CVE-2026-35361: uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems
The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::removedir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.
Other sources
uutils calls mknod before setting the SELinux context (GNU uses setfscreatecon first, labeling atomically). If setselinuxsecuritycontext fails, cleanup uses std::fs::removedir, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind.
Impact: on SELinux-enforcing systems the node is created with the wrong context; the command reports failure but leaves a mislabeled device node that may bypass mandatory access control, and orphaned nodes can persist across reboots. Recommendation: use setfscreatecon before mknod, abort on failure, and use removefile for cleanup.
Remediation: Acknowledged by Canonical.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.58. Credit: Zellic.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_mknodto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35361?
The severity of CVE-2026-35361 is categorized as medium due to potential improper handling of security labels.
How do I fix CVE-2026-35361?
To fix CVE-2026-35361, update to the latest version of uutils coreutils which contains the necessary patch.
What systems are impacted by CVE-2026-35361?
CVE-2026-35361 affects systems running uutils coreutils with SELinux enabled.
What are the risks associated with CVE-2026-35361?
The risks associated with CVE-2026-35361 include the potential for incorrect security labels on device nodes, leading to unauthorized access.
Is there a workaround for CVE-2026-35361?
As a temporary workaround for CVE-2026-35361, avoid using the mknod utility until the software is updated.