5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35369

CVE-2026-35369: kill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS)

kill -1 is incorrectly parsed as a positional pid = -1; combined with the default SIGTERM this calls kill(-1, SIGTERM), signaling nearly every process the caller can see. GNU kill recognizes -1/-9 as signals and reports "not enough arguments".

$ kill -1        # uutils: kill(-1, SIGTERM) -> mass termination / crash
$ kill -1        # GNU: kill: not enough arguments

Impact: a user running kill -1 mass-terminates processes, potentially crashing the system. Recommendation: parse -N as a signal number, and error with "not enough arguments" when no PID is given.

Remediation: Acknowledged by Canonical; fixed in commit cae94028.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.70. Credit: Zellic.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35369

CVE-2026-35369:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
uu_kill	rust	< 0.6.0	0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the argument parsing logic of the kill utility in uutils/coreutils. Specifically, when a user runs kill -1, the argument -1 is intended to be a signal (SIGHUP). However, due to a flaw in the handle_obsolete function, it was not recognized as a signal. The check if args.len() > 2 prevented the signal parsing logic from running when only one argument was present.\n\nConsequently, the -1 argument was passed down to the main argument parser, which, due to the allow_negative_numbers(true) setting, interpreted it as a process ID (PID) of -1. The uumain function then called the kill function with this PID and the default signal, SIGTERM. A kill call with a PID of -1 sends the signal to all processes in the current process group, effectively causing a system-wide denial of service for the user.\n\nThe patch corrects the boundary condition in handle_obsolete to if args.len() >= 2, ensuring that arguments like -1 are correctly parsed as signals. This prevents the incorrect interpretation as a PID and resolves the vulnerability.

Vulnerable functions

uu_kill::handle_obsolete

src/uu/kill/src/kill.rs

This function contains the core logic flaw. The original code checked `if args.len() > 2`, which skipped the logic for handling obsolete signal syntax when only one argument like `-1` was provided. This caused `-1` to be interpreted as a process ID (PID) instead of a signal. The fix changes the condition to `if args.len() >= 2`, ensuring that single arguments are correctly processed as signals.

uu_kill::uumain

src/uu/kill/src/kill.rs

This is the main entry point for the `kill` utility. It calls the vulnerable `handle_obsolete` function. When `handle_obsolete` fails to identify `-1` as a signal, `uumain` proceeds to parse it as a PID. It then calls the `kill` function with a PID of -1 and the default signal (SIGTERM), triggering the mass termination of processes.

uu_kill::kill

src/uu/kill/src/kill.rs

This function is responsible for making the underlying `kill` system call. In the vulnerable scenario, it receives a PID of -1 from the `uumain` function. Calling `kill` with a PID of -1 sends the specified signal to all processes that the user has permission to signal, leading to a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.