CVE-2026-35358

Name	CVE-2026-35358
Description	The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rust-coreutils (PTS)	bookworm	0.0.17-2	vulnerable
	trixie	0.0.30-2	vulnerable
	forky	0.0.30-4	vulnerable
	sid	0.7.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rust-coreutils	source	(unstable)	0.7.0-1

Notes

https://github.com/uutils/coreutils/issues/9746
https://github.com/uutils/coreutils/pull/11163
Fixed by: https://github.com/uutils/coreutils/commit/e6a3bb596f149628ba973eec3d099f3bb69f2464 (0.7.0)