CVE-2026-35376: 
Rust vulnerability analysis and mitigation

CVE-2026-35376 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the chcon utility of uutils coreutils (the Rust reimplementation of GNU coreutils). During recursive relabeling operations, the implementation resolves targets using a fresh path lookup via fts_accpath rather than anchoring operations to file descriptors bound to the traversal state, enabling a local attacker to redirect privileged SELinux relabeling to unintended files or directories. All versions prior to 0.8.0 are affected. The vulnerability was published on April 22, 2026, with a CVSS v3.1 base score of 5.8 (Medium) per Feedly/NVD, or 4.5 (Moderate) per the GitHub Advisory Database (GitHub Advisory, uutils Release).

The root cause is CWE-367 (Time-of-check Time-of-use Race Condition). The chcon utility's recursive mode uses fts_accpath to resolve file paths at the time of SELinux label application, but this lookup is not bound to the directory file descriptor (dirfd) established during traversal. GNU coreutils performs relabel operations relative to traversal dirfds using openat(), preventing path substitution between the check and use phases. Because uutils chcon lacked this anchoring, a local attacker with write access to a traversed directory tree can race the operation by performing a rename() or inserting a symbolic link between the path resolution and the setfilecon() call, redirecting the privileged label change to an unintended target. The fix, contributed via PR #11402, opens targets with openat() against the traversal current working directory file descriptor before performing SELinux get/set operations (GitHub PR #11402, GitHub Advisory).

A local attacker with write access to a directory tree being recursively relabeled can cause a privileged chcon operation to modify SELinux security labels on unintended sensitive system objects. This unauthorized modification of security labels can undermine SELinux policy enforcement, potentially enabling privilege escalation or bypassing mandatory access controls on protected resources. The vulnerability has low confidentiality and availability impact, but high integrity impact due to the ability to corrupt security policy state on the system (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with write permissions to a directory tree being processed by a privileged recursive chcon operation, and exploitation is timing-sensitive and non-deterministic, increasing attack complexity. The EPSS score is approximately 0.011–0.013%, placing it in the 2nd percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a system running uutils coreutils (Rust) version prior to 0.8.0 where a privileged user or process periodically executes chcon -R (recursive relabeling) on a directory tree to which the attacker has write access.
2. Prepare the race: In the target directory tree, create a file or subdirectory that will be traversed by the chcon -R operation. Prepare a symlink or a renamed path pointing to a sensitive system file (e.g., a file with a security-critical SELinux label such as /etc/shadow or a system binary).
3. Trigger the race: Launch a background process that rapidly alternates between the legitimate path and the symlink/renamed path (e.g., using rename() or ln -sf) in a tight loop, targeting the window between fts_accpath path resolution and the setfilecon() call in the chcon utility.
4. Win the race: If the rename or symlink swap occurs between the path lookup and the SELinux label application, chcon applies the new label to the unintended target file rather than the intended one.
5. Achieve objective: The sensitive system object now carries a modified SELinux label, potentially allowing the attacker's process (running under a context that matches the new label) to access or modify the previously protected resource, enabling privilege escalation or policy bypass (GitHub PR #11402, GitHub Advisory).

• File System: Unexpected changes to SELinux security labels on sensitive files (detectable via ls -Z or stat --printf='%C\n'); presence of symbolic links in directories undergoing recursive chcon operations pointing to files outside the intended tree.
• Logs: SELinux audit log entries (/var/log/audit/audit.log) showing setfilecon operations on unexpected or sensitive paths during or shortly after a chcon -R invocation; AVC denials or label changes on system files not normally relabeled.
• Process: Rapid rename() or symlink() syscalls in a directory tree concurrent with a running chcon process, observable via strace, auditd syscall monitoring, or inotifywait on the target directory.

Upgrade uutils coreutils to version 0.8.0 or later, which anchors recursive relabel resolution to the traversal directory file descriptor using openat(), eliminating the TOCTOU window (uutils Release). As a workaround prior to patching, restrict write access to directory trees where privileged chcon -R operations are performed, limiting the ability of unprivileged users to introduce symlinks or perform renames during traversal. Additionally, audit SELinux label configurations on affected systems to identify any unauthorized modifications made prior to patching.

The vulnerability was reported to the uutils project under the reported-canonical-2 label, indicating involvement from Canonical (Ubuntu) security researchers. An Ubuntu Discourse post discussed the broader context of Rust coreutils security (Ubuntu Discourse). The fix was contributed by researcher can1357 via GitHub PR #11402 and was incorporated into the 0.8.0 release. The oss-security mailing list also carried a disclosure notice (oss-sec).