[to-be-committed] Document CVE-2026-6238

[Carlos O'Donell]

On 4/28/26 12:45 AM, Florian Weimer wrote:
> * Siddhesh Poyarekar:
> 
>> Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
>> ---
>>   advisories/GLIBC-SA-2026-0012 | 18 ++++++++++++++++++
>>   1 file changed, 18 insertions(+)
>>   create mode 100644 advisories/GLIBC-SA-2026-0012
>>
>> diff --git a/advisories/GLIBC-SA-2026-0012 b/advisories/GLIBC-SA-2026-0012
>> new file mode 100644
>> index 0000000000..29498d905e
>> --- /dev/null
>> +++ b/advisories/GLIBC-SA-2026-0012
>> @@ -0,0 +1,18 @@
>> +Buffer overread in ns_printrrf with corrupted RDATA field
>> +
>> +The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the
>> +GNU C Library version 2.2 and newer fail to validate the RDATA content
>> +against the RDATA length in a DNS response when processing LOC, CERT,
>> +TKEY or TSIG records, which may allow an attacker to craft a DNS
>> +response, causing a target application to crash or read uninitialized
>> +memory.
> 
> Note that this code was present in glibc before 2.2.
> 
>          case T_LOC: {
>                  char t[255];
> 
>                  (void) fprintf(file, "\t%s", loc_ntoa(cp, t));
>                  cp += dlen;
>                  break;
>              }
> 
> It's in the tree that is tagged glibc-1.90.

May you please propose a different Vulnerable-Commit with updated text?

We can keep updating the advisories with more accurate information as
we receive it from reviewers.

-- 
Cheers,
Carlos.