Vulnerability · Published Apr 22, 2026 · Assigned by canonical
CVE-2026-35354uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device
Medium 4.7
In plain English
A medium-severity security flaw in coreutils from Uutils. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35354 |
| Debian:13 | rust-coreutils | no fix listed | DEBIAN-CVE-2026-35354 |
| Debian:14 | rust-coreutils | 0.9.0-1 | DEBIAN-CVE-2026-35354 |
| Ubuntu:24.04:LTS | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35354 |
| Ubuntu:25.10 | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35354 |
| Ubuntu:26.04:LTS | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35354 |
| Ubuntu:26.10 | rust-coreutils | no fix listed | UBUNTU-CVE-2026-35354 |
Affected products (as reported)
Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/uutils/coreutils/issues/10014 issue-tracking