CVE-2026-35360: uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses OTRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35360?
CVE-2026-35360 has been classified as a medium severity vulnerability due to the potential for arbitrary file truncation.
How do I fix CVE-2026-35360?
To fix CVE-2026-35360, update to the latest version of uutils coreutils where the race condition has been addressed.
What systems are affected by CVE-2026-35360?
CVE-2026-35360 affects the uutils coreutils tool, specifically the touch utility.
What types of attacks can exploit CVE-2026-35360?
CVE-2026-35360 can be exploited through a Time-of-Check to Time-of-Use race condition, allowing unauthorized file truncation.
How can I mitigate the risks associated with CVE-2026-35360?
To mitigate risks related to CVE-2026-35360, avoid using the touch command in environments where untrusted users can manipulate file accesses.