RHBA-2026:18273 - Bug Fix Advisory

Topic

An update for selinux-policy is now available for Red Hat Enterprise Linux 10.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 10 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 10 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x
• Red Hat Enterprise Linux for Power, little endian 10 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 10 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64
• Red Hat CodeReady Linux Builder for x86_64 10 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 10 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x
• Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x

Fixes

• RHEL-102535 - [rhel-10] SELinux prevents start of ras-mc-ctl service
• RHEL-107589 - insights-client cannot find core / execute during automatic registration
• RHEL-107732 - Improve OpenSSH SELinux policy bits
• RHEL-110090 - iio_sensor_proxy selinux policy regression on centos 10
• RHEL-112368 - Reinstate reverted selinux-policy rules to back insights-core policy module [rhel-10]
• RHEL-113167 - Wrong SELinux context set on the /usr/sbin/smartd file
• RHEL-116154 - [rhel-10] SELinux prevents stress-ng process from writing into secretmem anon inodes
• RHEL-117824 - grafana-server service runs as unconfined_service_t
• RHEL-119619 - Kerberos5 files ".{k5login,k5users,k5identity}" are not getting proper label for "pgsql" user
• RHEL-121479 - [rhel-10] aide_t want getattr perms to fs_t
• RHEL-123737 - avc: denied { write } for comm=tlshd name=source dev="dm-0"
• RHEL-124855 - insights-client cannot 'getattr' rpm_exec_t
• RHEL-127023 - [NFS-over-TLS] mounting timed out with refcount_t warnings since selinux-policy-42.1.9-1.el10
• RHEL-129839 - [rhel-10] more specific labels for new /dev/papr-* devices
• RHEL-132638 - SELinux prevents systemd from mmap-ing of the /sys/kernel/btf/vmlinux file
• RHEL-135676 - Backport support for Plasma Login Manager as a display manager
• RHEL-135875 - Antivirus booleans are not provided by selinux-policy-targeted-extra
• RHEL-138247 - selinux prevents sshd to use ICA crypto adapter
• RHEL-140760 - SELinux is blocking NetworkManager dispatcher from starting the nvmf-connect-nbft.service
• RHEL-140884 - newaliases creates /etc/aliases.lmdb with wrong context
• RHEL-140911 - SELinux denials when login manager stops units as part of target transition
• RHEL-141391 - Update rhsmcertd SELinux policies to let /run/ostree-booted be consulted
• RHEL-141423 - Require only "stable" version of selinux-policy
• RHEL-141813 - selinux-policy-targeted fail with POSTTRANS scriptlet due to usbguard and usbguard-selinux
• RHEL-142171 - AVC denial of NetworkManager accessing BPF device
• RHEL-68722 - [RHEL-10.0] avc: denied { search } for pid=29683 comm="nfsidmap" name="libvirt" dev="dm-0"
• RHEL-86926 - SELinux prevents the rasdaemon from writing into /sys/devices/system/memory/soft_offline_page
• RHEL-152308 - Selinux-policy must require the latest userspace
• RHEL-93773 - Revert patches attempting to fix RHEL-85319

CVEs

(none)

References

• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.2_release_notes/index