions defined for that class, the code still bounds the value by the maximum vector size but not by the actual class permission count. As a result, writing to the permissions array overruns the allocated buffer. This corruption can be exploited to achieve arbitrary code execution or privilege escalation at the kernel level, should an attacker be able to introduce a malicious policy entry.

All Linux distributions that ship the vulnerable kernel and use SELinux policy files. No specific kernel version ranges are listed in the data, so every current installation that accepts custom SELinux policies is potentially affected.

The vulnerability is not listed in CISA’s KEV catalog and no EPSS score is available, but the impact of a heap overflow in kernel space is severe. Attackers would need the ability to create or modify SELinux policy files, which is typically privileged. If such access is granted, the buffer overflow can be triggered without additional conditions. The absence of a public exploit does not reduce the risk because the flaw is straightforward to implement once the privilege condition is met.