uutils coreutils CVE-2026-35351

Exploitation requires the following specific conditions: (1) uutils coreutils must be the installed mv utility in the system PATH; (2) the mv command must be invoked with a source file on one filesystem and a destination on a different filesystem (e.g., /home → /mnt/backup, not /home → /var on the same filesystem); (3) the invoking user must have high privilege level (PR:H per CVSS), typically root or a user with root-equivalent capabilities; (4) the source file must have different ownership from the calling user (otherwise the bug has no visible effect). The vulnerability does NOT affect moves within the same filesystem (where hard-linking succeeds and ownership is preserved). The vulnerability does NOT affect GNU coreutils implementations. The vulnerability does NOT affect mv invocations by unprivileged users (they lack the privilege to change ownership anyway, so the impact is limited to their own files).

This vulnerability presents moderate real-world risk with important caveats. The CVSS score of 4.2 reflects the combination of local-only attack vector (AV:L), low attack complexity (AC:L), and high privilege requirement (PR:H), limiting the threat surface to administrators or root users already operating the system. The SSVC framework indicates a proof-of-concept exists (Exploitation: poc) but is not automatable (Automatable: no) and causes only partial technical impact (Technical Impact: partial), which aligns with the local, high-privilege constraint. The primary real-world concern is accidental misconfiguration or privilege misuse in backup and migration workflows where root users routinely move files across filesystems; legitimate owners losing access to their data post-migration represents a tangible operational risk rather than a direct remote compromise vector. The absence of confirmation in CISA KEV suggests this has not been exploited at scale. Defenders should prioritize this based on their use of uutils coreutils in privileged file-movement operations; systems relying on GNU coreutils are unaffected.

A system administrator running a backup or migration operation uses the uutils coreutils mv utility (perhaps installed as a drop-in replacement for GNU coreutils) to move files across different storage devices or partitions. The command invokes mv as root to move a user's files from /home to /mnt/backup (different filesystem). The utility falls back to copy-and-delete because hard-linking across filesystems is impossible. The copied file is created with root ownership instead of preserving the original user's UID/GID. When the operation completes, the user finds they no longer have read/write access to their files, causing information disclosure (if the user cannot open them) and access restrictions (if permissions are now 0600 and root-owned).