> USN-9041-1: uutils coreutils vulnerabilities

It was discovered that uutils coreutils mkfifo incorrectly continued processing when a target file already existed, applying default permissions to the existing file. A local attacker could possibly use this issue to obtain sensitive information or modify file permissions unexpectedly. (CVE-2026-35341) It was discovered that uutils coreutils dd incorrectly suppressed errors during file truncation operations. A local attacker could possibly use this issue to cause silent data corruption. (CVE-2026-35344) It was discovered that uutils coreutils tail incorrectly followed symbolic links when using the --follow=name option. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35345) It was discovered that uutils coreutils sort crashed when processing filenames containing non-UTF-8 bytes. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35348) It was discovered that uutils coreutils cp incorrectly preserved setuid and setgid bits when ownership changes failed. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-35350) It was discovered that uutils coreutils mv failed to preserve file ownership when moving files across file system boundaries. A local attacker could possibly use this issue to obtain sensitive information or cause unintended access restrictions. (CVE-2026-35351) It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition in its extended attribute preservation logic. A local attacker with write access to a directory could possibly use this issue to modify security labels on unintended files. (CVE-2026-35354) It was discovered that uutils coreutils cp had a race condition in its file creation logic, initially creating destination files with overly permissive modes. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35357) It was discovered that uutils coreutils cp had a time-of-check to time-of-use race condition when handling symbolic links. A local attacker with write access to a directory could possibly use this issue to obtain sensitive information. (CVE-2026-35359) It was discovered that uutils coreutils touch had a time-of-check to time-of-use race condition during file creation. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35360) It was discovered that uutils coreutils rm failed to recognize trailing slashes on the current directory path. A local attacker could possibly use this issue to cause data loss. (CVE-2026-35363) It was discovered that uutils coreutils mv had a time-of-check to time-of-use race condition during cross-device operations. A local attacker with write access to a directory could possibly use this issue to overwrite arbitrary files. (CVE-2026-35364) It was discovered that uutils coreutils nohup created its output file with world-readable permissions. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-35367) It was discovered that uutils coreutils chroot incorrectly resolved user specifications before dropping root privileges, allowing Name Service Switch modules to be loaded from the new root directory. A local attacker with write access to the chroot directory could possibly use this issue to execute arbitrary code as root. (CVE-2026-35368) It was discovered that uutils coreutils ln failed to process filenames containing non-UTF-8 bytes, causing the utility to exit with an error. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35373) It was discovered that uutils coreutils split had a time-of-check to time-of-use race condition in its input and output file validation. A local attacker with write access to a directory could possibly use this issue to cause data loss. (CVE-2026-35374) It was discovered that uutils coreutils chcon had a time-of-check to time-of-use race condition during recursive relabeling operations. A local attacker with write access to a directory could possibly use this issue to modify security labels on unintended files. (CVE-2026-35376) It was discovered that uutils coreutils env incorrectly handled backslash sequences within single quotes when using the -S option. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-35377) It was discovered that uutils coreutils install applied setuid and setgid mode bits to destination files before completing ownership changes. A local attacker could possibly use this issue to gain elevated privileges. (CVE-2026-93658)