CVE-2026-35364
MediumSummary
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation, which a local attacker with write access to the destination directory can exploit.
Risk Assessment
A local attacker can replace the destination file during the move operation, leading to unauthorized data access or privilege escalation on the system.
Recommendation
Immediately update the uutils coreutils package to a version containing the fix for the TOCTOU race condition. Until the update is applied, restrict write access to destination directories for untrusted users.
Original NVD description (English source)
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this