CVE-2026-19079 in Red Hat
Summary
by MITRE • 08/07/2026
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability under discussion represents a classic time-of-check to time-of-use race condition that fundamentally undermines the security assurances provided by SELinux mandatory access controls. This weakness exists within the fixfiles script component of policycoreutils, a critical toolset for managing SELinux policies and file contexts in Linux environments. The flaw specifically manifests during operations such as fixfiles relabel or fixfiles restore, where the system attempts to identify and relabel unlabeled files across various directories including the sensitive /tmp filesystem. The inherent design of these operations creates an exploitable temporal window between when files are discovered through the find command and when their SELinux labels are modified via chcon, allowing malicious actors to manipulate the filesystem state during this critical interval.
The technical execution of this attack relies on symbolic link manipulation within the target directories, particularly exploiting the predictable nature of file discovery operations. A local attacker can create a symlink in the directory being scanned that points to a system file outside the intended scope, such as /etc/shadow or other critical system resources. When the find command identifies the symlink during its traversal, it follows the link and presents the target file to chcon for relabeling operations. This race condition allows the attacker to effectively bypass the intended scope of the fixfiles operation, enabling them to modify SELinux labels on arbitrary system files that should remain protected by mandatory access controls. The vulnerability directly violates the principle of least privilege by permitting unauthorized modification of critical system file contexts.
The operational impact of this vulnerability extends far beyond simple privilege escalation capabilities, fundamentally compromising the integrity and confidentiality assurances provided by SELinux security policies. When an attacker successfully exploits this race condition to modify labels on sensitive files like /etc/shadow, they can potentially weaken or eliminate access controls that protect authentication data and system credentials. This creates a persistent threat vector that could allow unauthorized users to gain deeper system access, escalate privileges, or manipulate system configurations in ways that would otherwise be prevented by SELinux's mandatory access controls. The vulnerability demonstrates how seemingly innocuous administrative tools can create security weaknesses when they fail to properly account for concurrent filesystem modifications.
The attack pattern aligns with established cybersecurity frameworks and threat modeling approaches, particularly those addressing race condition vulnerabilities as described in CWE-367 and the broader ATT&CK framework's privilege escalation techniques. This vulnerability represents a specific implementation of the time-of-check to time-of-use pattern that has been documented extensively in security literature and represents a common class of flaws in Unix-like systems where file operations are not properly synchronized. The attack vector is particularly concerning because it requires minimal privileges - only local access to the system - yet can result in significant security breaches. Mitigation strategies should focus on eliminating the race condition through atomic operations, proper directory handling with restricted permissions, or implementing additional validation checks that prevent symlink traversal during critical file operations. Organizations should also consider immediate patching of affected policycoreutils versions and implement monitoring for suspicious file system changes in sensitive directories like /tmp and /var/tmp where such attacks are most likely to be attempted.
This vulnerability underscores the importance of proper security design principles in system administration tools, particularly regarding the handling of temporary files and directory traversal operations. The flaw demonstrates how the combination of multiple system commands without proper synchronization can create exploitable conditions that undermine even sophisticated security frameworks like SELinux. Security practitioners should recognize this as a pattern that may exist in other similar administrative scripts and consider implementing comprehensive code reviews focused on race condition vulnerabilities, especially in tools that perform file discovery and modification operations concurrently. The remediation approach must address not just the immediate vulnerability but also establish defensive coding practices that prevent similar issues from emerging in other system components.