CVE-2026-35354
MediumSummary
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access can exploit this race condition.
Risk Assessment
The risk involves a local attacker potentially replacing a file during the time window between check and use, leading to unauthorized data access or privilege escalation.
Recommendation
Immediately update the uutils coreutils package to a version containing the fix for the TOCTOU vulnerability in the mv utility. Also consider restricting system access for untrusted users.
Original NVD description (English source)
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with wri