Vulnerability in Uutils Coreutils
CVE-2026-35361
The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.4 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.001 (3.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 3.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Uutils Coreutils — versions 0
Weakness classification (CWE)
References
- github.com/uutils/coreutils/pull/10582 (issue-tracking, Exploit, Patch, patch, Issue Tracking)
- github.com/uutils/coreutils/releases/tag/0.6.0 (vendor-advisory, Release Notes)
Frequently asked questions
- What is CVE-2026-35361?
- CVE-2026-35361 is a low-severity vulnerability in Uutils Coreutils, classified under Improper Preservation of Permissions. CVSS score: 3.4/10. Published 2026-04-22.
- How severe is CVE-2026-35361?
- Low severity. CVSS v3 base score is 3.4 out of 10.