TOCTOU Race Condition in uutils Coreutils Touch Utility

CVE-2026-35360

What is CVE-2026-35360?

The touch utility in uutils coreutils is susceptible to a Time-of-Check to Time-of-Use (TOCTOU) race condition during the file creation process. When the utility detects a missing path, it subsequently attempts to create the file via File::create(), which uses O_TRUNC internally. This introduces a vulnerable time window where an attacker can exploit the condition by creating a file or swapping a symlink at the target path. This can lead to the unintended truncation of an existing file, resulting in permanent data loss.

References