The vulnerability arises because the mknod utility in uutils coreutils does not atomically handle security labels when creating device nodes. Specifically, device nodes are created before the SELinux context is applied. If the labeling fails, the utility tries to clean up using std::fs::remove_dir, which cannot remove device nodes or FIFOs, resulting in leftover nodes with incorrect default security contexts. This improper preservation of permissions (CWE-281) can lead to unauthorized access to device nodes that should be restricted by SELinux mandatory access controls.

The impact is limited to potential unauthorized access to device nodes due to incorrect SELinux labeling. The CVSS score of 3.4 (low severity) reflects limited confidentiality and integrity impact, requiring local privileges with high complexity and no user interaction. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor advisory for updates. Until a fix is available, cautious use of the mknod utility in uutils coreutils is advised, especially in environments relying on SELinux for mandatory access control. No vendor advisory content indicates that the issue is already mitigated or requires no action.