GHSA-M3F9-PMFC-6C92
Vulnerability from github – Published: 2026-10-14 15:32 – Updated: 2026-10-14 15:32In the Linux kernel, the following vulnerability has been resolved:
selinux: always fill AVC decision in avc_has_perm_noaudit()
avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache.
Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.
{
"affected": [],
"aliases": [
"CVE-2026-98413"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T14:17:52Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: always fill AVC decision in avc_has_perm_noaudit()\n\navc_has_perm_noaudit() is documented to return a copy of the access\ndecision in @avd, but its early return for an empty requested permission\nset leaves the buffer untouched. All callers pass an uninitialized\nstack variable and afterwards feed it to avc_audit(), and the inode hook\neven stores it in the per-task decision cache.\n\nFill in a deny-all, audit-all decision, similar to avd_init(), so every\ncaller receives a defined value at no cost on the hot path.",
"id": "GHSA-m3f9-pmfc-6c92",
"modified": "2026-10-14T15:32:21Z",
"published": "2026-10-14T15:32:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98413"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/24e00850bcff46b984f4c44b92e5499450fcfb5a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5a6f9a872b4ff68877caf998bee352153b7154bc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/835133337c2ce200db56f62d018c79087dee2603"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8861db305103107199b1426f25fde1fb6d465583"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c781e737aa0de95289b1774d5fd29388895737a9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e308c5acfe283a66627fc407065626df4ab753ec"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e77461af13eab5c9a953cc52ec8432cc941d61e2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f9da796fa238f8e4414ee8481e6c979759a3d563"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.