[PATCH 2.40 0/7] Cherry-pick CVE-2026-5435 and CVE-2026-6238 fixes to release/2.40/master
Jaipaul Cheernam
jaipaul.cheernam@est.tech
Mon Aug 3 14:22:52 GMT 2026
Hi,
This series cherry-picks the fixes for CVE-2026-5435 (bug 34033) and
CVE-2026-6238 (bug 34069) to the release/2.40/master branch.
All 7 commits cherry-pick cleanly with no conflicts.
Patches 1-3 are preparatory fixes for ns_sprintrrf type/class
formatting (bug 34289), required for the test in patch 7 to pass.
Patches 4-6 are the actual security fixes.
Patch 7 is the regression test.
The same fixes were already cherry-picked to release/2.43/master.
An identical series for release/2.39/master was sent as [PATCH v2 2.39 0/7].
Thanks,
Jaipaul
Florian Weimer (7):
resolv: Declare __p_class_syms, __p_type_syms for internal use
resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
resolv: Improve formatting of unknown records in ns_sprintrrf
resolv: Check for inet_ntop failure in ns_sprintrrf
resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
--
2.34.1
More information about the Libc-alpha
mailing list