CVE-2026-19079 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for managing SELinux-based systems, particularly those using policycoreutils, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The fixfiles script in policycoreutils is vulnerable to a TOCTOU race condition. When running fixfiles relabel or fixfiles restore, the script uses find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files.

Defensive priority

Medium priority due to local attack vector and potential impact on SELinux protections

Recommended defensive actions

• Apply patches or updates provided by the vendor to fix the vulnerability
• Implement compensating controls to monitor and restrict access to sensitive files and directories
• Conduct regular security audits and vulnerability assessments to identify potential weaknesses
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was found in the fixfiles script in policycoreutils. The script's use of find and chcon commands to locate and relabel unlabeled files under /tmp and other directories creates a TOCTOU race condition. A local attacker could exploit this by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.