CVE-2026-80913

In the Linux kernel, the following vulnerability has been resolved:

selinux: require every boolean value to be defined

p bools.nprim comes from the policy image independently of how many booleans follow it, and cond index bool() fills bool val to struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences each entry: cond evaluate expr() on the access-vector path, security get bools() and security get bool value() behind selinuxfs, and security set bools(). A sparse class value is absorbed by policydb class isvalid() and its siblings; booleans have no such predicate, and no consumer that could use one.

Reject a boolean value that no boolean defines, once, where the array is built. Conforming policies define every boolean they declare and are unaffected.