CVE-2026-80756: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80756 is a NULL pointer dereference vulnerability in the Linux kernel's SELinux policy loading mechanism. It affects the Linux kernel starting from version 5.10, with fixes available in versions 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. The flaw was published on September 3, 2026, and is estimated to be of Medium severity (GitHub Advisory). No official CVSS score has been assigned at this time, though Feedly estimates it as Medium severity (GitHub Advisory).

The vulnerability is classified as a NULL pointer dereference (CWE-476) in the SELinux subsystem of the Linux kernel. When sel_write_load() calls selinux_policy_cancel() after sel_make_policy_nodes() fails, the helper function dereferences the outgoing policy pointer to cancel its sidtab conversion — but on the first policy load, no outgoing policy exists (state->policy is NULL), leading to a kernel NULL dereference (GitHub Advisory). The attack vector is local: an attacker must be able to perform a write(2) system call to /sys/fs/selinux/load with an invalid policy payload that fails during selinuxfs tree construction. The fix adds a guard to skip the cancel operation when no old policy exists, mirroring the check already present in security_load_policy() (GitHub Advisory).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a Denial of Service (DoS) condition. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability. The affected asset is any Linux system running a vulnerable kernel version with SELinux enabled where a local user has write access to /sys/fs/selinux/load (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.21%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and write privileges to /sys/fs/selinux/load, which significantly limits the attack surface.

1. Gain local access: Obtain a local user account on a target Linux system running a vulnerable kernel (5.10 through pre-fix versions) with SELinux enabled.
2. Verify write access: Confirm write access to /sys/fs/selinux/load — this typically requires elevated privileges (e.g., root or a process with CAP_MAC_ADMIN).
3. Craft an invalid policy: Prepare a malformed or invalid SELinux policy binary that will pass initial validation in security_load_policy() but fail during sel_make_policy_nodes() when building the selinuxfs tree.
4. Trigger the vulnerability: Execute write(2) to /sys/fs/selinux/load with the crafted invalid policy on a system where no SELinux policy has been previously loaded (first policy load scenario).
5. Kernel crash: The failure in sel_make_policy_nodes() causes sel_write_load() to call selinux_policy_cancel(), which dereferences the NULL state->policy pointer, triggering a kernel panic and system crash (GitHub Advisory).

• Logs: Kernel panic or oops messages in /var/log/kern.log or dmesg output referencing a NULL pointer dereference in selinux_policy_cancel() or sel_write_load().
• Logs: Audit log entries showing a write syscall to /sys/fs/selinux/load immediately preceding a system crash or reboot.
• Process: Unexpected system reboots or kernel panics on systems with SELinux enabled, particularly during initial policy load sequences.
• File System: Presence of crafted or malformed SELinux policy files in temporary directories associated with a suspicious user account.

Apply the upstream kernel patches that add a NULL check for the old policy before calling selinux_policy_cancel(). Fixed versions are: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+ (GitHub Advisory). As a workaround, restrict write access to /sys/fs/selinux/load to only trusted, privileged users to reduce the attack surface. Oracle Linux users should apply the ELSA-2026-500249 kernel update (Linux Security).

The vulnerability was announced via the Linux kernel CVE announcement mailing list and tracked by standard vulnerability databases including VulnDB and OSV (Kernel Announce). Oracle issued a kernel security advisory (ELSA-2026-500249) addressing this and related CVEs for Oracle Linux 8 and 9 (Linux Security). No significant independent researcher commentary or broad social media discussion has been observed for this vulnerability.