CVE-2026-98413
selinux: always fill AVC decision in avc_has_perm_noaudit()
Published Oct 14, 2026 · updated Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · OSV.dev
Detected
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the in
Oct 15, 2026 · OSV.dev
Fix available
Kernel fixed in 5.10.271
Oct 15, 2026 · OSV.dev
Fix available
Kernel fixed in 5.10.271
Oct 15, 2026 · OSV.dev
Updated
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the in
Affected
- Linux Kernel5.1.0 → 5.10.271
Sources
- CVE.orgCVE-2026-98413
Official CVE identifier
cve.org - OSV.devCVE-2026-98413
selinux: always fill AVC decision in avc_has_perm_noaudit()
osv.dev - Tenable CVE DatabaseCVE-2026-98413
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the in
tenable.com