CVE-2026-35381

uutils coreutils before version 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal two-byte string '' (two single quotes) as an empty delimiter. The implementation mistakenly maps this string to the NUL character for both the -d and --output-delimiter options. This can lead to silent data corruption or logic errors in automated scripts and data pipelines.

A logic error in the tr utility of uutils coreutils incorrectly defines the [:graph:] and [:print:] character classes. The implementation mistakenly includes the ASCII space (0x20) in [:graph:] and excludes it from [:print:], reversing POSIX and GNU coreutils behavior. This can lead to unintended data modification or loss in automation scripts.

A logic error in the expr utility of uutils coreutils causes parenthesized subexpressions to be evaluated during parsing rather than execution. This prevents proper short-circuiting for logical OR (|) and AND (&), so arithmetic errors in branches that should be skipped are raised as fatal errors. This diverges from GNU expr behavior and can cause premature shell script termination.

A logic error in the env utility of uutils coreutils causes incorrect parsing of command-line arguments when using the -S (split-string) option. Unlike GNU env, the uutils implementation incorrectly validates sequences, resulting in an "invalid sequence" error and immediate termination with exit status 125 when encountering valid but unrecognized sequences like \a or \x.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup (via fts_accpath) rather than binding traversal and label application to the directory state encountered during traversal; because operations are not anchored to file descriptors, a local attacker with write access to a directory tree can exploit timing-sensitive rename or symlink races to redirect a privileged recursive relabeling operation to unintended files or directories. This breaks SELinux administration hardening expectations and can lead to unauthorized modification of security labels on sensitive system objects.

A logic error in the split utility of uutils coreutils corrupts output filenames when given non-UTF-8 prefixes or suffixes. The implementation uses to_string_lossy(), replacing invalid byte sequences with the UTF-8 replacement character (U+FFFD), unlike GNU split which preserves raw bytes. This leads to files with incorrect names.

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program checks identity between input and output files using their paths before initiating the split operation, but subsequently opens the output file with truncation after this path-based validation. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components (e.g., swapping a path with a symbolic link), causing split to truncate and write to an unintended target file, potentially including the input file itself or other sensitive files accessible to the process, leading to permanent data loss.

A logic error in the ln utility of uutils coreutils causes rejection of source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). Unlike GNU ln, the uutils implementation enforces UTF-8 encoding, resulting in a stat failure and non-zero exit code.

A logic error in the ln utility of uutils coreutils causes it to dereference a symbolic link target even when --no-dereference (or -n) is explicitly provided. The implementation only honored the no-dereference intent when --force was also enabled. This flaw causes ln to follow a symlink pointing to a directory and create new links inside that target directory instead of treating the symlink itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symlinks to redirect file creation into sensitive directories.