---
id: CVE-2026-80757
title: 'selinux: reject a class permission count below its inherited common'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  selinux: reject a class permission count below its inherited common

  security_get_permissions() maps an inherited common's permissions into
  an array sized by the class'…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    2002ff745db64ac83ee1bb9ff78196d2d68bfdb3
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    38d91446630a20ce8c2a981810deea81fd61a3b5
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    638213f2e6ea52c06a25861616781338d154db35
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    a63011c009ea79439b800a05602b880eb4adbb05
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    acd5b09be98fd38b7392307880156fb0452a7276
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    1b995966c3ae5244751bdaee9bfe7e17567d4fbe
  - >-
    Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 <
    9a82dcd98b6e6e11cfd162410967951f12152528
  - Linux 2.6.23
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:03:13.490932Z'
published: '2026-09-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:53.954Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80757'
references:
  - url: 'https://git.kernel.org/stable/c/2002ff745db64ac83ee1bb9ff78196d2d68bfdb3'
  - url: 'https://git.kernel.org/stable/c/38d91446630a20ce8c2a981810deea81fd61a3b5'
  - url: 'https://git.kernel.org/stable/c/638213f2e6ea52c06a25861616781338d154db35'
  - url: 'https://git.kernel.org/stable/c/2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7'
  - url: 'https://git.kernel.org/stable/c/a63011c009ea79439b800a05602b880eb4adbb05'
  - url: 'https://git.kernel.org/stable/c/acd5b09be98fd38b7392307880156fb0452a7276'
  - url: 'https://git.kernel.org/stable/c/1b995966c3ae5244751bdaee9bfe7e17567d4fbe'
  - url: 'https://git.kernel.org/stable/c/9a82dcd98b6e6e11cfd162410967951f12152528'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05704
ingestedAt: '2026-11-06T18:00:12.533Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a class permission count below its inherited common

security_get_permissions() maps an inherited common's permissions into
an array sized by the class's own permissions.nprim, but class_read()
takes that nprim verbatim from the policy image and never checks that it
covers the common.  A class that inherits a common of N permissions while
declaring a smaller nprim is accepted, and on load the common's
permissions are written past the class-sized array -- an out-of-bounds
heap write.

Reject a class whose permission count is below its inherited common's.
Well-formed policies, where the class count already includes the
inherited permissions, are unaffected.

## Affected

- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 2002ff745db64ac83ee1bb9ff78196d2d68bfdb3`
- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 38d91446630a20ce8c2a981810deea81fd61a3b5`
- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 638213f2e6ea52c06a25861616781338d154db35`
- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 2b7ffd7921fcbfe408fb7b372e47454e45b1e6a7`
- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < a63011c009ea79439b800a05602b880eb4adbb05`
- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < acd5b09be98fd38b7392307880156fb0452a7276`
- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 1b995966c3ae5244751bdaee9bfe7e17567d4fbe`
- `Linux >= 55fcf09b3fe4325c9395ebbb0322a547a157ebc7 < 9a82dcd98b6e6e11cfd162410967951f12152528`
- `Linux 2.6.23`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.