Loading vulnerability…
CVE-2026-35341 is a local vulnerability in the mkfifo utility of uutils coreutils caused by incorrect error-handling and non-atomic permission setting. When mkfifo attempts to create a FIFO at a target path and creation fails because the path already exists (EEXIST), the code logs the error but does not stop processing that path. Execution falls through to a subsequent permission-setting step, causing mkfifo to call set_permissions on the existing filesystem object instead of a newly created FIFO. As a result, an attacker can cause permissions on an existing file to be changed to the requested or default FIFO mode, often resulting in weaker protections such as 0644 after umask. The supporting content also notes a related TOCTOU symlink race: FIFO creation and permission modification occur in separate path-based operations, and because Rust std::fs::set_permissions follows symlinks by default, an attacker with control over the parent directory may replace the created FIFO with a symlink before permissions are applied, redirecting the chmod-like operation to another file.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.