Security xattr corruption via repeated path lookups

TOCTOU in the mv utility of uutils coreutils 0.8.0 and earlier allows local users to corrupt destination security xattrs during cross-device moves. The copy_xattrs, retrieve_xattrs, and apply_xattrs paths issue separate list, get, and set calls that resolve each pathname again instead of pinning an inode. Exploitation requires write access to a participating directory and a successful race, and the resulting file can combine SELinux labels or capabilities from different inodes.