CVE-2026-80757: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80757 is an out-of-bounds heap write vulnerability in the Linux kernel's SELinux policy parsing subsystem. It arises when a SELinux class inherits a common permission set but declares a smaller nprim (permission count) than the inherited common — a condition that class_read() fails to validate. When such a malformed policy is loaded, security_get_permissions() writes the common's permissions past the end of the class-sized array, resulting in a heap buffer overflow. The vulnerability affects Linux kernel versions from 2.6.23 up to (but not including) the fixed stable releases: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. It was published on September 3, 2026, and is estimated as HIGH severity; a formal CVSS score has not yet been assigned (GitHub Advisory, Feedly).

The root cause is a missing bounds check (CWE-787: Out-of-bounds Write) in the SELinux policy loading path. Specifically, class_read() reads the class's nprim value directly from the policy binary image without verifying that it is at least as large as the number of permissions in any inherited common. When security_get_permissions() subsequently maps the inherited common's permissions into an array sized by nprim, it writes beyond the allocated buffer. Exploitation requires a local attacker with the privilege to load a custom SELinux policy (typically requiring CAP_MAC_ADMIN or equivalent). The fix adds a validation step in class_read() to reject any class whose declared permission count is smaller than its inherited common's permission count, leaving well-formed policies unaffected (GitHub Advisory, Kernel CVE Announce).

Successful exploitation allows a local user with SELinux policy-loading privileges to corrupt kernel heap memory via an out-of-bounds write, potentially leading to arbitrary code execution in kernel context. This could result in full system compromise, privilege escalation to root, bypass of SELinux access controls, and loss of confidentiality, integrity, and availability of the affected system. The impact is limited to local attackers who can load SELinux policies, reducing the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.21%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to load SELinux policies, which significantly limits the attacker pool (Feedly).

1. Gain local access: Obtain a local shell on a target Linux system running a vulnerable kernel (2.6.23 through the unpatched stable branches) with SELinux enabled.
2. Acquire policy-loading privileges: Ensure the attacker account holds CAP_MAC_ADMIN capability or equivalent rights needed to load SELinux policies (e.g., via a prior privilege escalation or misconfigured sudo rules).
3. Craft a malformed SELinux policy: Create a binary SELinux policy image in which a class inherits a common permission set of N permissions but declares an nprim value smaller than N. This can be done by manually editing a compiled policy binary or using a custom policy compiler.
4. Load the malformed policy: Use semodule, load_policy, or direct security_load_policy() syscall to load the crafted policy into the running kernel.
5. Trigger heap overflow: When the kernel processes the policy, class_read() accepts the undersized nprim, and security_get_permissions() writes the inherited common's permissions past the end of the class-sized heap array, corrupting adjacent kernel memory.
6. Achieve kernel code execution: Leverage the heap corruption (e.g., via heap spray or controlled object placement) to overwrite a function pointer or other kernel control structure, ultimately achieving arbitrary code execution in kernel context and full system compromise (GitHub Advisory, Kernel CVE Announce).

• Logs: Kernel audit logs (/var/log/audit/audit.log) showing semanage or load_policy events from unexpected users or at unusual times; kernel oops or panic messages referencing SELinux policy loading functions (class_read, security_get_permissions).
• Process: Unexpected execution of semodule, load_policy, or semanage by non-administrative users; processes with elevated capabilities (CAP_MAC_ADMIN) that are not part of normal system administration.
• File System: Presence of unusual or unsigned .pp (SELinux policy package) files in temporary directories or user home directories; modifications to /etc/selinux/ policy files outside of normal change windows.
• Kernel: Kernel crash dumps or dmesg output containing stack traces involving selinux/ss/policydb.c or selinux/ss/services.c around policy load time, which may indicate triggered memory corruption.

Apply the upstream kernel patches included in the following fixed stable releases: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+ (GitHub Advisory). As a workaround where patching is not immediately possible, restrict the ability to load SELinux policies to trusted administrators only by tightening CAP_MAC_ADMIN assignments and auditing sudo rules. Validate all SELinux policies using policy analysis tools before deployment to detect malformed class permission counts. Oracle Linux users should apply the vendor advisory ELSA-2026-500249 (Linux Security).

The vulnerability was announced via the official Linux kernel CVE mailing list and tracked by major vulnerability databases including NVD, VulnDB, and OSV (Kernel CVE Announce). Oracle issued a kernel security advisory (ELSA-2026-500249) addressing this and related issues for Oracle Linux 8 and 9 (Linux Security). No significant independent researcher commentary or broad social media discussion has been observed for this vulnerability.