CVE-2026-80756 in Linux
Summary
by MITRE • 09/03/2026
In the Linux kernel, the following vulnerability has been resolved:
selinux: do not cancel a policy conversion that never started
sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy: security_load_policy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.
Skip the cancel when there is no old policy, mirroring the check security_load_policy() already makes before it converts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The Linux Security Modules framework, specifically the SELinux implementation, contains a critical null pointer dereference vulnerability within the policy loading mechanism that can lead to kernel panic or denial of service conditions. This flaw resides in the sel_write_load function which is invoked when user-space applications attempt to load new security policies via writes to the /sys/fs/selinux/load interface. The core issue arises from an improper state check during error handling paths where the system attempts to clean up resources allocated for a policy conversion that was never successfully initiated.
When a policy load operation fails during the construction of the selinuxfs tree, specifically within the sel_make_policy_nodes function, the kernel erroneously proceeds to call selinux_policy_cancel(). This helper function is designed to revert changes made by an ongoing policy conversion and involves dereferencing the outgoing policy structure to cancel its security identifier table sidtab conversion. However, during a first-time policy load or when no previous valid policy exists in memory, the state pointer for the current policy remains null because security_load_policy returns early before any actual conversion takes place. Consequently, attempting to access members of this non-existent policy object results in a NULL pointer dereference.
This vulnerability allows an unprivileged local user with write access to the SELinux load interface to trigger a kernel crash by repeatedly failing policy loads under specific conditions where no prior policy is loaded. The operational impact includes system instability and potential denial of service as the kernel panics upon encountering the invalid memory reference. This aligns with CWE-476 which describes null pointer dereference vulnerabilities that occur when software attempts to use an object without verifying it first, leading to unexpected termination or crashes.
From a threat modeling perspective utilizing the MITRE ATT&CK framework this vulnerability can be classified under T1529 System Shutdown Reboot as attackers may leverage such kernel panics to disrupt service availability effectively performing a denial of service attack against systems relying on SELinux for mandatory access control enforcement. The lack of proper state validation before resource cleanup represents a fundamental logic error in the security module's lifecycle management routines that compromises system integrity and reliability during configuration changes.
To mitigate this risk developers have implemented a fix that mirrors the existing check performed by security_load_policy ensuring that selinux_policy_cancel is only invoked when there is an actual outgoing policy to cancel. This patch introduces a conditional guard that verifies the existence of the old policy state before attempting any cancellation operations thereby preventing access to null memory addresses during error handling sequences in the policy loading workflow administrators should ensure their systems are updated with this kernel fix and verify proper SELinux configuration practices to maintain robust security posture without introducing instability through improper policy management procedures.