[PATCH v2 2.39 0/7] Cherry-pick CVE-2026-5435 and CVE-2026-6238 fixes to release/2.39/master

[Jaipaul Cheernam]

Hi Florian, Andreas,

My v2 series ([PATCH v2 2.39 XXX]) was marked "Not Applicable” in  patchwork. Could you clarify — is this being handled internally, or is there something I need to change in the submission?

 Happy to adjust if needed.


Regards,
Jaipaul Cheernam

🔗 EST Website<https://www.est.tech/>
🔗 EST LinkedIn<https://www.linkedin.com/company/ericsson-software-technology/>

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Date: Thursday, 2 July 2026 at 22:40
To: libc-alpha@sourceware.org <libc-alpha@sourceware.org>
Cc: fweimer@redhat.com <fweimer@redhat.com>; Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Subject: [PATCH v2 2.39 0/7] Cherry-pick CVE-2026-5435 and CVE-2026-6238 fixes to release/2.39/master

Hi,

v2: Backport the full series including the 3 preparatory commits
(type/class formatting fixes) needed for the test case to pass.
All 7 commits cherry-pick cleanly with no conflicts.

v1 only included 4 patches and had a trivial conflict. Florian
pointed out the test would fail without the type formatting changes.

This series cherry-picks the fixes for CVE-2026-5435 (bug 34033) and
CVE-2026-6238 (bug 34069) to the release/2.39/master branch.

Patches 1-3 are preparatory fixes for ns_sprintrrf type/class
formatting (bug 34289), required for the test in patch 7 to pass.
Patches 4-6 are the actual security fixes.
Patch 7 is the regression test.

The same fixes were already cherry-picked to release/2.43/master as
commits e64ae5a591f0, 3a418da6a393, and 8759917de589.

All patches apply cleanly on top of current release/2.39/master HEAD
(be1e627cd7).

glibc 2.39 is actively used in Yocto Project's scarthgap (LTS) release,
so this branch continues to have downstream consumers relying on it for
security fixes.

Testing: All 56 resolv tests pass, including the new tst-ns_sprintrr.
No regressions.

Thanks,
Jaipaul

Florian Weimer (7):
  resolv: Declare __p_class_syms, __p_type_syms for internal use
  resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
  resolv: Improve formatting of unknown records in ns_sprintrrf
  resolv: Check for inet_ntop failure in ns_sprintrrf
  resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
  resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
  resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)

 include/resolv.h         |   5 +
 resolv/Makefile          |   2 +
 resolv/ns_print.c        | 170 +++++++-------------
 resolv/res_debug.c       |   4 -
 resolv/tst-ns_sprintrr.c | 329 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 389 insertions(+), 121 deletions(-)
 create mode 100644 resolv/tst-ns_sprintrr.c

--
2.34.1

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260706/7861bb62/attachment.htm>