A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. (CVE-2026-59677)

CVE-2026-59677 describes a missing authorization vulnerability in the SELinux policycoreutils seunshares component. Specifically, it allows a user operating in an unconfined context to terminate processes owned by root that are also running in an unconfined context. This affects policycoreutils versions up to and including 3.10. The vulnerability has a CVSS 4.0 vector indicating local attack vector, low attack complexity, no privileges required beyond low, no user interaction, and high impact on availability. No known exploits in the wild or vendor patch information is provided.

An attacker with local access running in an unconfined context can kill root-owned processes also running in an unconfined context, potentially disrupting system availability. There is no indication of privilege escalation or confidentiality/integrity impact. The impact is limited to denial of service against certain processes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict unconfined user contexts and limit local user access to trusted users only to reduce risk.