CVE-2026-35354

What it actually does

This is a local time-of-check to time-of-use race condition in the uutils coreutils implementation of mv when moving files across filesystems or devices while preserving extended attributes. During the move, mv performs multiple path-based lookups to read and apply xattrs, rather than binding those operations to a stable file descriptor or verified inode. An attacker who can modify files in the relevant directory can race those lookups by swapping path targets between operations. If successful, the destination file can receive security-sensitive extended attributes from a different file, such as SELinux labels or Linux file capabilities, resulting in unauthorized integrity changes. The issue requires local access, write permission in the directory, and successful race timing; it does not provide remote code execution by itself.

Why it matters to the business

Systems that rely on uutils coreutils for file operations may incorrectly apply security metadata during cross-device file moves. In practical terms, this could weaken mandatory access controls, mislabel files, or assign unexpected file capabilities, potentially allowing a local low-privileged user to influence how files are trusted or executed. The CVSS score is moderate and EPSS is very low with no known exploitation or KEV listing, so broad internet-scale exploitation is unlikely; however, the integrity impact can be important on multi-user Linux systems, build hosts, container hosts, package staging systems, and environments that depend heavily on SELinux labels or file capabilities.

How an attack unfolds

An attacker first obtains local access to a system where uutils coreutils mv is installed and identifies a directory where they can create, delete, or rename files involved in a cross-device move. They prepare one or more files with security-relevant xattrs and another file intended to become the move destination. While a privileged or more trusted process performs a cross-device mv that preserves extended attributes, the attacker repeatedly swaps pathnames, symlinks, hard links where applicable, or file entries between the utility's xattr read and write operations. Because the vulnerable logic resolves the path again for each xattr operation, different operations may act on different inodes even though the pathname appears unchanged. If the race is won, the final destination can receive an inconsistent set of xattrs, such as an unintended SELinux context or file capability. The attacker then attempts to use the mislabeled or capability-bearing file to bypass expected security policy or alter program behavior.

How to fix it

Upgrade uutils coreutils to a vendor-provided version containing the fix when available. No exact fixed version was provided in the input, so track the upstream uutils coreutils advisory, operating system package advisories, and distribution backports. Where immediate patching is not possible, reduce exposure by avoiding cross-device mv operations in attacker-writable directories, preventing untrusted users from controlling source or destination directories used by privileged file-move workflows, and reviewing scripts or automation that preserve xattrs while moving files between filesystems. On SELinux-enabled systems or systems using file capabilities, consider validating or resetting security xattrs after privileged move operations. Prefer tools or workflows that preserve metadata using file-descriptor-based operations with inode verification rather than repeated path-based lookups.

How to confirm the fix worked

Confirm the installed mv implementation is from uutils coreutils and verify the package version against the fixed version published by the upstream project or operating system vendor. Test whether cross-device moves preserve xattrs safely by attempting controlled moves between two filesystems while concurrently renaming or replacing source and destination path entries, then checking that the final destination's inode and xattrs are consistent with the intended source. Inspect files moved through privileged workflows for unexpected security.selinux or security.capability xattrs. For production validation, use package inventory, configuration management, or endpoint telemetry to identify systems running uutils coreutils and prioritize multi-user hosts, build systems, and hosts enforcing SELinux or file capabilities.

Typical attack path

1. Gain local low-privileged access to a system using uutils coreutils mv.
2. Find a writable directory or workflow where cross-device mv operations occur and extended attributes are preserved.
3. Prepare controlled files with selected extended attributes, such as SELinux labels or file capabilities, where the attacker has a way to influence source or directory contents.
4. Trigger or wait for a cross-device mv operation involving paths in the attacker-writable directory.
5. Rapidly swap file path targets between xattr check, copy, and apply operations to win the TOCTOU race.
6. Verify whether the destination file received unexpected security xattrs.
7. Abuse the resulting mislabeled or capability-bearing file to affect integrity, policy enforcement, or privilege boundaries.

How to detect it

There are no unique public exploit indicators for this vulnerability, so detection should focus on behavior and artifacts consistent with attempted race exploitation. Review auditd, eBPF, endpoint detection, and filesystem telemetry for repeated rename, unlink, link, and xattr operations in the same directory while mv is running, especially when moves cross filesystem boundaries. On Linux, useful telemetry includes execve events for mv, rename/renameat/renameat2, setxattr/lsetxattr/fsetxattr, getxattr/lgetxattr/fgetxattr, removexattr, chmod/chown where relevant, and changes to security.selinux or security.capability attributes. Investigate unexpected file capabilities, unusual SELinux labels, or label transitions on files recently moved by privileged automation. Correlate suspicious activity with local users who had write access to the affected directory. For forensic review, compare destination file xattrs against known-good baselines, package manifests, deployment records, or expected SELinux policy contexts. High-frequency file swapping in temporary, staging, build, or shared writable directories during privileged mv execution should be treated as suspicious, but by itself may not prove exploitation.

What your security team should do

• Inventory systems using uutils coreutils, especially where it replaces GNU coreutils in the default user path.
• Monitor upstream and distribution advisories for the patched uutils coreutils release and deploy it when available.
• Prioritize remediation on multi-user Linux systems, build or packaging hosts, container hosts, and SELinux-enforcing systems.
• Restrict untrusted write access to directories used by privileged scripts or services that perform cross-device mv operations.
• Review automation that moves files across filesystems while preserving xattrs, and add post-move validation of SELinux labels and file capabilities where security-sensitive.
• Enable or tune audit/eBPF monitoring for suspicious xattr changes, file capability assignments, and high-frequency rename activity in attacker-writable directories.
• Because EPSS is low and there is no known KEV or mature public exploit, treat this as a targeted local integrity risk rather than an emergency internet-facing exposure.