CVE-2026-19079

Awaiting Analysis Awaiting Analysis - Queue

TOCTOU Race Condition in policycoreutils fixfiles Script

Publication date: 2026-08-07

Last updated on: 2026-08-21

Assigner: redhat-SADP

Description

A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-21

Generated

2026-08-27

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-19079

EUVD

EUVD-2026-54398

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	policycoreutils	From all_supported_rhel_versions (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

CVE-2026-19079 is a TOCTOU race condition in the fixfiles script of policycoreutils. The script uses find and chcon to relabel unlabeled files in directories like /tmp. A local attacker can exploit a timing window by replacing directory components with symlinks, causing chcon to modify SELinux labels on arbitrary system files, potentially including critical files like /etc/shadow.

Detection Guidance

To detect this vulnerability, check if the fixfiles script in policycoreutils is present and examine its usage of find and chcon commands. Look for recent runs of fixfiles relabel or fixfiles restore in system logs. Verify if /tmp, /var/tmp, or other directories have been relabeled unexpectedly.

Impact Analysis

This vulnerability allows a local attacker with limited privileges to manipulate SELinux labels on critical system files by exploiting a race condition. This could weaken mandatory access controls, potentially leading to unauthorized access or system compromise if sensitive files like /etc/shadow are relabeled.

Compliance Impact

This vulnerability could undermine SELinux mandatory access control protections on critical files such as /etc/shadow, which may contain sensitive user or system data. If exploited, it could lead to unauthorized modifications of system files, potentially violating data integrity and confidentiality requirements under standards like GDPR and HIPAA.

Mitigation Strategies

Immediately stop using fixfiles relabel or fixfiles restore commands. Instead, run restorecon -R / directly to relabel files safely. Ensure /tmp is tmpfs to prevent lingering unlabeled files. Monitor for unauthorized SELinux label changes on critical files like /etc/shadow.

Hi! I’m here to help you understand CVE-2026-19079. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70