Improper Symlink Handling in uutils Coreutils mv Utility

CVE-2026-35365

What is CVE-2026-35365?

The mv utility in uutils coreutils fails to properly manage directory trees containing symbolic links when moving files across different filesystem boundaries. Instead of retaining the symlinks, it incorrectly resolves them, copying the linked targets as actual files or directories. This behavior can precipitate resource exhaustion by consuming excess disk space or time if the symlinks lead to substantial external directories. Furthermore, it may cause unexpected data duplication into unintended locations and trigger infinite recursion if symlink loops are present.

References