CVE-2026-80913: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80913 is a NULL pointer dereference vulnerability in the Linux kernel's SELinux subsystem, caused by insufficient validation of boolean values during policy loading. When a policy image declares more booleans (p_bools.nprim) than are actually defined, the bool_val_to_struct[] array is left with NULL entries that are subsequently dereferenced by multiple kernel functions. The vulnerability affects the Linux kernel from version 2.6.12 through multiple stable branches, with fixes backported to 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. It was published on September 4, 2026, and carries an estimated CVSS severity of Medium with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is a missing validation predicate for SELinux boolean values during policy load (CWE-476: NULL Pointer Dereference). The p_bools.nprim field in the policy image is trusted as the boolean count, but cond_index_bool() only populates bool_val_to_struct[] for booleans that are actually present — a mismatch leaves NULL slots in the array. Four kernel code paths then walk this array by index without NULL checks: cond_evaluate_expr() on the access-vector path, security_get_bools(), security_get_bool_value(), and security_set_bools() via selinuxfs. Unlike sparse class values, which are caught by policydb_class_isvalid(), there is no equivalent guard for booleans. The fix adds a validation step at array construction time to reject any declared boolean that lacks a corresponding definition (GitHub Advisory).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a denial of service affecting the entire host. Because the crash occurs in a core kernel security subsystem (SELinux), all processes and services on the affected system are terminated. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

Exploitation requires local access and the privilege to load an SELinux policy (typically restricted to root or a privileged administrator), making this a low-severity local denial-of-service issue. No public proof-of-concept exploit exists, and there is no evidence of in-the-wild exploitation as of the publication date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Apply the upstream kernel patches that add boolean validation during SELinux policy load. Fixed versions are available across all active stable branches: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. As an interim workaround, restrict SELinux policy loading to trusted administrators only and validate all policy files before deployment to prevent malformed or malicious policies from being loaded (GitHub Advisory, Feedly).