CVE-2026-35368

HighCVSS 7.8/10Last modified Oct 26, 2026

Description

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigger the Name Service Switch (NSS) to load shared libraries (e.g., libnss_*.so.2) from the new root directory. If the NEWROOT is writable by an attacker, they can inject a malicious NSS module to execute arbitrary code as root, facilitating a full container escape or privilege escalation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

VendorProductVersions
Uutilscoreutils—

References

Timeline

Published
Apr 22, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-353695.5An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SICVE-2026-35378.8Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap CVE-2026-353704.4The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of theCVE-2026-353713.3The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The CVE-2026-353725.0A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference CVE-2026-353735.5A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when usingCVE-2026-353746.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data CVE-2026-353753.3A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffCVE-2026-353765.8A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The impleCVE-2026-353773.3A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (splitCVE-2026-353783.3A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rCVE-2026-353793.3A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes.
CVE-2026-35368: High severity, CVSS 7.8 | Vulnix