TOCTOU Race Condition Vulnerability in Policycoreutils by SELinux

CVE-2026-59676

What is CVE-2026-59676?

A Time-of-check Time-of-use (TOCTOU) race condition vulnerability has been identified in the 'seunshare' feature of the policycoreutils package in SELinux. This vulnerability allows an unauthorized user executing 'seunshare' within the unconfined SELinux domain to manipulate the access control, thereby enabling them to delete arbitrary root-owned files. This raises significant security concerns, as it can lead to unauthorized data access and potential system compromises.

References