selinux: always fill AVC decision in avc_has_perm_noaudit()

Summary

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.

Timeline

1. Oct 14, 2026, 1:27 PM UTCCVE published
2. Oct 19, 2026, 9:19 AM UTCRecord last updated

Affected versions

• Linux Linux

  From e6f2f381e4015386a656a369835f949c26000e6b · fixed in c781e737aa0de95289b1774d5fd29388895737a9; From e6f2f381e4015386a656a369835f949c26000e6b · fixed in e308c5acfe283a66627fc407065626df4ab753ec; From e6f2f381e4015386a656a369835f949c26000e6b · fixed in f9da796fa238f8e4414ee8481e6c979759a3d563; From e6f2f381e4015386a656a369835f949c26000e6b · fixed in e77461af13eab5c9a953cc52ec8432cc941d61e2; From e6f2f381e4015386a656a369835f949c26000e6b · fixed in 5a6f9a872b4ff68877caf998bee352153b7154bc; From e6f2f381e4015386a656a369835f949c26000e6b · fixed in 24e00850bcff46b984f4c44b92e5499450fcfb5a; From e6f2f381e4015386a656a369835f949c26000e6b · fixed in 835133337c2ce200db56f62d018c79087dee2603; From e6f2f381e4015386a656a369835f949c26000e6b · fixed in 8861db305103107199b1426f25fde1fb6d465583

• Linux Linux

  5.1

• KernelLinux

  From 5.1.0 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8

References 8