AZL-99074
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99074.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-99074
- Upstream
- Published
- 2026-09-03T13:06:15Z
- Modified
- 2026-10-02T14:19:12Z
- Summary
- CVE-2026-80756 affecting package kernel for versions less than 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
selinux: do not cancel a policy conversion that never started
sel_write_load() calls selinux_policy_cancel() when sel_make_policy_nodes() fails, and that helper dereferences the outgoing policy to cancel its sidtab conversion. On the first policy load there is no outgoing policy: security_load_policy() returns early for that case, before it converts anything, and state->policy is still NULL. A first load that fails while building the selinuxfs tree therefore takes a NULL dereference in selinux_policy_cancel(), reached from a write(2) to /sys/fs/selinux/load.
Skip the cancel when there is no old policy, mirroring the check security_load_policy() already makes before it converts.
- References