CVE-2026-35344: 
Rust vulnerability analysis and mitigation

CVE-2026-35344 is an unchecked return value vulnerability in the dd utility of uutils coreutils (the Rust reimplementation of GNU coreutils) that causes silent suppression of file truncation errors. The flaw was reported on December 20, 2025, and publicly disclosed on April 22, 2026. It affects uutils coreutils versions ≤ 0.8.0 for the Rust (cargo) ecosystem. The CVSS v3.1 base score is 3.3 (Low) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-252 (Unchecked Return Value). The dd utility in uutils coreutils unconditionally calls Result::ok() on file truncation attempts, discarding any error result without inspection. This behavior was originally intended to mimic GNU dd's handling of special files such as /dev/null, where truncation errors are expected and benign. However, the uutils implementation applies this suppression indiscriminately to regular files and directories as well, meaning failures caused by full disks or read-only file systems are silently ignored and the utility exits with code 0 (success) (GitHub Issue, GitHub Advisory).

The primary consequence is silent data corruption: backup or migration scripts using dd may receive a success exit code while the destination file retains stale, incomplete, or garbage data from a failed truncation. This integrity impact is limited to the local system and does not affect confidentiality or availability. The risk is most acute in automated backup pipelines where the absence of an error signal prevents operators from detecting data loss until recovery is attempted (GitHub Advisory, GitHub Issue).

There is no known public proof-of-concept exploit, no evidence of in-the-wild exploitation, and no threat actor attribution associated with this vulnerability. The EPSS score is approximately 0.012–0.015%, placing it in the 3rd percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require local access with low privileges and is contingent on environmental conditions such as a full disk or read-only file system (GitHub Advisory, Feedly).

A patch was made available on April 22, 2026; users should update uutils coreutils to a version beyond 0.8.0 as soon as a patched release is published. In the interim, backup and migration scripts should be modified to explicitly validate the integrity of destination files after dd operations rather than relying solely on exit codes — for example, by comparing checksums or file sizes. Consider replacing dd with an alternative tool that properly propagates truncation errors, or wrapping dd calls with additional shell-level checks. Monitor automated backup processes for unexpected behavior that may indicate prior silent failures (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported to the uutils project by Canonical (assigned as reported-canonical in the issue tracker) and tracked by Red Hat's Product Security team via Bugzilla. An Ubuntu community discussion thread on Rust coreutils was noted shortly after disclosure. The Yocto Project security mailing list and oss-security list also referenced the issue, indicating awareness across embedded Linux and open-source security communities (GitHub Issue, Red Hat Bugzilla).