CVE-2026-98413

Description

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.

Is your site exposed to CVE-2026-98413?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0022

Probability of exploitation

0.13%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/24e00850bcff46b984f4c44b92e5499450fcfb5a https://git.kernel.org/stable/c/5a6f9a872b4ff68877caf998bee352153b7154bc https://git.kernel.org/stable/c/835133337c2ce200db56f62d018c79087dee2603 https://git.kernel.org/stable/c/8861db305103107199b1426f25fde1fb6d465583 https://git.kernel.org/stable/c/c781e737aa0de95289b1774d5fd29388895737a9 https://git.kernel.org/stable/c/e308c5acfe283a66627fc407065626df4ab753ec https://git.kernel.org/stable/c/e77461af13eab5c9a953cc52ec8432cc941d61e2 https://git.kernel.org/stable/c/f9da796fa238f8e4414ee8481e6c979759a3d563

Frequently Asked Questions

What is CVE-2026-98413? +

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_noaudit() avc_has_perm_noaudit() is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All callers pass an uninitialized stack variable and afterwards feed it to avc_audit(), and the inode hook even stores it in the per-task decision cache. Fill in a deny-all, audit-all decision, similar to avd_init(), so every caller receives a defined value at no cost on the hot path.

How do I check if I'm vulnerable to CVE-2026-98413? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.