CVE-2026-35350 | BDVDB-2026-328481 Detail

Description#

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-22Record published in the CVE List.