[PATCH v2 0/8] Fixes for CVE-2026-5435, CVE-2026-6238

[Carlos O'Donell]

On 6/16/26 12:31 PM, Florian Weimer wrote:
> CVE-2026-6238 has multiple vulnerable commits across different glibc
> versions.  Technically, this means the CVE ID should be SPLIT.  I'm not
> sure if this is worthwhile because I doubt people care about glibc
> before version 2.7.

May you please expand on this comment?

As a glibc security team member I'd like to understand the reasoning
behind the split.

The series is good as-is.
  
> I fixed some generic record type formatting issues and then switched
> various record types to it, as Adhemerval suggested (including CERT,
> which is largely unused and probably not worth the complexity).  I
> believe this version also fixes the style issues Andreas raised.

OK.

> I found another bug (bug 34289) and fixed that as well.  No security
> implications for this one.

OK.

> Thanks,
> Florian
> 
> Florian Weimer (8):
>    Update GLIBC-SA-2026-0012 to mention A6 records
>    resolv: Declare __p_class_syms, __p_type_syms for internal use
>    resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
>    resolv: Improve formatting of unknown records in ns_sprintrrf
>    resolv: Check for inet_ntop failure in ns_sprintrrf
>    resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
>    resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
>    resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
> 
>   advisories/GLIBC-SA-2026-0012 |   4 +-
>   include/resolv.h              |   5 +
>   resolv/Makefile               |   2 +
>   resolv/ns_print.c             | 170 ++++++------------
>   resolv/res_debug.c            |   4 -
>   resolv/tst-ns_sprintrr.c      | 328 ++++++++++++++++++++++++++++++++++
>   6 files changed, 390 insertions(+), 123 deletions(-)
>   create mode 100644 resolv/tst-ns_sprintrr.c
> 
> 
> base-commit: 1cba6073e500c7bde9322a2f536fc0c308846c61