Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (CVE-2026-65183)

CVE-2026-65183 is a TOCTOU race condition vulnerability in Apache Tomcat related to the creation of Unix domain sockets. The race condition occurs when setting specific permissions, which can be exploited by an unauthorized local user to access the Unix domain socket improperly. This vulnerability affects multiple major versions of Apache Tomcat: 9.0.42 up to but not including 9.0.121, 10.1.0 up to but not including 10.1.58, and 11.0.0 up to but not including 11.0.25. The issue has been addressed in the respective fixed versions.

An unauthorized local user could exploit this race condition to gain access to Unix domain sockets that should be restricted, potentially leading to unauthorized local access or privilege escalation depending on the socket's use. This compromises the intended access controls on the socket.

A patch is available and users are strongly recommended to upgrade to Apache Tomcat versions 9.0.121, 10.1.58, or 11.0.25 or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official fix.