CVE-2026-35361: uutils coreutils incorrect permission assignment in mknod

CVE-2026-35361 · Severity: low · CVSS 3.4 · Published 2026-04-22

The mknod utility in uutils coreutils, a Rust-based alternative to the standard GNU core utilities, contains a flaw in how it handles security labels on SELinux-enabled systems. When creating special system files (device nodes), the tool may fail to apply the correct security context and then fail to remove the incorrectly labeled file. This can result in orphaned device nodes that bypass intended security restrictions, potentially allowing unauthorized access to hardware or system resources.

Technologies: Uutils Coreutils. Vendors: crates.io, Uutils.

Quick answers

Is CVE-2026-35361 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35361 being exploited in the wild.
How severe is CVE-2026-35361?
Low severity, with a CVSS score of 3.4, published 22 April 2026.
Which products and versions are affected?
uu_mknod (crates.io) < 0.6.0, SEMVER:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2026-35361?
Yes. uu_mknod (crates.io): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35361 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35361?
Check whether you run uu_mknod (crates.io) or Uutils Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • uu_mknod (crates.io): upgrade to 0.6.0 or later
    cargo update -p uu_mknod

Technical details

The mknod utility in uutils coreutils (specifically the uu_mknod crate) creates device nodes before setting the SELinux security context, rather than using atomic labeling via setfscreatecon. If the subsequent call to set_selinux_security_context fails, the utility attempts to clean up the node using std::fs::remove_dir. Because remove_dir cannot delete device nodes or FIFOs, the cleanup fails silently, leaving a mislabeled node on the filesystem. This node inherits a default context that may be less restrictive than intended, potentially bypassing Mandatory Access Control (MAC) policies. The vulnerability is addressed in version 0.6.0 by switching to std::fs::remove_file for cleanup and recommending atomic labeling.

Affected products

  • uutils coreutils (uu_mknod) < 0.6.0

Identifiers

  • CVE-2026-35361
  • GHSA-r9hw-mj3w-phcq

Timeline

  • 2026-01-20: disclosed: Reported by Zellic in security assessment
  • 2026-01-31: patched: Fix merged into main branch
  • 2026-05-30: advisory: Initial advisory published
  • 2026-07-06: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.