The mknod utility in uutils coreutils creates device nodes before assigning the SELinux context, so if labeling fails it leaves the node with the default context. This mis‑labeling can bypass mandatory access controls, allowing an attacker to access devices that should be restricted. The flaw is an instance of CWE-281 and CWE-459.

The vulnerability affects the Uutils coreutils project, specifically the mknod command. No specific version range is listed, so any installation using the affected utility may be impacted.

The CVSS score is 3.4, indicating a low severity. No EPSS data is available, and the issue is not yet listed in CISA's KEV catalog. Exploitation requires the ability to run mknod on a system with SELinux enabled, so local privilege or the ability to invoke the command may be needed. If the attack succeeds, the attacker could gain unauthorized access to device nodes through mis‑applied SELinux labels, potentially compromising system integrity.