PT-2026-34490 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35354

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) issue exists in the mv utility during cross-device moves. The logic for preserving extended attributes (xattr) relies on multiple path-based system calls that perform new path-to-inode lookups for every operation. A local attacker with write access to the directory can exploit this race condition to swap files between calls, resulting in the destination file receiving an inconsistent mix of security xattrs, such as file capabilities or SELinux labels.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-35354

GHSA-X4MC-MQM7-GG39

Affected Products

Uutils Coreutils

References · 10

• 🔥 https://github.com/uutils/coreutils/issues/10014 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35354 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35354 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35354 · Security Note
• https://osv.dev/vulnerability/GHSA-x4mc-mqm7-gg39 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35354 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35354 · Security Note
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012100862816667 · Twitter Post