A Time‑of‑Check Time‑of‑Use race condition exists in the policycoreutils fixfiles script. The script runs find and chcon to locate unlabeled files under /tmp and other directories. During the window between discovery and label assignment, an attacker may replace directory components with symlinks, causing chcon to follow the symlink and change the SELinux context on an arbitrary file. The vulnerability can therefore lead to arbitrary changes to SELinux labels, undermining the mandatory access control that protects files such as /etc/shadow. The attack is likely local; an attacker would need to invoke a privileged instance of fixfiles, for example by exploitation of local privilege or manipulation of a service that runs as root.

Red Enterprise Linux distributions version 6 through 10, Red Hardened Images, and Red OpenShift Container Platform 4 are affected. All variants of these products that include the policycoreutils package are susceptible; specific version ranges are not listed.

The CVSS score of 4.4 indicates a moderate impact. Exploitation requires local access and the ability to invoke or influence the fixfiles command, which is normally privileged. The EPSS score is not available and the vulnerability is not included in CISA’s KEV catalog, suggesting limited exploitation evidence. Nonetheless, the ability to alter SELinux labels can bypass mandatory access control restrictions on system files, representing a moderate risk in environments that actively use the fixfiles script.