Canonical Switch to uutils Coreutils and CVE Audit

Canonical announced on 1 May 2026 that it will continue to use the GNU implementations of cp, mv, and rm in Ubuntu 26.04 after a security audit of the uutils reimplementation of GNU coreutils. The audit, performed by Zellic, uncovered 113 issues, 44 of which were assigned CVE identifiers. The audit highlighted several TOCTOU race conditions, insecure default permissions, and missing preserve‑root checks in uutils utilities such as mkfifo, nohup, tail, chmod, and rm. Canonical noted that the vast majority of issues have been addressed, but the audit report lists several remaining vulnerabilities that could affect Ubuntu 26.04 users.

Among the most critical findings are CVE‑2026‑35352, where uutils mkfifo creates a FIFO with world‑readable permissions before chmod, allowing a race to replace the file with a symlink; CVE‑2026‑35367, where uutils nohup writes a world‑writable nohup.out file; and CVE‑2026‑35370, where uutils tail with --follow=name can expose the contents of a symlink target. Additional CVEs include CVE‑2026‑35338 (chmod bypasses preserve‑root), CVE‑2026‑35341 (mkfifo modifies existing file permissions on failure), CVE‑2026‑35345 (tail exfiltrates sensitive data via symlink), CVE‑2026‑35348 (sort crashes on non‑UTF‑8 filenames), and CVE‑2026‑35349 (rm bypasses preserve‑root via symlink). The audit also uncovered issues in chmod, chown, chgrp, dd, comm, and sort that could lead to silent data corruption, privilege escalation, or denial of service. Canonical’s decision to retain the GNU utilities in Ubuntu 26.04 mitigates the risk of these vulnerabilities in the default system tools.