CVE-2026-35358

The cp utility in uutils coreutils contains a vulnerability in its recursive copy functionality (-R flag) that incorrectly processes character and block device nodes as regular files rather than preserving them with proper device semantics. When copying devices like /dev/null, the utility creates regular files instead of recreating the device nodes at the destination, potentially corrupting system functionality. This flaw affects uutils coreutils and could impact systems relying on this implementation as a replacement for GNU coreutils. The vulnerability is classified as MEDIUM severity with a CVSS score of 4.4, reflecting local attack vector requirements, low complexity exploitation, and low privilege escalation. The primary impact manifests as integrity and availability issues, with potential for denial of service through disk exhaustion when unbounded device nodes are read into regular files, or process hangs when applications attempt to interact with the incorrectly-created device files. Currently, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation in the wild. The EPSS score of 0.00012 indicates minimal likelihood of exploitation compared to the broader CVE landscape. Community attention appears limited, with no publicly available exploit code, suggesting this remains a low-priority remediation issue despite the technical nature of the flaw.