https://seclists.org/oss-sec/2026/q3/958: CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction
Published Sep 26, 2026
·Updated
Affected Software
1 affected component
GNU InetUtils>=1.9
Frequently Asked Questions
1
Which Inetutils components use the affected function?
The function is used by rlogin, rlogind, and telnetd. Systems using any of these components should assess whether they include the vulnerable libinetutils code.
2
Is code execution confirmed, or is the impact limited to denial of service?
Code execution is not confirmed. The reported observation was telnetd crashing, which could cause denial of service; code execution was identified as a concern on platforms using the SA_RESTORER sa_flags bit and the sa_restorer member of struct sigaction.
3
What patch information is available?
A patch is available as commit f756321da9b964fc27fc43652b73913117883047.patch from the Inetutils Codeberg repository. The advisory states that it applies cleanly to an inetutils-2.8 tarball.