CVE catalog

CVE-2026-19079

A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.11% · Oct 25, 2026

A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This could undermine SELinux mandatory access control protections on critical files such as /etc/shadow.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpolicycoreutilssid3.11-1vulnerable
Debianpolicycoreutilsforky3.11-1vulnerable
Debianpolicycoreutilstrixie3.8.1-2vulnerable
Debianpolicycoreutilsbookworm3.4-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpolicycoreutilssourcesid(unfixed)not yet assignedNot reported[1143965]
Debianpolicycoreutilssourceforky(unfixed)not yet assignedNot reported[1143965]
Debianpolicycoreutilssourcetrixie(unfixed)not yet assignedNot reported[1143965]
Debianpolicycoreutilssourcebookworm(unfixed)not yet assignedNot reported[1143965]

[Debian bug #1143965]

Notes

[trixie] policycoreutils: Minor issue [bookworm] policycoreutils: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [newrole]Affected

    Source package: [policycoreutils]

    Details (2)

    • 3.4-1 · amd64 · bookworm

      Affected

      nvd · policycoreutils · debian · bookworm; nvd · policycoreutils · debian · 12

    • 3.4-1 · arm64 · bookworm

      Affected

      nvd · policycoreutils · debian · bookworm; nvd · policycoreutils · debian · 12

  • [policycoreutils]Affected
    Details (2)

    • 3.4-1 · amd64 · bookworm

      Affected

      nvd · policycoreutils · debian · bookworm; nvd · policycoreutils · debian · 12

    • 3.4-1 · arm64 · bookworm

      Affected

      nvd · policycoreutils · debian · bookworm; nvd · policycoreutils · debian · 12

[Debian 13 (Trixie)]

  • [newrole]Affected

    Source package: [policycoreutils]

    Details (2)

    • 3.8.1-2 · amd64 · trixie

      Affected

      nvd · policycoreutils · debian · 13

    • 3.8.1-2 · arm64 · trixie

      Affected

      nvd · policycoreutils · debian · 13

  • [policycoreutils]Affected
    Details (2)

    • 3.8.1-2 · amd64 · trixie

      Affected

      nvd · policycoreutils · debian · 13

    • 3.8.1-2 · arm64 · trixie

      Affected

      nvd · policycoreutils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]