Skip to content
OpenAdvisories
Medium · 4.4 CVE-2026-35358 EUVD-2026-24998GHSA-67hp-f6hq-2h6gGHSA-8vrf-r662-2w2v

uutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream Reading

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.7.0 0.7.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.7.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_cp < 0.7.0 0.7.0 GHSA-8vrf-r662-2w2v

References