CVE-2026-64846 NixOS CVE debrief

Who should care

Nix users and administrators, especially those using the recursive-nix feature or executing untrusted derivations, should assess exposure and prioritize remediation. This includes reviewing derivation execution policies, verifying Nix version and configuration, and monitoring Nix process and nix-daemon logs for suspicious activity.

Why it matters

CVE-2026-64846 is a low-severity vulnerability in Nix package manager versions prior to 2.35.0. A malicious derivation with the recursive-nix feature can exploit a time-of-check/time-of-use race condition, potentially allowing creation or truncation of empty files outside the build sandbox. Defenders should assess exposure, prioritize remediation, and verify Nix version and configuration.

• Potential creation or truncation of empty files outside the build sandbox
• Requires verification of Nix version and configuration
• May require additional monitoring and logging of Nix process activity

Technical summary

A time-of-check/time-of-use race condition in Nix package manager versions prior to 2.35.0 can be exploited by a malicious derivation with the recursive-nix feature. This can potentially allow creation or truncation of empty files outside the build sandbox with the daemon user's permissions. The issue is fixed in version 2.35.0. Defenders should assess exposure and prioritize remediation for Nix deployments using the recursive-nix feature, especially where untrusted derivations are executed. The primitive does not provide arbitrary-content writes and requires winning the race.

Defensive priority

Assess exposure and prioritize remediation for Nix deployments using the recursive-nix feature, especially where untrusted derivations are executed.

Recommended defensive actions

• Assess Nix deployment configurations for recursive-nix feature usage
• Verify Nix version and upgrade to 2.35.0 or later if necessary
• Review derivation execution policies and restrict untrusted derivations
• Monitor Nix process and nix-daemon logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional information is available in GitHub commits and pull requests related to the issue. The race condition can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.