CVE-2026-80756: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: selinux: do not cancel a policy conversion that never started sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy: security_load_policy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load. Skip the cancel when there is no old policy, mirroring the check security_load_policy() already makes before it converts.

Affected products

• Linux Linux: from 5.10, before 5.10.266 (fixed in 5.10.266); from 5.11, before 5.15.217 (fixed in 5.15.217); from 5.16, before 6.1.184 (fixed in 6.1.184); from 6.2, before 6.6.153 (fixed in 6.6.153); from 6.7, before 6.12.105 (fixed in 6.12.105); from 6.13, before 6.18.46 (fixed in 6.18.46); …

Published 2026-09-03. Last modified 2026-09-03.