CVE-2026-19079
Description
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.
Statement
Red Hat ships policycoreutils with the fixfiles script in all supported RHEL versions. The vulnerable /tmp cleanup code path has been present in fixfiles for many years. Red Hat product impact analysis is required to determine which specific shipped versions of policycoreutils include the vulnerable code and whether backporting the upstream fix is necessary. The vulnerability requires local access, winning a race condition, and an administrator running fixfiles relabel or fixfiles restore, which limits the practical attack surface.
Mitigation
As a workaround, use 'restorecon -R /' directly instead of 'fixfiles relabel' or 'fixfiles restore' to perform filesystem relabeling. This avoids the vulnerable /tmp-specific find+chcon code path entirely. Note that this skips the /tmp cleanup logic, but on modern systems where /tmp is mounted as tmpfs, this cleanup is unnecessary as tmpfs cannot retain files from a prior boot.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | N/A | 4.4 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
Local race condition in fixfiles /tmp cleanup requires admin to run fixfiles; allows arbitrary SELinux label modification
Acknowledgements
Upstream acknowledges Stephen Smalley as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
