VulnerabilityPublished 4 Sep 2026Updated 6 Nov 2026

CVE-2026-80913: Linux kernel · selinux: require every boolean value to be defined

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:32 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec, a93d37a09b863810653f93d371fb197457d59deb, 740012aebdb8311332bf66e2aabf453ba73c2c45 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec	Fixed in ed901e88aa3fb3d5d7b0b52c2ee3073209df9bec
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a93d37a09b863810653f93d371fb197457d59deb	Fixed in a93d37a09b863810653f93d371fb197457d59deb
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 740012aebdb8311332bf66e2aabf453ba73c2c45	Fixed in 740012aebdb8311332bf66e2aabf453ba73c2c45
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8	Fixed in 3938c8494d3c5d84a53fd7d1966ae9dde46cb5f8
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40	Fixed in 3161daa3f1e3ca68f8b2b8fa01720b5a8dcc6b40
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 42a7107f99d86a7524c37f108047dfa3db096ab5	Fixed in 42a7107f99d86a7524c37f108047dfa3db096ab5

AI-suggested

A fix has been implemented in the Linux kernel source as indicated by multiple commit hashes. Users should update their Linux kernel to a version including these fixes. Since this is a kernel-level issue, applying the official kernel patches or upgrading to a fixed kernel version is the recommended remediation.

Description

A vulnerability in the Linux kernel SELinux subsystem involves improper handling of boolean values in the policy image. The flaw arises because the array that stores boolean values can contain NULL entries if the count exceeds the number of defined booleans, leading to potential dereferencing of NULL pointers. The fix enforces that every boolean value must be explicitly defined in the policy, preventing sparse boolean arrays and related issues. Conforming policies that define all booleans are unaffected.

Impact

The vulnerability could cause SELinux subsystem functions to dereference NULL pointers when processing boolean values, potentially leading to kernel faults or instability. However, policies that correctly define all booleans are not affected. There is no indication of active exploitation in the wild.

Summary

The Linux kernel SELinux subsystem had a vulnerability where the boolean value array (bool_val_to_struct[]) could contain NULL entries due to a mismatch between the count of booleans and the actual defined booleans in the policy image. This occurs because p_bools.nprim is independent of the number of booleans, and cond_index_bool() fills the array at value - 1, leaving NULLs if the count is larger than the actual booleans. Various SELinux functions dereference this array by index without checking for NULL, which could lead to faults. The patch rejects any boolean value not defined by a boolean at the time the array is built, ensuring no NULL entries exist. This fix affects Linux kernel version 2.6.12 and later commits identified by specific hashes.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:32 UTC

Technical details

References

Community reviews

Related threats