CVE-2026-35340: uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode
A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35340?
The severity of CVE-2026-35340 is considered low, as it primarily impacts the accuracy of exit codes rather than leading to immediate security risks.
How do I fix CVE-2026-35340?
To fix CVE-2026-35340, update to the latest version of uutils coreutils beyond version 0.6.0 which addresses this flaw.
What systems are affected by CVE-2026-35340?
CVE-2026-35340 affects all versions of uutils coreutils up to, but not including, 0.6.0.
What is the impact of CVE-2026-35340 on users?
The impact of CVE-2026-35340 on users includes receiving misleading exit statuses during recursive operations with chown and chgrp commands.
Is there a workaround for CVE-2026-35340?
There are no specific workarounds for CVE-2026-35340; the recommended action is to upgrade to the fixed version.