CVE-2026-35369

MediumCVSS 5.5/10Last modified Oct 25, 2026

Description

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Uutilscoreutils< 0.6.0

References

Timeline

Published
Apr 22, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-35378.8Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap CVE-2026-353704.4The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of theCVE-2026-353713.3The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The CVE-2026-353725.0A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference CVE-2026-353735.5A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when usingCVE-2026-353746.3A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data CVE-2026-353753.3A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffCVE-2026-353765.8A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The impleCVE-2026-353773.3A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (splitCVE-2026-353783.3A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressions during the parsing phase rCVE-2026-353793.3A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and [:print:] character classes. CVE-2026-35388.8Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory acce
CVE-2026-35369: Medium severity, CVSS 5.5 | Vulnix