← Back

CVE-2026-35361

nvd nist
Published: Apr 22, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.4
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 1.8 / Impact: 2.5
Source: NVD

Description

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Affected (1)

Products: Uutils: Coreutils
1 product
Coreutils
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Before 0.6.0

References (3)

Source: security@ubuntu.com
ExploitIssue TrackingPatch
Source: security@ubuntu.com
Release Notes
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitIssue TrackingPatch

Timeline

No history available yet.