CVE-2026-35369

Description

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to the caller, potentially leading to a system crash or massive process termination. This differs from GNU coreutils, which correctly recognizes -1 as a signal number in this context and would instead report a missing PID argument.

PUBLISHED Reserved 2026-04-02 | Published 2026-04-22 | Updated 2026-04-22 | Assigner canonical

Problem types

CWE-20: Improper Input Validation

Product status

Credits

Zellic finder

References

github.com/uutils/coreutils/pull/9700 issue-tracking patch

github.com/uutils/coreutils/releases/tag/0.6.0 vendor-advisory

cve.org (CVE-2026-35369)

nvd.nist.gov (CVE-2026-35369)

Download JSON