CVE-2026-64846: Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with OTRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nixto a version that resolves this vulnerability.Fixed in 2.35.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Nix installations running versions prior to 2.35.0 are exposed when the recursive-nix experimental feature is enabled and a malicious derivation can be executed. The affected operation runs with the permissions of the Nix process or nix-daemon.
What does an attacker need to exploit it?
An attacker needs the ability to execute a malicious derivation with recursive-nix enabled and must win a time-of-check/time-of-use race involving final symlink handling. The attack is local and requires low privileges.
What is the practical impact if exploitation succeeds?
The attacker can cause the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox, subject to that process's permissions. The issue does not provide arbitrary-content writes.
What should be done if patching cannot happen immediately?
Disable the recursive-nix experimental feature and avoid executing untrusted derivations with it enabled. Upgrade to Nix 2.35.0 when possible.