Bugs Rust Won't Catch: 44 uutils CVEs Hit Ubuntu 26.04

Canonical disclosed 44 CVEs in uutils coreutils for Ubuntu 26.04 LTS. Bugs Rust won't catch exposed logic flaws like symlink races. Trail of Bits audit uncovered them before the April 15, 2026 release.

Ubuntu 26.04 ships uutils 25.10 for ls, cat, and install. Canonical kept GNU versions for cp, mv, and rm due to unresolved issues.

uutils CVEs Expose Rust Safety Model Gaps

Rust's borrow checker blocks memory bugs like overflows. The 44 CVEs target logic errors, including permission mishandling and time-of-check-to-use races.

CVE-2026-35355 in install.rs mishandles Permissions::from_mode(0o700). Attackers gain privilege escalation during installs on Ubuntu PCs, per Canonical's USN-2026-001.

CVE-2026-35363 flaws rm commands like "rm ..". It ignores OpenOptions::create_new rules, as Rust docs detail.

Jon Seager, Canonical VP of Engineering, said in the notice: "Audit ensures uutils maturity."

PC gamers risk Steam library deletions. Blender workstations face data loss from faulty rm.

Ubuntu 26.04 Defaults Challenge PC Reliability

uutils reimplements GNU coreutils in Rust for memory safety. Ubuntu 26.04 uses version 25.10 for most tools.

Trail of Bits report, cited in USN-2026-001 dated April 15, 2026, lists all 44 CVEs. Patches appear on uutils GitHub.

Phoronix tests by Michael Larabel on Ryzen 9 9950X show uutils ls 12% slower than GNU. cp lags 10-15%, delaying game asset copies.

Logic bugs evade Rust. PC admins doubt Ubuntu for NVMe RAID in workstations.

Rust Prioritizes Memory Over Logic Security

Rust prevents data races and use-after-free errors. uutils CVEs slip through, per Corrode.dev analysis.

CVE-2026-35355 enables escalation on desktops. RTX 5090 gamers and Threadripper pros need stable tools.

AI servers with NVIDIA GPUs depend on reliable coreutils. Bugs halt NVMe writes.

GNU C coreutils add ASLR hardening. Canonical weighs Rust gains against risks.

Performance Tradeoffs in uutils for PCs

• Tool: ls, cat · Language: Rust · Ubuntu 26.04 Default: Yes (25.10) · CVEs: 44
• Tool: cp, mv, rm · Language: C (GNU) · Ubuntu 26.04 Default: Yes · CVEs: Hardened

Phoronix confirms Rust overhead on Ryzen. uutils fits servers but slows PC tasks.

Rust drives Linux kernel and Firefox. uutils matches early GNU CVE rates.

PC Builders Face Canonical Strategy Shifts

Layered audits address bugs Rust won't catch. Enthusiasts test uutils on custom rigs.

Ubuntu powers Steam Proton gaming and VS Code dev. Disclosure hits Ubuntu Pro subs at $25/machine yearly, Canonical's revenue driver.

Hybrid Rust-C setup stabilizes high-end PCs. Future audits fix logic gaps.

Track updates at Canonical security notices. PC hardware demands reliable software. Ubuntu 26.04 users patch the 44 CVEs now. Rust advances, but audits build trust.