A TOCTOU race condition exists in the mv utility of uutils coreutils (CVE-2026-35354) affecting versions up to 0.8.0. This flaw occurs during cross-device moves where extended attribute preservation uses multiple path-based system calls, allowing a local attacker with write access to the directory to swap files between calls. This can cause the destination file to receive inconsistent security extended attributes such as SELinux labels or file capabilities. The vulnerability has a medium severity with a CVSS score of 4.7.