A TOCTOU race condition exists in the split utility of uutils coreutils (CVE-2026-35374). The utility checks for identity between input and output file paths before splitting, but then opens the output file with truncation after this check. A local attacker with write access to the directory can exploit this race window by manipulating path components, causing unintended truncation and data loss.