Home / mailings

PDF

[USN-9065-1] GNU C Library vulnerabilities

Posted on 12 November 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-9065-1
November 12, 2026

glibc vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.10
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in GNU C Library.

Software Description:
- glibc: GNU C Library

Details:

It was discovered that the GNU C Library incorrectly handled the ccs=option in the fopen function. An attacker could possibly use this issue
to cause GNU C Library to crash or execute arbitrary code.
(CVE-2026-18374)

It was discovered that the GNU C Library incorrectly handled long domain
names in DNS search lists. An attacker on the local network could
possibly use this issue to cause GNU C Library to crash, resulting in a
denial of service. (CVE-2026-8674)

It was discovered that the GNU C Library dynamic loader had a
time-of-check to time-of-use race condition when handling the $ORIGIN
path expansion in setuid or setgid programs. A local attacker could
possibly use this issue to execute arbitrary code with elevated
privileges. (CVE-2026-86805)

It was discovered that the GNU C Library dynamic loader incorrectly
handled $ORIGIN path expansion, leading to a stack-based buffer
overflow. A local attacker could possibly use this issue to cause GNU C
Library to crash, resulting in a denial of service, or obtain sensitive
information. (CVE-2026-95818)

It was discovered that the GNU C Library nscd service incorrectly
handled large DNS responses. An attacker could possibly use this issue
to cause nscd to crash, resulting in a denial of service.
(CVE-2026-89092)

It was discovered that the GNU C Library strncasecmp function optimized
for the Power8 architecture incorrectly handled certain inputs. An
attacker could possibly use this issue to cause GNU C Library to crash,
resulting in a denial of service. (CVE-2026-97399)

It was discovered that the GNU C Library incorrectly restricted path
traversal when processing the LANGUAGE environment variable in gettext.
A local attacker could possibly use this issue to load message catalogs
from arbitrary locations and execute arbitrary code.
(CVE-2026-84243)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.10
libc6 2.44-1ubuntu2.1

Ubuntu 26.04 LTS
libc6 2.43-2ubuntu2.7

Ubuntu 24.04 LTS
libc6 2.39-0ubuntu8.12

Ubuntu 22.04 LTS
libc6 2.35-0ubuntu3.18

In general, a standard system update will make all the necessary
changes.

References:
https://ubuntu.com/security/notices/USN-9065-1
CVE-2026-18374, CVE-2026-84243, CVE-2026-8674, CVE-2026-86805,
CVE-2026-89092, CVE-2026-95818, CVE-2026-97399

Package Information:
https://launchpad.net/ubuntu/+source/glibc/2.44-1ubuntu2.1
https://launchpad.net/ubuntu/+source/glibc/2.43-2ubuntu2.7
https://launchpad.net/ubuntu/+source/glibc/2.39-0ubuntu8.12
https://launchpad.net/ubuntu/+source/glibc/2.35-0ubuntu3.18

--===============5142082115662011347==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP