Home / mailings [USN-9041-1] uutils coreutils vulnerabilities
Posted on 11 November 2026
Ubuntu Security==========================================================================Ubuntu Security Notice USN-9041-1
November 11, 2026
rust-coreutils vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 26.04 LTS
Summary:
Several security issues were fixed in uutils coreutils.
Software Description:
- rust-coreutils: Universal coreutils utils, written in Rust
Details:
It was discovered that uutils coreutils mkfifo incorrectly continued
processing when a target file already existed, applying default
permissions to the existing file. A local attacker could possibly use
this issue to obtain sensitive information or modify file permissions
unexpectedly. (CVE-2026-35341)
It was discovered that uutils coreutils dd incorrectly suppressed
errors during file truncation operations. A local attacker could
possibly use this issue to cause silent data corruption.
(CVE-2026-35344)
It was discovered that uutils coreutils tail incorrectly followed
symbolic links when using the --follow=name option. A local attacker
could possibly use this issue to obtain sensitive information.
(CVE-2026-35345)
It was discovered that uutils coreutils sort crashed when processing
filenames containing non-UTF-8 bytes. A local attacker could possibly
use this issue to cause a denial of service. (CVE-2026-35348)
It was discovered that uutils coreutils cp incorrectly preserved
setuid and setgid bits when ownership changes failed. A local attacker
could possibly use this issue to gain elevated privileges.
(CVE-2026-35350)
It was discovered that uutils coreutils mv failed to preserve file
ownership when moving files across file system boundaries. A local
attacker could possibly use this issue to obtain sensitive information
or cause unintended access restrictions. (CVE-2026-35351)
It was discovered that uutils coreutils mv had a time-of-check to
time-of-use race condition in its extended attribute preservation
logic. A local attacker with write access to a directory could
possibly use this issue to modify security labels on unintended files.
(CVE-2026-35354)
It was discovered that uutils coreutils cp had a race condition in
its file creation logic, initially creating destination files with
overly permissive modes. A local attacker could possibly use this
issue to obtain sensitive information. (CVE-2026-35357)
It was discovered that uutils coreutils cp had a time-of-check to
time-of-use race condition when handling symbolic links. A local
attacker with write access to a directory could possibly use this
issue to obtain sensitive information. (CVE-2026-35359)
It was discovered that uutils coreutils touch had a time-of-check to
time-of-use race condition during file creation. A local attacker
could possibly use this issue to cause data loss. (CVE-2026-35360)
It was discovered that uutils coreutils rm failed to recognize
trailing slashes on the current directory path. A local attacker could
possibly use this issue to cause data loss. (CVE-2026-35363)
It was discovered that uutils coreutils mv had a time-of-check to
time-of-use race condition during cross-device operations. A local
attacker with write access to a directory could possibly use this
issue to overwrite arbitrary files. (CVE-2026-35364)
It was discovered that uutils coreutils nohup created its output file
with world-readable permissions. A local attacker could possibly use
this issue to obtain sensitive information. (CVE-2026-35367)
It was discovered that uutils coreutils chroot incorrectly resolved
user specifications before dropping root privileges, allowing Name
Service Switch modules to be loaded from the new root directory. A
local attacker with write access to the chroot directory could
possibly use this issue to execute arbitrary code as root.
(CVE-2026-35368)
It was discovered that uutils coreutils ln failed to process
filenames containing non-UTF-8 bytes, causing the utility to exit
with an error. A local attacker could possibly use this issue to
cause a denial of service. (CVE-2026-35373)
It was discovered that uutils coreutils split had a time-of-check to
time-of-use race condition in its input and output file validation. A
local attacker with write access to a directory could possibly use
this issue to cause data loss. (CVE-2026-35374)
It was discovered that uutils coreutils chcon had a time-of-check to
time-of-use race condition during recursive relabeling operations. A
local attacker with write access to a directory could possibly use
this issue to modify security labels on unintended files.
(CVE-2026-35376)
It was discovered that uutils coreutils env incorrectly handled
backslash sequences within single quotes when using the -S option. A
local attacker could possibly use this issue to cause a denial of
service. (CVE-2026-35377)
It was discovered that uutils coreutils install applied setuid and
setgid mode bits to destination files before completing ownership
changes. A local attacker could possibly use this issue to gain
elevated privileges. (CVE-2026-93658)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 26.04 LTS
rust-coreutils 0.10.0-1ubuntu2~26.04.1
In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-9041-1
CVE-2026-35341, CVE-2026-35344, CVE-2026-35345, CVE-2026-35348,
CVE-2026-35350, CVE-2026-35351, CVE-2026-35354, CVE-2026-35357,
CVE-2026-35359, CVE-2026-35360, CVE-2026-35363, CVE-2026-35364,
CVE-2026-35367, CVE-2026-35368, CVE-2026-35373, CVE-2026-35374,
CVE-2026-35376, CVE-2026-35377, CVE-2026-93658
Package Information:
https://launchpad.net/ubuntu/+source/rust-coreutils/0.10.0-1ubuntu2~26.04.1
--===============5875372675244430207==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
