CVE-2026-64846

A flaw was found in Nix. A malicious derivation, when executed with the recursive-nix experimental feature enabled, can exploit a time-of-check/time-of-use (TOCTOU) race condition in the final symlink handling of the LocalStore restore path. This allows the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. This vulnerability does not allow for arbitrary content writes and requires a successful race condition.

A time-of-check/time-of-use (TOCTOU) race condition flaw was found in Nix's LocalStore restore path when handling final symlinks. When a malicious derivation is executed with the recursive-nix experimental feature enabled, this flaw allows the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with daemon user permissions. This vulnerability is rated as having a low security impact because it requires the recursive-nix experimental feature to be enabled (which is not enabled by default and is unlikely in production environments), requires winning a race condition, and does not allow arbitrary content writes—only file truncation to empty files.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. For additional information, refer to the upstream advisory at https://github.com/NixOS/nix/security/advisories/GHSA-6h4g-g5j9-fm5f. As a workaround, ensure the recursive-nix experimental feature is not enabled in production environments.