CVE-2026-59676
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the seunshare tool of selinux policycoreutils, there is a TOCTOU (Time-of-check Time-of-use) race condition vulnerability. A user running seunshare in the unconfined SELinux domain can delete arbitrary root-owned files. This affects policycoreutils up to version 3.10.
Risk Assessment
The risk is that an unprivileged user could delete critical system files, potentially leading to complete loss of system integrity.
Recommendation
Update policycoreutils to a version later than 3.10, which includes a fix for the TOCTOU race condition.
Other vulnerabilities in policycoreutils
See all- CVE-2026-19079Medium
A TOCTOU race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script uses find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit the race window between file discovery and label change by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files, potentially undermining SELinux protections on critical files like /etc/shadow.
- CVE-2026-59677Medium
In the seunshares tool from the selinux policycoreutils package, a missing authorization vulnerability allows a user running in an unconfined context to kill root-owned processes also running in an unconfined context. This issue affects policycoreutils through version 3.10.
Original NVD description (English source)
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10.