Ubuntu patches 16 vulnerabilities in uutils coreutils, including chroot code execution flaw

Ubuntu has released USN-9041-1, a security update addressing 16 CVEs in uutils coreutils, a Rust rewrite of the GNU coreutils package shipping in Ubuntu. The vulnerabilities span multiple utilities including cp, mv, chroot, touch, rm, and nohup, with severity ranging from denial of service to critical local privilege escalation. The most severe flaw, CVE-2026-35368, allows a local attacker with write access to a chroot directory to execute arbitrary code as root by exploiting incorrect resolution of user specifications before privileges are dropped. Multiple race conditions in cp and mv create windows where destination files are created with overly permissive modes or security labels are applied to unintended files.

Affected utilities include mkfifo, dd, tail, sort, cp, mv, touch, rm, nohup, chroot, ln, split, and chcon. The bugs involve incorrect permission preservation during ownership changes, failure to preserve file ownership across filesystem boundaries, mishandling of symbolic links with --follow=name, and world-readable output file creation by nohup. Several vulnerabilities specifically affect non-UTF-8 filenames or involve extended attribute handling. Ubuntu users running systems with uutils coreutils installed should apply updates immediately, particularly on multi-user systems or containers where chroot environments are deployed.

Vulnerability classes and affected utilities

• chroot privilege escalation (CVE-2026-35368): chroot incorrectly resolves user specifications before dropping root privileges, allowing Name Service Switch modules to be loaded from the attacker-controlled chroot directory, enabling arbitrary code execution as root.
• Race conditions in cp and mv (CVE-2026-35354, CVE-2026-35357, CVE-2026-35359, CVE-2026-35364): Multiple time-of-check to time-of-use flaws in file creation, extended attribute preservation, symbolic link handling, and cross-device operations allow attackers to overwrite arbitrary files, modify security labels, or create files with overly permissive initial modes.
• Permission and ownership mishandling (CVE-2026-35350, CVE-2026-35351): cp preserves setuid and setgid bits when ownership changes fail, and mv fails to preserve file ownership across filesystem boundaries, both creating privilege escalation or information disclosure vectors.
• Information disclosure and data corruption (CVE-2026-35341, CVE-2026-35344, CVE-2026-35345, CVE-2026-35367): mkfifo applies default permissions to existing files, dd suppresses truncation errors, tail follows symbolic links with --follow=name, and nohup creates world-readable output files.
• Denial of service and data loss (CVE-2026-35348, CVE-2026-35360, CVE-2026-35363, CVE-2026-35373, CVE-2026-35374): sort and ln crash on non-UTF-8 filenames, touch has a TOCTOU race during file creation, rm mishandles trailing slashes on the current directory, and split has a race condition in input/output validation.

Why it matters

uutils coreutils is a significant Rust-based alternative to GNU coreutils that has been gaining adoption in Linux distributions seeking memory-safe system utilities, making these vulnerabilities particularly notable for the Rust-in-systems-programming narrative. The chroot code execution flaw directly undermines a fundamental containerization primitive, affecting sandboxing and build environment security across the ecosystem. Distributions packaging uutils coreutils as a default or optional replacement for GNU coreutils will need to evaluate their exposure and patching timelines carefully.