A Time‑of‑check Time‑of‑use race condition in the rm_rf() function of seunshare within the SELinux policycoreutils package allows a local user running in the unconfined SELinux domain to delete any root‑owned file on the system. The flaw arises from an insecure check‑then‑act sequence that can be hijacked when the user is granted the ability to invoke seunshare. The result is uncontrolled data loss or removal of system configuration files, which can lead to instability or unauthorized privilege escalation. The weakness is classified as CWE-367, a TOCTOU Condition.

SELinuxProject’s selinux policycoreutils package is affected, with the vulnerability present in all releases through version 3.10. Users running earlier or later versions are at risk if they use the seunshare command in an unconfined SELinux context.

The CVSS score of 5.8 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The issue is not listed in the CISA KEV catalog, and no public exploits are known. The likely attack vector is a local user executing seunshare in an unconfined domain; therefore, the vulnerability primarily affects systems where unconfined processes are permitted and SELinux policies do not adequately restrict file deletion rights.