CVE-2026-35364 Details

A Time-of-Check to Time-of-Use (TOCTOU) race condition has been identified in the mv utility of uutils coreutils, specifically during cross-device operations. The vulnerability arises because the utility deletes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this timing issue by replacing the destination with a symbolic link. When the privileged move operation is performed, it will follow the symlink, allowing the attacker to redirect the write operation and overwrite an arbitrary target file with contents from the source.