CVE-2026-35364 uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition

What is CVE-2026-35364?

CVE-2026-35364 is a medium-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.

Weakness: CWE-367

Which versions are affected by CVE-2026-35364?

2 open source packages ship an affected version, including coreutils. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35364?

Apply the vendor's patch.

Is CVE-2026-35364 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35364 exists.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35364, GHSA-m976-87wm-48fm, UBUNTU-CVE-2026-35364.