CVE-2026-64846
Received Received - Intake

Race Condition in Nix Package Manager

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-64846
EUVD
EUVD-2026-63424

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nixos nix to 2.35.0 (inc)
nixos nix to 2.35.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition in Nix versions prior to 2.35.0 when the experimental recursive-nix feature is enabled. A malicious derivation exploits this to cause the Nix process to truncate or create empty files outside the build sandbox with the daemon user's permissions. The issue involves improper handling of symbolic links that resolve outside the intended control scope.

Detection Guidance

Check Nix version with 'nix --version'. If it is below 2.35.0 and the experimental recursive-nix feature is enabled, the system may be vulnerable. Review system logs for unusual file creation or truncation events outside build directories.

Impact Analysis

The impact is limited but could allow a local attacker with access to the system to create or truncate empty files outside the build sandbox. This requires winning a race condition and does not allow arbitrary content writes. The attack has high complexity and does not need user interaction.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves a local privilege escalation within the Nix package manager's sandboxed environment. The issue allows file truncation outside the build sandbox but does not involve unauthorized data access or disclosure, which are key concerns for GDPR and HIPAA.

Mitigation Strategies

Upgrade Nix to version 2.35.0 or later. Disable the experimental recursive-nix feature if not required. Monitor file system changes and restrict nix-daemon permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart