CVE-2026-35340 uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode
uutils coreutils chown/chgrp return success despite failures in recursive mode, potentially causing security misconfigurations in administrative scripts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35340?
CVE-2026-35340 is a medium-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.
Weakness: CWE-253
Which versions are affected by CVE-2026-35340?
It affects 1 product.
Products include Uutils Coreutils.
How do I fix CVE-2026-35340?
Apply the vendor's patch.
Is CVE-2026-35340 being exploited?
There is no known exploitation of CVE-2026-35340 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
Sources
Also known as DEBIAN-CVE-2026-35340, UBUNTU-CVE-2026-35340.