{"id":"CVE-2026-80757","title":"selinux: reject a class permission count below its inherited common","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject a class permission count below its inherited common\n\nsecurity_get_permissions() maps an inherited common's permissions into\nan array sized by the class'…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 2002ff745db64ac83ee1bb9ff78196d2d68bfdb3","Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 38d91446630a20ce8c2a981810deea81fd61a3b5","Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 638213f2e6ea52c06a25861616781338d154db35","Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7","Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < a63011c009ea79439b800a05602b880eb4adbb05","Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < acd5b09be98fd38b7392307880156fb0452a7276","Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 1b995966c3ae5244751bdaee9bfe7e17567d4fbe","Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 9a82dcd98b6e6e11cfd162410967951f12152528","Linux 2.6.23"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T17:03:13.490932Z"},"published":"2026-09-03","updated":"2026-11-06","sourceUpdated":"2026-11-06T17:05:53.954Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80757","references":[{"url":"https://git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3"},{"url":"https://git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5"},{"url":"https://git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35"},{"url":"https://git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7"},{"url":"https://git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05"},{"url":"https://git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276"},{"url":"https://git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe"},{"url":"https://git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528"}],"tags":["cve.org"],"epss":0.00165,"epssPercentile":0.05704,"ingestedAt":"2026-11-06T18:00:12.533Z","slug":"CVE-2026-80757","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nselinux: reject a class permission count below its inherited common\n\nsecurity_get_permissions() maps an inherited common's permissions into\nan array sized by the class's own permissions.nprim, but class_read()\ntakes that nprim verbatim from the policy image and never checks that it\ncovers the common.  A class that inherits a common of N permissions while\ndeclaring a smaller nprim is accepted, and on load the common's\npermissions are written past the class-sized array -- an out-of-bounds\nheap write.\n\nReject a class whose permission count is below its inherited common's.\nWell-formed policies, where the class count already includes the\ninherited permissions, are unaffected.\n\n## Affected\n\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 2002ff745db64ac83ee1bb9ff78196d2d68bfdb3`\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 38d91446630a20ce8c2a981810deea81fd61a3b5`\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 638213f2e6ea52c06a25861616781338d154db35`\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7`\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < a63011c009ea79439b800a05602b880eb4adbb05`\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < acd5b09be98fd38b7392307880156fb0452a7276`\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 1b995966c3ae5244751bdaee9bfe7e17567d4fbe`\n- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 9a82dcd98b6e6e11cfd162410967951f12152528`\n- `Linux 2.6.23`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}