Logic Error in ln Utility Affects uutils Coreutils

CVE-2026-35373

What is CVE-2026-35373?

The ln utility within uutils coreutils contains a logic error that prevents it from processing source paths with non-UTF-8 filename bytes when specified in target-directory forms. Unlike GNU ln, which handles filenames as raw bytes, the uutils implementation strictly enforces UTF-8 encoding. This discrepancy results in the failure to accurately stat the file, returning a non-zero exit code. Consequently, automated scripts and system tasks that rely on valid, albeit non-UTF-8 filenames—common on Unix filesystems—can experience functional failures, leading to local denial of service in specific operations.

References