uutils coreutils CVE-2026-93658

Requires local use of the install utility with BOTH a setuid/setgid mode (e.g. -m 4755 or -m 2755) AND a requested ownership change (e.g. -o root / -g), executed by a privileged invoker, on a system where the chown(2) operation actually FAILS - the vendor's own test guards on 'only meaningful when the chown can actually fail' (non-root euid or capability-restricted environment such as dropped CAP_CHOWN). Limiting factors: attack is local only (AV:L), needs the operator to already hold install privileges (PR:L), requires the specific capability-restricted precondition (AT:P) and is high-complexity (AC:H); on unrestricted systems where chown succeeds the setuid bits are correctly cleared and re-applied, so default root-capable hosts are not affected.

This is a genuine but modest-priority local privilege-escalation flaw, not a mass-exploitable remote issue despite the 7.3 score. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L) is internally consistent with the description: exploitation is LOCAL, requires the attacker (or a privileged operator being abused) to already run install with elevated privilege (PR:L), demands a specific race/precondition (AT:P - a capability-restricted system where chown(2) actually fails), and is high-complexity (AC:H). No EPSS score, no CISA KEV listing, and no public weaponized exploit are present in the input - the only exploit-adjacent artifact is a regression test bundled in the fix commit, which demonstrates the flaw but is not an offensive POC. Signals are consistent rather than conflicting: high technical impact (VC:H/VI:H/VA:H) offset by strict local/privilege/environmental preconditions. Note the Tags list this as 'Information Disclosure,' which contradicts CWE-281 and the impact metrics - this is a privilege/permission-preservation bug (leftover setuid binary), not an info-leak, so the tag should be treated as mislabeled.

On a Linux system with restricted capabilities (e.g. CAP_CHOWN dropped or a mount/namespace that blocks ownership changes), an operator runs install -m 4755 -o root src dst. uutils applies the setuid bit before the ownership change; the chown fails but the file remains as a setuid executable owned by the privileged invoker, so a lower-privileged local user can then execute dst to gain the invoker's privileges. No public exploit code is identified at time of analysis, though the vendor patch includes a test proving the leftover-setuid behavior.