Race Condition Vulnerability in Policycoreutils by Red Hat
CVE-2026-19079

4.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
7 August 2026

What is CVE-2026-19079?

A race condition vulnerability exists in the fixfiles script of Policycoreutils, allowing a local attacker to exploit the gap between file discovery and label changes. By using symlinks to swap directory components, the attacker can manipulate SELinux labels on critical system files, such as /etc/shadow. This risk potentially compromises SELinux's mandatory access control measures, which are crucial for maintaining system security. Proper application of security practices is essential to mitigate this vulnerability.

References

https://access.redhat.com/security/cve/CVE-2026-19079
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511976
issue-trackingx_refsource_REDHAT
https://github.com/SELinuxProject/selinux/commit/a556538c...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Upstream acknowledges Stephen Smalley as the original reporter.
.