The mkdir utility in uutils coreutils has a race condition that temporarily applies umask-derived permissions when the -m flag is used. A directory that should be private is briefly accessible to other users before chmod sets the intended mode. This flaw can allow a local attacker on the same system to read data during the brief window, compromising confidentiality but not integrity or availability. The underlying weakness is a race condition (CWE‑367).

The issue affects the uutils coreutils package. No specific version range is listed in the CNA data, so the vulnerability could exist in any release before the fix. Users should verify they are running the latest available release.

The CVSS score of 3.3 indicates low severity. The EPSS score is less than 1%, suggesting a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user on a multi‑user system that creates a directory with the -m option during the brief race window.