TOCTOU Race Condition in policycoreutils fixfiles Script

Executive Summary

CVE-2026-19079 is a TOCTOU race condition in the fixfiles script of policycoreutils. The script uses find and chcon to relabel unlabeled files in directories like /tmp. A local attacker can exploit a timing window by replacing directory components with symlinks, causing chcon to modify SELinux labels on arbitrary system files, potentially including critical files like /etc/shadow.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the fixfiles script in policycoreutils is present and examine its usage of find and chcon commands. Look for recent runs of fixfiles relabel or fixfiles restore in system logs. Verify if /tmp, /var/tmp, or other directories have been relabeled unexpectedly.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker with limited privileges to manipulate SELinux labels on critical system files by exploiting a race condition. This could weaken mandatory access controls, potentially leading to unauthorized access or system compromise if sensitive files like /etc/shadow are relabeled.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using fixfiles relabel or fixfiles restore commands. Instead, run restorecon -R / directly to relabel files safely. Ensure /tmp is tmpfs to prevent lingering unlabeled files. Monitor for unauthorized SELinux label changes on critical files like /etc/shadow.

Useful 0 Not Useful 0