CVE-2026-35358 describes a weakness in the uutils coreutils cp utility where recursive copies (-R) do not preserve device node semantics. Instead of recreating character and block device nodes with mknod at the destination, the utility reads their contents as regular files, destroying device semantics. This misuse can cause runtime denial of service conditions such as disk exhaustion or process hangs when programs interact with the improperly copied device files. The vulnerability is classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference).

The vulnerability does not impact confidentiality but can affect integrity and availability. Specifically, device nodes are converted into regular files, which can cause denial of service by exhausting disk space or causing processes to hang when reading from these files. There is no indication of known exploits in the wild. The CVSS score is 4.4 (medium severity), reflecting local attack vector with low privileges required and no user interaction.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid using the cp utility in uutils coreutils for recursive copying of device nodes or use alternative tools that correctly preserve device semantics.