Logic Error in ln Utility of uutils Coreutils Allows Unintended Symbolic Link Dereferencing

CVE-2026-35372

What is CVE-2026-35372?

A vulnerability in the ln utility of uutils coreutils arises from a logic error that allows the utility to incorrectly dereference a symbolic link target. Despite the use of the --no-dereference (-n) flag, the utility still follows symbolic links if the --force mode is enabled. This behavior can lead to the creation of new links within a directory that a symbolic link points to, rather than treating the symbolic link itself as the destination. As a result, a local attacker could exploit this flaw to manipulate symbolic links, potentially redirecting file creation into sensitive directories and causing unauthorized modifications or misconfigurations in the system.

References