In the upcoming release of Ubuntu 26.10 on October 15, a significant transition has been completed in the package base. The distribution now fully incorporates the uutils coreutils toolkit, written in Rust, replacing all components of the GNU Coreutils package that were previously used. This includes popular utilities like cp, mv, and rm which were supplied in the GNU Coreutils version in Ubuntu 26.04. The switch to uutils coreutils brings a modern and more secure alternative to the traditional GNU Coreutils suite. More information on this transition can be found here.
The rust-coreutils package was initially enabled by default in Ubuntu 25.10, but in the LTS branch of Ubuntu 26.04, a decision was made to revert to using the cp, mv, and rm utilities from the GNU Coreutils suite. This rollback was prompted by security concerns identified during an audit of the Rust Coreutils codebase. Vulnerabilities were discovered in Rust Coreutils, primarily due to a race condition that allowed for data manipulation between checks and operations (TOCTOU – Time-Of-Check-To-Time-Of-Use). By exploiting these vulnerabilities, attackers could replace files with symbolic links, potentially causing harm.
In practical terms, the security implications of this issue become apparent when considering system scripts that run with root privileges. Symbolic link substitution could enable unauthorized copying, overwriting, or deletion of files. For instance, a scenario could arise where a cron script, such as /etc/cron.daily/apport, recursively deletes the contents of a directory like /var/crash. By strategically replacing directories with symbolic links at crucial junctures, malicious actors could manipulate these operations to gain unauthorized access. The implications of such vulnerabilities underscore the importance of robust security measures when handling system utilities.