CVE-2026-93658
Description
A flaw was found in uutils coreutils. When installing files, the software applies setuid or setgid permissions before finalizing ownership changes. This can allow a privileged user to inadvertently leave behind executable files with elevated privileges if the ownership change operation fails on systems with restricted capabilities. A local attacker could then exploit these leftover files to achieve privilege escalation.
Statement
Moderate: The uutils coreutils install utility can create root-owned setuid/setgid executables if ownership changes fail during installation in capability-restricted environments. This flaw allows a local attacker to execute these leftover files with elevated privileges.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
