policycoreutils seunshare CVE-2026-59677

The attacker must have a local user account on the target system and that account must be running within an unconfined SELinux domain (e.g., unconfined_t or sysadm_t) - this is the default for administrative and often regular user sessions on RHEL/Fedora systems with default SELinux policy, but non-default on hardened deployments using confined user policies. The target process being killed must also be running in an unconfined SELinux context; confined processes in separate domains are not reachable. SELinux must be installed with policycoreutils version 3.10 or earlier present. Exploitation is limited by: (1) local access requirement (AV:L per CVSS 4.0), (2) both attacker and victim must share the unconfined domain (not guaranteed on hardened systems), and (3) impact is restricted to process availability - no privilege escalation or data exfiltration is possible. Systems where all non-root users are assigned confined SELinux domains are not exploitable via this vector.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 6.8 Medium) accurately reflects the local, low-privilege nature of the attack with impact confined to availability. Real-world risk is meaningfully constrained by the requirement that both the attacker's session and the target root processes must be operating in unconfined SELinux domains - unconfined context is typically assigned to administrators and specific system daemons, not regular user accounts on hardened deployments. On minimally-configured RHEL/Fedora systems with default SELinux policy, regular users may run unconfined, which would broaden the exploitable population. No EPSS data was provided; however, the lack of any KEV listing and absence of POC code suggest this is not being exploited in the wild. The impact is constrained to process availability - there is no confidentiality or integrity compromise, and no scope change affecting subsequent systems. This is a genuine medium-priority issue, not a critical one, but should be prioritized on multi-tenant systems where untrusted local users share unconfined SELinux context with administrative processes.

A regular user account on a multi-user Linux system, whose session is assigned to the unconfined_t SELinux domain under default policy, invokes seunshare with arguments targeting a long-running root-owned daemon (such as a monitoring agent or init process) that also operates in unconfined context. Due to missing authorization checks, seunshare delivers a kill signal without validating process ownership, causing the root process to terminate unexpectedly. No public proof-of-concept code has been identified, but the attack is mechanically simple for any user with local access in the correct SELinux context.