CVE-2026-35358 Details
Description
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
A vulnerability exists in the cp utility of uutils coreutils, specifically in version 0.7.0, regarding how it handles recursive copies of directories. When the -R option is used, cp incorrectly processes character and block device nodes as if they were regular files, leading to a loss of the original device semantics. This mismanagement can cause critical device nodes, such as /dev/null, to be overwritten with regular files, disrupting their intended functionality. The issue arises because uutils coreutils lacks the capability to properly recreate device nodes using the mknod command, a problem not present in GNU coreutils, which handles such files correctly by default.
Users can update to uutils coreutils version 0.7.0, which includes a patch for this vulnerability. The updated version can be downloaded from the uutils coreutils GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/issues/9746 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/uutils/coreutils/issues/9746 | [email protected] | ExploitIssue Tracking |
| https://github.com/uutils/coreutils/pull/11163 | [email protected] | Issue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.7.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.7.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |