CVE-2026-98413
Description
A flaw was found in the Linux kernel's SELinux (Security-Enhanced Linux) subsystem. When an access check is performed with an empty permission set, the Access Vector Cache (AVC) fails to initialize the access decision structure before returning. A local attacker can exploit this flaw by triggering operations that cause the kernel to read uninitialized stack memory during audit logging and decision caching, potentially leading to a denial of service or unpredictable security enforcement.
Statement
A flaw of moderate impact was found in the Linux kernel's SELinux Access Vector Cache (AVC) subsystem as shipped in the Red Hat kernel. When avc_has_perm_noaudit() is called with an empty requested permission set, it returns early without filling in the access decision structure, leaving the caller-provided stack variable uninitialized. That uninitialized value is subsequently passed to avc_audit() for audit logging and, in the inode hook, stored in the per-task AVC decision cache, so the kernel may act on uninitialized stack memory. A local attacker with low privileges could trigger operations that perform SELinux access checks with an empty permission set, causing the kernel to use this uninitialized data during audit logging and decision caching, which can result in unpredictable SELinux enforcement or a denial of service (availability impact only; CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Within the current product scope, the Red Hat kernel in RHEL 8, RHEL 9, and RHEL 10 update streams, RHEL In-Vehicle OS (RHIVOS) 2, and the kernel shipped with OpenShift 4 and OpenShift 5 is affected. Fixes for these affected streams are currently deferred, so they will be addressed in a future planned update rather than an immediate erratum; the residual risk until then is limited to local availability impact by an already-authenticated local user, with no direct confidentiality or integrity impact. RHEL 7 is not affected because the vulnerable code is not present in that kernel, and the RHEL 6 stream is marked out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
