rust-coreutils 0.10 is now available for Ubuntu 26.04 LTS. The update is being rolled out slowly in stages (“phased update”), currently to 10% of users.
To bypass the staged rollout and directly install the update, run
sudo apt install --update rust-coreutils
On a similar note, version 0.12 has just made its way to 26.10 in time for this week’s beta. We hope to keep backporting versions as the project keeps evolving.
Please let us know if you notice any new issues after upgrading.
Included security fixes relative to 0.8.0
This release fixes 15 CVEs. 9 CVEs in tools that are enabled by default, 6 in tools that are not enabled (cp, mv, rm)
Fixed in 0.9.0 (2026-05-30) — 7 CVEs
| CVE | Utility | Summary | Issue | Fix PR | Merge Commit |
|---|---|---|---|---|---|
| CVE-2026-35350 | cp | unexpected privileged executable creation with -p (setuid/setgid not stripped when chown fails) |
#9750 | #12135 | — |
| CVE-2026-35351 | mv | silent ownership loss in cross-device operations | #9714 | #11706 | — |
| CVE-2026-35357 | cp | information disclosure via permission handling race (creates dest with permissive mode, then tightens) | #10011 | #12135 | — |
| CVE-2026-35359 | cp | TOCTOU symlink swap bypasses no-dereference intent (opens source without O_NOFOLLOW) |
#10017 | #12135 | — |
| CVE-2026-35363 | rm | safeguard bypass via improper path normalization | #9749 | #11005 | — |
| CVE-2026-35367 | nohup | information disclosure via insecure default output permissions (non-0600 nohup.out) |
#10021 | #12339 | — |
| CVE-2026-35368 | chroot | local privilege escalation and chroot escape via NSS injection | #10327 | #11211 | — |
Note: CVE-2026-35350, 35357, and 35359 were all fixed in a single sweep PR #12135 (“cp: address the remaining toctou issues”), which addressed the three remaining
cpissues.
Fixed in 0.10.0 (2026-08-05) — 8 CVEs
| CVE | Utility | Summary | Issue | Fix PR | Merge Commit |
|---|---|---|---|---|---|
| CVE-2026-35344 | dd | silent data corruption via unconditional truncation error suppression (Result::ok() hid disk-full/read-only errors) |
#9745 | #12667 | 0f538b9 |
| CVE-2026-35345 | tail | privileged information disclosure via symlink replacement race (--follow=name followed symlinks swapped in after monitoring started) |
#10328 | #12661 | 2c2f1b0 |
| CVE-2026-35348 | sort | local DoS via forced UTF-8 parsing of non-UTF-8 filenames (--files0-from) |
#9696 | #11593 | — |
| CVE-2026-35360 | touch | arbitrary file truncation via TOCTOU race (stat-then-create with O_CREAT|O_TRUNC) |
#10019 | — | ca0c842 |
| CVE-2026-35364 | mv | arbitrary file overwrite via cross-device TOCTOU race condition | #10015 | #12468 | — |
| CVE-2026-35373 | ln | local DoS via improper handling of non-UTF-8 source names in target-dir mode | — | #11403 | — |
| CVE-2026-35374 | split | arbitrary file truncation via TOCTOU target swap | — | #12565 | — |
| CVE-2026-35377 | env | local DoS via improper handling of backslashes in -S/split-string mode |
— | #12657 | — |