diff --git a/pkgs/by-name/po/policycoreutils/package.nix b/pkgs/by-name/po/policycoreutils/package.nix
index 89a2e30e324c..092b0183bac7 100644
--- a/pkgs/by-name/po/policycoreutils/package.nix
+++ b/pkgs/by-name/po/policycoreutils/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   gettext,
   libsepol,
   libselinux,
@@ -20,6 +21,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-BU5B7AOXMaXua3l6jguNbjRu4dCpusLyUttIwj+aixs=";
   };
 
+  patches = [
+    # https://nvd.nist.gov/vuln/detail/CVE-2026-19079
+    (fetchpatch {
+      name = "CVE-2026-19079.patch";
+      url = "https://github.com/SELinuxProject/selinux/commit/a556538c2d5d2583273e025b45c02651fef47679.patch";
+      stripLen = 1;
+      hash = "sha256-na/4xfW1R5VwvwHTUHXSs23pOD8Z/ClbBET+oxJe+uA=";
+    })
+  ];
+
   postPatch = ''
     # Fix install references
     substituteInPlace po/Makefile \