All vulnerabilities
CVE-2026-98413

selinux: always fill AVC decision in avc_has_perm_noaudit()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5a6f9a872b4ff68877caf998bee352153b7154bcAlso 24e00850bcff46b984f4c44b92e5499450fcfb5a, 835133337c2ce200db56f62d018c79087dee2603 and 1 moreCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5a6f9a872b4ff68877caf998bee352153b7154bcLinuxCVE List
  • 24e00850bcff46b984f4c44b92e5499450fcfb5aLinuxCVE List
  • 835133337c2ce200db56f62d018c79087dee2603LinuxCVE List
  • 8861db305103107199b1426f25fde1fb6d465583LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

selinux: always fill AVC decision in avc_has_perm_noaudit()

avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache.

Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.

Text from CVE List

Affected versions 18

  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before c781e737aa0de95289b1774d5fd29388895737a9CVE List
  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before e308c5acfe283a66627fc407065626df4ab753ecCVE List
  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before f9da796fa238f8e4414ee8481e6c979759a3d563CVE List
  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before e77461af13eab5c9a953cc52ec8432cc941d61e2CVE List
  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before 5a6f9a872b4ff68877caf998bee352153b7154bcCVE List
  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before 24e00850bcff46b984f4c44b92e5499450fcfb5aCVE List
  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before 835133337c2ce200db56f62d018c79087dee2603CVE List
  • Linuxaffected: e6f2f381e4015386a656a369835f949c26000e6b before 8861db305103107199b1426f25fde1fb6d465583CVE List
  • Linuxaffected: 5.1CVE List
  • Linuxunaffected: all versions before 5.1CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8