TOCTOU Flaw in coreutils mkfifo: Local Privilege Escalation Risk

The National Vulnerability Database has identified CVE-2026-35352, a Time-of-Check to Time-of-Use (TOCTOU) race condition in the mkfifo utility within uutils coreutils. This flaw allows a local attacker with write permissions to the parent directory to exploit the window between mkfifo creating a FIFO and setting its permissions. By swapping the newly created FIFO for a symbolic link, the attacker can redirect the chmod operation to an arbitrary file, potentially leading to privilege escalation if the utility is executed with elevated rights.

The CVSS score of 7 (HIGH) highlights the severity of this vulnerability. While affected products are not explicitly detailed by the National Vulnerability Database, the nature of the attack implies any system utilizing this version of coreutils is at risk, particularly in shared or multi-user environments where local access is present. Defenders must be aware that even seemingly benign utilities can harbor critical security flaws.

To mitigate this risk, organizations should prioritize patching or updating their uutils coreutils installation to a version that addresses CVE-2026-35352. For systems where patching is not immediately feasible, restricting write access to parent directories where mkfifo might be used, especially by unprivileged users, can serve as a compensating control. Auditing execution logs for suspicious mkfifo usage or permission changes could also provide early detection.