In the Linux kernel SELinux module, the function avc_has_perm_noaudit() is supposed to fill an AVC decision structure before returning. When the requested permission set is empty, the function returns early and leaves the decision buffer uninitialized. Callers then rely on that buffer for audit and caching, which can lead to undefined behavior. Because the kernel may interpret the garbage contents as a decision, an attacker could potentially cause SELinux to allow or deny operations incorrectly, undermining policy enforcement and granting privileges that should be denied.

All Linux kernel releases that contain the unpatched implementation of avc_has_perm_noaudit() are potentially affected. The vulnerability is tied to the internal SELinux logic rather than a specific release number, so any kernel version prior to the inclusion of the corrective commit must be updated to a version that initializes the decision buffer properly.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% suggests a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local or kernel‑level code execution to trigger the uninitialized buffer path, and because SELinux enforcement is kernel‑level, a failure can have system‑wide effects. With no publicly available exploit, the risk is considered low to moderate, especially in environments that rely on SELinux for critical isolation.