When LOG_CONS is enabled and sending to the logging facility fails, syslog() opens /dev/console without the O_CLOEXEC flag. Thus a file descriptor to the console can leak to child processes in multithreaded programs or programs which fork and exec from signal handlers.
Fixed on 2.34.