CVE-2026-93658

Publication date 18 September 2026

Last updated 11 November 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.0 · High

Score breakdown

Description

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

Status

Package Ubuntu Release Status
rust-coreutils 26.10 stonking
Not affected
26.04 LTS resolute
Fixed in 0.10.0-1ubuntu2~26.04.1
24.04 LTS noble
Needs evaluation
22.04 LTS jammy Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
rust-coreutils

Severity score breakdown

CVSS version:

Base score 7.3 · High

Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Base score 7.0 · High

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-9041-1
    • uutils coreutils vulnerabilities
    • 11 November 2026

Other references

Access our resources on patching vulnerabilities