The touch utility in uutils coreutils suffers from a TOCTOU race condition when creating files. After detecting a missing file path, touch calls File::create(), which opens the file with O_TRUNC, truncating it if it exists. Because of the race window between the check and the use, an attacker with local access and limited privileges can create or swap a symlink at the target path, causing unintended truncation of files. This vulnerability is tracked as CVE-2026-35360 with a CVSS 3.1 score of 6.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). No known exploits are reported in the wild, and no patch or official remediation level has been published.

Exploitation of this vulnerability can lead to permanent data loss by truncating existing files due to the race condition in file creation. The integrity and availability of files can be compromised. Confidentiality is not affected. The attack requires local access with low privileges and high attack complexity due to the timing requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the vulnerable touch utility in untrusted or multi-user environments where an attacker could exploit the race condition. Monitor vendor channels for updates or official patches.