Vulnerability in Uutils Coreutils
CVE-2026-35376
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup (via fts_accpath) rather than binding the traversal and label application to the specific directory state encountered during traversal. Because these operations are not anchored to file descriptors, a local attacker with write access to a directory tree can exploit timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories. This vulnerability breaks the hardening expectations for SELinux administration workflows and can lead to the unauthorized modification of security labels on sensitive system objects.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.001 (1.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Uutils Coreutils — versions 0
Weakness classification (CWE)
References
- github.com/uutils/coreutils/pull/11402 (issue-tracking, patch, Issue Tracking)
- github.com/uutils/coreutils/releases/tag/0.8.0 (vendor-advisory, Release Notes)
Frequently asked questions
- What is CVE-2026-35376?
- CVE-2026-35376 is a medium-severity vulnerability in Uutils Coreutils, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 4.5/10. Published 2026-04-22.
- How severe is CVE-2026-35376?
- Medium severity. CVSS v3 base score is 4.5 out of 10.