A logic error in ln lets it dereference a symbolic-link target even when --no-dereference/-n is explicitly given — the no-dereference intent was only honored when --force was also enabled. ln then follows a symlink pointing to a directory and creates links inside that target directory instead of operating on the symlink itself.
Zellic private finding (zellic-ext/coreutils-private PR #114). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
A logic error in
lnlets it dereference a symbolic-link target even when--no-dereference/-nis explicitly given — the no-dereference intent was only honored when--forcewas also enabled.lnthen follows a symlink pointing to a directory and creates links inside that target directory instead of operating on the symlink itself.Zellic private finding (zellic-ext/coreutils-private PR #114). Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit
3a07ffc5a9bd4c283e75afa548ba1f1957bad242.