The flaw exists in the rm command of uutils coreutils. The program verifies the presence of / when the user supplies the --preserve-root flag by inspecting the path string instead of checking the underlying device and inode numbers. If a symbolic link that points to / is supplied, the check passes and the command proceeds to remove files normally. An attacker or accidental user can trigger the dangerous behavior by providing such a link, causing rm to delete the entire root filesystem recursively.

The vulnerability affects the uutils coreutils package, specifically the rm utility in releases prior to v0.7.0. Any systems that rely on the uutils coreutils binary and have not applied the patch in the 0.7.0 release are potentially vulnerable.

The CVSS score of 6.7 indicates a moderate severity and the attack likely requires local execution with elevated privileges, as removing the root filesystem requires root or similar rights. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA's KEV catalogue, but its impact remains substantial because a single mistaken invocation can cause catastrophic data loss. Updating to a patched version negates the problem and removes the risk.