UBUNTU-CVE-2026-35360: Race Condition
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses OTRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1 - Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu2~26.04.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low privileges, and must be able to race the affected touch invocation by creating a file or replacing the target path with a symlink during the check-to-create window.
What is the practical impact of a successful race?
A successful exploit can cause touch to truncate an existing file at the target path. This results in permanent data loss; the provided information does not indicate confidentiality impact.
What conditions make an invocation exposed?
The vulnerable path is reached when touch determines that a target path is missing and subsequently creates it. Exploitation also requires a timing race, reflected by the high attack complexity rating.