CVE-2026-35340 Details

A vulnerability exists in the uutils coreutils 'chown' and 'chgrp' commands, specifically in the ChownExecutor component. During recursive operations, these utilities fail to return the correct exit code. The exit code reflects only the outcome of the last file processed, leading to potential security misconfigurations. If the final operation is successful, the command returns 0, even if previous ownership changes encountered permission errors. This issue can cause administrative scripts to mistakenly assume that ownership has been properly transferred across a directory.

Users can manually check the exit codes of 'chown' and 'chgrp' operations to ensure that ownership changes were applied correctly, especially when using recursive options. Additionally, be cautious when scripting file management tasks that involve ownership changes, and consider implementing checks that verify ownership adjustments were successful.