CVE-2026-19079 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
A local attacker can exploit a race condition in fixfiles to manipulate SELinux labels on arbitrary files, potentially bypassing mandatory access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-19079?
CVE-2026-19079 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 7 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.
Weakness: CWE-367
Which versions are affected by CVE-2026-19079?
Linux distribution packages (9)
policycoreutils Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
policycoreutils-dbus Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
policycoreutils-devel Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
policycoreutils-gui Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
policycoreutils-newrole Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
policycoreutils-python-utils Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
policycoreutils-restorecond Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
policycoreutils-sandbox Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
python3-policycoreutils Red Hat:hummingbird:1 | All versions | 0:3.11-2.2.hum1 |
How do I fix CVE-2026-19079?
Apply the vendor's patch.
Is CVE-2026-19079 being exploited?
There is no known exploitation of CVE-2026-19079 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-19079, GHSA-8hc6-8f5m-vmq3, RHSA-2026:51861, UBUNTU-CVE-2026-19079.