Vulnerability in Uutils Coreutils
CVE-2026-35354
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.001 (0.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 0th percentile — 0.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
Weakness classification (CWE)
References
- github.com/uutils/coreutils/issues/10014 (issue-tracking, Exploit, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-35354?
- CVE-2026-35354 is a medium-severity vulnerability in Uutils Coreutils, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 4.7/10. Published 2026-04-22.
- How severe is CVE-2026-35354?
- Medium severity. CVSS v3 base score is 4.7 out of 10.