[Pkg-rust-maintainers] Bug#1136043: rust-coreutils: CVE-2026-35354

[Moritz Mühlenhoff]

Source: rust-coreutils
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for rust-coreutils.

CVE-2026-35354[0]:
| A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the
| mv utility of uutils coreutils during cross-device moves. The
| extended attribute (xattr) preservation logic uses multiple path-
| based system calls that perform fresh path-to-inode lookups for each
| operation. A local attacker with write access to the directory can
| exploit this race to swap files between calls, causing the
| destination file to receive an inconsistent mix of security xattrs,
| such as SELinux labels or file capabilities.

https://github.com/uutils/coreutils/issues/10014


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-35354
    https://www.cve.org/CVERecord?id=CVE-2026-35354

Please adjust the affected versions in the BTS as needed.