CVE-2026-35359

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

It was discovered that uutils coreutils mkfifo incorrectly continued processing when a target file already existed, applying default permissions to the existing file. A local attacker could possibly use this issue to obtain sensitive information or modify file permissions unexpectedly. (CVE-2026-35341)

It was discovered that uutils coreutils dd incorrectly suppressed errors during file truncation operations. A local attacker could possibly use this issue to cause silent data corruption. (CVE-2026-35344)

It was discovered that uutils coreutils tail incorrectly followed symbolic links when using the --follow=name option. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35345)

It was discovered that uutils coreutils sort crashed when processing filenames containing non-UTF-8 bytes. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35348)

It was discovered that uutils coreutils cp incorrectly preserved setuid and setgid bits when ownership changes failed. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-35350)

It was discovered that uutils coreutils mv failed to preserve file ownership when moving files across file system boundaries. A local attacker could possibly use this issue to obtain sensitive information or cause unintended access restrictions. (CVE-2026-35351)

It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition in its extended attribute preservation logic. A local attacker with write access to a directory could possibly use this issue to modify security labels on unintended files. (CVE-2026-35354)

It was discovered that uutils coreutils cp had a race condition in its file creation logic, initially creating destination files with overly permissive modes. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35357)

It was discovered that uutils coreutils cp had a time-of-check to time-of-use race condition when handling symbolic links. A local attacker with write access to a directory could possibly use this issue to obtain sensitive information. (CVE-2026-35359)

It was discovered that uutils coreutils touch had a time-of-check to time-of-use race condition during file creation. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35360)

It was discovered that uutils coreutils rm failed to recognize trailing slashes on the current directory path. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35363)

It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition during cross-device operations. A local attacker with write access to a directory could possibly use this issue to overwrite arbitrary files. (CVE-2026-35364)

It was discovered that uutils coreutils nohup created its output file with world-readable permissions. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35367)

It was discovered that uutils coreutils chroot incorrectly resolved user specifications before dropping root privileges, allowing Name Service Switch modules to be loaded from the new root directory. A local attacker with write access to the chroot directory could possibly use this issue to execute arbitrary code as root. (CVE-2026-35368)

It was discovered that uutils coreutils ln failed to process filenames containing non-UTF-8 bytes, causing the utility to exit with an error. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35373)

It was discovered that uutils coreutils split had a time-of-check to time-of-use race condition in its input and output file validation. A local attacker with write access to a directory could possibly use this issue to cause data loss. (CVE-2026-35374)

It was discovered that uutils coreutils chcon had a time-of-check to time-of-use race condition during…