CVE-2026-86805

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.(CVE-2026-86805)

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.

When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.(CVE-2026-95818)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.(CVE-2026-86805)

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.

When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.(CVE-2026-95818)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.(CVE-2026-86805)

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.

When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.(CVE-2026-95818)

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.(CVE-2026-86805)

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.

When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.(CVE-2026-95818)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)

• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)

• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)

• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)

• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)

• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)

• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)

• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

Bug Fix(es) and Enhancement(s):

• glibc: Fix race condition in tst-bz21269 [rhel-9.9.z] (JIRA:Rocky Linux-283707)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)

• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program. Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)
• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)
• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)
• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)
• glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674)
• glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805)
• glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by ".." traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation. (CVE-2026-18374) Stack overflow in nscd due to unbounded alloca use. (CVE-2026-89092) Assertion failure in the DNS stub resolver with a long search domain. (CVE-2026-8674) AT_SECURE programs may load attacker-controlled code via $ORIGIN. (CVE-2026-86805) AT_SECURE program buffer overflow via $ORIGIN processing. (CVE-2026-95818) Directory traversal via the LANGUAGE environment variable. (CVE-2026-84243)

These are all security issues fixed in the glibc-2.44-3.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
• CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
• CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
• CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

• Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
• CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
• CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
• CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
• CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issues:

• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).

This update for glibc fixes the following issues:

• CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
• CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
• CVE-2026-97399: one byte out-of-bounds read via function strncasecmp on Power8 can lead to a program crash (bsc#1283147).

This update for glibc fixes the following issue:

• CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

It was discovered that the GNU C Library incorrectly handled the ccs= option in the fopen function. An attacker could possibly use this issue to cause GNU C Library to crash or execute arbitrary code. (CVE-2026-18374)

It was discovered that the GNU C Library incorrectly handled long domain names in DNS search lists. An attacker on the local network could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service. (CVE-2026-8674)

It was discovered that the GNU C Library dynamic loader had a time-of-check to time-of-use race condition when handling the $ORIGIN path expansion in setuid or setgid programs. A local attacker could possibly use this issue to execute arbitrary code with elevated privileges. (CVE-2026-86805)

It was discovered that the GNU C Library dynamic loader incorrectly handled $ORIGIN path expansion, leading to a stack-based buffer overflow. A local attacker could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service, or obtain sensitive information. (CVE-2026-95818)

It was discovered that the GNU C Library nscd service incorrectly handled large DNS responses. An attacker could possibly use this issue to cause nscd to crash, resulting in a denial of service. (CVE-2026-89092)

It was discovered that the GNU C Library strncasecmp function optimized for the Power8 architecture incorrectly handled certain inputs. An attacker could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service. (CVE-2026-97399)

It was discovered that the GNU C Library incorrectly restricted path traversal when processing the LANGUAGE environment variable in gettext. A local attacker could possibly use this issue to load message catalogs from arbitrary locations and execute arbitrary code. (CVE-2026-84243)