Time-of-Check/Time-of-Use Race in Nix Package Manager by NixOS

CVE-2026-64846

What is CVE-2026-64846?

The Nix package manager, used in Linux and other Unix systems, is exposed to a vulnerability due to a time-of-check/time-of-use race condition in its recursive-nix experimental feature. This flaw pertains to the final symlink handling within the LocalStore restore path. If a malicious derivation successfully triggers this race, it can manipulate the writeFile function to follow a substituted final symlink while opening a path with O_TRUNC, resulting in the Nix process or nix-daemon creating or truncating an empty file outside the designated build sandbox. This action occurs with the permissions of the daemon user. The issue was addressed and resolved in version 2.35.0.

References