https://seclists.org/oss-sec/2026/q2/373: uutils coutils CVEs
Published May 4, 2026
·Updated
Affected Software
1 affected component
uutils uutils coreutils mkfifo=0.8.0
Users who run uutils coreutils mkfifo in a location where another local user can access the newly created FIFO during creation are exposed. The example uses /tmp/fifo, where the FIFO is initially created world-readable and world-writable before its mode is changed.
The attacker needs local access and an opportunity to act between FIFO creation and the subsequent chmod call. For the issue described as involving a symlink swap, the attacker also needs write access to the FIFO's parent directory.
Yes. The provided trace shows mkfifo temporarily creating the FIFO with mode 0666, subject to the process umask, before applying the requested 0700 mode with chmod.