CVE-2026-35370
MediumSummary
The 'id' utility in uutils coreutils miscalculates the 'groups=' section of its output. The implementation uses the user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils.
Risk Assessment
Scripts and automated processes relying on the correct behavior of the 'id' utility may receive incorrect group information, potentially causing errors in authorization, permission assignment, or other security-context-dependent operations.
Recommendation
It is recommended to update uutils coreutils to a version where this behavior is fixed, or temporarily use GNU coreutils for the 'id' utility in environments where correct group listing is critical.
Original NVD description (English source)
The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely