CVE catalog

CVE-2026-35364

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it throug

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.09% · Oct 25, 2026

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-coreutilssid0.12.0-1fixed
Debianrust-coreutilsforky0.12.0-1fixed
Debianrust-coreutilstrixie0.0.30-2vulnerable
Debianrust-coreutilsbookworm0.0.17-2vulnerable
Cperust-coreutilsNot reportedNot reportedvulnerable
CpecoreutilsNot reportedNot reportedunknown
CpecoreutilsNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-coreutilssourcesid0.9.0-1not yet assignedNot reported[1136045]
Debianrust-coreutilssourceforky0.9.0-1not yet assignedNot reported[1136045]
Debianrust-coreutilssourcetrixie(unfixed)not yet assignedNot reported[1136045]
Debianrust-coreutilssourcebookworm(unfixed)not yet assignedNot reported[1136045]

[Debian bug #1136045]

Notes

[trixie] rust-coreutils: Minor issue [bookworm] rust-coreutils: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.17-2 · amd64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

    • 0.0.17-2 · arm64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

[Debian 13 (Trixie)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.30-2 · amd64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

    • 0.0.30-2 · arm64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]