CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition

What is CVE-2026-35352?

CVE-2026-35352 is a high-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.

Weakness: CWE-367

Which versions are affected by CVE-2026-35352?

2 open source packages ship an affected version, including coreutils. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35352?

Apply the vendor's patch.

Is CVE-2026-35352 being exploited?

There is no known exploitation of CVE-2026-35352 in the wild and no public exploit code.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7
• CVE-2026-35350 uutils coreutils cp Unexpected Privileged Executable Creation with -p Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35352, GHSA-9gh9-hwpr-rvqq, UBUNTU-CVE-2026-35352.