CVE-2026-35358
This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
Does this matter?
Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.
Description
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.18% probability · 7th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-706
- Affected
- uutils/coreutils
- Source
- security@ubuntu.com
References
- https://github.com/uutils/coreutils/issues/9746Exploit, Issue Tracking
- https://github.com/uutils/coreutils/pull/11163Issue Tracking, Patch
- https://github.com/uutils/coreutils/releases/tag/0.7.0Release Notes
- https://github.com/uutils/coreutils/issues/9746Exploit, Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.