Bug 2511976 (CVE-2026-19079)

Summary: CVE-2026-19079 policycoreutils: policycoreutils: TOCTOU race condition in fixfiles allows arbitrary SELinux label manipulation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2512415    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-06 11:09:08 UTC 
A TOCTOU (Time-of-Check-Time-of-Use) race condition was found in the fixfiles script in the policycoreutils package. The vulnerable code used 'find' to locate unlabeled files under /tmp, /var/tmp, /var/run, and /var/lib/debug, then passed those pathnames to 'chcon' to change their SELinux context. Between the time 'find' identified a file and 'chcon' operated on it, a local attacker could use renameat2(RENAME_EXCHANGE) to atomically swap a directory component with a symlink pointing to a sensitive system directory (e.g., /etc). This caused 'chcon' to resolve the path through the symlink and modify SELinux labels on arbitrary files, such as relabeling /etc/shadow to tmp_t.

The vulnerable code was in the restore() function's default case block (case "*)"), which executed during both 'fixfiles relabel' and 'fixfiles restore' commands. The find commands searched for files with unlabeled_t or undefined context types and invoked 'chcon --no-dereference --reference /tmp' on their pathnames. The --no-dereference flag only prevents dereferencing of the final path component; intermediate symlinks in the path are still followed by the kernel during resolution.

The fix removes the entire /tmp cleanup code path, as the upstream maintainer determined it was unnecessary on modern systems where /tmp is typically a tmpfs that cannot have lingering unlabeled files from a prior SELinux-disabled boot.

Upstream fix commit: a556538c2d5d2583273e025b45c02651fef47679 (merged July 16, 2026).

Reported by Stephen Smalley (upstream SELinux maintainer).