In the Linux kernel, the following vulnerability has been resolved:
selinux: require every boolean value to be defined
pbools.nprim comes from the policy image independently of how many booleans follow it, and condindexbool() fills boolvaltostruct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: condevaluateexpr() on the access-vector path, securitygetbools() and securitygetboolvalue() behind selinuxfs, and securitysetbools(). A sparse class value is absorbed by policydbclass_isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one.
Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80913.json"
}