CVE-2026-35373: uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames
A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.
Other sources
In target-directory forms (ln SOURCE... DIRECTORY), ln rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.
PoC: name=$(printf 'bad\377'); mkdir dst; : > "$name"; ln "$name" dst GNU: exit 0, creates dst/bad\377 ; uutils: exit 1, dst empty
--- Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_lnto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35373?
CVE-2026-35373 has been classified as a denial of service vulnerability.
How do I fix CVE-2026-35373?
To mitigate CVE-2026-35373, ensure that filenames used with the ln utility are encoded in UTF-8.
What software is affected by CVE-2026-35373?
CVE-2026-35373 affects the uutils coreutils package, specifically the ln utility.
What type of vulnerability is CVE-2026-35373?
CVE-2026-35373 is a logic error that triggers a denial of service when handling non-UTF-8 filenames.
When was CVE-2026-35373 disclosed?
CVE-2026-35373 was disclosed in 2026, highlighting an issue in uutils coreutils.