CVE-2026-35339: 
Rust vulnerability analysis and mitigation

CVE-2026-35339 is an incorrect exit code handling vulnerability in the chmod utility of uutils coreutils (the Rust reimplementation of GNU coreutils). When running chmod in recursive mode (-R) against multiple files, the final return value reflects only the success or failure of the last file processed, masking errors on earlier files. This affects all versions of uutils coreutils prior to 0.6.0 (Rust/cargo package). The vulnerability was published on April 22, 2026, with a fix merged on January 1, 2026 and released in version 0.6.0 on February 2, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, GitHub PR).

The root cause is classified as CWE-253 (Incorrect Check of Function Return Value). In the affected code, when chmod -R processes a list of files, the exit code accumulation logic overwrites the previous result with each iteration, so only the last file's result is returned. A low-privileged local attacker can craft a scenario where chmod is invoked on a mix of files — some accessible, some not — ensuring the last file in the list succeeds, causing the overall command to return exit code 0 despite earlier Operation not permitted errors. The fix, contributed via pull request #9793, corrects the return value aggregation so that any error encountered during processing is preserved in the final exit code (GitHub PR, Github Advisory).

The primary impact is an integrity violation: scripts or automation relying on chmod -R exit codes to confirm permission changes may proceed under a false assumption of success, leaving sensitive files with incorrect or overly restrictive permissions. A low-privileged attacker could exploit this to ensure that critical files retain unintended permissions — either preventing legitimate access or maintaining unauthorized access — without triggering script-level error handling. There is no direct confidentiality or availability impact, but the silent failure can enable privilege escalation or unauthorized file access in environments where permission management is automated (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.01% (3rd percentile), indicating a very low probability of exploitation in the near term. No threat actor attribution exists, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and depends on the target environment using uutils coreutils (rather than GNU coreutils) and relying on chmod exit codes in scripts (Github Advisory).

1. Identify target environment: Confirm the target system uses uutils coreutils (Rust implementation) prior to version 0.6.0, where chmod is the uutils binary rather than GNU coreutils.
2. Identify target script: Locate an automated script or cron job that runs chmod -R <mode> <file1> <file2> ... and checks the exit code to determine success (e.g., if chmod -R 600 /sensitive /accessible; then proceed; fi).
3. Arrange file ordering: Ensure that a file the attacker cannot modify (e.g., a root-owned file) appears before a file the attacker can modify in the argument list, so the last file processed succeeds.
4. Trigger the command: Cause the vulnerable chmod -R command to execute (e.g., by triggering the script through normal system activity or a race condition).
5. Observe silent failure: The command returns exit code 0 despite failing on the sensitive file, causing the script to proceed as if all permissions were correctly set, while the sensitive file retains its original (potentially exploitable) permissions (GitHub PR, Github Advisory).

• Logs: System logs (e.g., /var/log/syslog, /var/log/auth.log) showing Operation not permitted errors from chmod processes that nonetheless exit with code 0; audit logs (auditd) recording failed chmod syscalls on sensitive files followed by successful script continuation.
• File System: Sensitive files retaining unexpected permissions after a chmod -R operation that was reported as successful; discrepancy between expected and actual file permission states after automated permission management scripts run.
• Process: Processes running as low-privileged users invoking chmod -R on directories containing files owned by other users or root, particularly in environments using uutils coreutils.

Update uutils coreutils to version 0.6.0 or later, which includes the fix from pull request #9793 that correctly aggregates exit codes across all processed files (GitHub Release). As a workaround prior to patching, modify scripts to explicitly verify file permissions after chmod operations (e.g., using stat or ls -l) rather than relying solely on the exit code. Additionally, review all automation and scripts that use chmod -R with multiple file arguments and add explicit per-file error handling or use GNU coreutils chmod as an interim measure (Github Advisory).

The Ubuntu community discussed the broader context of Rust coreutils adoption and this vulnerability in a Discourse thread (Ubuntu Discourse). The vulnerability was also reported to the oss-security mailing list (oss-sec). Detection coverage was added by Tenable (Nessus plugin 309817) and Qualys (detection ID 5011612) shortly after disclosure. Overall community reaction has been measured, given the moderate severity and absence of active exploitation.