CVE-2026-35365: uutils coreutils mv Denial of Service and Data Duplication via Improper Symlink Expansion
The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.
Other sources
When moving directories across filesystems, uutils mv dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a etclink -> /etc inside the source becomes a full copy of /etc at the destination.
Impact: (1) resource exhaustion — a small tree can expand into a huge copy (time/disk DoS); (2) unintended duplication of sensitive paths referenced by symlink; (3) symlink-loop amplification causing deep recursion. Recommendation: in cross-device fallback, detect symlinks via symlinkmetadata() and recreate with readlink()/symlink(); add loop detection.
Remediation: Acknowledged by Canonical; fixed in commit 9654e4ab.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.63. Credit: Zellic.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_mvto a version that resolves this vulnerability.Fixed in 0.7.0 - Upgrade
Upgrade
uutils coreutilsto a version that resolves this vulnerability.Patch 9654e4ab - Configuration
During cross-filesystem moves, detect symlinks using `symlink_metadata()`, then recreate them with `read_link()`/`symlink()` rather than expanding the symlink targets into real files/directories. Also add symlink-loop detection to prevent infinite recursion/amplification.
uutils coreutils mv cross-device symlink handling = preserve symlinks instead of expanding/dereferencing
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35365?
CVE-2026-35365 is considered a moderate vulnerability as it can lead to Denial of Service and data duplication issues.
How do I fix CVE-2026-35365?
To fix CVE-2026-35365, update to the latest version of uutils coreutils where this issue has been addressed.
What types of systems are affected by CVE-2026-35365?
CVE-2026-35365 affects systems running uutils coreutils, specifically when using the mv utility with symbolic links.
What are the potential impacts of CVE-2026-35365?
The potential impacts of CVE-2026-35365 include denial of service and unintended data duplication when moving files.
Is CVE-2026-35365 easy to exploit?
CVE-2026-35365 can be exploited by users with access to the mv utility, making it a concern for systems relying on this command with symlinks.