uutils coreutils CVE-2026-35376

Exploitation requires the following specific conditions: (1) the attacker must have write access to a directory tree being subjected to a recursive chcon operation; (2) the chcon command must be executed by a process with higher privileges than the attacker (typically root); (3) the attacker must be able to inject a symbolic link or rename files within the target directory tree during the narrow window between path validation and label application; (4) the chcon utility version must be earlier than 0.8.0. The attack is limited by the unpredictability of the race condition window-successful exploitation requires winning a timing race and is not reliably automatable. Default SELinux administrative workflows that restrict write access to directories being relabeled significantly reduce exploitability.

This vulnerability presents low-to-moderate real-world risk despite its moderate CVSS score of 4.5. The SSVC decision framework assessment (Exploitation: none, Automatable: no, Technical Impact: partial) aligns with the CVSS rating and indicates this is not a priority emergency. While the attack vector is local (AV:L) and requires low-level privileges (PR:L), the high attack complexity (AC:H) significantly restricts practical exploitation-an attacker must win a timing-sensitive race condition, which is notoriously unreliable and difficult to weaponize reliably. The CISA SSVC framework explicitly marks exploitation as 'none,' meaning there is no confirmed active exploitation or well-documented proof-of-concept demonstrating reliable weaponization. The technical impact is partial rather than complete, limiting blast radius to security label modifications rather than full system compromise. Environments where unprivileged users have write access to directories being recursively relabeled by privileged processes are relatively uncommon. This is a genuine vulnerability that requires patching in security-sensitive deployments, but it does not warrant emergency response procedures typical of critical remote code execution flaws.

A local user with write access to a shared directory being recursively relabeled by root via chcon -R monitors the filesystem for the moment when the chcon process checks a symbolic link within that directory. The attacker quickly creates a symbolic link pointing to a sensitive system file (e.g., /etc/security/selinux/contexts/file_contexts) before the relabeling operation is applied. If the timing aligns, the security label modification is applied to the symlink target instead of the intended directory, potentially altering SELinux policy enforcement.