CVE catalog

CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race inv

[CVE catalog]

Severity
Low · CVSS 2.8CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.11% · Oct 25, 2026

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannixsid2.34.8+dfsg-1vulnerable
Debiannixforky2.34.8+dfsg-1vulnerable
Debiannixtrixie2.26.3+dfsg-1vulnerable
Debiannixbookworm2.8.0-1.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannixsourcesid(unfixed)not yet assignedNot reported[1145021]
Debiannixsourceforky(unfixed)not yet assignedNot reported[1145021]
Debiannixsourcetrixie(unfixed)not yet assignedNot reported[1145021]
Debiannixsourcebookworm(unfixed)not yet assignedNot reported[1145021]

[Debian bug #1145021]

Notes

[trixie] nix: Minor issue [bookworm] nix: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [nix-bin]Affected

    Source package: [nix]

    Details (2)

    • 2.8.0-1.1 · arm64 · bookworm

      Affected

      nvd · nix · debian · bookworm; nvd · nix · debian · 12

    • 2.8.0-1.1+b1 · amd64 · bookworm

      Affected

      nvd · nix · debian · bookworm; nvd · nix · debian · 12

  • [nix-setup-systemd]Affected

    Source package: [nix]

    Details (2)

    • 2.8.0-1.1 · all · bookworm

      Affected

      nvd · nix · debian · bookworm; nvd · nix · debian · 12

    • 2.8.0-1.1 · all · bookworm

      Affected

      nvd · nix · debian · bookworm; nvd · nix · debian · 12

[Debian 13 (Trixie)]

  • [nix-bin]Affected

    Source package: [nix]

    Details (2)

    • 2.26.3+dfsg-1 · amd64 · trixie

      Affected

      nvd · nix · debian · 13

    • 2.26.3+dfsg-1 · arm64 · trixie

      Affected

      nvd · nix · debian · 13

  • [nix-setup-systemd]Affected

    Source package: [nix]

    Details (2)

    • 2.26.3+dfsg-1 · all · trixie

      Affected

      nvd · nix · debian · 13

    • 2.26.3+dfsg-1 · all · trixie

      Affected

      nvd · nix · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]