CVE-2026-35341High· 7.1▾ Twilightmkfifo: permissions of an existing file are changed after FIFO creation fails
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).
$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret # uutils:
prw-r--r-- secret # changed to 644 (GNU leaves it 000)
Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.
Remediation: Acknowledged by Canonical; fixed in PR #10376.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.
Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341
uu_mkfifo < 0.6.0Upgrade to a patched release:
uu_mkfifo 0.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35361Low· 3.4mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
CVE-2025-54546High· 7.5On affected platforms, restricted users could use SSH port forwarding to access host-internal services
CVE-2025-54545High· 7.8On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.
CVE-2025-43470Medium· 5.5A permissions issue was addressed with additional restrictions
CVE-2022-0330High· 7.8A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU
CVE-2026-10840High· 7.1A flaw was found in the OpenShift Pipelines operator