CVE-2026-80912: Linux Kernel SELinux Privilege Escalation

CVE-2026-80912 Overview

CVE-2026-80912 is a null pointer dereference vulnerability in the Linux kernel's Security-Enhanced Linux (SELinux) subsystem. The flaw resides in the security_get_classes() function, which sizes an array by p_classes.nprim and populates entries at value - 1. When a policy leaves a class value unclaimed, the corresponding slot remains NULL. The sel_make_classes() function then passes every entry to sel_make_dir(), triggering a d_alloc_name() dereference on the NULL pointer. Conforming SELinux policies that define every declared class are unaffected.

Critical Impact
A sparse SELinux class symbol table can cause a kernel NULL pointer dereference in sel_make_classes(), resulting in a denial-of-service condition on affected Linux kernel builds.

Affected Products

Linux kernel builds containing the vulnerable security_get_classes() implementation in the SELinux subsystem
Systems loading SELinux policies with sparse class symbol tables
Distributions shipping kernels prior to the upstream fixes referenced in the stable git commits

Discovery Timeline

2026-09-04 - CVE-2026-80912 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80912

Vulnerability Analysis

The vulnerability lives in the SELinux security server code path exposed through selinuxfs. The security_get_classes() function allocates an array whose size is derived from p_classes.nprim, the highest class value declared in the loaded policy. It then walks the class hash table and stores each entry at index value - 1. Any class value the policy never defines leaves a NULL slot in that array.

The caller, sel_make_classes(), iterates over every array entry unconditionally and hands each one to sel_make_dir(). That helper reaches d_alloc_name(), which dereferences the supplied pointer. When the slot is NULL, the kernel dereferences a null pointer while creating selinuxfs directory entries for classes.

Elsewhere in the kernel, policydb_class_isvalid() exists precisely to absorb sparse class tables. The getter added its own array-building logic without invoking that predicate, so sparse policies bypass the existing validity check.

Root Cause

The root cause is missing input validation on the reconstructed class array. security_get_classes() assumes contiguous class values from 1 to nprim, but the SELinux class symbol table is permitted to be sparse. Unclaimed indices remain NULL, and no check filters them before consumers dereference the pointers.

Attack Vector

Triggering the flaw requires the ability to load an SELinux policy whose class symbol table is sparse. On systems where such a policy is loaded, subsequent selinuxfs operations that walk the class list can reach the NULL dereference and crash the kernel. Conforming policies that define every class they declare do not exercise the vulnerable path.

No verified proof-of-concept code is publicly available. See the upstream fix commits for technical detail: Kernel Git Commit 099869e, Kernel Git Commit 22b05fe, Kernel Git Commit 841aea4, Kernel Git Commit d8a1089, and Kernel Git Commit e0285bb.

Detection Methods for CVE-2026-80912

Indicators of Compromise

Kernel oops or panic messages referencing sel_make_classes, sel_make_dir, or d_alloc_name in the call trace
Unexpected process termination or system reboots correlated with SELinux policy load operations
Custom or third-party SELinux policy modules that declare classes non-contiguously

Detection Strategies

Inventory kernel package versions across Linux hosts and compare against the fixed builds referenced in the upstream stable commits
Audit SELinux policy sources for sparse class declarations that leave gaps in the class value range
Review dmesg and journal logs for NULL pointer dereference traces originating in the SELinux subsystem

Monitoring Recommendations

Forward kernel crash telemetry and kdump artifacts to a centralized logging platform for pattern analysis
Alert on repeated SELinux policy reload events, particularly from non-standard sources
Track selinuxfs access patterns from userspace processes that enumerate class directories under /sys/fs/selinux/class/

How to Mitigate CVE-2026-80912

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable commits and reboot affected systems
Restrict the ability to load SELinux policies to trusted administrative accounts only
Validate custom SELinux policies for contiguous class value declarations before deployment

Patch Information

The fix rejects the lookup when a class value went unclaimed rather than returning a NULL entry to callers. The patch is available across multiple stable branches: Kernel Git Commit 099869e, Kernel Git Commit 22b05fe, Kernel Git Commit 841aea4, Kernel Git Commit d8a1089, and Kernel Git Commit e0285bb. Rebuild or update to a distribution kernel that incorporates one of these commits.

Workarounds

Load only conforming SELinux policies that define every class they declare, eliminating sparse class tables
Limit administrative access to policy management tooling such as semodule and load_policy
Where feasible, enable kernel lockdown to restrict the loading of untrusted policy modules

bash

# Verify running kernel version and SELinux policy status
uname -r
sestatus

# List currently loaded SELinux policy modules for review
semodule -l