CVE-2026-35347 describes an improper input validation vulnerability (CWE-20) in the comm utility of uutils coreutils. The are_files_identical function reads from both input paths to compare contents but does not check if the inputs are regular files. When inputs are FIFOs or pipes, the pre-read operation drains the stream, causing silent data loss before comparison. Additionally, reading from infinite streams such as /dev/zero can cause the utility to hang indefinitely. This behavior can disrupt normal operation but does not directly compromise confidentiality.

The vulnerability can cause silent data loss when comm is used with FIFO or pipe inputs, as the input streams are consumed prematurely. It can also cause the utility to hang indefinitely if used with infinite streams like /dev/zero. There is no indication of confidentiality or privilege impact. The overall impact is limited to integrity and availability disruptions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the comm utility with FIFO, pipe, or infinite stream inputs to prevent data loss or hangs.