| Name | CVE-2026-59677 |
| Description | A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| policycoreutils (PTS) | bullseye | 3.1-3 | fixed |
| bookworm | 3.4-1 | fixed |
| trixie | 3.8.1-2 | fixed |
| forky, sid | 3.11-1 | fixed |
| selinux-python (PTS) | bullseye | 3.1-1 | vulnerable |
| bookworm | 3.4-1 | vulnerable |
| trixie | 3.8.1-2 | fixed |
| forky | 3.10-1 | fixed |
| sid | 3.11-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bookworm] - selinux-python <postponed> (Minor issue; seunshare is not setuid-root in Debian, it gets file capabilities without CAP_KILL, so killall() cannot signal root-owned processes)
[bullseye] - selinux-python <postponed> (Minor issue; seunshare is not setuid-root in Debian, it gets file capabilities without CAP_KILL, so killall() cannot signal root-owned processes)
src:policycoreutils 2.7 dropped sandbox/seunshare.c core and stopped building
policycoreutils-sandbox. Built from selinux-python until 3.7-1 and moved to a
separate upstream package.
https://security.opensuse.org/2026/07/15/selinux-seunshare.html