{"id":"CVE-2026-35351","aliases":["DEBIAN-CVE-2026-35351","EUVD-2026-24984","GHSA-957r-r8gc-vv3h","UBUNTU-CVE-2026-35351","USN-9041-1"],"status":"published","title":"uutils coreutils mv Silent Ownership Loss in Cross-Device Operations","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00132,"percentile":0.02821,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-281"],"published":"2026-04-22T16:08:04Z","modified":"2026-11-12T17:55:50Z","fixes":[{"ecosystem":"Debian:14","package":"rust-coreutils","fixed_in":["0.9.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rust-coreutils","fixed_in":["0.10.0-1ubuntu2~26.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.8.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.17-2","0.0.17-3","0.0.17-4","0.0.17-5","0.0.17-6","0.0.19-1","0.0.19-2","0.0.19-3","0.0.20-1","0.0.21-1","0.0.22-1","0.0.23-1","0.0.23-2","0.0.23-3","0.0.24-1","0.0.24-2","0.0.26-1","0.0.26-2","0.0.26-3","0.0.26-4","0.0.26-5","0.0.27-1","0.0.27-2","0.0.27-3","0.0.30-1","0.0.30-2","0.0.30-3","0.0.30-3~exp1","0.0.30-4","0.10.0-1","0.11.0-1","0.11.0-2","0.12.0-1","0.6.0-1","0.7.0-1","0.8.0-1","0.8.0-2","0.8.0-3","0.8.0-4","0.8.0-5","0.8.0-6","0.9.0-1","0.9.0-2","0.9.0-3"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.30-2","0.0.30-3","0.0.30-3~exp1","0.0.30-4","0.10.0-1","0.11.0-1","0.11.0-2","0.12.0-1","0.6.0-1","0.7.0-1","0.8.0-1","0.8.0-2","0.8.0-3","0.8.0-4","0.8.0-5","0.8.0-6","0.9.0-1","0.9.0-2","0.9.0-3"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-1"}]}],"versions":["0.0.30-2","0.0.30-3","0.0.30-3~exp1","0.0.30-4","0.6.0-1","0.7.0-1","0.8.0-1","0.8.0-2","0.8.0-3","0.8.0-4","0.8.0-5","0.8.0-6"]},{"source":"osv","ecosystem":"crates.io","package":"coreutils","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.8.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.20-1","0.0.22-1","0.0.23-1","0.0.23-2","0.0.23-3","0.0.24-1","0.0.24-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0.30-1","0.0.30-2","0.0.30-2ubuntu2","0.1.0-0ubuntu1","0.1.0+git20250711.2ba3a33-0ubuntu1","0.1.0+git20250711.2ba3a33-0ubuntu2","0.1.0+git20250711.2ba3a33-0ubuntu3","0.1.0+git20250711.2ba3a33-0ubuntu4","0.1.0+git20250801.cf79675-0ubuntu1","0.1.0+git20250813.4af2a84-0ubuntu2","0.1.0+git20250813.4af2a84-0ubuntu4","0.1.0+git20250813.4af2a84-0ubuntu6","0.1.0+git20250813.4af2a84-0ubuntu7","0.2.2-0ubuntu1","0.2.2-0ubuntu2","0.2.2-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1ubuntu2~26.04.1"}]}],"versions":["0.2.2-0ubuntu2","0.2.2-0ubuntu4","0.5.0-0ubuntu1","0.5.0-0ubuntu2","0.6.0-0ubuntu1","0.7.0-0ubuntu1","0.8.0-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-coreutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1ubuntu2~26.04.1"}]}],"versions":["0.2.2-0ubuntu2","0.2.2-0ubuntu4","0.5.0-0ubuntu1","0.5.0-0ubuntu2","0.6.0-0ubuntu1","0.7.0-0ubuntu1","0.8.0-0ubuntu3"],"bundled":19}],"products":[{"vendor":"uutils","product":"coreutils"}],"references":[{"url":"https://github.com/uutils/coreutils/issues/9714","tags":["issue-tracking","exploit","Exploit","Issue Tracking","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35351","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-957r-r8gc-vv3h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-35351","tags":["advisory"]},{"url":"https://github.com/uutils/coreutils","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-35351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35351","tags":["report"]},{"url":"https://github.com/uutils/coreutils/pull/11706","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9041-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-35341","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35344","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35359","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35360","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35363","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35367","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35368","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35373","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35374","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35376","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-35377","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93658","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-35351","title":"uutils coreutils mv Silent Ownership Loss in Cross-Device Operations","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","status":"published","published":"2026-04-22T16:08:04.936Z","modified":"2026-04-22T18:05:16.431Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:20:05.15083Z"}],"euvd":[{"id":"EUVD-2026-24984","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","status":"published","published":"2026-04-22T16:08:04Z","modified":"2026-04-22T18:05:16Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:24:19.81608Z"}],"ghsa":[{"id":"GHSA-957r-r8gc-vv3h","title":"uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","status":"published","published":"2026-04-22T18:31:45Z","modified":"2026-04-29T23:18:01Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:39:59.776263Z"}],"nvd":[{"id":"CVE-2026-35351","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","status":"published","published":"2026-04-22T17:16:37.457Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"DEBIAN-CVE-2026-35351","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","status":"published","published":"2026-04-22T17:16:37.457Z","modified":"2026-10-27T09:47:36.823296967Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-957r-r8gc-vv3h","title":"uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","status":"published","published":"2026-04-22T18:31:45Z","modified":"2026-09-10T03:51:01.367045573Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2026-35351","description":"The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.","status":"published","published":"2026-04-22T17:16:00Z","modified":"2026-11-12T17:25:37.002851435Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-12T18:05:42.073711Z"},{"id":"USN-9041-1","title":"rust-coreutils vulnerabilities","description":"It was discovered that uutils coreutils mkfifo incorrectly continued\nprocessing when a target file already existed, applying default\npermissions to the existing file. A local attacker could possibly use\nthis issue to obtain sensitive information or modify file permissions\nunexpectedly. (CVE-2026-35341)\n\nIt was discovered that uutils coreutils dd incorrectly suppressed\nerrors during file truncation operations. A local attacker could\npossibly use this issue to cause silent data corruption.\n(CVE-2026-35344)\n\nIt was discovered that uutils coreutils tail incorrectly followed\nsymbolic links when using the --follow=name option. A local attacker\ncould possibly use this issue to obtain sensitive information.\n(CVE-2026-35345)\n\nIt was discovered that uutils coreutils sort crashed when processing\nfilenames containing non-UTF-8 bytes. A local attacker could possibly\nuse this issue to cause a denial of service. (CVE-2026-35348)\n\nIt was discovered that uutils coreutils cp incorrectly preserved\nsetuid and setgid bits when ownership changes failed. A local attacker\ncould possibly use this issue to gain elevated privileges.\n(CVE-2026-35350)\n\nIt was discovered that uutils coreutils mv failed to preserve file\nownership when moving files across file system boundaries. A local\nattacker could possibly use this issue to obtain sensitive information\nor cause unintended access restrictions. (CVE-2026-35351)\n\nIt was discovered that uutils coreutils mv had a time-of-check to\ntime-of-use race condition in its extended attribute preservation\nlogic. A local attacker with write access to a directory could\npossibly use this issue to modify security labels on unintended files.\n(CVE-2026-35354)\n\nIt was discovered that uutils coreutils cp had a race condition in\nits file creation logic, initially creating destination files with\noverly permissive modes. A local attacker could possibly use this\nissue to obtain sensitive information. (CVE-2026-35357)\n\nIt was discovered that uutils coreutils cp had a time-of-check to\ntime-of-use race condition when handling symbolic links. A local\nattacker with write access to a directory could possibly use this\nissue to obtain sensitive information. (CVE-2026-35359)\n\nIt was discovered that uutils coreutils touch had a time-of-check to\ntime-of-use race condition during file creation. A local attacker\ncould possibly use this issue to cause data loss. (CVE-2026-35360)\n\nIt was discovered that uutils coreutils rm failed to recognize\ntrailing slashes on the current directory path. A local attacker could\npossibly use this issue to cause data loss. (CVE-2026-35363)\n\nIt was discovered that uutils coreutils mv had a time-of-check to\ntime-of-use race condition during cross-device operations. A local\nattacker with write access to a directory could possibly use this\nissue to overwrite arbitrary files. (CVE-2026-35364)\n\nIt was discovered that uutils coreutils nohup created its output file\nwith world-readable permissions. A local attacker could possibly use\nthis issue to obtain sensitive information. (CVE-2026-35367)\n\nIt was discovered that uutils coreutils chroot incorrectly resolved\nuser specifications before dropping root privileges, allowing Name\nService Switch modules to be loaded from the new root directory. A\nlocal attacker with write access to the chroot directory could\npossibly use this issue to execute arbitrary code as root.\n(CVE-2026-35368)\n\nIt was discovered that uutils coreutils ln failed to process\nfilenames containing non-UTF-8 bytes, causing the utility to exit\nwith an error. A local attacker could possibly use this issue to\ncause a denial of service. (CVE-2026-35373)\n\nIt was discovered that uutils coreutils split had a time-of-check to\ntime-of-use race condition in its input and output file validation. A\nlocal attacker with write access to a directory could possibly use\nthis issue to cause data loss. (CVE-2026-35374)\n\nIt was discovered that uutils coreutils chcon had a time-of-check to\ntime-of-use race condition during recursive relabeling operations. A\nlocal attacker with write access to a directory could possibly use\nthis issue to modify security labels on unintended files.\n(CVE-2026-35376)\n\nIt was discovered that uutils coreutils env incorrectly handled\nbackslash sequences within single quotes when using the -S option. A\nlocal attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-35377)\n\nIt was discovered that uutils coreutils install applied setuid and\nsetgid mode bits to destination files before completing ownership\nchanges. A local attacker could possibly use this issue to gain\nelevated privileges. (CVE-2026-93658)","status":"published","published":"2026-11-11T10:45:28Z","modified":"2026-11-12T17:55:50.895747164Z","updated_at":"2026-11-12T18:08:46.665847Z"}]}}