SB20261007158 - Missing Authorization in Linux kernel selinux include

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261007158

SB20261007158 - Missing Authorization in Linux kernel selinux include

Published: October 7, 2026

Security Bulletin ID SB20261007158
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authorization (CVE-ID: CVE-2026-98214)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass SELinux execution restrictions on intermediate filesystem layers.

The vulnerability exists due to missing authorization checks in selinux_file_mprotect() when changing memory protections for files on stacked filesystems. A local user can map a file with mmap(PROT_NONE) and then call mprotect(PROT_EXEC) to bypass SELinux execution restrictions on intermediate filesystem layers.

The demonstrated scenario uses two nested overlayfs mounts and an SELinux policy denying an intermediate mounter execute permission on the intermediate file.


Remediation

Install update from vendor's website.

References