CVEvulnerability

CVE-2026-35361

4.4 MEDIUM Published 2026-04-22 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-04-22
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.4 LOW — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-281, CWE-459

Description

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Affected configurations

• uutils coreutils (< 0.6.0)

Related

Weakness · CWE (2)

  • CWE-281 Improper Preservation of Permissions weakness
  • CWE-459 Incomplete Cleanup weakness

References