CVE-2026-35376
TOCTOU Vulnerability in uutils coreutils chcon Enables SELinux Label Tampering
Publication date: 2026-04-22
Last updated on: 2026-05-04
Assigner: Canonical Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| uutils | coreutils | to 0.8.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) flaw in the chcon utility of uutils coreutils during recursive operations. It occurs because the utility resolves recursive targets using a fresh path lookup instead of binding the traversal and label application to the specific directory state encountered during traversal. This means that a local attacker with write access to a directory tree can exploit timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories.
As a result, the vulnerability breaks the hardening expectations for SELinux administration workflows and can lead to unauthorized modification of security labels on sensitive system objects.
How can this vulnerability impact me? :
This vulnerability can allow a local attacker with write access to a directory tree to manipulate privileged recursive relabeling operations. By exploiting timing-sensitive rename or symbolic link races, the attacker can redirect these operations to unintended files or directories.
The impact includes unauthorized modification of security labels on sensitive system objects, potentially weakening the security posture of the system and allowing further unauthorized actions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized modification of security labels on sensitive system objects by exploiting a race condition in recursive SELinux relabel operations. Such unauthorized modifications can undermine the integrity and security of system controls that protect sensitive data.
Because standards like GDPR and HIPAA require strict controls over access and protection of sensitive data, this vulnerability could potentially lead to non-compliance by enabling attackers to bypass security mechanisms and alter security labels, thereby compromising data protection measures.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a timing-sensitive race condition in the chcon utility during recursive SELinux relabel operations. Because it involves local file system races with rename or symbolic link operations, detection requires monitoring for unexpected or unauthorized changes to SELinux security labels on files or directories.
There are no specific commands provided in the available information to directly detect this vulnerability on your system or network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that you update the uutils coreutils package to a version that includes the fix described in the referenced pull request (#11402). This fix anchors recursive relabel operations to the traversal directory file descriptor, preventing the race condition.
Additionally, restrict write access to directory trees where SELinux relabeling operations are performed to trusted users only, minimizing the risk of local attackers exploiting rename or symbolic link races.