diff --git a/xen/xsm/flask/ss/policydb.c b/xen/xsm/flask/ss/policydb.c
index 165304c133..f3674371ac 100644
--- a/xen/xsm/flask/ss/policydb.c
+++ b/xen/xsm/flask/ss/policydb.c
@@ -1271,7 +1271,10 @@ static int cf_check role_read(struct policydb *p, struct hashtab *h, void *fp)
     if ( ver >= POLICYDB_VERSION_BOUNDARY )
         rc = next_entry(buf, fp, sizeof(buf[0]) * 3);
     else
+    {
         rc = next_entry(buf, fp, sizeof(buf[0]) * 2);
+        buf[2] = cpu_to_le32(0); /* gcc14 onwards */
+    }
 
     if ( rc < 0 )
         goto bad;
@@ -1342,7 +1345,10 @@ static int cf_check type_read(struct policydb *p, struct hashtab *h, void *fp)
     if ( ver >= POLICYDB_VERSION_BOUNDARY )
         rc = next_entry(buf, fp, sizeof(buf[0]) * 4);
     else
+    {
         rc = next_entry(buf, fp, sizeof(buf[0]) * 3);
+        buf[3] = cpu_to_le32(0); /* gcc14 onwards */
+    }
 
     if ( rc < 0 )
         goto bad;
@@ -1436,7 +1442,10 @@ static int cf_check user_read(struct policydb *p, struct hashtab *h, void *fp)
     if ( ver >= POLICYDB_VERSION_BOUNDARY )
         rc = next_entry(buf, fp, sizeof(buf[0]) * 3);
     else
+    {
         rc = next_entry(buf, fp, sizeof(buf[0]) * 2);
+        buf[2] = cpu_to_le32(0); /* gcc14 onwards */
+    }
 
     if ( rc < 0 )
         goto bad;