The Red Hat Hardened Images RPMs update includes fixes and enhancements for policycoreutils packages. A notable vulnerability (CVE-2026-59677) exists in policycoreutils through version 3.10 in the seunshares component, where missing authorization allows local users running in an unconfined SELinux context to kill other unconfined processes, including root-owned ones, leading to denial of service. The advisory notes that default SELinux confinement reduces practical attack surface. The update includes multiple policycoreutils RPMs versioned 3.11-2.1.hum1 for architectures aarch64 and x86_64. No explicit patch link is provided, and mitigation options are currently unavailable or insufficient per Red Hat criteria.

The vulnerability allows a local low-privileged user running unconfined SELinux to terminate other unconfined processes, including those owned by root, causing denial of service. There is no confidentiality or integrity impact reported. The default SELinux confinement reduces the practical attack surface, limiting exploitation to unconfined contexts.

Red Hat currently does not provide an official fix for this vulnerability in the affected versions. Mitigation options are either unavailable or do not meet Red Hat's criteria for ease of use, deployment, applicability, or stability. Users are advised to apply the updated policycoreutils RPMs when available and maintain default SELinux confinement to reduce attack surface. Monitoring Red Hat advisories for future patches is recommended.