CVE-2026-35351 describes a vulnerability in the mv utility of uutils coreutils where file ownership is improperly preserved during moves across filesystem boundaries. The fallback copy-and-delete routine creates the destination file with the caller's UID/GID instead of retaining the source file's ownership metadata. This flaw affects backup and migration processes by altering file ownership unexpectedly, which may cause security and access control issues.

Files moved by privileged users (such as root) may become root-owned unexpectedly, breaking expected ownership semantics. This can lead to information disclosure if files become accessible to unintended users or restricted access if legitimate users lose ownership rights. The impact is limited to confidentiality, integrity, and availability at a low to medium level as indicated by the CVSS score of 4.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when moving files across filesystem boundaries using uutils coreutils mv, especially when running as a privileged user. Consider alternative tools that correctly preserve ownership or manually restore ownership metadata after moves.