CVE-2026-35354 uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device

What is CVE-2026-35354?

CVE-2026-35354 is a medium-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

Weakness: CWE-367

Which versions are affected by CVE-2026-35354?

2 open source packages ship an affected version, including coreutils. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35354?

Apply the vendor's patch.

Is CVE-2026-35354 being exploited?

There is no known exploitation of CVE-2026-35354 in the wild and no public exploit code.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35354, GHSA-x4mc-mqm7-gg39, UBUNTU-CVE-2026-35354.