CVE-2026-80912: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80912 is a NULL pointer dereference vulnerability in the Linux kernel's SELinux subsystem, specifically within the security_get_classes() function. When a SELinux policy contains unclaimed (undefined) class values, the function leaves NULL entries in its internal array, which are subsequently passed to sel_make_dir() and trigger a NULL pointer dereference in d_alloc_name(). The vulnerability affects Linux kernel versions from 2.6.23 up to (but not including) the fixed releases: 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. It was disclosed on September 4, 2026, with patches available on the same date. The CVSS base score is reported as 0.0 (no official severity rating assigned at time of publication), though Feedly estimates it as Medium impact (GitHub Advisory, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the Linux kernel's SELinux policy loading path. security_get_classes() allocates an array sized by p_classes.nprim and populates entries at index value - 1; if a class value declared in the policy is never actually defined, the corresponding array slot remains NULL. The downstream function sel_make_classes() iterates over every entry and passes each to sel_make_dir(), which eventually calls d_alloc_name() on the NULL pointer, causing a kernel crash. The fix adds a validation check to reject unclaimed class values during the lookup rather than propagating the NULL. Exploitation requires local access and the ability to load a malformed SELinux policy, which is typically a privileged operation (GitHub Advisory, Kernel CVE Announce).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (kernel panic) or hang — a Denial of Service condition. Because the vulnerability resides in kernel space, a crash affects the entire system and all running workloads. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability. Conforming SELinux policies that define every declared class are unaffected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). Exploitation requires local access and the ability to load a malformed SELinux policy, which is typically restricted to privileged users or administrators, significantly limiting the attack surface. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Apply the upstream kernel patches that add validation to reject unclaimed class values in security_get_classes(). Fixed versions are: 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2 (GitHub Advisory). As a configuration-based mitigation, restrict SELinux policy loading to trusted administrators only and validate all SELinux policies before loading them into production systems. Monitor for unexpected or unauthorized SELinux policy load attempts as an additional defensive measure.