This vulnerability in uutils coreutils' chmod utility arises from improper limitation of a pathname to a restricted directory (CWE-22). The --preserve-root option is intended to prevent destructive recursive operations on the root filesystem by checking if the target path is '/'. However, the check does not canonicalize the path, allowing bypass via path variants like '/../' or symbolic links. Exploiting this can lead to recursive permission changes (e.g., chmod -R 000) on the root filesystem, resulting in loss of file permissions and possible complete system failure. The CVSS 3.1 score is 7.3 (high), reflecting local attack vector with low complexity, requiring low privileges but user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation can cause system-wide permission loss by recursively changing permissions on the root filesystem. This can lead to denial of service or complete system breakdown due to inaccessible or improperly permissioned files. The vulnerability affects local users with some privileges and requires user interaction to trigger the destructive operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using the vulnerable chmod utility with recursive operations on paths that could be manipulated via symbolic links or path traversal. Consider using alternative tools or additional manual checks to ensure the target path is canonicalized before recursive permission changes. Monitor vendor channels for official patches or updates.