CVE-2026-35360

What it actually does

CVE-2026-35360 is a local Time-of-Check to Time-of-Use race condition in the uutils coreutils implementation of the touch utility. When touch determines that a target path does not exist, there is a race window before the file is actually created. During that window, a local attacker with the ability to manipulate the target directory can create the path or replace it with a symlink. Because the subsequent creation path uses File::create(), which opens the target with truncation semantics, touch may truncate an attacker-chosen existing file instead of safely creating only the originally missing file. The primary impacts are integrity loss and availability loss through unintended file truncation; it does not directly provide confidentiality impact or remote code execution.

Why it matters to the business

Successful exploitation can cause permanent loss or corruption of files that are reachable through the vulnerable touch operation, which may disrupt applications, jobs, scripts, deployments, or system maintenance workflows that rely on those files. The risk is most relevant on multi-user systems, shared workspaces, build environments, CI runners, temporary directories, or automation paths where one user or process can influence file paths used by another. The CVSS score is moderate, EPSS is very low and flat over 30 days, it is not listed in CISA KEV, and no public exploit maturity is indicated, so broad internet-scale exploitation is unlikely; however, the operational impact can be significant if trusted automation runs touch in attacker-writable directories or against predictable paths.

How an attack unfolds

An attacker first needs local access or the ability to influence a directory where the vulnerable uutils touch command will operate. The attacker identifies a workflow that invokes touch on a predictable path that is expected to be absent, such as a generated marker file, build artifact, temporary file, or lock-style path. While touch checks whether the path exists and then proceeds toward creation, the attacker wins the race by creating the path or swapping in a symlink that points to another file the touch process is allowed to modify. When the vulnerable code calls File::create(), the target is opened with truncation behavior, causing the referenced existing file to be reduced to zero length or otherwise overwritten as part of the creation operation. The attacker’s practical goal is destructive: corrupting configuration, state, application data, logs, or build/deployment artifacts accessible to the victim process. Exploitation requires timing and local path control, making it higher complexity, but it can be reliable in scripts or automation loops that repeatedly invoke touch on predictable paths.

How to fix it

Upgrade uutils coreutils to a version that contains a fix when an official fixed release is available. No fixed versions were provided in the input, so security teams should monitor the uutils coreutils advisory, distribution package advisories, and downstream vendor repositories for patched builds. Where immediate upgrade is not possible, reduce exposure by avoiding use of the uutils touch implementation in attacker-writable directories, replacing it with a known-safe implementation if appropriate, and modifying scripts to create files atomically with no-follow and exclusive-create semantics rather than relying on check-then-create behavior. Avoid predictable file names in shared directories, avoid operating on paths controlled by less-trusted users, harden temporary directory handling, and ensure automation does not run touch with elevated privileges against user-controllable paths. Standard filesystem permissions, sticky-bit directories, private working directories, and least-privilege execution can materially reduce exploitability.

How to confirm the fix worked

Confirm whether systems use the uutils coreutils implementation of touch rather than another coreutils implementation, then verify the installed package version against vendor advisories once a fixed release is published. Validate that scripts and automation do not invoke touch on predictable paths in directories writable by lower-trust users. In test environments, attempt safe negative validation by checking whether touch can be induced to truncate a benign file through symlink/path replacement in an attacker-writable directory; do not test against production files. After patching or mitigation, confirm that file creation uses atomic exclusive-create behavior and does not follow attacker-swapped symlinks in the vulnerable path. Package inventories, SBOMs, container image scans, and CI runner base-image checks should include uutils coreutils because the affected binary may be embedded in images or developer toolchains.

Typical attack path

1. Gain local access to a system, container, shared development host, CI worker, or automation environment where uutils coreutils touch is used.
2. Identify a directory or workflow where the attacker can create, delete, or replace entries and where a more privileged or trusted process invokes touch on a predictable missing path.
3. Prepare a target file for truncation that the victim touch process has permission to write, often by abusing symlink resolution or rapid path replacement.
4. Race the vulnerable touch operation after it checks that the requested path is missing but before it creates the file.
5. Create the path or swap in a symlink during the race window so the final File::create() call acts on an existing attacker-selected file.
6. Cause the selected file to be truncated, resulting in data loss, application disruption, failed jobs, or corrupted operational state.

How to detect it

This vulnerability leaves filesystem-centric evidence rather than network indicators. Review endpoint, audit, EDR, and file integrity logs for suspicious touch executions in shared or attacker-writable directories followed by unexpected truncation of existing files. Useful sources include Linux auditd logs for execve and open/openat/openat2 events, EDR process telemetry, shell history where available, CI runner logs, build system logs, file integrity monitoring alerts, and application logs showing sudden parse failures or zero-length configuration/state files. Hunt for touch processes opening files with truncation flags shortly after path creation, symlink creation, rename, or unlink activity in the same directory by a different user or lower-trust process. Pay particular attention to /tmp, /var/tmp, workspace directories, build directories, shared project directories, and container-mounted volumes. Indicators are likely low-confidence because touch is common and file truncation may be legitimate; correlate process lineage, user identity, directory permissions, symlink activity, and whether the truncated file is security- or operations-sensitive. No named threat actors, ransomware campaigns, or KEV exploitation are associated with the provided data.

• process.name:touch
• comm="touch"
• exe="/usr/bin/touch"
• exe="/bin/touch"
• type=EXECVE msg=* a0="touch"
• type=SYSCALL msg=* comm="touch"
• O_TRUNC
• openat*O_TRUNC*comm="touch"
• /tmp/
• /var/tmp/
• /dev/shm/
• ln -s
• type=SYMLINK
• type=PATH msg=* nametype=CREATE
• type=PATH msg=* nametype=DELETE
• type=PATH msg=* nametype=NORMAL

What your security team should do

• Inventory systems, containers, CI images, build agents, and developer environments for uutils coreutils and determine whether its touch utility is in use.
• Prioritize review of multi-user hosts, shared writable directories, build pipelines, deployment scripts, and automation that runs touch with elevated or service-level privileges.
• Monitor upstream and distribution advisories for the first fixed uutils coreutils version, then patch affected packages and rebuild dependent container images or base images.
• Until a fix is available, avoid invoking vulnerable touch on attacker-controlled or shared writable paths; use private directories and atomic file-creation patterns instead.
• Review scripts for predictable marker, lock, stamp, or temporary file names that are created with touch and move them to secure per-process or per-user directories.
• Enable or tune file integrity monitoring and audit logging around high-value files that should never be truncated unexpectedly.
• Treat unexpected zero-byte critical files, sudden configuration truncation, or unexplained build artifact corruption on shared systems as possible exploitation indicators.
• Because EPSS is very low, KEV is false, and exploit maturity is listed as none, prioritize remediation based on local exposure and operational criticality rather than internet-facing urgency.