CVE-2026-80755

A flaw was found in the Linux kernel's Security-Enhanced Linux (SELinux) subsystem. This vulnerability occurs because the system does not properly check the size of permission values when processing security policies. A specially crafted SELinux policy could cause the kernel to write data outside of its intended memory area, leading to memory corruption. This could potentially result in a system crash (denial of service) or other unpredictable behavior.

SELinux policy parsing did not reject a permission value that is greater than the permission count of the owning class or common block. security_get_permissions later allocates an nprim-sized array and writes to perms(value - 1), so a malformed policy image can drive a kernel heap out-of-bounds write. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate policy loading to a reduced-privilege root, service account, or policy management component rather than a full system administrator. The issue is not directly network reachable and normally requires local access to a SELinux policy load path. Impact is at least denial of service via kernel memory corruption and in worst case may allow privilege escalation, so the issue should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.