CVE-2026-35362
TOCTOU Symlink Race Vulnerability in uutils coreutils on Unix-like Systems
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: Canonical Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| uutils | coreutils | to 0.6.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided context and resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability exists in the safe_traversal module of uutils coreutils. The module is designed to protect against Time-of-Check to Time-of-Use (TOCTOU) symlink race conditions by using file-descriptor-relative system calls. However, this protection is only applied on Linux systems. On other Unix-like systems such as macOS and FreeBSD, the module does not use these protections, making directory traversal operations vulnerable to symlink race attacks.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to exploit symlink race conditions during directory traversal operations on affected systems (macOS, FreeBSD). This could lead to unauthorized access or manipulation of files by tricking the system into following malicious symbolic links, potentially compromising the integrity and confidentiality of data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability relates to unsafe directory traversal operations due to missing TOCTOU protections on Unix-like systems other than Linux. Detection involves verifying whether the safe_traversal protections are enabled and functioning on your system's uutils coreutils utilities.
Since the issue is related to race conditions in directory traversal, direct detection commands are not explicitly provided. However, you can check the version of uutils coreutils installed and verify if it includes the patch expanding safe_traversal to all Unix platforms.
Suggested commands to gather relevant information include:
- Check the version of uutils coreutils: `uutils --version` or check the version of individual utilities like `chmod`, `rm`, `du` if they are from uutils.
- Review the source or binary for the presence of the safe_traversal module supporting your platform (Unix but not Linux).
- Run tests or scripts that attempt to exploit TOCTOU symlink race conditions on directory traversal operations to see if protections are effective.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update your uutils coreutils installation to a version that includes the patch expanding safe_traversal protections to all Unix platforms, including macOS and BSD variants.
This update ensures that directory traversal operations use file-descriptor-relative syscalls to prevent TOCTOU symlink race conditions.
Additional mitigation steps include:
- Apply the security update or patch from the uutils/coreutils project that changes the safe_traversal module from Linux-only to all Unix platforms.
- Verify that SELinux feature guards are correctly configured if you are on Linux, to avoid build or runtime issues.
- Test your utilities after update to confirm that safe_traversal protections are active and that TOCTOU race conditions are mitigated.