CVE-2026-19079 is a TOCTOU race condition in the fixfiles script of policycoreutils used in Red Hat Hardened Images. When fixfiles relabel or fixfiles restore commands run, they use find and chcon to relabel unlabeled files under /tmp and other directories. An attacker with local access can exploit a race window between file discovery and label change by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on arbitrary system files. This can compromise SELinux mandatory access control protections on critical files such as /etc/shadow. The vulnerability requires local privileges and administrative execution of fixfiles commands, limiting practical attack surface. Red Hat has not yet released a patch but provides a mitigation workaround.

The vulnerability allows a local attacker to modify SELinux labels on arbitrary system files by exploiting a race condition during filesystem relabeling, potentially undermining SELinux protections. This could lead to unauthorized access or modification of critical system files, impacting system integrity. However, exploitation requires local access, winning a race condition, and administrative execution of fixfiles relabel or restore, which limits the attack surface. There is no indication of confidentiality or availability impact.

Red Hat advises using 'restorecon -R /' directly instead of 'fixfiles relabel' or 'fixfiles restore' to avoid the vulnerable code path. This workaround skips the /tmp cleanup logic but is safe on modern systems where /tmp is mounted as tmpfs. Users should apply this mitigation until an official fix is released. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.