The mkdir utility in uutils coreutils incorrectly handles permission setting when the -m flag is used. Instead of atomically creating the directory with the requested permissions, it first creates the directory with default umask permissions and then changes them with a separate chmod call. This TOCTOU race condition can expose directories intended to be private to other users for a short time in multi-user environments. The vulnerability is identified as CWE-367 and has a low severity rating (CVSS 3.3). There is no vendor advisory or patch information available at this time.

The vulnerability allows a brief window during directory creation where permissions are more permissive than intended, potentially enabling unauthorized users to access directories that should be private. However, the impact is limited to information disclosure (confidentiality) and does not affect integrity or availability. The low CVSS score reflects the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be aware of the potential race condition when using the -m flag with mkdir in uutils coreutils and consider alternative methods or additional access controls to protect sensitive directories in multi-user environments.