CVE-2026-59676
Received Received - Intake

TOCTOU Race Condition in policycoreutils seunshare

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: SUSE

Description
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-59676
EUVD
EUVD-2026-47888

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
suse policycoreutils to 3.10 (inc)
suse policycoreutils From 3.11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59676 is a Time-of-check Time-of-use (TOCTOU) race condition in the seunshare program of SELinux policycoreutils. It allows an unconfined SELinux user to delete arbitrary root-owned files by exploiting a flaw in the rm_rf() function during temporary directory cleanup.

Detection Guidance

To detect this vulnerability, check the version of policycoreutils installed on your system. Run: rpm -q policycoreutils or dpkg -l policycoreutils. If the version is 3.10 or earlier, the system is vulnerable. Additionally, verify if seunshare has the setuid bit enabled with: ls -l /usr/sbin/seunshare or ls -l /usr/bin/seunshare. A vulnerable system will show the setuid bit (s) set.

Impact Analysis

This vulnerability enables a local attacker to delete critical system files, potentially causing system instability or denial of service. It requires the attacker to be in the unconfined SELinux domain and have access to seunshare with setuid root privileges.

Compliance Impact

The vulnerability allows deletion of arbitrary root-owned files due to a TOCTOU race condition in seunshare, which could lead to unauthorized data destruction. This may violate compliance requirements for data integrity and availability under standards like GDPR (data integrity principles) and HIPAA (integrity and availability of protected health information).

Mitigation Strategies

Immediately update policycoreutils to version 3.11 or later. On openSUSE Tumbleweed, run: zypper update policycoreutils. For other distributions, check for backported patches. If an update is not immediately available, consider disabling the setuid bit on seunshare with: chmod u-s /usr/sbin/seunshare or chmod u-s /usr/bin/seunshare, but this may affect functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart