This vulnerability involves a TOCTOU race condition in the mv utility of uutils coreutils when moving files across devices. The extended attribute preservation logic uses multiple system calls that resolve file paths independently, allowing a local attacker with write permissions in the directory to swap files between these calls. This can result in the destination file receiving inconsistent or incorrect security extended attributes, including SELinux labels or file capabilities. The vulnerability is identified as CWE-367 and has a CVSS 3.1 base score of 4.7, indicating medium severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability allows a local attacker with write access to the directory to cause the destination file to receive an inconsistent mix of security extended attributes during cross-device moves. This could lead to incorrect security labeling or capabilities being applied to files, potentially undermining security policies enforced by mechanisms such as SELinux or file capabilities. There is no indication of confidentiality or availability impact, and exploitation requires local access with write permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to directories where the mv utility is used for cross-device moves by untrusted users to reduce the risk of exploitation.