{"id":"CVE-2026-64846","title":"Nix is a package manager for Linux and other Unix systems","summary":"Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the …","severity":"low","cvss":2.8,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N","cwe":["CWE-61","CWE-367"],"published":"2026-08-20","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:05:53.723","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64846","references":[{"url":"https://github.com/NixOS/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390","label":"security-advisories@github.com"},{"url":"https://github.com/NixOS/nix/pull/15401","label":"security-advisories@github.com"},{"url":"https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64846.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64846"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520584"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64846"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64846"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00108,"epssPercentile":0.01085,"ingestedAt":"2026-09-18T20:51:25.642Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["ansible_automation_orchestrator 2026","confidential_compute_attestation","logging_subsystem_for_red_hat_openshift","openshift_lightspeed","openshift_service_mesh 3","pen_drive_powered_by_red_hat_lightspeed","ansible_automation_platform 2","ansible_automation_platform_ansible_core 2","discovery 2","enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","enterprise_linux_command_line_assistant","openshift_ai_rhoai","openshift_container_platform 4","quay 3","satellite 6","trusted_profile_analyzer"],"slug":"CVE-2026-64846","body":"## Overview\n\nNix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Ansible Automation Orchestrator 2026, Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, OpenShift Service Mesh 3, Pen Drive Powered by Red Hat Lightspeed, … · no fix planned: Ansible Automation Orchestrator 2026, Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64846.json)","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":15.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}