Race Condition in mkfifo Utility of uutils Coreutils

CVE-2026-35352

What is CVE-2026-35352?

A race condition in the mkfifo utility of uutils coreutils allows a local attacker to exploit the difference between the time a FIFO is created and when permissions are applied. An attacker with write access to the parent directory can replace the newly created FIFO with a symbolic link before the chmod operation executes. This manipulation can redirect the chmod call to an arbitrary file, which can lead to privilege escalation when the mkfifo utility is executed with elevated privileges.

References