UBUNTU-CVE-2026-35364: Race Condition
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu2~26.04.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the mv utility from Ubuntu's rust-coreutils package are exposed when a privileged cross-device move writes into a destination directory that an untrusted local user can modify.
What conditions are required for exploitation?
An attacker needs local access and write permission to the destination directory. They must win the race after mv removes the destination path and before it recreates it during the cross-device copy operation.
Can this be exploited through ordinary same-filesystem moves?
The described race occurs during cross-device operations, where mv removes the destination and recreates it through a copy operation. The provided information does not indicate that same-filesystem moves are affected.
What is the impact if exploitation succeeds?
The attacker can replace the destination path with a symbolic link and cause the privileged move operation to follow it. This can redirect the write and overwrite an arbitrary target file with the source file's contents.