The mkdir utility in uutils coreutils incorrectly handles permissions when the -m flag is used by first creating a directory with umask-derived permissions (commonly 0755) and then changing the permissions with a separate chmod call. This introduces a time-of-check to time-of-use (TOCTOU) race condition, allowing other users to access the directory during the brief window before permissions are corrected. This vulnerability is tracked as CVE-2026-35353 and classified under CWE-367. It affects version 0 of the product. There is no official remediation or patch available at this time.

In multi-user environments, the vulnerability allows a directory intended to be private to be temporarily accessible to other users. This can lead to unauthorized data access during the window between directory creation and permission adjustment. The impact is limited to confidentiality with no integrity or availability effects reported. The CVSS score of 3.3 reflects a low severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of the potential race condition when using the -m flag with mkdir in uutils coreutils. Consider avoiding the use of the -m flag in sensitive multi-user environments or applying additional access controls at the filesystem or OS level to mitigate unauthorized access during directory creation.