CVE-2026-19079 is a TOCTOU race condition vulnerability in the fixfiles script of policycoreutils used in Red Hat Hardened Images. The script uses find and chcon commands to relabel unlabeled files under /tmp and other directories. An attacker with local access can exploit the race window between file discovery and label change by swapping directory components with symlinks, causing chcon to follow symlinks and modify SELinux labels on arbitrary system files. This can compromise SELinux mandatory access control protections on critical files such as /etc/shadow. The vulnerability requires local privileges and administrative execution of fixfiles relabel or restore, limiting the attack surface. Red Hat is investigating affected versions and whether backporting fixes is necessary. A mitigation is to avoid using fixfiles relabel or restore and instead use 'restorecon -R /' to perform relabeling, which bypasses the vulnerable code path. No official fix has been released yet.

The vulnerability allows a local attacker to manipulate SELinux labels on arbitrary system files by exploiting a race condition in the fixfiles script. This can undermine SELinux mandatory access control protections, potentially allowing unauthorized modification of critical files such as /etc/shadow. However, exploitation requires local access, winning a race condition, and an administrator running the vulnerable fixfiles commands, which limits the practical attack surface. There is no indication of remote exploitation or automated attacks in the wild.

Red Hat recommends using 'restorecon -R /' directly instead of 'fixfiles relabel' or 'fixfiles restore' to avoid the vulnerable /tmp-specific find+chcon code path. This workaround skips the /tmp cleanup logic, which is generally unnecessary on modern systems where /tmp is mounted as tmpfs. Red Hat is still analyzing affected versions and has not yet released an official fix. Users should monitor Red Hat advisories for updates and apply official patches once available.