CVE-2026-19079
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
A TOCTOU race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script uses find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit the race window between file discovery and label change by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files, potentially undermining SELinux protections on critical files like /etc/shadow.
Risk Assessment
An attacker can alter SELinux labels on critical system files, potentially leading to system integrity compromise and privilege escalation. This may allow unauthorized access to sensitive data.
Recommendation
Update policycoreutils to a patched version. Restrict access to the fixfiles script to trusted administrators and avoid using it in environments with untrusted local users.
Other vulnerabilities in policycoreutils
See all- CVE-2026-59677Medium
In the seunshares tool from the selinux policycoreutils package, a missing authorization vulnerability allows a user running in an unconfined context to kill root-owned processes also running in an unconfined context. This issue affects policycoreutils through version 3.10.
- CVE-2026-59676Medium
In the seunshare tool of selinux policycoreutils, there is a TOCTOU (Time-of-check Time-of-use) race condition vulnerability. A user running seunshare in the unconfined SELinux domain can delete arbitrary root-owned files. This affects policycoreutils up to version 3.10.
Original NVD description (English source)
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.