This vulnerability in uutils coreutils' chmod utility arises from improper validation of the --preserve-root option. The utility only verifies if the target path is literally '/', failing to canonicalize paths before validation. Consequently, paths like '/../' or symbolic links can circumvent the safeguard, allowing recursive operations (e.g., chmod -R 000) on the entire root filesystem. This can lead to severe impacts including loss of file permissions system-wide and potential system breakdown. The CVSS 3.1 score is 7.3 (high), reflecting local attack vector with low complexity, requiring low privileges and user interaction, and resulting in high confidentiality, integrity, and availability impacts. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

Exploitation of this vulnerability can result in destructive recursive permission changes on the root filesystem, causing system-wide permission loss. This can lead to denial of service by making critical system files inaccessible or unusable, potentially resulting in complete system breakdown. The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the vulnerable chmod utility with recursive operations on root or root-like paths and exercise caution with symbolic links and path variants that may bypass --preserve-root protections.