[DSE-Dev] Bug#1143965: policycoreutils: CVE-2026-19079

[Salvatore Bonaccorso]

Source: policycoreutils
Version: 3.11-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for policycoreutils.

CVE-2026-19079[0]:
| A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability
| was found in the fixfiles script in policycoreutils. When running
| fixfiles relabel or fixfiles restore, the script used find and chcon
| commands to locate and relabel unlabeled files under /tmp and other
| directories. A local attacker could exploit a race window between
| the file discovery and the label change operation by swapping
| directory components with symlinks, causing chcon to follow the
| symlink and modify SELinux labels on arbitrary system files. This
| could undermine SELinux mandatory access control protections on
| critical files such as /etc/shadow.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-19079
    https://www.cve.org/CVERecord?id=CVE-2026-19079
[1] https://github.com/SELinuxProject/selinux/commit/a556538c2d5d2583273e025b45c02651fef47679

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore