CVE-2026-98413

In the Linux kernel, the following vulnerability has been resolved:

selinux: always fill AVC decision in avc has perm noaudit()

avc has perm noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc audit(), and the inode hook even stores it in the per-task decision cache.

Fill in a deny-all, audit-all decision, similar to avd init(), so every caller receives a defined value at no cost on the hot path.