CVE-2026-35352: uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35352?
CVE-2026-35352 is classified as a privilege escalation vulnerability due to its potential for unauthorized access.
How do I fix CVE-2026-35352?
To fix CVE-2026-35352, update the uutils coreutils package to the latest version where the vulnerability has been addressed.
Who is affected by CVE-2026-35352?
Users of the uutils coreutils mkfifo utility are affected by CVE-2026-35352 if they have write access.
What kind of attack does CVE-2026-35352 enable?
CVE-2026-35352 enables a local attacker to exploit a TOCTOU race condition for privilege escalation.
What does TOCTOU stand for in CVE-2026-35352?
TOCTOU stands for Time-of-Check to Time-of-Use, referring to a race condition vulnerability present in CVE-2026-35352.