diff --git a/src/security/security_selinux.c b/src/security/security_selinux.c
index 310e30060b..ace9cc0ead 100644
--- a/src/security/security_selinux.c
+++ b/src/security/security_selinux.c
@@ -218,10 +218,10 @@ virSecuritySELinuxMCSGetProcessRange(char **sens,
         *tmp = '\0';
     /* sens now just contains the sensitivity lower bound */
 
-    /* If there was no category part, just assume c0.c1024 */
+    /* If there was no category part, just assume c0.c1023 */
     if (!cat) {
         *catMin = 0;
-        *catMax = 1024;
+        *catMax = 1023;
         ret = 0;
         goto cleanup;
     }