CVE-2026-89092

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.

Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.

There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.

Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.(CVE-2026-89092)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.

Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.

There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.

Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.(CVE-2026-89092)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.

Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.

There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.

Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.(CVE-2026-89092)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.

Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.

There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.

Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.(CVE-2026-89092)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)

• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)

• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)
• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)
• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)
• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system.

Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated.

There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash.

Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
• CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
• CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).