The vulnerability in uutils coreutils' rm utility (CVE-2026-35349) involves improper link resolution before file access (CWE-59). The --preserve-root option is intended to prevent recursive deletion of the root filesystem, but the implementation relies on checking the path string rather than comparing device and inode numbers. This allows a symbolic link that resolves to the root directory to bypass the protection, leading to potential unintended recursive deletion of the root filesystem. The vulnerability is local attack vector with high impact on integrity and availability, but requires high attack complexity and no privileges or user interaction.

An attacker or user can bypass the --preserve-root safeguard by using a symbolic link that points to the root directory, which may result in the recursive deletion of the entire root filesystem. This leads to high impact on system integrity and availability. There is no confidentiality impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the vulnerable version of uutils coreutils or refrain from using the rm utility with symbolic links that could point to the root directory. Monitor vendor channels for updates and apply patches once released.