In the package base of the Ubuntu 26.10 distribution, scheduled for release on October 15, there has been a complete transition to the uutils coreutils (Rust Coreutils) toolkit, written in Rust. The utilities from Rust Coreutils have fully replaced all components of the GNU Coreutils package, including the cp, mv, and rm utilities, which were supplied in Ubuntu 26.04 from GNU Coreutils.
The rust-coreutils package was initially included by default in the Ubuntu 25.10 release, but was reverted to supply the cp, mv, and rm utilities from the GNU Coreutils set in the LTS branch of Ubuntu 26.04. The cp, mv, and rm variants were restored due to security issues identified during the audit of the Rust Coreutils codebase. Most vulnerabilities in Rust Coreutils stem from a race condition that allows data to be changed after validating the information but before performing operations on it (TOCTOU — Time-Of-Check-To-Time-Of-Use). Among other things, such vulnerabilities allow for a file to be substituted with a symbolic link in the time between the completion of the check and the start of the operation.
In the context of using the cp, mv, and rm utilities in system scripts running with root privileges, substituting a symbolic link enables the copying, overwriting, or deletion of arbitrary files. For instance, during recursive directory deletions, the rm utility first checked all directories and then removed them sequentially in reverse order by calling the rmdir() function. If the parent directory is substituted with a symbolic link immediately after checking this directory but before checking the nested child directories, it could lead to the deletion of any directory in the system during the daily execution of the script /etc/cron.daily/apport, which, running with root privileges, recursively deletes the contents of the /var/crash directory, writable by all users in the system.
Source: opennet.ru
