CVE-2026-35361 uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems

What is CVE-2026-35361?

CVE-2026-35361 is a low-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Weakness: CWE-459, CWE-281

Which versions are affected by CVE-2026-35361?

2 open source packages ship an affected version, including uu_mknod. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35361?

Upgrade uu_mknod to 0.6.0 or later.

Is CVE-2026-35361 being exploited?

There is no known exploitation of CVE-2026-35361 in the wild and no public exploit code.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35361, GHSA-r9hw-mj3w-phcq, UBUNTU-CVE-2026-35361.