Security Label Handling Flaw in uutils Coreutils Affects Device Nodes

CVE-2026-35361

What is CVE-2026-35361?

The mknod utility in uutils coreutils poses a significant risk due to improper handling of security labels during the creation of device nodes. The utility fails to set the appropriate SELinux context atomically, leading to a situation where mislabeled nodes may be left behind if the labeling process encounters an error. The subsequent cleanup attempts using std::fs::remove_dir are ineffective, as this method is incapable of removing device nodes or FIFO special files. This flaw could result in unauthorized access to device nodes, bypassing established mandatory access controls and potentially exposing systems to further security threats.

References