PT-2026-34512 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-35376

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) issue exists in the chcon utility during recursive operations. The implementation resolves recursive targets using a fresh path lookup via fts accpath instead of binding the traversal and label application to the specific directory state encountered during traversal. Since these operations are not anchored to file descriptors, a local attacker with write access to a directory tree can use timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories. This can lead to unauthorized modification of security labels on sensitive system objects, breaking hardening expectations for SELinux administration workflows.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-35376

Affected Products

Uutils Coreutils

References · 4

• https://github.com/uutils/coreutils/releases/tag/0.8.0 · Vendor Advisory
• https://github.com/uutils/coreutils/pull/11402 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35376 · Security Note
• https://twitter.com/CVEnew/status/2047012077123109032 · Twitter Post