CVE-2026-59676: SELinux Policycoreutils Race Condition

CVE-2026-59676 Overview

CVE-2026-59676 is a Time-of-check Time-of-use (TOCTOU) race condition in the seunshare utility of SELinux policycoreutils. The flaw affects policycoreutils releases through version 3.10. A local user invoking seunshare while running in the unconfined SELinux domain can win the race between file validation and file operation. Successful exploitation lets the attacker delete arbitrary root-owned files on the system. The weakness is tracked under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.

Critical Impact
A local unprivileged user in the unconfined SELinux domain can delete arbitrary root-owned files, enabling denial of service, tampering with system integrity, and potential follow-on privilege escalation.

Affected Products

SELinux policycoreutils package through version 3.10
The seunshare binary shipped as part of policycoreutils
Linux distributions bundling affected policycoreutils versions, including openSUSE and SUSE Linux Enterprise

Discovery Timeline

2026-07-23 - CVE-2026-59676 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59676

Vulnerability Analysis

The seunshare utility creates a new namespace and runs a command as a specified user, remounting directories along the way. During this workflow, seunshare performs privileged file operations on paths supplied by the caller. The code validates a target path and then acts on it in a separate step. An attacker who controls the filesystem entries between those two operations can substitute the checked path with a symlink or alternate inode pointing to a root-owned file. The privileged process then removes the substituted target, giving the caller the power to delete files owned by root without ever holding root privileges themselves.

Root Cause

The root cause is a non-atomic sequence between path resolution and the destructive file operation inside seunshare. The utility inspects file metadata to confirm ownership or type, then reopens or unlinks the same path by name. Because the second operation resolves the path again, an attacker running concurrently can swap the underlying inode after the check but before the use. This classic TOCTOU pattern maps to CWE-367 and is only reachable when seunshare executes under the unconfined SELinux domain, where policy does not constrain the resulting file access.

Attack Vector

The attack requires local access and the ability to execute seunshare from an unconfined domain. The attacker prepares a directory under their control containing a file or symlink that passes the initial validation. They then invoke seunshare and, in a tight loop, replace the validated entry with a symlink pointing to the intended root-owned target such as files under /etc, /var, or /boot. When the race is won, seunshare deletes the linked root-owned file. Refer to the openSUSE Security Announcement and SUSE Bug Report #1268256 for distribution-specific technical details.

Detection Methods for CVE-2026-59676

Indicators of Compromise

Unexpected execution of /usr/sbin/seunshare or /usr/bin/seunshare by non-administrative users
Audit records showing rapid open, lstat, unlink, and rename syscalls against the same path from a non-root process shortly before a root-owned file is deleted
Missing or truncated critical files in /etc, /var/lib, or /boot without a corresponding package management transaction
SELinux AVC logs showing seunshare operating in the unconfined_t domain against unusual file paths

Detection Strategies

Enable Linux auditd rules covering execve of seunshare and correlate with subsequent unlink, unlinkat, and rename syscalls performed with EUID 0
Alert on symlink creations by non-privileged users that immediately precede seunshare invocations targeting the same directory
Monitor process ancestry for short-lived loops spawning ln -sf or rename calls against paths passed to seunshare

Monitoring Recommendations

Forward auditd and SELinux AVC events to a centralized logging platform for correlation and retention
Baseline legitimate seunshare usage in your environment and alert on deviations, especially invocations from interactive shells
Track integrity of files under /etc, /boot, and package-managed directories using tooling such as AIDE or Tripwire to catch unauthorized deletions

How to Mitigate CVE-2026-59676

Immediate Actions Required

Apply the updated policycoreutils package from your Linux distribution once a fixed version above 3.10 is available
Restrict execution of seunshare by removing its setuid bit or limiting access via file permissions where the utility is not required
Audit which users can invoke seunshare from an unconfined SELinux domain and reduce that set to administrators only

Patch Information

Monitor distribution advisories for updated policycoreutils releases addressing CVE-2026-59676. Vendor tracking is available through the SUSE Bug Report #1268256 and the openSUSE Security Announcement. Apply the patched package through your standard package manager once released for your distribution.

Workarounds

Remove the setuid permission from seunshare with chmod u-s /usr/sbin/seunshare if the utility is not in active use
Confine users to SELinux domains other than unconfined_t so policy denies the vulnerable file operations
Uninstall the policycoreutils-newrole or equivalent subpackage that ships seunshare on systems that do not require it

bash

# Configuration example: remove setuid bit and restrict execution to root
sudo chmod u-s /usr/sbin/seunshare
sudo chown root:root /usr/sbin/seunshare
sudo chmod 700 /usr/sbin/seunshare

# Verify current permissions
ls -l /usr/sbin/seunshare