The Linux kernel SELinux socket permission helpers sock_has_perm() and nlmsg_sock_has_extended_perms() directly dereference sk->sk_security, assuming the SELinux socket blob is at offset zero. In configurations where multiple Linux Security Modules (LSMs) are stacked and another LSM allocates socket blob storage before SELinux, this assumption is invalid. As a result, these helpers may read incorrect blob data, leading to invalid security identifiers (SIDs) and class values being passed to Access Vector Cache (AVC) permission checks. The vulnerability was fixed by replacing direct sk_security access with the selinux_sock() accessor, which correctly handles the socket blob offset in stacked LSM scenarios.

This vulnerability does not affect confidentiality or integrity but can cause denial of service (availability impact) due to improper permission checks resulting from invalid security context data. There is no indication of privilege escalation or information disclosure. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves using the selinux_sock() accessor instead of direct sk->sk_security access in the SELinux socket permission helpers. Until an official fix is available, users should monitor vendor advisories for updates.