Skip to content
OpenAdvisories
Low · 3.4 CVE-2026-35361 EUVD-2026-25004GHSA-79rc-qpw3-jv92GHSA-r9hw-mj3w-phcq

uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.6.0 0.6.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.6.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_mknod < 0.6.0 0.6.0 GHSA-r9hw-mj3w-phcq

References