CVE-2026-80755: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80755 is an out-of-bounds heap write vulnerability in the Linux kernel's SELinux subsystem, specifically in the perm_read() function's handling of permission values during policy loading. The flaw exists because perm_read() bounds permission values only by SEL_VEC_MAX and not by the nprim (permission count) of the owning class or common, allowing a malformed SELinux policy to trigger an out-of-bounds write in kernel memory. The vulnerability affects Linux kernel versions from 2.6.23 onward, with fixes available in 6.12.108, 6.18.49, 7.1.13, and 7.2+. It was published on September 3, 2026, with patches released the same day. Feedly estimates the severity as HIGH, with an EPSS score of approximately 0.2% (Github Advisory, Feedly).

The root cause is an improper input validation flaw (CWE class: out-of-bounds write) in the Linux kernel's SELinux policy parsing code. Specifically, perm_read() reads permission values verbatim from the policy image and only validates them against SEL_VEC_MAX, but never against the nprim field of the owning class or common permission table. When security_get_permissions() subsequently processes these values, it writes to perms[value - 1] within an nprim-sized kcalloc() array — if a class declares fewer permissions than its largest permission value, this results in an out-of-bounds heap write. The validation gap is specific to the nested per-class permission table; top-level symbol tables are correctly validated. Exploitation requires the ability to load a crafted SELinux policy file into the kernel (Github Advisory).

Successful exploitation can lead to arbitrary code execution with kernel privileges, representing a full system compromise. An attacker who can load a malicious SELinux policy — typically requiring elevated privileges or a secondary vulnerability enabling policy loading — could corrupt kernel heap memory, potentially enabling privilege escalation, data exfiltration, or complete control of the affected system. Well-formed, legitimate SELinux policies are not affected by this vulnerability (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.2% (0.002), placing it in the 10th percentile for exploitation likelihood within 30 days. Exploitation is constrained by the precondition that an attacker must be able to load a crafted SELinux policy into the kernel, which typically requires significant existing access (Github Advisory, Feedly).

Patches have been released for multiple stable kernel branches. Users should upgrade to Linux kernel version 6.12.108 or later (for the 6.12.x branch), 6.18.49 or later (for the 6.18.x branch), 7.1.13 or later (for the 7.1.x branch), or 7.2+. The fix adds a validation check in perm_read() to reject any permission value that exceeds nprim, the permission count of the owning class or common. As a configuration-based mitigation, restrict the ability to load SELinux policies to trusted administrative accounts only, and validate SELinux policy files from trusted sources before loading them into production systems (Github Advisory, Feedly).

The vulnerability was announced via the Linux kernel CVE announcement mailing list and picked up by standard vulnerability tracking services including VulDB, CIRCL, and Tenable's Nessus (detection ID 342730). No notable independent researcher commentary or significant social media discussion has been identified beyond routine vulnerability database entries (Feedly).