UBUNTU-CVE-2026-35351: Medium severity ubuntu/rust-coreutils vulnerability
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.
Affected Software
Event History
Frequently Asked Questions
When does the ownership change occur?
It occurs when mv moves a file across different filesystem boundaries and falls back to copying the file and deleting the original. In that path, the destination is created with the UID and GID of the caller rather than the source file's ownership metadata.
Who is most exposed to the impact?
Workflows in which a privileged user, such as root, moves files between filesystems are most exposed. Files intended to remain owned by another user can become root-owned, potentially disclosing data to the wrong account context or preventing the intended owner from accessing it.
Can this be exploited remotely or without elevated access?
The supplied vector identifies the issue as locally exploitable with low attack complexity, requiring high privileges and no user interaction. The described impact depends on a privileged caller performing an affected cross-filesystem move.