policycoreutils fixfiles EUVD-2026-54398

Exploitation requires all of the following: (1) a local user account with at least low privileges on the target system (PR:L); (2) write access to /tmp or the ability to influence path components under directories scanned by fixfiles (/tmp, /var/tmp, /var/run, /var/lib/debug); (3) an administrator to actively invoke fixfiles relabel or fixfiles restore - this is the mandatory user interaction (UI:R) and the primary exploitation gate; (4) the attacker must win the kernel-scheduled race between find's path resolution and chcon's relabeling operation (AC:H). Exploitation is not possible via network access, without a co-located local account, or on systems where fixfiles is never run. On systems where /tmp is mounted with restrictive permissions or where local user sessions are isolated (e.g., containers without shared /tmp), the race surface is significantly reduced. The vulnerability does not affect fixfiles when run in modes that do not invoke the find/chcon unlabeled-context relabeling block.

The CVSS 3.1 score of 4.4 (Medium) accurately captures the constrained exploitability: local access only (AV:L), race condition timing requirement (AC:H), low-privileged user account needed (PR:L), and mandatory administrator interaction to trigger fixfiles (UI:R). The High integrity impact (I:H) is the most significant signal - stripping or corrupting the SELinux label on /etc/shadow or other MAC-protected files can undermine the entire SELinux enforcement model for those objects, with effects that persist until re-relabeled. No EPSS data is available in the provided intelligence, and neither a CISA KEV listing nor any POC has been identified, suggesting this has not been operationally exploited. The practical exploitation barrier is meaningful: the attacker must predict when an administrator will run fixfiles and must win a kernel-scheduled race on a multi-process system; however, modern multi-core systems and persistent /tmp write access make sustained race attempts feasible. The impact is disproportionately severe relative to the CVSS score in environments where SELinux enforcement is a core security boundary, such as Red Hat Hardened Images and OpenShift, where MAC bypass can cascade into broader privilege escalation primitives.

A local attacker with a standard user account monitors for an administrator initiating fixfiles restore during a scheduled SELinux relabeling task (common post-update or post-boot operation). During the brief window between find identifying an unlabeled socket or pipe under /tmp and chcon executing against that path, the attacker atomically replaces a directory component with a symlink chain targeting /etc/shadow. If the race is won, chcon applies a permissive or attacker-specified SELinux type label to /etc/shadow, stripping its enforced MAC protection and potentially allowing subsequent unauthorized reads or writes to the shadow password database. No public POC has been identified at time of analysis.