CVE-2026-19079

Name of the Vulnerable Software and Affected Versions policycoreutils (affected versions not specified)

Description A TOCTOU (Time-of-Check-Time-of-Use) race condition exists in the fixfiles script. This occurs when executing fixfiles relabel or fixfiles restore, as the script utilizes find and chcon commands to identify and relabel files in /tmp and other directories. A local attacker can exploit the timing gap between file discovery and the label update by replacing directory components with symlinks. This forces chcon to follow the symlink, allowing the modification of SELinux labels on arbitrary system files, which can compromise mandatory access control protections for critical files like /etc/shadow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.