UBUNTU-CVE-2026-35373: Medium severity ubuntu/rust-coreutils vulnerability
A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu1 - Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu2~26.04.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Ubuntu rust-coreutils are exposed when automated scripts or system tasks create links for valid Unix filenames containing non-UTF-8 bytes. The impact is limited to the affected link operations failing locally.
What does an attacker need to trigger the failure?
The attacker needs local access with low privileges and the ability to cause an affected ln operation to process a source path containing non-UTF-8 filename bytes. The vulnerable invocation uses a target-directory form, such as ln SOURCE... DIRECTORY.
How can I determine whether an operation is affected?
An affected ln invocation fails to stat the valid source file and exits with a non-zero status when the source filename contains non-UTF-8 bytes and a target-directory form is used. GNU ln creates the link correctly for the same raw-byte filename.