https://seclists.org/oss-sec/2026/q3/958: CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction

Published Sep 26, 2026

Updated

Affected Software

1 affected component

GNU InetUtils>=1.9

Frequently Asked Questions

Which Inetutils components use the affected function?

The function is used by rlogin, rlogind, and telnetd. Systems using any of these components should assess whether they include the vulnerable libinetutils code.

Is code execution confirmed, or is the impact limited to denial of service?

Code execution is not confirmed. The reported observation was telnetd crashing, which could cause denial of service; code execution was identified as a concern on platforms using the SA_RESTORER sa_flags bit and the sa_restorer member of struct sigaction.

What patch information is available?

A patch is available as commit f756321da9b964fc27fc43652b73913117883047.patch from the Inetutils Codeberg repository. The advisory states that it applies cleanly to an inetutils-2.8 tarball.

https://seclists.org/oss-sec/2026/q3/958: CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction

Affected Software

Frequently Asked Questions

Which Inetutils components use the affected function?

Is code execution confirmed, or is the impact limited to denial of service?

What patch information is available?

Company

Resources

Contact

Frequently Asked Questions

Which Inetutils components use the affected function?

Is code execution confirmed, or is the impact limited to denial of service?

What patch information is available?