CVE-2026-35353 uutils coreutils mkdir Permission Exposure Race Condition with -m

What is CVE-2026-35353?

CVE-2026-35353 is a low-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.

Weakness: CWE-367

Which versions are affected by CVE-2026-35353?

2 open source packages ship an affected version, including uu_mkdir. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35353?

Upgrade uu_mkdir to 0.6.0 or later.

Is CVE-2026-35353 being exploited?

There is no known exploitation of CVE-2026-35353 in the wild and no public exploit code.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35353, GHSA-mj6p-44ch-cq69, UBUNTU-CVE-2026-35353.