CVE-2026-80912selinux: reject an unclaimed class value in security_get_classes()
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.
Timeline
ID reserved
By Linux
- 9 days later
· 9 days later
Published
- 10 days later
· 10 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < d2e7f7035d6f407119ba5467f7218cc4370844fc
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < f38a71868888285efc9c0ab5b032e23919c5a0a1
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < 3480c081c23d559fd9a6921b76955664f2e95153
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < e0285bb152211c00900136b66d4b420c14a59094
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < 099869e9343a5f8c22b58497f074b34f63cbf856
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < 841aea4d5a25e16273d04cd07a74142b4687e03b
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < d8a10899ea3c84b80de72ca8ee9039e9a5156c9a
- affected 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 – < 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd
- affected 2.6.23
- unaffected < 2.6.23
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.153 – ≤ 6.6.*
- unaffected 6.12.105 – ≤ 6.12.*
- unaffected 6.18.46 – ≤ 6.18.*
- unaffected 7.1.10 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/d2e7f7035d6f407119ba5467f7218cc4370844fc (opens in a new tab)
- https://git.kernel.org/stable/c/f38a71868888285efc9c0ab5b032e23919c5a0a1 (opens in a new tab)
- https://git.kernel.org/stable/c/3480c081c23d559fd9a6921b76955664f2e95153 (opens in a new tab)
- https://git.kernel.org/stable/c/e0285bb152211c00900136b66d4b420c14a59094 (opens in a new tab)
- https://git.kernel.org/stable/c/099869e9343a5f8c22b58497f074b34f63cbf856 (opens in a new tab)
- https://git.kernel.org/stable/c/841aea4d5a25e16273d04cd07a74142b4687e03b (opens in a new tab)
- https://git.kernel.org/stable/c/d8a10899ea3c84b80de72ca8ee9039e9a5156c9a (opens in a new tab)
- https://git.kernel.org/stable/c/22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-71615 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-80912)Record last updated .