CVE-2026-35341High· 7.1▾ Twilightmkfifo: permissions of an existing file are changed after FIFO creation fails
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
When mkfifo() fails (e.g. target already exists), the code shows an error but is missing a continue;, so it falls through to fs::set_permissions and changes the permissions of the pre-existing file to the default FIFO mode (0o666 & umask -> 0644).
$ touch secret; chmod 000 secret
$ coreutils mkfifo secret fifo3 fifo4
mkfifo: cannot create fifo 'secret': File exists
$ ll secret # uutils:
prw-r--r-- secret # changed to 644 (GNU leaves it 000)
Impact: an attacker (or user error) can relax permissions on sensitive owner-only files such as SSH private keys, exposing them to other users. Recommendation: add continue; after the error.
Remediation: Acknowledged by Canonical; fixed in PR #10376.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.8. Credit: Zellic.
Upstream tracking issue: https://github.com/uutils/coreutils/issues/10020 · CVE-2026-35341
uu_mkfifo < 0.6.0Upgrade to a patched release:
uu_mkfifo 0.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35361Low· 3.4mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
CVE-2018-13374Medium· 4.3A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connecti…
CVE-2022-0330High· 7.8A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU
CVE-2026-10840High· 7.1A flaw was found in the OpenShift Pipelines operator
CVE-2026-35385High· 7.5In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
CVE-2026-0775High· 7.0npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability