CVE-2026-80913: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80913 is a privilege escalation vulnerability in the Linux kernel's SELinux implementation that affects boolean value handling. This flaw could allow attackers to elevate privileges through improper validation. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-80913 Overview

CVE-2026-80913 affects the Security-Enhanced Linux (SELinux) subsystem in the Linux kernel. The vulnerability stems from insufficient validation of boolean definitions in policy images loaded into the kernel. When p_bools.nprim reports a larger count than the actual boolean entries defined in the policy, cond_index_bool() populates the bool_val_to_struct[] array sparsely, leaving NULL entries. Multiple downstream consumers walk this array by index and dereference each entry without checking for NULL, creating a kernel-mode NULL pointer dereference condition [CWE-476].

Critical Impact
A malformed SELinux policy image can trigger a kernel NULL pointer dereference through the access-vector cache, selinuxfs boolean read paths, or security_set_bools(), leading to a kernel crash and denial of service.

Affected Products

Linux kernel with SELinux enabled (multiple stable branches referenced in kernel.org fix commits)
Distributions shipping affected upstream kernels with SELinux policy loading enabled
Systems allowing privileged loading of custom SELinux policy binaries

Discovery Timeline

2026-09-04 - CVE-2026-80913 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80913

Vulnerability Analysis

The defect resides in the SELinux policy database loader. The p_bools.nprim field is read from the on-disk policy image independently of the number of boolean records that follow it in the stream. During policy load, cond_index_bool() writes each boolean structure into bool_val_to_struct[value - 1]. When nprim exceeds the number of actual boolean records processed, indices without a corresponding definition remain uninitialized NULL pointers.

Every consumer of the array walks it by index and dereferences the entry unconditionally. Affected paths include cond_evaluate_expr() on the access-vector evaluation path, security_get_bools() and security_get_bool_value() exposed via selinuxfs, and security_set_bools(). Unlike class values, which are guarded by policydb_class_isvalid() and related predicates, no equivalent validator exists for boolean values. The fix rejects the policy once at load time when a boolean value has no defining record.

Root Cause

The root cause is missing input validation on a length field in the SELinux policy binary format. The loader trusts nprim without cross-checking it against the number of boolean definitions actually present, producing a sparse array that later code assumes is dense.

Attack Vector

Exploitation requires the ability to load a crafted SELinux policy, an operation gated by CAP_MAC_ADMIN. A local privileged actor supplying a malformed policy can induce a kernel NULL pointer dereference through subsequent boolean queries or condition evaluations, resulting in a system crash. Conforming policies define every boolean they declare and are unaffected. See the upstream fix at Kernel Change 3161daa3 and related backports for implementation details.

Detection Methods for CVE-2026-80913

Indicators of Compromise

Unexpected kernel oops or panic traces referencing cond_evaluate_expr, security_get_bools, security_get_bool_value, or security_set_bools.
SELinux policy load events from non-standard sources or unsigned policy modules on production systems.
Repeated reads of /sys/fs/selinux/booleans/ immediately following a policy reload that precedes a crash.

Detection Strategies

Audit type=MAC_POLICY_LOAD records in the Linux audit log for unexpected policy loads outside change windows.
Correlate kernel crash telemetry with recent policy load activity to identify malformed-policy triggers.
Inventory hosts running kernel versions preceding the fix commits listed on git.kernel.org to prioritize remediation.

Monitoring Recommendations

Forward auditd and kernel ring buffer messages to a centralized log platform for correlation with process lineage.
Alert on invocations of semodule, load_policy, or direct writes to /sys/fs/selinux/load on servers that should not receive policy updates at runtime.
Track kernel version and SELinux enforcement state across the fleet to confirm patched hosts remain patched.

How to Mitigate CVE-2026-80913

Immediate Actions Required

Apply the stable kernel updates that include the SELinux boolean validation fix from the upstream commits.
Restrict CAP_MAC_ADMIN to a minimal set of administrative accounts and services.
Verify that only signed, vendor-provided SELinux policy modules are permitted on production systems.

Patch Information

The fix is available across multiple stable kernel branches. Reference commits include Kernel Change 3161daa3, Kernel Change 3938c849, Kernel Change 42a7107f, Kernel Change 4d0ece18, Kernel Change 4dfb997c, Kernel Change 740012ae, Kernel Change a93d37a0, and Kernel Change ed901e88. Rebuild or update to a distribution kernel package that incorporates these commits and reboot to activate.

Workarounds

Refuse runtime policy replacement by enforcing signed policy delivery through the distribution package manager only.
Audit any locally maintained SELinux policies to confirm every declared boolean has a defining record before loading.
Where feasible, disable interfaces that expose custom policy loading on multi-tenant or shared-administration hosts.

bash

# Confirm the running kernel and SELinux state, then audit recent policy loads
uname -r
getenforce
ausearch -m MAC_POLICY_LOAD -ts recent