Strix
63.4K

CVE-2026-80912

UnknownEPSS 0.16%

Last modified

CVE-2026-80912 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.

Metrics

EPSS Probability
0.16%

5.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < d2e7f7035d6f407119ba5467f7218cc4370844fc; >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < f38a71868888285efc9c0ab5b032e23919c5a0a1; >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < 3480c081c23d559fd9a6921b76955664f2e95153; >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < e0285bb152211c00900136b66d4b420c14a59094; >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < 099869e9343a5f8c22b58497f074b34f63cbf856; >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < 841aea4d5a25e16273d04cd07a74142b4687e03b; >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < d8a10899ea3c84b80de72ca8ee9039e9a5156c9a; >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7, < 22b05fec62c0fe9864cfceb52f7d0f3a34d9b1dd
LinuxLinux2.6.23

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-80912?
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.
How severe is CVE-2026-80912?
Severity scoring for CVE-2026-80912 is pending analysis. The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-80912?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-80912?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST