SECURITY: policycoreutils/fixfiles <= 3.11: relabel files to incorrect security context

An upstream security advisory for CVE-2026-19079 has been published at:
https://github.com/SELinuxProject/selinux/security/advisories/GHSA-647q-jhqw-6p4w

The description is included below but please refer to the link for the
latest information as it
may be updated.

Title
policycoreutils/fixfiles <= 3.11: relabel files to incorrect security context

Description
fixfiles is a script that wraps the setfiles and restorecon programs
to provide a more user-friendly interface for fixing or checking file
security contexts. When called with the relabel command, fixfiles also
attempts to clean up /tmp and to relabel any unlabeled files in /tmp,
/var/tmp, /var/run, and /var/lib/debug that may be leftover from a
previous SELinux-disabled boot. fixfiles does so in an unsafe manner
that is subject to TOCTOU issues, making it possible for files to be
mislabeled.

Impact
If an unprivileged user/process can execute commands/code while
fixfiles relabel is being run by an admin or other privileged process,
the user may be able to trigger a relabel of a file they do not own to
the wrong security context.

Patches
Upstream fixed this issue by dropping the functionality in commit
https://github.com/SELinuxProject/selinux/commit/a556538c2d5d2583273e025b45c02651fef47679,
which will be included in the 3.12 release.

Workarounds
Enable the fs.protected_symlinks and fs.protected_hardlinks sysctl settings.
Only run fixfiles relabel at boot using autorelabel before any
untrusted users/processes can run.

References
https://access.redhat.com/security/cve/cve-2026-19079