CVE-2026-80756 - Vulnerability Details

- selinux: do not cancel a policy conversion that never started

Description

In the Linux kernel, the following vulnerability has been resolved:

selinux: do not cancel a policy conversion that never started

sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
fails, and that helper dereferences the outgoing policy to cancel its
sidtab conversion. On the first policy load there is no outgoing policy:
security_load_policy() returns early for that case, before it converts
anything, and state->policy is still NULL. A first load that fails while
building the selinuxfs tree therefore takes a NULL dereference in
selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.

Skip the cancel when there is no old policy, mirroring the check
security_load_policy() already makes before it converts.

Published: 2026-09-03

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel contains a code path that attempts to cancel a policy conversion when a SELinux kernel policy load fails. When that load is the very first one, the system has no prior policy and the cancellation helper dereferences a NULL pointer, causing a kernel crash. The fault is triggered by a write(2) to /sys/fs/selinux/load, which initiates the load process.

Affected Systems

All Linux kernel releases that do not include the commit series which implements the fix are affected. The vendor list identifies the kernel broadly; no specific version range is given, so any distribution running a kernel version before the patch is potentially impacted.

Risk and Exploitability

The fault can be triggered only if an actor can write to /sys/fs/selinux/load, meaning the attack requires privilege sufficient for that write operation. The EPSS score of < 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. If successfully triggered, it results in a kernel panic and a local denial of service, requiring a reboot or patch to recover.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< 2d29983104f06f5b0babcd5a25a0f0408272cd27
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< a4f182f8715cb0819445f0850cd5436828f4bafc
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< 1059789ae9f99cbbe3a78e361e9c0976beb5958b
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< 1acc317d67a755a45e32419a15d70e403fa43f0e
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< a42932c6aa33d0aac683cacdf1ec7009b955ba5d
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< 1b4ff94ae7c580c880291519fb0e3e2bd075beef
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< 219c96de5d9b6b4af7e8576ad897b774cc3ee9a7
`02a52c5c8c3b8cbad0f12009cde9f36dbefb6972`	affected	< e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,2d29983104f06f5b0babcd5a25a0f0408272cd27)`	affected	code_commit	—
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,a4f182f8715cb0819445f0850cd5436828f4bafc)`	affected	code_commit	—
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,1059789ae9f99cbbe3a78e361e9c0976beb5958b)`	affected	code_commit	—
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,1acc317d67a755a45e32419a15d70e403fa43f0e)`	affected	code_commit	—
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,a42932c6aa33d0aac683cacdf1ec7009b955ba5d)`	affected	code_commit	—
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,1b4ff94ae7c580c880291519fb0e3e2bd075beef)`	affected	code_commit	—
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,219c96de5d9b6b4af7e8576ad897b774cc3ee9a7)`	affected	code_commit	—
`[02a52c5c8c3b8cbad0f12009cde9f36dbefb6972,e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[5.10.266,5.11.0)`	unaffected	semver	—
`[5.15.217,5.16.0)`	unaffected	semver	—
`[6.1.184,6.2.0)`	unaffected	semver	—
`[6.6.153,6.7.0)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the SELinux policy cancellation fix.
Limit write permission on /sys/fs/selinux/load to only trusted or privileged users.
If an update cannot be applied immediately, reboot the system to clear any incomplete policy state and plan to apply the patch at the next kernel upgrade.

Generated by OpenCVE AI on September 3, 2026 at 14:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1059789ae9f99cbbe3a78e361e9c0976beb5958b
https://git.kernel.org/stable/c/1acc317d67a755a45e32419a15d70e403fa43f0e
https://git.kernel.org/stable/c/1b4ff94ae7c580c880291519fb0e3e2bd075beef
https://git.kernel.org/stable/c/219c96de5d9b6b4af7e8576ad897b774cc3ee9a7
https://git.kernel.org/stable/c/2d29983104f06f5b0babcd5a25a0f0408272cd27
https://git.kernel.org/stable/c/a42932c6aa33d0aac683cacdf1ec7009b955ba5d
https://git.kernel.org/stable/c/a4f182f8715cb0819445f0850cd5436828f4bafc
https://git.kernel.org/stable/c/e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e

History

Thu, 03 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 03 Sep 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy: security_load_policy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load. Skip the cancel when there is no old policy, mirroring the check security_load_policy() already makes before it converts.
Title		selinux: do not cancel a policy conversion that never started
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1059789ae9f99cbbe3a78e361e9c0976beb5958b https://git.kernel.org/stable/c/1acc317d67a755a45e32419a15d70e403fa43f0e https://git.kernel.org/stable/c/1b4ff94ae7c580c880291519fb0e3e2bd075beef https://git.kernel.org/stable/c/219c96de5d9b6b4af7e8576ad897b774cc3ee9a7 https://git.kernel.org/stable/c/2d29983104f06f5b0babcd5a25a0f0408272cd27 https://git.kernel.org/stable/c/a42932c6aa33d0aac683cacdf1ec7009b955ba5d https://git.kernel.org/stable/c/a4f182f8715cb0819445f0850cd5436828f4bafc https://git.kernel.org/stable/c/e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-03T08:26:34.396Z

Updated: 2026-09-03T08:26:34.396Z

Reserved: 2026-08-26T14:34:25.791Z

Link: CVE-2026-80756

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-03T13:06:15.360

Modified: 2026-09-03T13:06:15.360

Link: CVE-2026-80756

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-03T17:15:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object