CVE-2026-80757

A flaw was found in the Linux kernel's Security-Enhanced Linux (SELinux) component. When an SELinux policy is loaded, the system fails to properly validate the number of permissions declared by a class that inherits permissions from a common set. This oversight can lead to an out-of-bounds heap write, resulting in memory corruption. An attacker could potentially exploit this to impact system stability or integrity.

A malformed SELinux policy can define a class that inherits a common permission set while declaring fewer permissions than that common. During policy loading, security_get_permissions() can then map common permissions into an array sized by the smaller class permission count, causing an out of bounds heap write in kernel memory. For the CVSS the PR:L is used for the paranoid score because some deployments may delegate SELinux policy loading to a confined policy management process or reduced capability administrator, although typical systems require high privileges to load SELinux policy. The issue is not network reachable and requires local ability to supply or load a policy image. Impact is at least local denial of service via kernel memory corruption and in worst case may allow confidentiality, integrity, and availability impact due to the OOB heap write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.