The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.
Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.
##### uutils: no backup created
$ coreutils cp --suffix=.bak src dest # dest.bak NOT created
##### GNU: dest.bak created
$ cp --suffix=.bak src dest
Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.
Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.
Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.
We are happy to announce the release of Rust Coreutils 0.6.0 — a major milestone achieving 96% GNU compatibility with significant safety improvements, enhanced locale support, and extensive bug fixes!
Highlights:
Major GNU Compatibility Leap
622 passing tests (+56 from 0.5.0), achieving 96.28% compatibility
Reduced failures from 55 to just 16 (-39) and skipped tests from 23 to 7 (-16)
Extensive test suite improvements across sort, ls, date, cksum, tail, and many more
Safety & Code Quality
Removed unsafe code from date, sort, locale.rs, and other utilities
Replaced raw libc calls with safe nix crate equivalents throughout
Enhanced error handling to avoid panics on /dev/full writes across many utilities
Locale & Internationalization
Added ICU support for locale-aware day/month names in date
Implemented locale-aware hour formatting and calendar support
Added locale-aware numeric sorting with thousand separator support in sort
Locale-aware collation support in join
Performance Improvements
base32/base64/basenc: Optimized with reduced memset operations
shuf: Optimized numeric output and added --random-seed option
date: Wrapped stdout in BufWriter for batch processing
uniq: Optimized memory usage for ignore-case comparison
tsort: Avoid reading entire input into memory, intern strings
df: Performance improvements with better filesystem handling
Platform Support Expansion
Expanded safe directory traversal to all Unix platforms
Enhanced Cygwin support across multiple utilities
Added SMACK security module support for ls, id, mkdir, mkfifo, mknod
Added RISC-V 64-bit musl target to CI
Notable Utility Improvements
cksum/hashsum: Merged common logic, removed deprecated hashsum binary
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
uucore: safe_traversal TOCTOU protection only enabled on Linux
CVE-2026-35362 / GHSA-w6xc-g9qj-vp32
More informationDetails
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.
Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
Severity
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)
GHSA-fqf6-gxhh-2xhw
More informationDetails
determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.
Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.
Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.
Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.
Severity
References
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
uutils/coreutils (uucore)v0.6.0
Compare Source
Rust Coreutils 0.6.0 Release:
We are happy to announce the release of Rust Coreutils 0.6.0 — a major milestone achieving 96% GNU compatibility with significant safety improvements, enhanced locale support, and extensive bug fixes!
Highlights:
Major GNU Compatibility Leap
Safety & Code Quality
Locale & Internationalization
Performance Improvements
Platform Support Expansion
Notable Utility Improvements
Contributions: This release was made possible by 41 new contributors joining our community
GNU Test Suite Compatibility:
Call to Action:
Help us translate - Contribute translations at Weblate
Sponsor us on GitHub to accelerate development: github.com/sponsors/uutils
What's Changed
arch
base64
basename
cat
chgrp
chmod
chroot
cksum
comm
cp
csplit
date
dd
df
dir
dirname
du
echo
env
expand
expr
fmt
fold
groups
hashsum
head
hostid
id
install
join
kill
ln
logname
ls
mkdir
mkfifo
mknod
mktemp
more
mv
nice
nl
nohup
nproc
numfmt
pr
printenv
printf
ptx
readlink
rm
rmdir
runcon
seq
shred
shuf
sort
split
stat
stdbuf
stty
sync
tac
tail
tee
test
timeout
touch
truncate
tsort
uname
unexpand
uniq
uptime
users
wc
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.