CVE-2026-80913

What the bug is

p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

security/selinux/ss/policydb.c

What this is

SELINUX SECURITY MODULEMAINTAINERS section matched on security/selinux/ · selinux@vger.kernel.org · Supported

Show whether Debian builds this, per release

Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.

• bookworm, trixie, forky, sid, bookworm · linux-6.12?

?

not established - no Makefile entry for the affected file

Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS

Signals

Published

2026-09-04 (44 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.17%, higher than 5.3% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

security/selinux

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.12	5.10.266	4d0ece18e648
2.6.12	5.15.217	3938c8494d3c
2.6.12	6.1.184	4dfb997c60f7
2.6.12	6.6.153	3161daa3f1e3
2.6.12	6.12.105	740012aebdb8
2.6.12	6.18.46	42a7107f99d8
2.6.12	7.1.10	ed901e88aa3f
2.6.12	7.2	a93d37a09b86

Debian advisories