CVE-2026-35352 Details
Description
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.
A Time-of-Check to Time-of-Use (TOCTOU) race condition has been identified in the mkfifo utility of uutils coreutils. This vulnerability arises because mkfifo creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can exploit this by replacing the newly created FIFO with a symbolic link to an arbitrary file before the chmod operation is applied. This could lead to unauthorized modifications, such as changing the permissions of sensitive files, and potentially allow privilege escalation if mkfifo is executed with elevated rights.
Users are advised to update to the latest version of uutils coreutils, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/issues/10020 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/05/04/4 | CVE | |
| http://www.openwall.com/lists/oss-security/2026/05/04/5 | CVE | |
| http://www.openwall.com/lists/oss-security/2026/05/04/6 | CVE | |
| https://github.com/uutils/coreutils/issues/10020 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | CVE Modified | CVE |
| May 4, 2026 | CVE Modified | CVE |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |