This vulnerability involves a TOCTOU race condition in the mv utility of uutils coreutils when performing cross-device moves. The utility removes the destination path before recreating it via a copy operation. During this window, an attacker with local write access to the destination directory can replace the destination with a symbolic link. The subsequent privileged move operation follows the symlink, enabling the attacker to overwrite arbitrary files with the source file's contents. The CVSS 3.1 score is 6.3, reflecting local attack vector with high complexity and low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

The vulnerability allows a local attacker with write permissions on the destination directory to overwrite arbitrary files by exploiting a race condition. This can lead to integrity and availability impacts, such as unauthorized modification or destruction of files. There is no confidentiality impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to destination directories to trusted users only to reduce the risk of exploitation.