---
id: CVE-2026-80756
title: 'selinux: do not cancel a policy conversion that never started'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  selinux: do not cancel a policy conversion that never started

  sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
  fails, and that helper derefe…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    2d29983104f06f5b0babcd5a25a0f0408272cd27
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    a4f182f8715cb0819445f0850cd5436828f4bafc
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    1059789ae9f99cbbe3a78e361e9c0976beb5958b
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    1acc317d67a755a45e32419a15d70e403fa43f0e
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    a42932c6aa33d0aac683cacdf1ec7009b955ba5d
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    1b4ff94ae7c580c880291519fb0e3e2bd075beef
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    219c96de5d9b6b4af7e8576ad897b774cc3ee9a7
  - >-
    Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 <
    e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e
  - Linux 5.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:03:09.106850Z'
published: '2026-09-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:53.807Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80756'
references:
  - url: 'https://git.kernel.org/stable/c/2d29983104f06f5b0babcd5a25a0f0408272cd27'
  - url: 'https://git.kernel.org/stable/c/a4f182f8715cb0819445f0850cd5436828f4bafc'
  - url: 'https://git.kernel.org/stable/c/1059789ae9f99cbbe3a78e361e9c0976beb5958b'
  - url: 'https://git.kernel.org/stable/c/1acc317d67a755a45e32419a15d70e403fa43f0e'
  - url: 'https://git.kernel.org/stable/c/a42932c6aa33d0aac683cacdf1ec7009b955ba5d'
  - url: 'https://git.kernel.org/stable/c/1b4ff94ae7c580c880291519fb0e3e2bd075beef'
  - url: 'https://git.kernel.org/stable/c/219c96de5d9b6b4af7e8576ad897b774cc3ee9a7'
  - url: 'https://git.kernel.org/stable/c/e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05702
ingestedAt: '2026-11-06T18:00:12.534Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

selinux: do not cancel a policy conversion that never started

sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes()
fails, and that helper dereferences the outgoing policy to cancel its
sidtab conversion. On the first policy load there is no outgoing policy:
security_load_policy() returns early for that case, before it converts
anything, and state->policy is still NULL. A first load that fails while
building the selinuxfs tree therefore takes a NULL dereference in
selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.

Skip the cancel when there is no old policy, mirroring the check
security_load_policy() already makes before it converts.

## Affected

- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < 2d29983104f06f5b0babcd5a25a0f0408272cd27`
- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < a4f182f8715cb0819445f0850cd5436828f4bafc`
- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < 1059789ae9f99cbbe3a78e361e9c0976beb5958b`
- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < 1acc317d67a755a45e32419a15d70e403fa43f0e`
- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < a42932c6aa33d0aac683cacdf1ec7009b955ba5d`
- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < 1b4ff94ae7c580c880291519fb0e3e2bd075beef`
- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < 219c96de5d9b6b4af7e8576ad897b774cc3ee9a7`
- `Linux >= 02a52c5c8c3b8cbad0f12009cde9f36dbefb6972 < e5c0235a3c4e9eb047a16cd02323fe4ecf2f570e`
- `Linux 5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.