CVE-2026-8674

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.

The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.(CVE-2026-8674)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)

• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)

• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)

• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)

• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)

• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117)
• glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489)
• glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374)
• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)
• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)
• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)
• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.

The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.

These are all security issues fixed in the glibc-2.44-3.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
• CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
• CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).