CVE-2026-35339: uutils coreutils chmod False Success Exit Code in Recursive Mode
In Chmoder::chmod() the recursive branch overwrites the running result instead of accumulating it, so the exit code reflects only the last file processed:
if self.recursive { r = self.walkdirwithcontext(file, true); // overwrites r } else { r = self.chmodfile(file).and(r); }
PoC: GNU returns 1 when a file fails; uutils returns 0 if the last entry succeeds:
$ chmod -R 0755 chmod-bug/root chmod-bug/user # GNU -> ret=1 $ uutils chmod -R 0755 chmod-bug/root chmod-bug/user # -> ret=0
Impact: scripts relying on the exit code get a false success signal while some files retained restrictive/unexpected permissions, leading to access-control misconfigurations. Recommendation: accumulate errors during traversal.
Remediation: Acknowledged by Canonical; fixed in commit abd581f6.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.2. Credit: Zellic.
Other sources
The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_chmodto a version that resolves this vulnerability.Fixed in 0.6.0 - Upgrade
Upgrade
uutils coreutils chmodto a version that resolves this vulnerability.Patch abd581f6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35339?
CVE-2026-35339 has a medium severity rating due to the potential for false success exit codes that could mislead users into thinking permissions were set correctly.
How do I fix CVE-2026-35339?
To fix CVE-2026-35339, update to uutils coreutils version 0.6.0 or later where this issue is addressed.
What software is affected by CVE-2026-35339?
CVE-2026-35339 affects uutils coreutils versions prior to 0.6.0.
What specific issue does CVE-2026-35339 present?
CVE-2026-35339 presents an issue where the chmod utility's recursive mode incorrectly handles exit codes based on the last file processed.
Is CVE-2026-35339 a critical vulnerability?
CVE-2026-35339 is not classified as critical, but it can lead to inappropriate permission settings due to misleading exit codes.