Denial of Service Vulnerability in uutils Coreutils Affecting Recursive Copy Operations

CVE-2026-35358

What is CVE-2026-35358?

The cp utility in uutils coreutils, when executing recursive copies, mishandles character and block device nodes by treating them as standard stream sources. This mismanagement results in the loss of device semantics, causing critical issues such as transforming /dev/null into a regular file. The consequence of this flawed implementation includes potential runtime denial of service, where systems may experience disk exhaustion or unresponsive processes when attempting to read from unbounded device nodes.

References