The comm utility in uutils coreutils improperly handles input validation by reading data from both input paths before comparison without checking if the inputs are regular files. This causes the are_files_identical function to consume data from non-regular files such as FIFOs or pipes, resulting in silent data loss. Additionally, the utility may hang indefinitely when reading from infinite streams like /dev/zero due to this pre-read behavior. This vulnerability is categorized under CWE-20 (Improper Input Validation) and has a CVSS 3.1 base score of 4.4, indicating medium severity. No patch or official remediation has been documented as of the published date.

The vulnerability can cause silent data loss when comm is used with FIFO or pipe inputs because the utility drains the stream before comparison. It may also cause the utility to hang indefinitely when processing infinite streams such as /dev/zero. There is no direct confidentiality impact, but integrity and availability are affected due to data loss and potential hangs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the comm utility on non-regular files such as FIFOs, pipes, or infinite streams to prevent data loss or hangs.