Argument Parsing Flaw in uutils coreutils Kill Utility

CVE-2026-35369

What is CVE-2026-35369?

An issue in the kill utility of uutils coreutils arises from a failure to properly interpret the argument '-1'. When the command 'kill -1' is invoked, it mistakenly attempts to send the default termination signal (SIGTERM) to process ID -1. This erroneous interpretation causes the kernel to terminate all visible processes for the caller, which can lead to significant system instability or an unexpected system crash. This behavior contrasts with GNU coreutils, which accurately recognizes -1 as an invalid signal number and instead would indicate that a PID argument is missing.

References