CVE-2026-19079 is a TOCTOU race condition vulnerability in the fixfiles script within policycoreutils in Red Hat Hardened Images. When fixfiles relabel or restore commands run, they use find and chcon to locate and relabel unlabeled files under /tmp and other directories. A local attacker can exploit the race window between file discovery and label change by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files, such as /etc/shadow. This undermines SELinux mandatory access control protections. The vulnerability requires local access, winning a race condition, and an administrator running fixfiles relabel or restore, which limits the attack surface. Red Hat has analyzed affected versions and released updated policycoreutils RPMs (version 3.11-2.2.hum1) to fix this issue. A recommended mitigation is to use 'restorecon -R /' instead of fixfiles relabel or restore to avoid the vulnerable code path. The vulnerability has a CVSS v3.1 score of 4.4 (medium severity) with local attack vector, high attack complexity, low privileges required, and user interaction required.

The vulnerability allows a local attacker to modify SELinux labels on arbitrary system files by exploiting a race condition in the fixfiles script. This can undermine SELinux mandatory access control protections on critical files such as /etc/shadow, potentially allowing unauthorized modification of security-sensitive files. However, exploitation requires local access, winning a race condition, and an administrator running fixfiles relabel or restore commands, which limits the practical attack surface. The CVSS score of 4.4 reflects medium severity with high attack complexity and low privileges required.

Red Hat has released updated policycoreutils packages (version 3.11-2.2.hum1) that fix this vulnerability. Users should apply these updates to remediate the issue. As a workaround, administrators can use the 'restorecon -R /' command directly instead of 'fixfiles relabel' or 'fixfiles restore' to avoid the vulnerable /tmp-specific find+chcon code path. This workaround skips the /tmp cleanup logic, which is generally unnecessary on modern systems where /tmp is mounted as tmpfs. No other actions are required if the update is applied.