CVE-2026-35354

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

• CWE-367

• https://github.com/uutils/coreutils/issues/10014Exploit, Issue Tracking, Vendor Advisory
• https://github.com/uutils/coreutils/issues/10014Exploit, Issue Tracking, Vendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35349A vulnerability in the rm utility of uutils coreutils allows…7.7
• CVE-2026-3535The DSGVO Google Web Fonts GDPR plugin for WordPress is vuln…9.8
• CVE-2026-35350The cp utility in uutils coreutils fails to properly handle …6.6
• CVE-2026-35351The mv utility in uutils coreutils fails to preserve file ow…4.2
• CVE-2026-35352A Time-of-Check to Time-of-Use (TOCTOU) race condition exist…7
• CVE-2026-35353The mkdir utility in uutils coreutils incorrectly applies pe…3.3
• CVE-2026-35355The install utility in uutils coreutils is vulnerable to a T…6.3
• CVE-2026-35356A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists…6.3
• CVE-2026-35357The cp utility in uutils coreutils is vulnerable to an infor…4.7
• CVE-2026-35358The cp utility in uutils coreutils, when performing recursiv…5.5
• CVE-2026-35359A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the…4.7
• CVE-2026-3536Integer overflow in ANGLE in Google Chrome prior to 145.0.76…8.8