CVE-2026-64846

Name of the Vulnerable Software and Affected Versions Nix versions prior to 2.35.0

Description A time-of-check/time-of-use (TOCTOU) race condition exists in the LocalStore restore path when using the experimental recursive-nix feature. This occurs because the writeFile function may follow a substituted final symlink when opening a path with O TRUNC instead of enforcing FinalSymlink::DontFollow. An attacker can exploit this to cause the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox using the permissions of the daemon user. This issue does not allow for arbitrary-content writes and requires winning the race condition.

Recommendations Update to version 2.35.0. As a temporary mitigation, avoid using the recursive-nix experimental feature.