CVE-2026-35373: 
Rust vulnerability analysis and mitigation

CVE-2026-35373 is a local denial-of-service vulnerability in the ln utility of uutils coreutils (the Rust reimplementation of GNU coreutils). A logic error causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY), diverging from GNU ln behavior which treats filenames as raw bytes. The vulnerability affects uutils coreutils versions ≤ 0.8.0 (Rust/cargo package). It was disclosed on April 22, 2026, with a fix merged on June 6, 2026. The CVSS v3.1 base score is 5.5 (Medium) per NVD, or 3.3 (Low) per the GitHub Advisory Database (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-176 (Improper Handling of Unicode Encoding). The uutils ln implementation internally converts source path bytes to a UTF-8 string when resolving the target-directory form; if the filename contains bytes that are not valid UTF-8 (e.g., \xFF), the conversion fails and the utility exits with a non-zero status and the error cannot stat 'bad_\xFF', without creating the link. GNU ln avoids this by treating filenames as opaque byte sequences throughout. The attack vector is local (requires the ability to execute the ln command), with low attack complexity and low privileges required. A proof-of-concept reproduction is publicly available in the upstream pull request (uutils PR #11403).

Exploitation results in a local denial of service limited to link-creation operations involving non-UTF-8 filenames. Automated scripts, build systems, or system tasks that rely on ln to process such filenames will fail silently or with a non-zero exit code, potentially breaking dependent workflows. There is no confidentiality or integrity impact; the vulnerability does not enable privilege escalation, lateral movement, or data exposure (Github Advisory, Red Hat Bugzilla).

A proof-of-concept is publicly available in the upstream GitHub pull request, consisting of a simple bash command sequence that demonstrates the failure (name=$(printf 'bad_\377'); mkdir dst; : > "$name"; ln "$name" dst). There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013–0.015%, indicating a very low probability of exploitation in the near term (uutils PR #11403, Github Advisory).

1. Identify target environment: Confirm the system uses uutils coreutils (Rust) version ≤ 0.8.0 as the ln binary, rather than GNU coreutils.
2. Create a non-UTF-8 filename: Use a shell command to create a file with an invalid UTF-8 byte in its name, e.g., name=$(printf 'bad_\377'); : > "$name".
3. Prepare a target directory: Create a destination directory, e.g., mkdir dst.
4. Invoke ln in target-directory mode: Run ln "$name" dst to trigger the bug.
5. Observe failure: uutils ln exits with code 1 and prints cannot stat 'bad_\xFF'; the destination directory remains empty, causing any dependent script or task to fail (uutils PR #11403).

• Logs: Shell or cron job logs showing ln exiting with a non-zero status and the error message cannot stat $'bad_\xFF' (or similar non-UTF-8 filename representation).
• Process: Unexpected failures of automated scripts or system tasks that invoke ln with filenames containing high-byte characters (bytes > 0x7F).
• File System: Expected symlinks or hard links absent from target directories when source filenames contain non-UTF-8 bytes.

Update uutils coreutils to a version that includes the fix merged on June 6, 2026 (commit 48d030d into uutils:main), which corrects the ln utility to handle non-UTF-8 filenames as raw bytes. As a workaround, replace the uutils ln binary with GNU coreutils ln on affected systems, or ensure automated scripts avoid filenames with non-UTF-8 bytes until patching is complete. Red Hat has tracked this issue in Bugzilla for downstream package (rust-coreutils) assessment (uutils PR #11403, Red Hat Bugzilla, Github Advisory).

The vulnerability was discussed in the oss-security mailing list and noted by the Yocto Project security list, reflecting awareness in embedded and Linux distribution communities. Ubuntu published an update on Rust coreutils adoption in response to related issues. Community reaction has been low-key given the limited severity and scope of the vulnerability (Github Advisory).