The vulnerability in uutils coreutils mkfifo arises from improper handling of existing files at the target path. Specifically, if mkfifo fails to create a FIFO because a file already exists, it continues to execute a set_permissions call that resets the existing file's permissions to a default mode (commonly 644). This behavior constitutes an incorrect permission assignment (CWE-732) that can lead to unauthorized access to critical files by lowering their protection unexpectedly.

The impact of this vulnerability is the unauthorized modification of file permissions on existing files, potentially exposing sensitive data such as SSH private keys to other users with local access. The CVSS score of 7.1 reflects high severity, indicating significant confidentiality and integrity impact without affecting availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a fix is available, avoid running mkfifo on paths where critical files exist or verify file permissions after mkfifo operations to detect unintended changes.