[PATCH] Add advisory text for CVE-2026-0861

[Siddhesh Poyarekar]

Explain the security issue and set context for the vulnerability to help
downstreams get a better understanding of the issue.

Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
---
I will be mirroring the text to cve.org as well so that the nuance and
context for the vulnerability is more widely accessible.

 advisories/GLIBC-SA-2026-0001 | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 advisories/GLIBC-SA-2026-0001

diff --git a/advisories/GLIBC-SA-2026-0001 b/advisories/GLIBC-SA-2026-0001
new file mode 100644
index 0000000000..2d613e1f6f
--- /dev/null
+++ b/advisories/GLIBC-SA-2026-0001
@@ -0,0 +1,21 @@
+Integer overflow in memalign leads to heap corruption
+
+Passing too large an alignment to the memalign suite of functions
+(memalign, posix_memalign, aligned_alloc) in the GNU C Library version
+2.30 to 2.42 may result in an integer overflow, which could consequently
+result in a heap corruption.
+
+Typically the alignment argument passed to such functions is a known
+constrained quantity (e.g. page size or block size) and is not user
+controlled, because of which this may not be easily exploitable in
+practice.  One rare scenario could be an integer overflow in an
+application in computation of alignment, which propagates as too large
+an input to memalign.  In this rare scenario too, it would be uncommon
+to have typical parameters that define such alignment be user
+controlled.
+
+CVE-Id: CVE-2026-0861
+Public-Date: 2026-01-14
+Vulnerable-Commit: 9bf8e29ca136094f73f69f725f15c51facc97206 (2.30)
+Fix-Commit: c9188d333717d3ceb7e3020011651f424f749f93 (2.43)
+Reported-by: Igor Morgenstern, Aisle Research
-- 
2.52.0