CVE-2026-35350
Publication date 22 April 2026
Last updated 11 November 2026
Ubuntu priority
Description
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| rust-coreutils | 26.10 stonking |
Fixed in 0.9.0-2ubuntu1
|
| 26.04 LTS resolute |
Fixed in 0.10.0-1ubuntu2~26.04.1
|
|
| 24.04 LTS noble |
Vulnerable
|
|
| 22.04 LTS jammy | Not in release |
Notes
john-breton
Fixed in 0.10.0-1ubuntu2~26.04.1 in resolute-updates (LP: #2166202), but not yet in the -security pocket.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.6 · Medium
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
References
Related Ubuntu Security Notices (USN)
- USN-9041-1
- uutils coreutils vulnerabilities
- 11 November 2026