CVE-2026-35364

What it actually does

This vulnerability is a local time-of-check to time-of-use race condition in the uutils coreutils implementation of mv during cross-device move operations. When mv handles a move that requires copying data to the destination filesystem, it removes the destination path before recreating it. A local attacker who can write to the destination directory may win the race window by replacing the destination path with a symbolic link. If the mv operation is running with elevated privileges, the subsequent copy can follow the attacker-controlled symlink and overwrite an arbitrary file with the source file contents, causing high-impact integrity and availability compromise.

Why it matters to the business

Systems that use uutils coreutils for privileged file-management workflows may be vulnerable to local privilege-abuse scenarios where a lower-privileged user can corrupt or replace sensitive files. Successful exploitation could break services, alter configuration, disable controls, or create conditions for privilege escalation depending on which privileged process invokes mv and what files are overwritten. The EPSS score is very low, there is no known CISA KEV listing, and no public exploit maturity is reported, so broad exploitation is not currently indicated; however, the impact is serious where untrusted local users can write to directories used by privileged move operations.

How an attack unfolds

An attacker first obtains low-privileged local access to a system and identifies a destination directory where they have write permission and where a privileged process or administrator may run uutils mv across filesystem boundaries. The attacker monitors or repeatedly attempts to interfere with the destination path during the cross-device move. When mv removes the existing destination path and before it recreates the destination through the copy operation, the attacker replaces that path with a symbolic link pointing to a sensitive target file. If the timing succeeds, the privileged mv process follows the symlink and writes the source file contents into the target file. The attacker can use this to corrupt critical files, alter configuration, or create a follow-on path to privilege escalation if the overwritten file is security-sensitive.

How to fix it

Upgrade uutils coreutils to a vendor-provided version that fixes this race condition as soon as an official fixed release is available. No exact fixed version was provided in the input, so track the uutils coreutils project and downstream operating system or package maintainers for patched builds. Where immediate upgrade is not possible, avoid using uutils mv in privileged workflows that operate in directories writable by untrusted users, especially for cross-device moves. Replace vulnerable workflows with safer copy-and-rename patterns that do not follow attacker-controlled symlinks, use temporary files created securely in trusted directories, validate paths after opening them, and enforce ownership and permission checks. Restrict write access to directories used as destinations by privileged file operations. Consider using a patched alternative coreutils implementation if operationally acceptable until uutils packages are corrected.

How to confirm the fix worked

Confirm whether systems use uutils coreutils rather than another coreutils implementation and inventory the installed package version through the operating system package manager or the mv binary metadata. Validate that patched packages are installed once a fixed version is published by the vendor or distribution. Review privileged scripts, service units, maintenance jobs, package hooks, and administrative automation for cross-device mv operations into directories writable by non-privileged users. Test mitigation by ensuring untrusted users cannot create or replace entries in privileged mv destination directories. For high-assurance validation, use filesystem auditing or a controlled lab test to verify that a symlink substituted at the destination is not followed during privileged move operations after patching.

Typical attack path

1. Gain low-privileged local access to a system using uutils coreutils.
2. Identify a writable destination directory used by a privileged mv operation.
3. Trigger or wait for a cross-device mv operation that removes and recreates the destination path.
4. Race the operation by replacing the destination path with a symbolic link after deletion and before copy/recreation.
5. Point the symbolic link at a sensitive file that the privileged mv process can write.
6. Cause the privileged mv operation to overwrite the target file with attacker-chosen or attacker-influenced source contents.
7. Leverage the overwritten file to disrupt services, alter behavior, or attempt privilege escalation.

How to detect it

Look for behavioral evidence rather than a stable exploit signature. Relevant sources include Linux auditd or equivalent syscall telemetry, EDR process/file events, shell history, sudo logs, systemd journal entries, file integrity monitoring, and package manager or automation logs. Focus on privileged executions of uutils mv performing cross-device moves into directories writable by non-privileged users, followed closely by symlink creation or replacement of the same destination path. Investigate sequences where a low-privileged user creates a symbolic link in a shared or writable directory immediately before a privileged mv process writes through that path. Review recent unexpected modifications to sensitive files such as sudoers policy, cron files, systemd unit files, SSH authorized_keys, PAM configuration, shell startup files, and service configuration. Since no known threat actors, ransomware use, or public exploit maturity are reported, detections should emphasize local race-condition behavior and anomalous privileged file overwrites rather than known campaign indicators.

• comm="mv"
• exe="/usr/bin/mv"
• exe="/bin/mv"
• SYSCALL=symlink
• SYSCALL=symlinkat
• SYSCALL=unlink
• SYSCALL=unlinkat
• SYSCALL=rename
• SYSCALL=renameat
• SYSCALL=renameat2
• /etc/sudoers
• /etc/sudoers.d/
• /etc/crontab
• /etc/cron.d/
• /etc/systemd/system/
• /root/.ssh/authorized_keys
• /etc/ssh/sshd_config
• /etc/passwd
• /etc/shadow
• /etc/pam.d/

What your security team should do

• Inventory systems and containers that use uutils coreutils, prioritizing multi-user systems, build hosts, CI runners, shared development machines, and systems with local shell access for untrusted users.
• Monitor upstream uutils coreutils and distribution advisories for the official fixed version, then patch promptly when available.
• Identify privileged automation that invokes mv across filesystems and refactor it to use trusted directories, secure temporary files, and non-symlink-following file handling.
• Remove untrusted write permissions from directories used as destinations by privileged file operations.
• Add audit rules or EDR detections for privileged mv executions involving writable directories, symlink creation, and writes to sensitive paths.
• Treat unexpected changes to privileged configuration files, service definitions, cron entries, shell startup files, sudo policy, SSH authorized keys, and system libraries as potential follow-on evidence.
• Because EPSS is low and there is no KEV listing, prioritize based on local-user exposure and privileged workflow risk rather than internet-facing urgency.