CVE-2026-80756

A flaw was found in the SELinux subsystem of the Linux kernel. A local attacker could trigger a null pointer dereference by attempting to load a policy when no old policy exists and the policy conversion fails. This issue, reachable through a write operation to /sys/fs/selinux/load, could lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because successful exploitation results in a local kernel denial of service, but requires privileged access to write to the SELinux filesystem during the initial policy load. On standard Red Hat Enterprise Linux deployments, the primary policy is loaded by system initialization routines during boot, after which an active policy remains present in memory. As a result, subsequent runtime policy updates do not trigger this error path, substantially narrowing the attack window under typical operating conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.