Bug 2460791 (CVE-2026-35369) - CVE-2026-35369 rust-coreutils: kill: system-wide process termination and denial of service via argument misinterpretation
Summary: CVE-2026-35369 rust-coreutils: kill: system-wide process termination and deni...
Keywords:
Status: NEW
Alias: CVE-2026-35369
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2461644 2461645
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-22 17:02 UTC by OSIDB Bzimport
Modified: 2026-04-24 19:13 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-22 17:02:54 UTC
An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.


Note You need to log in before you can comment on or make changes to this bug.