A TOCTOU (Time-of-Check to Time-of-Use) race condition exists in the safe_traversal module of uutils coreutils. This module uses file-descriptor-relative syscalls to protect against symlink race conditions but only on Linux systems. On other Unix-like systems such as macOS and FreeBSD, these protections are not applied, leaving directory traversal vulnerable to symlink race attacks. The vulnerability has a low severity score and currently no known exploits or patches.
CVE-2026-35361 is a vulnerability in the mknod utility of uutils coreutils where device nodes are created before their SELinux security labels are set. If the labeling fails, the cleanup attempt does not remove the improperly labeled device nodes, leaving them with default contexts that may allow unauthorized access. This issue relates to improper preservation of permissions due to non-atomic handling of security labels.
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.
A vulnerability in the cp utility of uutils coreutils affects recursive copy operations (-R). When copying character and block device nodes, the utility incorrectly reads device nodes as regular files instead of preserving their device semantics using mknod. This causes device nodes like /dev/null to become regular files, potentially leading to denial of service through disk exhaustion or process hangs when accessing these files.
The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.
CVE-2026-35356 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the install utility of uutils coreutils when used with the -D flag. The vulnerability arises because the utility creates parent directories and then resolves the target file path in two separate steps without anchoring these operations to a directory file descriptor. This allows an attacker with concurrent write access to replace a path component with a symbolic link between these steps, potentially redirecting privileged writes to arbitrary filesystem locations. The vulnerability has a medium severity with a CVSS score of 6.3.
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the install utility of uutils coreutils. The vulnerability arises because the utility unlinks an existing destination file and then recreates it without using the O_EXCL flag, allowing a local attacker to swap the file path with a symbolic link. This can lead to privileged writes overwriting arbitrary system files. The vulnerability has a medium severity with a CVSS score of 6.3.
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.
A TOCTOU race condition exists in the mkdir utility of uutils coreutils when using the -m flag. The directory is initially created with default umask permissions before being changed to the requested mode, creating a brief window where the directory may be accessible to other users. This can lead to unauthorized data access in multi-user environments. The vulnerability has a low CVSS score of 3.3 and currently no known exploits or official patches are available.
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
CVE-2026-35349 is a vulnerability in the rm utility of uutils coreutils that allows bypassing the --preserve-root protection. The vulnerability arises because the utility uses a path-string check instead of verifying device and inode numbers to identify the root directory. This flaw enables an attacker or accidental user to bypass safeguards by using a symbolic link that resolves to the root directory, potentially causing recursive deletion of the entire root filesystem.
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
A vulnerability in the comm utility of uutils coreutils causes improper input validation. The utility reads data from input paths without verifying if they are regular files, leading to potential silent data loss when inputs are FIFOs or pipes. It may also hang indefinitely when reading from infinite streams like /dev/zero.
The comm utility in uutils coreutils improperly handles Unicode encoding by performing lossy UTF-8 conversion on all output lines. This causes silent data corruption when comparing binary files or files with non-UTF-8 encodings, as invalid UTF-8 sequences are replaced with the Unicode replacement character. This behavior differs from GNU comm, which preserves raw byte data. The vulnerability has a low severity score and no known exploits in the wild.
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
A vulnerability in the cut utility of uutils coreutils causes incorrect handling of the -s (only-delimited) option when a newline character is used as the delimiter. This flaw results in non-delimited lines being printed when they should be suppressed, potentially passing unexpected data to downstream scripts relying on strict output filtering. The issue is identified as CWE-670 (Always-Incorrect Control Flow Implementation). The vulnerability has a low severity score and no known exploits or patches are currently available.