CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection

What is CVE-2026-35368?

CVE-2026-35368 is a high-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

Weakness: CWE-426

Which versions are affected by CVE-2026-35368?

2 open source packages ship an affected version, including coreutils. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35368?

Apply the vendor's patch.

Is CVE-2026-35368 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35368 exists.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7
• CVE-2026-35350 uutils coreutils cp Unexpected Privileged Executable Creation with -p Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35368, GHSA-mh5c-xrmh-m794, UBUNTU-CVE-2026-35368.