CVE-2026-35361

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35361
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-35361.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-35361
Aliases
Downstream
Published
2026-04-22T16:08:30.756Z
Modified
2026-07-11T03:54:28.925534797Z
Severity
  • 3.4 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems
Details

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Database specific 
{
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-281",
        "CWE-459"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35361.json"
}
References

Affected packages

Git / github.com/uutils/coreutils

Affected ranges

Type
GIT
Repo
https://github.com/uutils/coreutils
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2319a99057d11b0c9744c885df84806eea019166
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.0"
        }
    ]
}

Affected versions

0.*
0.0.1
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.0.3
0.0.30
0.0.30-delete
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.2.0
0.2.2
0.3.0
0.4.0
0.5.0
Other
latest-commit

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-35361.json"