CVE-2026-35344: uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides failures on regular files and directories caused by full disks or read-only file systems. This can lead to silent data corruption in backup or migration scripts, as the utility may report a successful operation even when the destination file contains old or garbage data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35344?
The severity of CVE-2026-35344 is considered high due to the potential for silent data corruption.
How do I fix CVE-2026-35344?
To fix CVE-2026-35344, update to the latest version of uutils coreutils where this issue has been addressed.
What is the impact of CVE-2026-35344?
The impact of CVE-2026-35344 is that it can lead to undetected data loss during file truncation operations.
Which versions of uutils coreutils are affected by CVE-2026-35344?
All versions of uutils coreutils prior to the fix for CVE-2026-35344 are affected.
Is CVE-2026-35344 a remote or local vulnerability?
CVE-2026-35344 is primarily a local vulnerability affecting users who run the dd utility in uutils coreutils.