CVE-2026-35361

The record

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Affected packages

Related vulnerabilities

• GHSA-79rc-qpw3-jv92 uutils coreutils has an Improper Preservation of Permissions issue Same vulnerability
• GHSA-532v-xp3f-837c uutils coreutils has an Incorrect Provision of Specified Functionality Issue in its cut… Also affects coreutils
• GHSA-6g8r-74qp-6859 uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition Also affects coreutils
• GHSA-53gr-wmf4-8hh3 uutils coreutils's User Interface (UI) Misrepresents Critical Information Also affects coreutils
• GHSA-5pv5-xh52-hvrp uutils coreutils has an Incorrect Short Circuit Evaluation Issue Also affects coreutils
• GHSA-5v4g-vw9x-h534 uutils coreutils has an Improper Input Validation Issue in its env Utility Also affects coreutils
• GHSA-4wrp-79m8-9m9p uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition Also affects coreutils
• GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue Also affects coreutils