[PATCH 0/5] Fixes for CVE-2026-5435, CVE-2026-6238

[Florian Weimer]

* Florian Weimer:

> CVE-2026-6238 has multiple vulnerable commits across different glibc
> versions.  Technically, this means the CVE ID should be SPLIT.  I'm not
> sure if this is worthwhile because I doubt people care about glibc
> before version 2.7.
>
> Thanks,
> Florian
>
> Florian Weimer (5):
>   Update GLIBC-SA-2026-0012 to mention A6 records
>   resolv: Check for inet_ntop failure in ns_sprintrrf
>   resolv: Remove incorrect parts of TSIG handling from ns_sprintrrf
>     (CVE-2026-5435)
>   resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
>   resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
>
>  advisories/GLIBC-SA-2026-0012 |   4 +-
>  resolv/Makefile               |   2 +
>  resolv/ns_print.c             |  46 ++---
>  resolv/tst-ns_sprintrr.c      | 322 ++++++++++++++++++++++++++++++++++
>  4 files changed, 352 insertions(+), 22 deletions(-)
>  create mode 100644 resolv/tst-ns_sprintrr.c
>
>
> base-commit: dbc2b380fac027fed5db6ae864e4accf9f82a3fd

Ping.  I'd appreciate review of this security fix.

  <https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com>

Thanks,
Florian