CVE-2026-93658: uutils coreutils Privilege Escalation Flaw

CVE-2026-93658 Overview

CVE-2026-93658 affects uutils coreutils versions before 0.10.0, the Rust reimplementation of the GNU core utilities. The install utility applies setuid or setgid mode bits to destination files before finalizing ownership changes. When ownership transfer fails on capability-restricted systems, the resulting setuid binary remains owned by the privileged invoker. A local attacker can then execute the leftover file with elevated privileges. The weakness is categorized as [CWE-281: Improper Preservation of Permissions].

Critical Impact
Local attackers can obtain elevated privileges by executing setuid or setgid binaries left behind when install operations fail on systems with restricted capabilities.

Affected Products

uutils/coreutils versions 0.0.18 through 0.9.x
Linux distributions packaging uutils coreutils as a replacement for GNU coreutils
Systems where the install utility runs with elevated privileges but limited Linux capabilities

Discovery Timeline

2026-09-18 - CVE-2026-93658 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93658

Vulnerability Analysis

The install utility in uutils coreutils copies files to a destination and can apply file mode bits, including the setuid (u+s) and setgid (g+s) bits. The vulnerable code path in src/uu/install/src/install.rs performs chmod before chown. When the process invoking install runs with elevated privileges but lacks the capabilities required to change ownership to the requested user or group, the chmod succeeds while the subsequent chown fails.

The result is a file on disk carrying the setuid or setgid bit while still owned by the privileged invoker, typically root. Any local user with execute permission on that file gains the privileges of the file owner when running it. The flaw is a permission-preservation error rather than a memory-safety issue.

Root Cause

The order of operations in the install command applied mode bits before ownership was finalized, and the failure path for chown did not revert the applied mode. On capability-restricted systems, CAP_CHOWN may be dropped while write access to the destination is retained, producing a setuid binary owned by the caller.

Attack Vector

Exploitation is local and requires that a privileged process invoke install with setuid or setgid mode against a target the caller cannot re-own. An attacker with unprivileged access to the destination directory can execute the leftover binary to run code as the privileged owner. The attack complexity is elevated because it depends on specific capability configurations and ownership-change failures.

rust

// Security patch: finalize ownership before mode, and skip chmod if chown fails
// Source: https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55

-        if mode::chmod(path, b.mode()).is_err() {
-            // Error messages are printed by the mode::chmod function!
+        // Ownership before mode; on failure skip the chmod.
+        // See set_ownership_and_permissions for why.
+        if b.privileged
+            && let Err(e) = chown_optional_user_group(path, b)
+        {
+            show!(e);
             uucore::error::set_exit_code(1);
             continue;
         }

+        // Set SELinux context for directory if needed
+        #[cfg(all(feature = "selinux", any(target_os = "linux", target_os = "android")))]
         if b.privileged {
-            show_if_err!(chown_optional_user_group(path, b));
-
-            // Set SELinux context for directory if needed
-            #[cfg(all(feature = "selinux", any(target_os = "linux", target_os = "android")))]
             if b.default_context {
                 show_if_err!(set_selinux_default_context(path));
             } else if b.context.is_some() {
                 let context = get_context_for_selinux(b);
                 show_if_err!(set_selinux_security_context(path, context));
             }
         }

The patch inverts the order: ownership is applied first, and if chown_optional_user_group fails, the loop exits without applying mode bits. This prevents leftover setuid or setgid files owned by the privileged invoker.

Detection Methods for CVE-2026-93658

Indicators of Compromise

Unexpected files with the setuid or setgid bit set in writable installation directories, particularly those owned by root.
install process exits with non-zero status followed by executable files remaining on disk with elevated mode bits.
Local user processes spawning shells or privileged binaries after executing files placed by install.

Detection Strategies

Audit filesystems for setuid and setgid binaries using find / -perm /6000 -type f and compare against a known-good baseline.
Monitor process execution telemetry for install invocations that use -m or --mode flags containing 4 or 2 prefixes such as 4755 or 2755.
Track chown and chmod syscall sequences on files created by install to identify failed ownership changes preceding successful mode changes.

Monitoring Recommendations

Enable Linux auditd rules for execve events on newly created setuid binaries outside standard system paths.
Alert on execution of setuid files owned by root when the executing user is unprivileged and the file resides in a non-standard directory.
Correlate build system and package installation logs with unexpected setuid file creation events across managed hosts.

How to Mitigate CVE-2026-93658

Immediate Actions Required

Upgrade uutils coreutils to version 0.10.0 or later on all affected systems.
Inventory hosts using uutils coreutils as the system coreutils provider and prioritize those where install is invoked by privileged automation.
Scan for and remove or re-permission any leftover setuid or setgid files created by prior install failures.

Patch Information

The fix is available in commit 7c87ab04 and merged via Pull Request #13629. Details are documented in GitHub Security Advisory GHSA-cgg3-923w-v53m and the VulnCheck advisory. The patch reorders operations so ownership is applied before mode bits, and skips the chmod when chown fails.

Workarounds

Avoid invoking install with setuid or setgid mode flags on capability-restricted processes until the patched version is deployed.
Wrap install invocations in scripts that verify both ownership and mode after completion, and remove the target file if ownership does not match the expected user.
Restrict execution of setuid binaries on non-system mount points by mounting user-writable filesystems with nosuid.

bash

# Verify installed uutils coreutils version and locate residual setuid files
uu-install --version

# Enumerate setuid and setgid files for review
find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -printf '%M %u %g %p\n' 2>/dev/null

# Mount user-writable partitions with nosuid to blunt exploitation
mount -o remount,nosuid /home