Skip to main content

policycoreutils fixfiles EUVDEUVD-2026-54398

| CVE-2026-19079 MEDIUM
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-08-07 redhat GHSA-8hc6-8f5m-vmq3
Information Disclosure Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat Hardened Images Red Hat
4.4
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
4.4 MEDIUM
AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
vuln.today AI
4.4 MEDIUM

Local race condition (AV:L/AC:H) requires admin to run fixfiles (UI:R) and a low-privileged local account (PR:L); only integrity impact applies as labels are modified, not secrets read.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
4.0 AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.4 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 07, 2026 - 08:21 vuln.today
Analysis Generated
Aug 07, 2026 - 08:21 vuln.today
CVE Published
Aug 07, 2026 - 07:21 cve.org
MEDIUM 4.4

DescriptionCVE.org

A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.

AnalysisAI

SELinux label manipulation via TOCTOU race condition in the policycoreutils fixfiles script allows a local low-privileged attacker to corrupt SELinux mandatory access control labels on arbitrary system files, including security-critical targets such as /etc/shadow. The flaw affects fixfiles when run in relabel or restore mode across all supported Red Hat Enterprise Linux releases (6 through 10), Red Hat Hardened Images, and OpenShift Container Platform 4. No public exploit code or active exploitation has been identified at time of analysis, and exploitation is constrained by both a required race condition win and the need for an administrator to actively invoke fixfiles.

Technical ContextAI

policycoreutils is the canonical SELinux userspace utilities package, installed by default on RHEL and derivatives; the fixfiles shell script within it is used to relabel filesystem objects to their correct SELinux security contexts. The vulnerable code path (removed in upstream commit a556538c) uses find to enumerate files under /tmp, /var/tmp, /var/run, and /var/lib/debug that carry unlabeled or undefined SELinux types, then passes those paths to chcon for relabeling. CWE-367 (TOCTOU Race Condition) precisely describes the root cause: the inode resolved by find is not the same inode acted upon by chcon, because directory components can be replaced between the two operations. An attacker controlling the /tmp filesystem during this window can atomically swap a directory component with a symlink pointing to a sensitive target; chcon then dereferences the symlink and applies the new SELinux context to that target instead of the intended file. The upstream fix eliminates the entire vulnerable code block rather than attempting atomic path resolution, indicating no safe in-place repair of the original approach was viable.

RemediationAI

Monitor the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-19079 for the patched policycoreutils RPM for each affected RHEL release and apply it via dnf or yum when available; a specific patched package version has not been confirmed from available data - the upstream fix exists as source commit a556538c2d5d2583273e025b45c02651fef47679 in the SELinuxProject/selinux repository but no tagged release or RPM build has been independently verified. As an interim compensating control, restrict invocation of fixfiles relabel and fixfiles restore to controlled maintenance windows with no concurrent local user sessions active, which collapses the race window to near zero. Additionally, auditing /tmp write access via ACLs or temporary mount options (e.g., mounting /tmp with noexec,nosuid) reduces an attacker's ability to prepare symlink chains during the race, though this may affect applications that legitimately use /tmp. Note that neither control fully eliminates the vulnerability on systems with multiple concurrent local users.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Micro for Rancher 5.4 Affected

Share

EUVD-2026-54398 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy