Red Hat Enterprise Linux up to 10 Fixfiles fixfiles toctou

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Red Hat Enterprise Linux, Hardened Images and OpenShift Container Platform 6/7/8/9/10. Affected by this vulnerability is an unknown functionality of the file fixfiles of the component Fixfiles. This manipulation causes toctou. This vulnerability is tracked as CVE-2026-19079. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability classified as very critical was found in Red Hat Enterprise Linux, Hardened Images and OpenShift Container Platform 6/7/8/9/10. Affected by this vulnerability is an unknown functionality of the file fixfiles of the component Fixfiles. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.

It is possible to read the advisory at access.redhat.com. This vulnerability is known as CVE-2026-19079 since 08/06/2026. The exploitation appears to be easy. Attacking locally is a requirement. Additional levels of successful authentication are required for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/07/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux
• Hardened Images
• OpenShift Container Platform

Version

• 6
• 7
• 8
• 9
• 10

License

• commercial

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion