The mv utility in uutils coreutils contains a Time‑of‑Check to Time‑of‑Use race that allows a local attacker with write access to a directory to swap files during a cross‑device move. The bug causes the destination file to receive an inconsistent mix of extended attributes such as SELinux labels or file capabilities. This flaw is a classic TOCTOU problem (CWE‑367), which can enable privilege escalation or bypass of security controls by tampering with these attributes.

All releases of the uutils coreutils mv command are potentially affected. No specific version range is provided, so any installed instance should be treated as vulnerable until an official patch or update is available.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score is 0.0001, indicating a very low exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker who can write to the directory involved in the cross‑device move. If such access exists, the attacker can swap files during the move, resulting in the destination file inheriting a mixed set of security attributes that may allow unauthorized access or execute actions with elevated privileges.