CVE-2026-35349
The --preserve-root check uses a path-string test (path.has_root() && path.parent().is_none()) rather than comparing device/inode. A symlink to / (e.g. /tmp/rootlink -> /) has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it.
Impact: rm -rf --preserve-root on a path that resolves through a symlink to / bypasses protection and can delete system directories. Recommendation: compare each entered directory's dev/inode against cached /.
Remediation: Acknowledged by Canonical; fixed in commit 5e5968cd.
_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.44. Credit: Zellic._
⚡ Watch CVE-2026-35349
Get an email if CVE-2026-35349 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-35349)