CVE-2026-19079: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-19079 is a TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability in the fixfiles script within the policycoreutils package, affecting Red Hat Enterprise Linux and related products. When running fixfiles relabel or fixfiles restore, the script uses find and chcon commands to locate and relabel unlabeled files under /tmp, /var/tmp, /var/run, and /var/lib/debug. A local attacker can exploit the race window between file discovery and label change by swapping directory components with symlinks via renameat2(RENAME_EXCHANGE), causing chcon to modify SELinux labels on arbitrary system files such as /etc/shadow. The vulnerability was reported by Stephen Smalley (upstream SELinux maintainer), disclosed on August 7, 2026, and carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE, Github Advisory).

The vulnerability is classified as CWE-367 (Time-of-check Time-of-use Race Condition). The vulnerable code resided in the restore() function's default case block (case "*") of the fixfiles script, which invoked find to identify files with unlabeled_t or undefined context types, then passed those pathnames to chcon --no-dereference --reference /tmp. The --no-dereference flag only prevents dereferencing of the final path component; intermediate symlinks in the path are still followed by the kernel during resolution. An attacker exploits this by using renameat2(RENAME_EXCHANGE) to atomically swap a directory component in the discovered path with a symlink pointing to a sensitive directory (e.g., /etc), causing chcon to relabel files like /etc/shadow to tmp_t and undermining SELinux MAC protections. The upstream fix (commit a556538) removes the entire /tmp cleanup code path, as it was deemed unnecessary on modern systems where /tmp is typically a tmpfs (Red Hat Bugzilla, SELinux Commit).

Successful exploitation allows a local low-privileged attacker to modify SELinux security labels on arbitrary system files, including highly sensitive files such as /etc/shadow. This undermines SELinux mandatory access control (MAC) protections, potentially enabling privilege escalation or allowing processes to access resources they would otherwise be denied. There is no confidentiality or availability impact; the impact is limited to integrity — specifically, the ability to alter SELinux context labels on critical files in ways that could facilitate further attacks (Red Hat CVE, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). Exploitation requires local access, low privileges, the ability to win a race condition, and an administrator actively running fixfiles relabel or fixfiles restore, which significantly limits the practical attack surface (Red Hat CVE). The EPSS score is approximately 0.081%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable version of policycoreutils with SELinux enabled.
2. Monitor for fixfiles execution: Wait for or social-engineer an administrator to run fixfiles relabel or fixfiles restore (e.g., during a system relabeling operation after a policy change).
3. Create a target path: Create a directory structure under /tmp (e.g., /tmp/attacker/subdir/file) that will be discovered by the find command searching for unlabeled files.
4. Prepare the symlink swap: Prepare a symlink pointing to a sensitive directory (e.g., a symlink to /etc).
5. Race the TOCTOU window: After find identifies the path but before chcon operates on it, use renameat2(RENAME_EXCHANGE) to atomically swap the intermediate directory component (e.g., subdir) with the symlink pointing to /etc.
6. Trigger label modification: chcon --no-dereference --reference /tmp resolves the path through the now-swapped symlink and applies the tmp_t SELinux label to a file in /etc (e.g., /etc/shadow), stripping its protective SELinux context.
7. Leverage the mislabeled file: With /etc/shadow relabeled to tmp_t, SELinux policies that previously restricted access to it may no longer apply, potentially enabling further privilege escalation (Red Hat Bugzilla, SELinux Commit).

• File System: Unexpected SELinux context changes on critical files such as /etc/shadow (e.g., context changed to system_u:object_r:tmp_t:s0); presence of unusual symlinks in /tmp, /var/tmp, /var/run, or /var/lib/debug pointing to sensitive directories like /etc.
• Logs: SELinux audit log (/var/log/audit/audit.log) entries showing chcon modifying labels on files outside of /tmp or expected directories; entries for renameat2 syscalls with RENAME_EXCHANGE flag from non-root users during a fixfiles operation.
• Process: chcon process spawned as a child of fixfiles operating on paths resolving outside of /tmp or /var/tmp; renameat2 system calls from low-privileged user processes coinciding with fixfiles execution.

Red Hat has released a patched version of policycoreutils (version 3.11-2.2.hum1) via security advisory RHSA-2026:51861 for Red Hat Hardened Images; administrators should update to this version or the applicable patched version for their RHEL release (Red Hat Errata). As a workaround, use restorecon -R / directly instead of fixfiles relabel or fixfiles restore to perform filesystem relabeling, which avoids the vulnerable /tmp-specific find+chcon code path entirely (Red Hat CVE). Additionally, restrict execution of fixfiles relabel and fixfiles restore to trusted administrators, and implement filesystem monitoring to detect unusual symlink creation in /tmp and related directories during fixfiles operations.

Red Hat Product Security acknowledged the vulnerability and noted that the vulnerable /tmp cleanup code path has been present in fixfiles for many years, but that the practical attack surface is limited due to the requirement for local access, winning a race condition, and an administrator actively running fixfiles (Red Hat CVE). The upstream fix was authored and reported by Stephen Smalley, a well-known upstream SELinux maintainer, who determined the /tmp cleanup code was both unsafe and unnecessary on modern systems (SELinux Commit). No significant broader community or social media reactions have been observed beyond standard vulnerability tracking.