Ubuntu fixes local flaws in uutils coreutils mkfifo, dd and tail
Original title: USN-9041-1: uutils coreutils vulnerabilities
mkfifo can reset permissions on an existing file, and dd can hide truncation errors that corrupt data.
Ubuntu security notice USN-9041-1 covers local flaws in uutils coreutils. mkfifo kept processing when a target file already existed and applied default permissions to it, which a local attacker could use to read sensitive data or change permissions (CVE-2026-35341). dd suppressed errors during truncation, which could cause silent data corruption (CVE-2026-35344). tail followed symbolic links with --follow=name; the notice is cut off before the full impact and any CVE id.
Unconfirmed: The tail issue is cut off, so its CVE id and full impact are not shown, and exploitation is not stated.
- CVE-2026-35341 affects uutils coreutils mkfifo when the target file already exists.
- CVE-2026-35344 lets dd hide errors during file truncation.
- The tail issue involves --follow=name following symbolic links; details are truncated.
- No fixed package versions or exploitation status appear in the notice text.
Impact: Local permission changes, data exposure, or silent corruption
| Product | Affected |
|---|---|
| Ubuntu uutils coreutils | — |
- 1.Install the Ubuntu security updates for uutils coreutils.
- Vendors
- Ubuntu
- Products
- uutils coreutils
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-35341+1 related CVE | A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files | 7.1 group max | <1% | PoC |
From the original article
It was discovered that uutils coreutils mkfifo incorrectly continued processing when a target file already existed, applying default permissions to the existing file. A local attacker could possibly use this issue to obtain sensitive information or modify file permissions unexpectedly. (CVE-2026-35341) It was discovered that uutils coreutils dd incorrectly suppressed errors during file truncation operations.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.