CVE-2026-64846

Name	CVE-2026-64846
Description	Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1145021

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nix (PTS)	bullseye	2.3.7+dfsg1-1	vulnerable
	bookworm	2.8.0-1.1	vulnerable
	trixie	2.26.3+dfsg-1	vulnerable
	forky, sid	2.34.8+dfsg-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nix	source	(unstable)	(unfixed)			1145021

Notes

https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f
https://github.com/NixOS/nix/pull/15401
Fixed by: https://github.com/NixOS/nix/commit/26679828f74ee6e82a4100904e6361f993ff5390 (2.35.0)