mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)
When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a `etc_link -> /etc` inside the source becomes a full copy of `/etc` at the destination. **Impact:** (1) resource exhaustion — a small tree can expand into a huge copy (time/disk DoS); (2) unintended duplication of sensitive paths referenced by symlink; (3) symlink-loop amplification causing deep recursion. Recommendation: in cross-device fallback, detect symlinks via `symlink_metadata()` and recreate with `read_link()`/`symlink()`; add loop detection. **Remediation:** Acknowledged by Canonical; fixed in commit 9654e4ab. --- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.63. Credit: Zellic._
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-35365US | — | — | ||
The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the imple… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/uutils/coreutilsPACKAGE
- https://github.com/uutils/coreutils/commit/9654e4abaf24449ef2279e9a16963edb5c8b8fefWEB
- https://github.com/uutils/coreutils/pull/10546WEB
- https://github.com/uutils/coreutils/releases/tag/0.7.0WEB
- https://github.com/uutils/coreutils/security/advisories/GHSA-h444-6j9x-p8vhWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-35365ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan