---
id: CVE-2026-64846
title: Nix is a package manager for Linux and other Unix systems
summary: >-
  Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a
  malicious derivation executed with the recursive-nix experimental feature can
  exploit a time-of-check/time-of-use race involving final symlink handling in
  the …
severity: low
cvss: 2.8
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N'
cwe:
  - CWE-61
  - CWE-367
published: '2026-08-20'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:05:53.723'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64846'
references:
  - url: >-
      https://github.com/NixOS/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390
    label: security-advisories@github.com
  - url: 'https://github.com/NixOS/nix/pull/15401'
    label: security-advisories@github.com
  - url: 'https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64846.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64846'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2520584'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64846'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64846'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00108
epssPercentile: 0.01086
ingestedAt: '2026-09-18T20:51:25.642Z'
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - ansible_automation_orchestrator 2026
  - confidential_compute_attestation
  - logging_subsystem_for_red_hat_openshift
  - openshift_lightspeed
  - openshift_service_mesh 3
  - pen_drive_powered_by_red_hat_lightspeed
  - ansible_automation_platform 2
  - ansible_automation_platform_ansible_core 2
  - discovery 2
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - enterprise_linux_ai_rhel_ai 3
  - enterprise_linux_command_line_assistant
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - quay 3
  - satellite 6
  - trusted_profile_analyzer
---

## Overview

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Ansible Automation Orchestrator 2026, Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, OpenShift Service Mesh 3, Pen Drive Powered by Red Hat Lightspeed, … · no fix planned: Ansible Automation Orchestrator 2026, Confidential Compute Attestation, Logging Subsystem for Red Hat OpenShift, OpenShift Lightspeed, … · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64846.json)