Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
@mikedoerfler @LundukeJournal Latest GNU Coreutils CVE: CVE-2017-18018, creating symlinks without permission(no cp involved) Latest rust coreutils CVE: CVE-2026-35358 which is actually 44 CVE's all across the board.
Post summary
The tweet alerts to two CVE identifiers for GNU and Rust Coreutils, highlighting a symlink creation flaw and a large cluster of related CVEs, but provides no exploit or patch information.
CVE-2026-35358 The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preservin… https://www.cve.org/CVERecord?id=CVE-2026-35358
Post summary
The text announces a new vulnerability in the cp utility of uutils coreutils, detailing how recursive copies mishandle character and block device nodes.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | uutils | coreutils | - | rust | - |