Bug 2460790 (CVE-2026-35365) - CVE-2026-35365 rust-coreutils: mv: denial of service and data duplication via improper symlink expansion
Summary: CVE-2026-35365 rust-coreutils: mv: denial of service and data duplication via...
Keywords:
Status: NEW
Alias: CVE-2026-35365
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2461646 2461647
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-22 17:02 UTC by OSIDB Bzimport
Modified: 2026-07-18 08:28 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-22 17:02:50 UTC
The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.


Note You need to log in before you can comment on or make changes to this bug.