CVE-2026-35352

OVERVIEW CVE-2026-35352 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the mkfifo utility of uutils coreutils. The vulnerability exists because mkfifo creates a FIFO file and then separately applies permission changes via chmod. A local attacker with write access to the parent directory can exploit the timing window between these two operations by replacing the newly created FIFO with a symbolic link, redirecting the chmod call to an arbitrary file on the system. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) with a local attack vector, high complexity requirement, and low privileges needed. Potential impact is severe, including confidentiality, integrity, and availability compromise. The attack becomes particularly dangerous if mkfifo is executed with elevated privileges, where an attacker could use the redirected chmod operation to alter permissions on sensitive system files and potentially achieve privilege escalation. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the KEV catalog and is marked as inactive on threat intelligence tracking lists. The estimated probability of exploitation (EPSS score of 0.0001) is significantly lower than the average CVE, suggesting minimal current community attention or publicly available proof-of-concept code. However, the straightforward nature of the race condition means exploitation remains feasible for motivated threat actors with local system access.