CVE-2026-98413

A flaw was found in the Linux kernel's SELinux (Security-Enhanced Linux) subsystem. When an access check is performed with an empty permission set, the Access Vector Cache (AVC) fails to initialize the access decision structure before returning. A local attacker can exploit this flaw by triggering operations that cause the kernel to read uninitialized stack memory during audit logging and decision caching, potentially leading to a denial of service or unpredictable security enforcement.

A flaw of moderate impact was found in the Linux kernel's SELinux Access Vector Cache (AVC) subsystem as shipped in the Red Hat kernel. When avc_has_perm_noaudit() is called with an empty requested permission set, it returns early without filling in the access decision structure, leaving the caller-provided stack variable uninitialized. That uninitialized value is subsequently passed to avc_audit() for audit logging and, in the inode hook, stored in the per-task AVC decision cache, so the kernel may act on uninitialized stack memory. A local attacker with low privileges could trigger operations that perform SELinux access checks with an empty permission set, causing the kernel to use this uninitialized data during audit logging and decision caching, which can result in unpredictable SELinux enforcement or a denial of service (availability impact only; CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Within the current product scope, the Red Hat kernel in RHEL 8, RHEL 9, and RHEL 10 update streams, RHEL In-Vehicle OS (RHIVOS) 2, and the kernel shipped with OpenShift 4 and OpenShift 5 is affected. Fixes for these affected streams are currently deferred, so they will be addressed in a future planned update rather than an immediate erratum; the residual risk until then is limited to local availability impact by an already-authenticated local user, with no direct confidentiality or integrity impact. RHEL 7 is not affected because the vulnerable code is not present in that kernel, and the RHEL 6 stream is marked out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.