CVE-2026-64846

Executive Summary

CVE-2026-64846 is a local privilege-boundary vulnerability in Nix, a package manager for Linux and other Unix systems, affecting all versions prior to 2.35.0. The flaw is a Time-of-Check/Time-of-Use (TOCTOU) race condition in the LocalStore restore path that activates only when the experimental recursive-nix feature is enabled; a successful exploit allows an unprivileged process running a hostile derivation to create or truncate empty files outside the build sandbox with the permissions of the Nix daemon user. The vulnerability is rated low severity (CVSS 2.8) due to the requirement of winning a race and the limited impact (integrity loss only, no content-write primitive or confidentiality impact), but its effect on build-sandbox trust boundaries warrants attention for Nix/NixOS deployments using the experimental feature.

Technical Analysis

Vulnerability Class: Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-61).

Mechanism: The NVD description identifies a race condition in the LocalStore restore path of Nix, executed when a malicious derivation is run with the experimental recursive-nix feature enabled. During the restore path, Nix handles symlinks via a FinalSymlink::DontFollow mode, which is intended to prevent path traversal out of the build sandbox. The race involves the final symlink handling in this restore path.

Specifically, when a file is being written (the NVD references an open call with the O_TRUNC flag in the context of a writeFile operation), Nix must resolve a substituted final symlink. The TOCTOU window exists between the moment Nix checks the symlink (the "time of check") and the moment the file is actually opened and truncated (the "time of use"). If an attacker can swap the symlink or alter the filesystem state during that window, the O_TRUNC open can follow a substituted symlink rather than enforcing the intended FinalSymlink::DontFollow policy. This causes the Nix process (or the nix-daemon when builds run in daemon mode) to open a path outside the sandbox, creating or truncating an empty file with the daemon user's permissions.

Attack Surface: The local filesystem, specifically the Nix store and build directories. The attack is launched from within a malicious derivation executed by a user who has rights to build derivations under Nix with the recursive-nix feature enabled. The target is any path writable by the daemon user outside the sandbox.

Constraints: The primitive does not permit arbitrary-content writes — only file creation and truncation (emptying) of files that exist. The race must be won; this requires tight timing and likely repeated attempts, which increases the difficulty. The experimental feature recursive-nix must be enabled, which narrows the affected deployment population.

Exploitation Scenarios

Preconditions:

1. Target runs Nix < 2.35.0 with the recursive-nix experimental feature enabled.
2. Attacker has local access to a Nix account that can build derivations.
3. The nix-daemon runs as a privileged user (common in multi-user Nix installs).

Attack Chain:

1. Reconnaissance / Target Identification: The attacker identifies a Nix deployment where recursive-nix is enabled (e.g., by attempting to use it or reading Nix config) and determines the daemon user's identity (often root or a dedicated nix user). The attacker also identifies a target file on the system they wish to truncate (e.g., a log file, a zero-byte placeholder, a config file whose absence could degrade security).

2. Trigger of the Flaw: The attacker crafts a malicious derivation that, during its build phase (or via post-build hooks), initiates the LocalStore restore path while simultaneously manipulating the filesystem to create a symlink substitution race. Specifically, the derivation performs the writeFile operation that opens with O_TRUNC while a separate thread or process repeatedly swaps a symlink at the target location. The race window is the interval between the FinalSymlink::DontFollow check and the actual open.

3. Payload / Execution at Vulnerability-Class Level: The malicious derivation repeatedly attempts to place a symlink that points outside the sandbox (e.g., to /etc/passwd or a file in the daemon's home directory) at the exact position Nix's restore path will open. Winning the race means Nix performs the open(path, O_TRUNC) call following the outside symlink instead of rejecting it. Since the race is probabilistic, the build script likely loops thousands of times to increase success odds.

4. Post-Exploitation Impact: On success, the attacker causes an empty file to be created or an existing file to be truncated (size zero) at a path of their choice outside the sandbox, with the permissions of the daemon user. This can disrupt system operations, destroy integrity of log files, or — if a security-sensitive file that triggers re-initialization or bypass logic on emptiness is targeted — weaken the system. No content can be written, and the attacker does not gain code execution or read access.

Note: No public PoC is available; the attack chain is inferred from the vulnerability mechanism described in the NVD entry. The complexity of winning the race suggests this would be a low-probability, high-repetition attack.

Impact Assessment

• CVSS Score: 2.8 (Low) — Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

  • Attack Vector: Local (AV:L) — requires local shell access.
  • Attack Complexity: High (AC:H) — winning the race is non-trivial.
  • Privileges Required: Low (PR:L) — needs a Nix build account; not root.
  • User Interaction: None (UI:N).
  • Scope: Changed (S:C) — the sandbox boundary is crossed; impact is outside the vulnerable component's security scope.
  • Confidentiality: None (C:N) — no read access gained.
  • Integrity: Low (I:L) — limited to file creation/truncation, no content control.
  • Availability: None (A:N).

• Business Impact: For most Nix users not enabling recursive-nix, the exposure is nil. For those using the feature (often in research or complex build environments), the risk is integrity disruption of host files via the daemon user's permissions. In a multi-tenant CI environment with untrusted build users, this could allow one tenant to corrupt files owned by the daemon user, potentially affecting other builds or host services. The inability to write arbitrary content limits the severity; direct RCE or data theft is not achievable.

• Blast Radius: Restricted to single-host local deployments running the experimental feature. Not remotely exploitable. The target file set is limited to those writable by the daemon user (often broad if running as root) but the attacker's influence over content is zero; only the transition to "empty file" state is controllable.

• Exploitability Trends: No PoC confirmed, no exploitation in the wild reported, not on CISA KEV. EPSS not yet scored. The experimental feature gate plus race-winner difficulty make mass exploitation unlikely in the near term.

Detection Guidance

Detection of this exploit is challenging because the attack is entirely local, high-speed, and produces no network traffic. File-integrity and filesystem-monitoring approaches are most relevant.

Sigma Rule

title: Nix LocalStore TOCTOU Race - Suspicious File Truncation Via O_TRUNC
id: c43e6c2e-6e0a-4b7a-9f3c-1a4d8f2e9b10
status: experimental
description: Detects mass file truncation events by Nix daemon processes, potentially indicating CVE-2026-64846 exploitation attempts.
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: 'nix-daemon'
        TargetFilename|endswith: ['.log', '.conf', '.lock', '.pid']
        EventID: 2  # File modified/truncated (Sysmon-like)
    filter:
        TargetFilename|contains: '/nix/store/'
    condition: selection and not filter
    timeframe: 60s
level: medium
falsepositives:
    - Legitimate Nix operations truncating log files (rare)
    - Nix garbage collection touching state files
fields:
    - Image
    - TargetFilename
    - User
tags:
    - attack.t1204
    - cve.2026-64846

YARA Rule

rule nix_toctou_race_cve_2026_64846
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects strings in build scripts associated with recursive-nix symlink race exploitation"
        date = "2026-06-15"
        cve = "CVE-2026-64846"
        severity = "medium"

    strings:
        $race_loop = "while true" ascii nocase
        $symlink_op = /(ln\s+-[sf]|symlink\()/ ascii nocase
        $truncate_target = /O_TRUNC|truncate\s+[^\s]+/ ascii nocase
        $nix_build_ref = /recursive-nix/ ascii nocase
        $temp_swap = /mv\s+[^\s]+\s+[^\s]+/ ascii

    condition:
        ($race_loop and $symlink_op and $nix_build_ref) or
        ($truncate_target and $symlink_op and filesize < 50KB)
}

Suricata IDS Rule

# This vulnerability is local-only; network detection is mostly inapplicable.
# The rule below detects Nix-related traffic that may precede a local attack
# (e.g., fetching malicious derivations) — informational only.

alert http any any -> any any (
    msg:"Nix CVE-2026-64846 - Possible Malicious Derivation Download (Informational)";
    flow:established,to_server;
    http.uri;
    content:"/nix/";
    content:"derivation";
    classtype:attempted-user;
    sid:50064846; rev:1;
    metadata:created_at 2026-06-15, cve CVE-2026-64846;
)

Elastic Detection

// EQL: Detect mass truncation of files by nix-daemon outside the store
sequence by process.entity_id with maxspan=30s
  [process where process.name == "nix-daemon" and event.action == "exec"]
  [file where file.path : "!*nix/store*" and event.action in ("modify", "truncate")]
  [file where file.path : "!*nix/store*" and event.action in ("modify", "truncate")] |
// Threshold: >20 truncation events in 30s outside store
  | where sequence_count > 20

Splunk SPL Query

index=linux_audit sourcetype=linux:audit | 
    where syscall=257 (openat) OR syscall=2 (open) | 
    search flags="*O_TRUNC*" | 
    rename process.name as proc | 
    where proc="nix-daemon" | 
    search NOT file_path IN ("/nix/store/*") | 
    stats count by file_path, user, host | 
    where count > 50 | 
    table _time, host, user, file_path, count

Wazuh OSSEC Rule

<group name="nix_localstore_toctou,">
    <rule id="100646" level="10" frequency="30" timeframe="60">
        <decoded_as>auditd</decoded_as>
        <field name="system_call">openat|open</field>
        <field name="flags">O_TRUNC</field>
        <field name="process">nix-daemon</field>
        <field name="file_path">!/nix/store/</field>
        <description>CVE-2026-64846: Repeated truncation outside Nix store by nix-daemon - possible TOCTOU exploitation</description>
        <group>local_integrity,</group>
        <mitre>
            <id>T1204</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. The only patch source is OSV, citing version 2.35.0 as the fix. This is not independently confirmed by the vendor advisory at the time of writing.

1) Immediate Mitigations:

• Disable the recursive-nix experimental feature if not strictly required. In Nix config, remove recursive-nix from the experimental-features set. This eliminates the attack surface entirely.
• If recursive-nix must remain enabled, restrict which users can build derivations (limit to trusted users) and consider running nix-daemon under a dedicated unprivileged user account rather than root, reducing the permissions granted to a successful exploitation.

2) Patch / Upgrade Steps:

• Upgrade Nix to version 2.35.0 or later where the issue is claimed fixed. Use the official Nix installation channels: nix-channel --update followed by nix-env -iA nixpkgs.nix or the system-specific upgrade procedure for NixOS (nixos-rebuild switch).
• After upgrade, verify the version with nix --version and confirm the recursive-nix feature still works as expected (if kept).
• Independently verify the patch by reviewing the changelog or performing a targeted regression test of the LocalStore restore path with symlink substitution.

3) Long-Term Hardening:

• Treat experimental features as high-risk; enable them only in isolated, single-user environments or where the security model accounts for potential sandbox escape.
• Implement filesystem-level monitoring (auditd, fanotify) on directories outside the store where the daemon user has write access.
• Run builds in disposable VMs or containers (e.g., NixOS sandboxing with sandbox = true and a non-root daemon) to minimize blast radius even if sandbox escapes occur.
• Subscribe to the Nix security mailing list / GitHub advisories to obtain independent confirmation of the fix when available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-64846
2. OSV Advisory (primary patch source): https://osv.dev/vulnerability/CVE-2026-64846
3. Nix Project (official site/security info): https://nixos.org/security/
4. CWE-61 Description (TOCTOU): https://cwe.mitre.org/data/definitions/61.html
5. ATT&CK T1204 (User Execution): https://attack.mitre.org/techniques/T1204/

Threat Actor / Exploit-in-the-Wild Evidence: None reported. CISA KEV: NO. No public PoC, no Nuclei template, no exploit code available. EPSS score not yet assigned by FIRST.org.