CVE-2026-80755 selinux: reject a permission value exceeding the class permission count
A local attacker with high privileges can trigger an out-of-bounds heap write in the Linux kernel SELinux subsystem, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80755?
CVE-2026-80755 is a memory corruption vulnerability in Linux, published on 3 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
selinux: reject a permission value exceeding the class permission count
perm_read() bounds a permission value by SEL_VEC_MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. security_get_permissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not.
Reject a permission whose value exceeds nprim, which is already set when perm_read() runs. Well-formed policies are unaffected.
[PM: tweak comment for line length]
Which versions are affected by CVE-2026-80755?
How do I fix CVE-2026-80755?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80755 being exploited?
There is no known exploitation of CVE-2026-80755 in the wild and no public exploit code.
Sources
Also known as AZL-99056, BELL-CVE-2026-80755, DEBIAN-CVE-2026-80755, GHSA-jcj2-5fhp-x66j, UBUNTU-CVE-2026-80755.