Linux Kernel Security Flaw in SELinux Class Handling

CVE-2026-80912

What is CVE-2026-80912?

A vulnerability in the Linux kernel's SELinux implementation arises from improper handling of unclaimed class values in the security_get_classes() function. When an unrecognized class value is encountered, the function fails to correctly handle the NULL return, which may lead to unexpected behavior. Properly defined security policies require that every class they declare must be accounted for; otherwise, this flaw could result in security compliance issues. The fix ensures that lookups for unclaimed class values fail gracefully instead of returning a NULL, thereby enforcing stricter policy adherence.

References