CVE-2026-80912

In the Linux kernel, the following vulnerability has been resolved:

selinux: reject an unclaimed class value in security get classes()

security get classes() sizes an array by p classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel make classes() passes every entry to sel make dir(), reaching the same d alloc name() dereference as the permission array. The class symbol table is allowed to be sparse (policydb class isvalid() exists to absorb that), but this getter builds its own array straight from the hash table and has no such predicate.

Fail the lookup when a value went unclaimed instead of handing out the NULL. Conforming policies define every class they declare and are unaffected.