Skip to content
OpenAdvisories
Medium · 6.7 CVE-2026-35349 EUVD-2026-24981GHSA-7cr3-h577-g38jGHSA-v762-x3cf-5mfg

uutils coreutils Path-Based Safety Bypass with --preserve-root

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.7.0 0.7.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.7.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_rm < 0.7.0 0.7.0 GHSA-7cr3-h577-g38j

References