CVE-2026-35368 is a vulnerability in the chroot utility of uutils coreutils (versions up to 0.8.0) when using the --userspec option. The issue arises because the utility resolves user specifications via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this triggers the Name Service Switch (NSS) to load shared libraries from the new root directory. If the new root directory is writable by an attacker, they can inject a malicious NSS module, leading to arbitrary code execution as root. This can enable full container escape or privilege escalation.