CVE catalog

CVE-2026-35354

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based

[CVE catalog]

Severity
Medium · CVSS 6.4CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.11% · Oct 25, 2026

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-coreutilssid0.12.0-1fixed
Debianrust-coreutilsforky0.12.0-1fixed
Debianrust-coreutilstrixie0.0.30-2vulnerable
Debianrust-coreutilsbookworm0.0.17-2vulnerable
Cperust-coreutilsNot reportedNot reportedvulnerable
CpecoreutilsNot reportedNot reportedunknown
CpecoreutilsNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-coreutilssourcesid0.9.0-1not yet assignedNot reported[1136043]
Debianrust-coreutilssourceforky0.9.0-1not yet assignedNot reported[1136043]
Debianrust-coreutilssourcetrixie(unfixed)not yet assignedNot reported[1136043]
Debianrust-coreutilssourcebookworm(unfixed)not yet assignedNot reported[1136043]

[Debian bug #1136043]

Notes

[trixie] rust-coreutils: Minor issue [bookworm] rust-coreutils: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.17-2 · amd64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

    • 0.0.17-2 · arm64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

[Debian 13 (Trixie)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.30-2 · amd64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

    • 0.0.30-2 · arm64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]