An SELinux module can declare a class that inherits more permissions than it advertises in its own permission count. During policy loading the kernel allocates an array sized by the class’s declared permission count but then copies the inherited permissions into that array without bounds checking. The write therefore can overwrite adjacent kernel heap memory. This out‑of‑bounds heap write could corrupt kernel data structures, potentially allowing privilege escalation to root or causing a system crash, which affects confidentiality, integrity, or availability.

All Linux kernel distributions that ship the standard SELinux policy handling and that have not applied the recent patch are potentially affected. The vulnerability is present whenever an SELinux policy containing a class with a declared permission count lower than those inherited from a common is loaded. No specific kernel version range is disclosed, so every distribution using the default SELinux implementation should consider the risk.

The CVSS score is not disclosed and the EPSS data is unavailable; nevertheless, an unchecked out‑of‑bounds heap write is considered high severity. KEV does not list this vulnerability, indicating no confirmed exploits. The likely attack vector is local: an attacker must have the ability to configure or load a custom SELinux policy, which typically requires root privileges or access to a privileged account that can modify policy files. Inferred that the attacker would create a policy where a class’s permission count is smaller than the inherited common’s, thereby triggering the vulnerability. While no public exploits have been reported, the potential for kernel memory corruption and the high impact of successful exploitation warrant immediate mitigation.