« Volver al listado

CVE-2026-80757

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a class permission count below its inherited common

security_get_permissions() maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class_read() takes that nprim verbatim from the policy image and never checks that it covers the common. A class that inherits a common of N permissions while declaring a smaller nprim is accepted, and on load the common's permissions are written past the class-sized array -- an out-of-bounds heap write.

Reject a class whose permission count is below its inherited common's. Well-formed policies, where the class count already includes the inherited permissions, are unaffected.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80757",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "2002ff745db64ac83ee1bb9ff78196d2d68bfdb3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "38d91446630a20ce8c2a981810deea81fd61a3b5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "638213f2e6ea52c06a25861616781338d154db35",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "a63011c009ea79439b800a05602b880eb4adbb05",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "acd5b09be98fd38b7392307880156fb0452a7276",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "1b995966c3ae5244751bdaee9bfe7e17567d4fbe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "55fcf09b3fe4325c9395ebbb0322a547a157ebc7",
              "lessThan": "9a82dcd98b6e6e11cfd162410967951f12152528",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "security/selinux/ss/policydb.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.23"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.23",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "security/selinux/ss/policydb.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-03T13:06:15.493",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject a class permission count below its inherited common\n\nsecurity_get_permissions() maps an inherited common's permissions into\nan array sized by the class's own permissions.nprim, but class_read()\ntakes that nprim verbatim from the policy image and never checks that it\ncovers the common.  A class that inherits a common of N permissions while\ndeclaring a smaller nprim is accepted, and on load the common's\npermissions are written past the class-sized array -- an out-of-bounds\nheap write.\n\nReject a class whose permission count is below its inherited common's.\nWell-formed policies, where the class count already includes the\ninherited permissions, are unaffected."
    }
  ],
  "lastModified": "2026-09-03T13:06:15.493",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}