CVE-2026-35341: uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up setpermissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.
Other sources
When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::setpermissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).
$ touch secret; chmod 000 secret $ coreutils mkfifo secret fifo3 fifo4 mkfifo: cannot create fifo 'secret': File exists $ ll secret # uutils: prw-r--r-- secret # changed to 644 (GNU leaves it 000)
Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.
Remediation: Acknowledged by Canonical; fixed in PR #10376.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.
Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_mkfifoto a version that resolves this vulnerability.Fixed in 0.6.0 - Upgrade
Upgrade
uutils coreutils mkfifoto a version that resolves this vulnerability.Patch #10376 - Configuration
In uutils coreutils mkfifo, after the error when mkfifo fails (e.g., when the target path already exists), add the missing `continue;` so the code does not fall through to `fs::set_permissions` that would change permissions on the pre-existing file.
uutils coreutils mkfifo continue; after mkfifo error handling = add continue; - Operational
Re-check any sensitive owner-only files whose permissions may have been relaxed to default modes (e.g., changed to 644 after umask) as a result of mkfifo failing and falling through to set_permissions; restore intended permissions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35341?
CVE-2026-35341 has a moderate severity rating due to its potential for unauthorized permission changes on existing files.
How do I fix CVE-2026-35341?
To mitigate CVE-2026-35341, ensure that the `mkfifo` command is not used on paths where existing files could be unintentionally modified.
Which versions of uutils coreutils are affected by CVE-2026-35341?
CVE-2026-35341 affects all versions of uutils coreutils, particularly in scenarios involving the mkfifo command.
What type of vulnerability is CVE-2026-35341?
CVE-2026-35341 is a permissions vulnerability allowing unauthorized changes to existing file permissions.
How can I identify systems vulnerable to CVE-2026-35341?
You can identify vulnerable systems by checking for the use of uutils coreutils, especially where mkfifo is utilized.