CVE-2026-35361

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-353623.6The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using fCVE-2026-353635.6A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. WCVE-2026-353646.3A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utilCVE-2026-353656.6The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. ICVE-2026-353664.4The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permitsCVE-2026-353673.3The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This cCVE-2026-353687.8A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specificatiCVE-2026-353695.5An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SICVE-2026-35378.8Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap CVE-2026-353704.4The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of theCVE-2026-353713.3The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The CVE-2026-353725.0A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference
CVE-2026-35361: Medium severity, CVSS 4.4 | Vulnix