CVE-2026-73584

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the /tmp directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.

This Moderate impact flaw in sblim-sfcb allows a local attacker to achieve privileged file corruption or denial of service through a time-of-check-to-time-of-use (TOCTOU) race condition. Exploitation requires a local low-privileged user to win a race during privileged sfcbrepos instance migration, which must be enabled and have specific repository content. The high attack complexity and specific preconditions limit its broader impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, if instance migration is not required, run the sfcbrepos command with the -i option to disable the vulnerable migration path. For example: sudo sfcbrepos -f -i. Alternatively, avoid running sfcbrepos with elevated privileges on systems where untrusted local users can concurrently write to the /tmp directory. A service restart or reload may be required for changes to take effect if sfcbrepos is managed by a service.