CVE-2026-80913
In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond_evaluate_expr() on the access-vector path, security_get_bools() and security_get_bool_value() behind selinuxfs, and security_set_bools(). A sparse class value is absorbed by policydb_class_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one. Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
Affected versions
Linux kernel versions
2.6.12
and later are affected. Fixed in
5.10.266,
5.15.217,
6.1.184,
6.6.153,
6.12.105,
6.18.46,
7.1.10,
7.2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-80913?
CVE-2026-80913 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.10.266, 5.15.217, 6.1.184 and others. CVE-2026-80913 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80913?
Yes. CVE-2026-80913 has been patched. Fixed versions include 5.10.266, 5.15.217, 6.1.184 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80913 actively exploited?
No. CVE-2026-80913 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.