CVE-2026-35372: 
Rust vulnerability analysis and mitigation

CVE-2026-35372 is a UNIX Symbolic Link (Symlink) Following vulnerability in the ln utility of uutils coreutils (the Rust reimplementation of GNU coreutils). A logic error causes ln to dereference a symbolic link target even when the --no-dereference (-n) flag is explicitly provided, because the implementation only honored the no-dereference intent when --force mode was also active. All versions of uutils coreutils prior to 0.8.0 are affected. It carries a CVSS v3.1 base score of 5.0 (Medium severity) (Github Advisory, Red Hat Bugzilla). The vulnerability was published on April 22, 2026, and patched in the 0.8.0 release (uutils Release).

The root cause is a logic error (CWE-61: UNIX Symbolic Link Following) in the ln utility's handling of the --no-dereference flag. The implementation conditioned the no-dereference behavior on the simultaneous presence of the --force flag, meaning that when ln -n was invoked without --force, the utility would still follow a symlink pointing to a directory and create new links inside that target directory rather than treating the symlink itself as the destination. This violates the expected POSIX semantics of --no-dereference. The fix was contributed by researcher aweinstock314 from Zellic and merged on March 11, 2026, via pull request #11253 (GitHub PR, Github Advisory).

Exploitation allows a local attacker to redirect file creation into sensitive directories by manipulating existing symbolic links in paths accessed by privileged users or system scripts that invoke ln -n. The primary impact is high integrity loss — unauthorized files can be created in directories the attacker would not normally have write access to — potentially leading to system misconfiguration, privilege escalation preconditions, or disruption of security-sensitive file layouts. There is no confidentiality or availability impact (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.019% (2nd percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local access, low privileges, and some degree of user interaction, further limiting the attack surface (Github Advisory).

1. Reconnaissance: Identify a target system running uutils coreutils (Rust) version prior to 0.8.0 where a privileged user or automated script periodically executes ln -n to update a symlink in a world-writable or attacker-accessible directory.
2. Prepare malicious symlink: As a local low-privileged user, create or replace an existing symlink in the target path so that it points to a sensitive directory (e.g., /etc or a privileged application config directory): ln -sfn /etc /tmp/target_symlink.
3. Trigger vulnerable ln invocation: Wait for or socially engineer the privileged script to execute ln -n <source_file> /tmp/target_symlink. Due to the logic error, ln dereferences the symlink and creates the new link inside /etc/ instead of replacing the symlink.
4. Achieve unauthorized file creation: The new hard link or symlink is now created inside the sensitive directory (e.g., /etc/<source_file_name>), potentially overwriting configuration files or planting attacker-controlled content, leading to system misconfiguration or a stepping stone for further privilege escalation (Github Advisory, GitHub PR).

• File System: Unexpected hard links or symlinks appearing inside sensitive directories (e.g., /etc/, /usr/lib/, application config directories) with ownership or timestamps inconsistent with normal administrative activity.
• File System: Symlinks in world-writable directories (e.g., /tmp/, /var/tmp/) pointing to sensitive system directories, potentially placed by a low-privileged user.
• Logs: Audit logs (auditd) showing ln invocations by privileged users or scripts where the destination resolves to an unexpected directory path (i.e., the symlink target rather than the symlink itself).
• Process: Privileged scripts or cron jobs invoking ln with the -n flag where the destination argument is a symlink controlled or modifiable by non-privileged users.

Upgrade uutils coreutils to version 0.8.0 or later, which contains the fix for this logic error (uutils Release, GitHub PR). As a workaround prior to patching, audit and restrict filesystem permissions on directories where privileged scripts invoke ln -n, ensuring that low-privileged users cannot create or modify symlinks in those paths. Additionally, review all system scripts and cron jobs that use ln --no-dereference to confirm they operate on paths not writable by untrusted users (Github Advisory, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (Bug 2460806) and assigned it medium priority and severity, reflecting its limited exploitability scope (Red Hat Bugzilla). The fix was contributed by Zellic security researchers (aweinstock314), indicating the vulnerability was discovered through a professional security audit of the uutils codebase (GitHub PR). An Ubuntu community discussion on the adoption of Rust coreutils referenced the issue in the context of ongoing security hardening efforts (Ubuntu Discourse). The oss-security mailing list also carried a disclosure post (oss-sec).