CVE-2026-59676 Local File Deletion Attack Vector in rm_rf() in seunshare
A local attacker in an unconfined SELinux domain can exploit a race condition in seunshare to delete arbitrary root-owned files, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59676?
CVE-2026-59676 is a medium-severity vulnerability in SELinuxProject selinux, published on 23 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files,
This issue affects policycoreutils through 3.10.
Weakness: CWE-367
Which versions are affected by CVE-2026-59676?
How do I fix CVE-2026-59676?
Apply the vendor's patch.
Is CVE-2026-59676 being exploited?
There is no known exploitation of CVE-2026-59676 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-59676, GHSA-j6qh-f45v-j454, UBUNTU-CVE-2026-59676.