CVE-2026-35352

What it actually does

This is a local time-of-check to time-of-use race condition in the uutils coreutils implementation of mkfifo. The utility creates a FIFO and then applies permissions using a path-based chmod operation. If an attacker can write to the parent directory, they may be able to replace the just-created FIFO with a symbolic link before chmod runs, causing permissions to be changed on a different file. When mkfifo is executed with elevated privileges, this can alter permissions on sensitive files and may enable local privilege escalation, integrity compromise, and unauthorized data access.

Why it matters to the business

The risk is primarily to systems where uutils coreutils is installed and mkfifo can be invoked in privileged workflows against directories writable by less-privileged users. Successful exploitation could allow a local user or compromised low-privilege account to weaken file permissions, potentially leading to administrative access, disclosure of sensitive data, or disruption of host integrity. The CVSS score is high, but exploitation requires local access, precise race timing, and a writable parent directory; EPSS is very low and there is no known KEV listing or public exploit maturity reported.

How an attack unfolds

An attacker first obtains local low-privilege access to a system using uutils coreutils. They identify a privileged script, service, installation routine, or administrator action that runs mkfifo in a directory the attacker can modify. During mkfifo execution, the program creates the FIFO and then performs chmod using the pathname. The attacker races this sequence by replacing the FIFO path with a symbolic link to a target file before chmod occurs. If the race succeeds, chmod follows the attacker-controlled path and changes permissions on the target file. Depending on the target and resulting permissions, the attacker may gain read or write access to sensitive files, modify trusted configuration, or create a path to privilege escalation.

How to fix it

Upgrade uutils coreutils to a version containing the upstream fix once available from the project or operating system/package maintainer. If no fixed version is currently provided, mitigate by avoiding privileged use of uutils mkfifo in attacker-writable directories, using trusted directories with restrictive ownership and permissions, and replacing vulnerable workflows with implementations that apply permissions safely without following attacker-controlled paths. Do not run mkfifo with elevated privileges on paths inside world-writable, group-writable, temporary, shared, or user-controlled directories. Where practical, use OS distribution coreutils packages that are confirmed not to contain this vulnerable behavior, or pin to a patched vendor package when released.

How to confirm the fix worked

Confirm whether uutils coreutils is installed and whether the mkfifo binary in use is from uutils rather than another coreutils implementation. Review package manager metadata, binary provenance, and version information. Search privileged scripts, service units, cron jobs, build/install tooling, and automation for mkfifo calls that create FIFOs in writable directories. After remediation, verify that the installed package version includes the vendor fix or that vulnerable privileged workflows have been removed. Validate directory permissions so privileged mkfifo operations occur only in directories not writable by untrusted users. If audit controls are available, test that file permission changes caused by privileged mkfifo workflows are logged and do not affect symlink targets.

Typical attack path

1. Gain local access as an unprivileged user or execute code through a compromised low-privilege account.
2. Confirm the system uses uutils coreutils and that mkfifo is available in a privileged execution path.
3. Identify a directory writable by the attacker where mkfifo is run with elevated privileges.
4. Monitor or trigger the privileged mkfifo operation.
5. Replace the newly created FIFO with a symbolic link before the path-based chmod operation completes.
6. Cause chmod to apply permissions to an attacker-chosen target file.
7. Use the changed permissions to read, modify, or replace sensitive files and escalate privileges.

How to detect it

Look for evidence of privileged mkfifo executions in directories writable by untrusted users, followed closely by symlink creation, deletion, rename activity, or chmod operations on unexpected files. Useful log sources include Linux auditd, eBPF/EDR telemetry, shell history, sudo logs, process execution logs, file integrity monitoring, package inventory, and system logs from automation frameworks. Investigate chmod events performed by root or privileged service accounts where the target file is not the FIFO expected by the associated script. Also review sensitive files for recent permission changes, especially files that became group-writable, world-readable, world-writable, or executable unexpectedly. Because this flaw is a race condition, exploitation may leave limited evidence; correlation between mkfifo execution, symlink manipulation, and anomalous chmod activity is the most useful signal.

• process.name=mkfifo
• comm="mkfifo"
• SYSCALL=chmod
• SYSCALL=fchmodat
• SYSCALL=symlink
• SYSCALL=symlinkat
• SYSCALL=rename
• SYSCALL=renameat
• ln -s
• chmod 777
• chmod 666
• chmod 777 /etc/
• chmod 666 /etc/
• type=EXECVE msg=*mkfifo*
• type=SYSCALL msg=*chmod*
• type=SYSCALL msg=*symlink*

What your security team should do

• Inventory systems using uutils coreutils and identify where its mkfifo implementation is present.
• Prioritize review of servers, build systems, developer workstations, containers, and automation hosts where unprivileged users can write to directories used by privileged scripts.
• Patch through the operating system, package manager, or upstream uutils coreutils release as soon as a fixed version is available.
• Until patched, prevent privileged mkfifo execution in attacker-writable directories and harden temporary directory usage in scripts and services.
• Enable or review audit logging for chmod, symlink creation, and privileged process execution involving mkfifo.
• Investigate unexpected permission changes on sensitive files, especially where they coincide with mkfifo execution or symlink manipulation.
• Treat successful exploitation as a local privilege escalation event and perform credential, persistence, and integrity review of affected hosts.