Assertion failure in the DNS stub resolver with a long search domain

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid (ATSECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protectedhardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DTRPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protectedhardlinks enabled by default and mitigate the vulnerability.

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (ATSECURE) programs.

When such a program's DTRPATH or DTRUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

The following security advisories have been published:

GLIBC-SA-2026-0022: =================== ATSECURE programs may load attacker-controlled code via $ORIGIN

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid (ATSECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protectedhardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DTRPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protectedhardlinks enabled by default and mitigate the vulnerability.

CVE-Id: CVE-2026-86805 Public-Date: 2026-07-06 Vulnerable-Commit: 47c3cd7a74e8c089d60d603afce6d9cf661178d6 (2.13-113) Fix-Commit: ed0c137b97eb940b4b64981e84ed806d3276edd9 (2.45) Reported-by: Jann Horn <jannh () google com> CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L - 6.3

GLIBC-SA-2026-0023: =================== ATSECURE program buffer overflow via $ORIGIN processing

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (ATSECURE) programs.

When such a program's DTRPATH or DTRUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

CVE Id: CVE-2026-95818 Public-Date: 2026-08-14 Vulnerable-Commit: 47c3cd7a74e8c089d60d603afce6d9cf661178d6 (2.13-113) Fix-Commit: ed0c137b97eb940b4b64981e84ed806d3276edd9 (2.45) Reported-by: AISLE in partnership with Red Hat CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - 3.6

The following security advisories have been published:

GLIBC-SA-2026-0021: =================== Assertion failure in the DNS stub resolver with a long search domain

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.

The resolver truncates the search list when copying it into the fixed-size res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.

CVE-Id: CVE-2026-8674 Public-Date: 2023-11-07 Vulnerable-Commit: 3f853f22c87f0b671c0366eb290919719fa56c0e (2.26) Fix-Commit: 506ea57086bfb9ce3daff1c14246a1cb532aba0a (2.45) Reported-by: Joshua Rogers - joshua () joshua hu CVSS: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 5.3

The following security advisories have been published:

GLIBC-SA-2026-0017: =================== Buffer overflow in strfmon and strfmonl right-justification padding

Calling strfmon and strfmonl in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.

Exploitation requires an application code path that calls strfmon or strfmonl with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.

At the time of publication, no network-facing application impact is known.

CVE-Id: CVE-2026-19499 CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H - 7.7 Public-Date: 2026-08-11 Vulnerable-Commit: e88b9f0e5cc50cab57a299dc7efe1a4eb385161d (2.38) Fix-Commit: b090cf226ff65b913e41536f1f573f500855615c (2.45) Reported-by: AISLE in partnership with Red Hat

GLIBC-SA-2026-0018: =================== Stack-based out-of-bounds write in tdelete during tree rebalancing

Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.

The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.

CVE-Id: CVE-2026-19542 Public-Date: 2026-08-11 Vulnerable-Commit: 993b3242cdc37152fbbc7fbd5ce22b2734b04b23 (1.93-194) Fix-Commit: e2789c46e3bfdcd67a82bea9946b315c179e83d3 (2.45) Fix-Commit: d6ff274313d79feb864cc10eb775b91c817a67e9 (2.44-26) Fix-Commit: 0afa34adb0fd9d756d1fe745064272e9b9aadbdc (2.43-51) Fix-Commit: 2ea357280d82dab462851419a2338d940516a37e (2.42-85) Fix-Commit: 9318c2571576017d280a31b7b9ab576c9b696b1a (2.41-154) Reported-by: AISLE in partnership with Red Hat CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - 5.6

GLIBC-SA-2026-0019: =================== SHIFTJISX0213 decoding may hang on crafted input

Converting crafted SHIFTJISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.

Some SHIFTJISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFTJISX0213 character set is affected, which is not commonly used. The related defect in the EUCJISX0213 converter is tracked separately as CVE-2026-80489.

CVE-Id: CVE-2026-77117 Public-Date: 2026-08-21 Vulnerable-Commit: 93a568aaba1d3da3497102dfe1eeb81070a24c1c (2.2.4-823) Fix-Commit: 68d94bbe50b7577d48998107d632ef3a0df050e3 (2.45) Fix-Commit: 6f9b2bfa500bf5d1cff5d990adfff4b71298dadd (2.44-30) Fix-Commit: 138c43f0180945b014e284a87b332d4d8237f537 (2.43-55) Fix-Commit: 67db60ee152d221782d2ae915268871d3e06a007 (2.42-88) Fix-Commit: e43e46f94398b3de446fec11da1e7633ea5202ec (2.41-157) CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 5.9 Reported-by: AISLE in partnership with Red Hat

GLIBC-SA-2026-0020: =================== EUCJISX0213 decoding may hang on crafted input

Converting crafted EUCJISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.

Some EUCJISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUCJISX0213 character set is affected, which is not commonly used. The related defect in SHIFTJISX0213 converter is tracked separately as CVE-2026-77117.

CVE-Id: CVE-2026-80489 Public-Date: 2026-08-26 Vulnerable-Commit: 93a568aaba1d3da3497102dfe1eeb81070a24c1c (2.2.4-823) Fix-Commit: 4dafa087ff5fe7df45bd37dc727e988da6b8c935 (2.45) Fix-Commit: cb61572ea3f773e1e1978f6c412cc36a30acdb0c (2.44-31) Fix-Commit: 3ad1bbd8f94a207efb108a38d434695eab8a1831 (2.43-56) Fix-Commit: 87c2795cf6a7584e351036ab43e74b03ccc54a83 (2.42-89) Fix-Commit: ec116a0fbedcc860631e525e70b409cf295f27da (2.41-158) CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 5.9 Reported-by: AISLE in partnership with Red Hat

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.

This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

The deprecated functions nsprintrrf, nsprintrr and fpnquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.

These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.

Hello,

The following security advisory has been published:

GLIBC-SA-2026-0015: ===================

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.

This usage pattern is not seen in applications in common GNU or Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation.

CVE-Id: CVE-2026-18374 Public-Date: 2026-08-27 Vulnerable-Commit: 129d706d77587e4d6627cc1ebef9be0f7cbc65f0 Reported-by: AISLE in partnership with Red Hat CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - 4.9

Notes: ======

Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

The "Security related changes" section below lists fixes for CVE-2026-4046, CVE-2026-4437, & CVE-2026-4438.

-------- Forwarded Message -------- Subject: The GNU C Library version 2.44 is now available Date: Sat, 25 Jul 2026 18:49:56 +0900 From: Andreas K. Huettel <dilfridge () gentoo org> Organization: Gentoo Linux To: libc-alpha () sourceware org, libc-announce () sourceware org, info-gnu () gnu org

The GNU C Library =================

The GNU C Library version 2.44 is now available.

The GNU C Library is used as the C library in the GNU system and in GNU/Linux systems, as well as many other systems that use Linux as the kernel.

The GNU C Library is primarily designed to be a portable and high performance C library. It follows all relevant standards including ISO C23 and POSIX.1-2024. It is also internationalized and has one of the most complete internationalization interfaces known. The GNU C Library website is at http://www.gnu.org/software/libc/

Packages for the 2.44 release may be downloaded from: http://ftpmirror.gnu.org/libc/ http://ftp.gnu.org/gnu/libc/

The mirror list is at http://www.gnu.org/order/ftp.html

Distributions are encouraged to track the release/ branches corresponding to the releases they are using. The release branches will be updated with conservative bug fixes and new features while retaining backwards compatibility.

NEWS for version 2.44 =====================

Major new features:

System-wide tunables can be applied using /etc/tunables.conf and running ldconfig. Specific tunable settings and the /etc/tunables.conf file format and path are not part of the stable library interfaces and may change between releases.

A new tunable, glibc.elf.thp, is added to map read-only segments with Transparent Huge Pages (THP) if THP is not disabled in the kernel. When glibc.elf.thp is set to 1, malloc uses the actual kernel THP mode instead of defaulting to madvise mode and madvisethp will stop issuing MADVHUGEPAGE if kernel THP mode is always.

The THP page size in malloc is capped to MAXTHPPAGESIZE. If the THP page size is above MAXTHPPAGESIZE, THP in malloc is disabled.

Additional optimized and correctly rounded mathematical functions have been imported from the CORE-MATH project, in particular cosh, sinh, and tanh.

Many additional improvements to existing functions have been synchronized from the CORE-MATH project.

For C++26, the assert macro is now variadic, allowing more complex arguments containing commas (which however still must evaluate to a single value).

The SVID error handling for cosh and sinh was moved to compatibility symbols, allowing improvements in performance.

Static PIE is now supported for arm--linux-gnueabi. It requires toolchain support to correctly set the expected linker options.

On AArch64 targets that support the Guarded Control Stack extension all GCS operations (including status, write on shadow stack, and push to shadow stack) are locked after enabling GCS with ENFORCED or OVERRIDE GCS policy. When a GCS operation is locked, a program cannot change this operation status via the prctl syscall. This prevents disabling or corrupting the GCS shadow stack during runtime.

On AArch64 targets, log, exp, sin, cas, sinh, cosh, asinh, acosh, atanh single and double precision special cases have been vectorized for SVE and AdvSIMD, and vector variants of powr have been added.

On RISC-V targets, vector extension optimized variants of memcmp, memccpy, memchr, memcpy, memmove, stpncpy, strcmp, strchr, strcpy, strncmp, strncpy, strlen, and strrchr have been added.

On PowerPC, memchr optimized for Power10 has been re-added.

Support for LoongArch32 has been added.

Pre-built ld.so.cache files can be installed with ldconfig.

A new locale has been added: hrxBR (Hunsrik language spoken in Brazil).

Deprecated and removed features, and other changes affecting compatibility:

Although malloc and related functions currently return pointers aligned to alignof (maxalignt), the documentation now says future versions of glibc may relax alignment requirements for small allocations. For example, a future malloc(1) might return a pointer with odd alignment, because no object of size 1 can have a fundamental alignment greater than 1.

The s390-linux-gnu (31bit) configuration is no longer supported.

The --enable-memory-tagging configure option has been removed. The corresponding AArch64-specific functionality that was previously activated by this flag has been removed as well.

The --enable-static-nss configure option has been removed. It had no effect on the build since the NSS reorganization in glibc 2.33; its only remaining behavior was to suppress the link-time warnings on the NSS interface functions in libc.a, which are now emitted unconditionally.

Security related changes:

The following CVEs were fixed in this release, details of which can be found in the advisories directory of the release tarball:

GLIBC-SA-2026-0005: gethostbyaddr and gethostbyaddrr may incorrectly handle DNS response (CVE-2026-4437)

GLIBC-SA-2026-0006: gethostbyaddr and gethostbyaddrr return invalid DNS hostnames (CVE-2026-4438)

GLIBC-SA-2026-0007: iconv crash due to assertion failure with untrusted input (CVE-2026-4046)

The following bugs were resolved with this release:

[2363] libc: EOPNOTSUPP and ENOTSUP in errno.h must be different, according to SUSv3 [3794] manual: iconv: //TRANSLIT and //IGNORE feature not documented [15792] dynamic-link: [arm] ARM dynamic linker should save/restore coprocessor registers [20331] libc: fts ignores errors from readdir() [20680] dynamic-link: ifunc resolver cannot access the thread pointer with static linking [22944] libc: fts cannot traverse paths which have a length longer than USHRTMAX [25257] libc: sotruss: fix error message for '--f' argument [25770] locale: newlocale memory leak in LOCPATH parsing and on error paths [27582] libc: x8664: IFUNC in static user programs may crash when built with -fstack-protector-all [28218] dynamic-link: ld.so: ifunc resolver calls a lazy PLT. When does it work? [28817] libc: static-pie ifunc resolver tls failure [28940] nss: nssdatabaseget doesn't check for allocation failure [30136] manual: Please document behaviour of iconv(3) when input is untranslatable [30304] nptl: nptl/tst-pthread-gdb-attach test fails with new libc shared library version [30769] malloc: malloctrim is not working correctly for arenas other than arena 0 [30976] dynamic-link: rtld: resolve ifunc relocations after JUMPSLOT/GLOBDAT/etc [30992] libc: alpha: setrlimit() with negative values besides RLIMINFINITY returns EPERM [31901] libc: elf/tst-glibc-hwcaps-prepend-cache fails on i686 [33226] math: math-vector-fortran.h vs not ffast-math [33626] libc: execvpe should skip inaccessible $PATH components [33650] build: abilist.awk doesn't handle unversioned defined symbols [33785] stdio: New streams are linked into global list before they are fully initialized [33848] build: Build fails at openat2.h, redefinition of 'struct openhow' [33882] libc: Recursion in nftw() causes stack overflow(CWE-674) [33904] build: error: 'vasprintfchk' undeclared here [33921] build: Building with Linux-7.0-rc1 errors on OPENTREECLONE [33935] stdio: IOwfiledoallocate not linked correctly when linking glibc statically [33980] locale: iconv: ibm139x trigger assertion error when converting to internal while lack enough room (CVE-2026-4046) [33985] build: ld: cannot find -lgccs: No such file or directory [33999] stdio: libio: potential dangling IOsavebase or memory leak in wgenops.c [34006] stdio: libio: inconsistent fmemopenwrite behavior on last \0 [34008] stdio: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 [34014] nss: gethostbyaddr and gethostbyaddrr may incorrectly handle DNS response [34015] nss: gethostbyaddr and gethostbyaddrr return invalid DNS hostnames [34019] stdio: libio: undefined behavior when setbuf on openmemstream [34033] network: resolv/nsprint.c: nssprintrrf TSIG path bypasses buflen and can overflow caller buffer [34064] dynamic-link: The unnecessary PTNOTE check in when loading a binary [34069] network: Buffer overread in nssprintrrf with corrupted RDATA field (CVE-2026-6238) [34070] hurd: Calling open ("/dev/tty/", ORDONLY) causes the program to segfault [34073] regex: regexec can mistakenly match with backrefs and the $ anchor [34079] dynamic-link: THP segment load aligns all PTLOAD segments to THP page size [34080] dynamic-link: Support THP segment load with THP enabled with madvise [34083] dynamic-link: getthpmode and getthpsize are called twice [34090] libc: wordexp WRDEAPPEND rollback restores stale wewordv, leading to invalid free in wordfree [34098] libc: Missing SUPPORTSTATICPIE in arm32 [34129] string: x86: Non-temporal memset unreachable on AMD Zen 3/4/5 [34144] libc: ld.so clobbers VFP registers during runtime linking [34154] network: Segfault in sockeq after resinit() returns -1, due to stale u.ext.nscount in resiclose [34156] dynamic-link: dlsym(RTLDDEFAULT, ...) from a constructor SIGSEGVs when tail-called [34164] dynamic-link: elf: IFUNC resolvers do not see static TLS initialization [34170] dynamic-link: elf: IFUNC resolver reading global- dynamic/TLSDESC thread variable crashes inside tlsgetaddr [34183] math: fma produces wrong results [34192] nptl: pthreadsetnamenp opens /proc/<tid>/comm with ORDWR instead of OWRONLY|OCLOEXEC [34196] libc: elf: static dlopen: pointer guard of the loaded ld.so/libc.so is left uninitialized [34197] dynamic-link: elf: Stack canary and pointer guard are recoverable from ATRANDOM (getauxval) [34205] libc: aarch64: SIGSEGV in tunablestrcmp in static-pie binaries run with a string tunable [34208] stdio: scanf not pushback after matching failure [34210] libc: elf/tst-glibc-hwcaps-prepend-cache fails on armv7a-unknown-linux-gnueabihf [34236] locale: Non-representable transliteration still causes iconv to exit with 1 if //TRANSLIT is specified [34289] network: nssprintrrf uses pclass, ptype internally [34311] build: THP tests failed to link [34347] libc: Incorrect trailing bitfield word of struct tcpinfo [34348] dynamic-link: FAIL: elf/tst-thp-1 if THP is disabled in kernel [34351] build: Random test failures [34355] build: [2.44 Regression] "make check -j7 subdirs=stdio-common" no longer works [34396] libc: sparc64-unknown-linux-gnu , Gentoo: >200 test failures, SIGILL in many binaries [34398] string: Truncated strncpy on s390x z900 ifunc variant

Release Notes =============

https://sourceware.org/glibc/wiki/Release/2.44

Contributors ============

This release was made possible by the contributions of many people. The maintainers are grateful to everyone who has contributed changes or bug reports. These include:

Adam Yi Adhemerval Zanella Alejandro Colomar Andreas K. Hüttel Andreas Schwab Arjun Shankar Aurelien Jarno Avinal Kumar Brian Jorgensen Carlos O'Donell Carlos Peón Costa Charlotte Mcmenamin Collin Funk Cosmina Dunca DJ Delorie Daan De Meyer Deng Jianbo Dev Jain Diego Nieto Cid Dmitry Kovalenko Dylan Fleming Etienne Brateau Fabian Rast Florian Weimer Frédéric Bérat Garccez George Hu H.J. Lu Jakub Jelinek Jiamei Xie Jiho Lee Jiri Stransky John David Anglin Jonathan Wakely Josef Johansson Joseph Myers Justus Winter Luca Boccassi Lucas Chollet Martin Coufal Matt Turner Michael Ford Michael Jeanson Michael Kelly Mike FABIAN Mike Kelly Muhammad Kamran Nicolas Boulenguez Paul Eggert Peter Bergner Peter Collingbourne Petr Menšík Pierre Blanchard Pino Toscano Pádraig Brady Richard Wild Rocket Ma RyotaSaito Sachin Monga Sajan Karumanchi Sam James Samuel Balazi Samuel Thibault Sana Kazi Sergey Kolosov Shamil Abdulaev Shengwen Cheng Siddhesh Poyarekar Stefan Liebler Thomas Daubney Tomasz Kamiński Uros Bizjak WANG Rui Weihong Ye Weixie Cui Wilco Dijkstra Xi Ruoyao Xiang Gao Yao Zihong Yunze Zhu Yury Khrustalev Zihong Yao mengqinggang xiejiamei zombie12138

We would like to call out the following and thank them for their tireless patch review:

Adhemerval Zanella Andreas K. Hüttel Arjun Shankar Aurelien Jarno caiyinyu Carlos O'Donell Collin Funk DJ Delorie Florian Weimer Frédéric Bérat Ganesh Gopalasubramanian H.J. Lu JiangNing Mathieu Desnoyers Paul Eggert Paul Zimmermann Peter Bergner Sam James Samuel Thibault Siddhesh Poyarekar Stefan Liebler Sunil K Pandey Wilco Dijkstra Yury Khrustalev

-- PD Dr. Andreas K. Hüttel dilfridge () gentoo org Gentoo Linux developer (council, comrel, toolchain, base-system, perl, libreoffice) https://wiki.gentoo.org/wiki/User:Dilfridge

Hello,

The following security advisory has been published:

GLIBC-SA-2026-0007: ===================

iconv crash due to assertion failure with untrusted input

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

Notes: ======

Published advisories are available directly in the project git repository: https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD