CVE-2026-35353 Details

A vulnerability exists in the uutils coreutils mkdir utility, specifically in version 0.6.0, related to how directory permissions are managed when the -m flag is used. The utility initially creates a directory with default umask-derived permissions, typically 0755. It then attempts to change these permissions to the desired mode using a separate chmod system call. This process creates a temporary window in multi-user environments where the directory, intended to be private, is briefly accessible to other users. This flaw could potentially lead to unauthorized access to sensitive data.

Users can update to uutils coreutils version 0.6.0 or later, where this vulnerability has been addressed.