CVE-2026-35347: 
Rust vulnerability analysis and mitigation

CVE-2026-35347 is a vulnerability in the comm utility of uutils coreutils (the Rust reimplementation of GNU coreutils) where the tool incorrectly consumes data from non-regular file inputs before performing comparison operations. The flaw affects all versions of uutils coreutils prior to 0.6.0 (Rust/cargo package). It was published on April 22, 2026, with a patch merged on January 17, 2026, and released in version 0.6.0 on February 2, 2026. The vulnerability carries a CVSS v3.1 base score of 4.4 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) in the are_files_identical function within the comm utility. This function opens and reads from both input file paths to compare their content without first verifying whether the paths refer to regular files. When a FIFO or pipe is passed as input, the pre-read operation in are_files_identical drains the stream before the actual comparison logic in fn comm executes, causing data to be silently skipped and producing incorrect output. A secondary issue arises when the utility encounters infinite streams such as /dev/zero, causing it to hang indefinitely. The fix, contributed via pull request #9545, skips the file-identity comparison when either input is not a regular file (Github PR #9545, Github Advisory).

Exploitation of this vulnerability results in silent data loss (integrity impact) and potential denial of service via indefinite hangs (availability impact) when the comm utility processes FIFO, pipe, or infinite stream inputs. There is no confidentiality impact. The vulnerability is particularly impactful in automated scripts or CI/CD pipelines that use process substitution (e.g., comm <(cat file1) <(cat file2)) or pipe data into comm, as incorrect comparison results are produced without any error indication (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.019–0.023%, indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Identify a vulnerable system: Confirm the target system uses uutils coreutils (Rust) version prior to 0.6.0, where the comm binary is provided by the coreutils Rust crate.
2. Craft a FIFO or pipe input: Prepare a scenario where comm is invoked with at least one non-regular file input, such as using bash process substitution: comm <(cat file1) <(cat file2) or mkfifo /tmp/testfifo && comm /tmp/testfifo file2.
3. Trigger silent data loss: When comm runs, the are_files_identical function reads from the FIFO/pipe, draining part of the stream. The subsequent comparison logic then operates on incomplete data, producing incorrect output without any error or warning.
4. Trigger a hang (DoS): Pass an infinite stream as input, e.g., comm /dev/zero file2, causing the utility to attempt to pre-read indefinitely and hang the process (Github PR #9545, Github Advisory).

Upgrade uutils coreutils to version 0.6.0 or later, which includes the fix merged in pull request #9545. The fix modifies the comm utility to skip the file-identity comparison when either input is not a regular file, preventing premature stream consumption. Organizations using the Rust coreutils crate in automated workflows that process pipes or FIFOs should prioritize this upgrade. No configuration-based workaround is available; the only remediation is upgrading to the patched version (Github Advisory, uutils Release 0.6.0).

Red Hat tracked the issue via Bugzilla (Bug 2460801) and classified it as medium severity, assigning it to their Security Response team. An Ubuntu community discussion thread noted the broader context of the Rust coreutils project's progress and security posture. No significant public researcher commentary or media coverage beyond standard vulnerability tracking was identified (Red Hat Bugzilla, Ubuntu Discourse).