AIKIDO-2026-440873

TL;DR

The touch utility creates a file by first checking that the target path is missing and then opening it with File::create, which internally passes O_TRUNC. Because the existence check and the open are separate steps, a concurrent local process can create the path or replace it with a symlink to an existing file inside that window. When that happens, the open truncates the unintended file and permanently destroys its contents, which is most damaging when touch runs in a shared or writable directory or with elevated privileges. The fix removes the prior existence check and opens the file without O_TRUNC, so a raced target is no longer truncated.