CVE-2026-64846 Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-64846?
CVE-2026-64846 is a low-severity vulnerability in NixOS nix, published on 20 Aug 2026.
Official description
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Which versions are affected by CVE-2026-64846?
How do I fix CVE-2026-64846?
No fix has been published for CVE-2026-64846 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-64846 being exploited?
There is no known exploitation of CVE-2026-64846 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-64846, GHSA-6h4g-g5j9-fm5f, UBUNTU-CVE-2026-64846.