Skip to content
OpenAdvisories
Medium · 5.5 CVE-2026-35369 EUVD-2026-25017GHSA-gpcg-h6x2-c26pGHSA-p6rv-2qpm-fwvg

uutils coreutils kill System-wide Process Termination and Denial of Service via Argument Misinterpretation

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.6.0 0.6.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.6.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_kill < 0.6.0 0.6.0 GHSA-p6rv-2qpm-fwvg

References