CVE-2026-80912
In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb_class_isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate. Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.
Affected versions
Linux kernel versions
2.6.23
and later are affected. Fixed in
5.10.270,
5.15.221,
6.1.188,
6.6.153,
6.12.105,
6.18.46,
7.1.10,
7.2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-80912?
CVE-2026-80912 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.23 onward and has been patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-80912 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80912?
Yes. CVE-2026-80912 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 2.6.23 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80912 actively exploited?
No. CVE-2026-80912 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.