CVE-2026-80757

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject a class permission count below its inherited common

security_get_permissions() maps an inherited common's permissions into

an array sized by the class's own permissions.nprim, but class_read()

takes that nprim verbatim from the policy image and never checks that it

covers the common. A class that inherits a common of N permissions while

declaring a smaller nprim is accepted, and on load the common's

permissions are written past the class-sized array -- an out-of-bounds

heap write.

Reject a class whose permission count is below its inherited common's.

Well-formed policies, where the class count already includes the

inherited permissions, are unaffected.