CVE-2026-80913 selinux: require every boolean value to be defined
A null pointer dereference in the Linux kernel SELinux subsystem allows a local privileged attacker to cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80913?
CVE-2026-80913 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
selinux: require every boolean value to be defined
p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
Which versions are affected by CVE-2026-80913?
How do I fix CVE-2026-80913?
Apply the vendor's patch.
Is CVE-2026-80913 being exploited?
There is no known exploitation of CVE-2026-80913 in the wild and no public exploit code.
Sources
Also known as AZL-99455, BELL-CVE-2026-80913, DEBIAN-CVE-2026-80913, GHSA-97qf-47rv-vfvf, UBUNTU-CVE-2026-80913.