The mknod utility in uutils coreutils fails to atomically handle SELinux security labels when creating device nodes. It creates the device nodes first and then attempts to set the SELinux context. If setting the context fails, the utility tries to clean up using std::fs::remove_dir, which cannot remove device nodes or FIFOs. As a result, mislabeled device nodes remain with incorrect default security contexts, potentially permitting unauthorized access to these nodes that should be restricted by mandatory access controls.

The vulnerability may lead to device nodes being left with incorrect default SELinux contexts, potentially allowing unauthorized users with sufficient privileges to access device nodes that should be restricted. The CVSS score of 3.4 (low severity) reflects limited confidentiality and integrity impact and no availability impact. Exploitation requires local access with high privileges.

No official fix or patch is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should be aware of the risk of mislabeled device nodes when using the mknod utility in uutils coreutils and consider alternative methods or manual verification of device node labels after creation.