{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "linux-headers-7.3.0-9", "linux-headers-7.3.0-9-generic", "linux-image-7.3.0-9-generic", "linux-main-modules-v4l2loopback-7.3.0-9-generic", "linux-main-modules-zfs-7.3.0-9-generic", "linux-modules-7.3.0-9-generic", "linux-tools-7.3.0-9", "linux-tools-7.3.0-9-generic" ], "removed": [ "libssl3t64", "linux-headers-7.3.0-8", "linux-headers-7.3.0-8-generic", "linux-image-7.3.0-8-generic", "linux-main-modules-v4l2loopback-7.3.0-8-generic", "linux-main-modules-zfs-7.3.0-8-generic", "linux-modules-7.3.0-8-generic", "linux-tools-7.3.0-8", "linux-tools-7.3.0-8-generic" ], "diff": [ "apparmor", "base-files", "bpftool", "cloud-init", "cloud-init-base", "dracut", "dracut-core", "dracut-install", "dracut-network", "fwupd", "libapparmor1", "libc-bin", "libc-dev-bin", "libc-gconv-modules-extra", "libc6", "libc6-dev", "libfreetype6", "libfwupd3", "libsgutils2-1.48", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-libc-dev", "linux-perf", "linux-tools-common", "linux-virtual", "locales", "motd-news-config", "python-apt-common", "python3-apt", "python3-distupgrade", "sg3-utils", "sg3-utils-udev", "sudo", "trace-cmd", "ubuntu-release-upgrader-core" ] } }, "diff": { "deb": [ { "name": "apparmor", "from_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu3", "version": "6.0.0~alpha1-0ubuntu3" }, "to_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu4", "version": "6.0.0~alpha1-0ubuntu4" }, "cves": [], "launchpad_bugs_fixed": [ 2169395, 2169294 ], "changes": [ { "cves": [], "log": [ "", " * Update patches to fix loupe printing and editing (LP: #2169395)", " - d/p/u/0002-profiles-begin-adding-abstractions-for-the-XDG-Deskt.patch", " - d/p/u/0004-profiles-rewrite-the-loupe-profile.patch", " * Add and update autopkgtests for libvirt-daemon-system removal on", " 32-bit architectures (LP: #2169294):", " - debian/tests/control", " - debian/tests/compile-policy", " - debian/tests/compile-policy-64bit-only", "" ], "package": "apparmor", "version": "6.0.0~alpha1-0ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169395, 2169294 ], "author": "Ryan Lee ", "date": "Mon, 05 Oct 2026 16:35:10 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "base-files", "from_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu1", "version": "14.2ubuntu1" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu2", "version": "14.2ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * /etc/issue{,.net}, /etc/os-release: Prepare for 26.10 release.", "" ], "package": "base-files", "version": "14.2ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Florent 'Skia' Jacquet ", "date": "Thu, 08 Oct 2026 17:18:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "bpftool", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.8.0+7.3.0-8.8" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.8.0+7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu1", "version": "26.2-0ubuntu1" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu2", "version": "26.2-0ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2169908 ], "changes": [ { "cves": [], "log": [ "", " * d/p/udev-settle-after-mkfs.patch: perform udevadm settle when", " cloud-init performs disk setup to avoid mount errors: (LP: #2169908)", "" ], "package": "cloud-init", "version": "26.2-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169908 ], "author": "Chad Smith ", "date": "Thu, 08 Oct 2026 18:09:26 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "cloud-init-base", "from_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu1", "version": "26.2-0ubuntu1" }, "to_version": { "source_package_name": "cloud-init", "source_package_version": "26.2-0ubuntu2", "version": "26.2-0ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2169908 ], "changes": [ { "cves": [], "log": [ "", " * d/p/udev-settle-after-mkfs.patch: perform udevadm settle when", " cloud-init performs disk setup to avoid mount errors: (LP: #2169908)", "" ], "package": "cloud-init", "version": "26.2-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169908 ], "author": "Chad Smith ", "date": "Thu, 08 Oct 2026 18:09:26 -0600" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut", "from_version": { "source_package_name": "dracut", "source_package_version": "112-6", "version": "112-6" }, "to_version": { "source_package_name": "dracut", "source_package_version": "112-7", "version": "112-7" }, "cves": [], "launchpad_bugs_fixed": [ 2168989, 2168725 ], "changes": [ { "cves": [], "log": [ "", " * Cherry-pick several upstream commits (LP: #2168989):", " - fix(drm): also include i2c/panel/bridge/backlight modules on riscv64", " - fix(drm): include the SpacemiT K3 DisplayPort PHY module", " * fix(systemd-udevd): do not install loginctl override in /bin (LP: #2168725)", " * fix(systemd-udevd): support busybox for loginctl override", "" ], "package": "dracut", "version": "112-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2168989, 2168725 ], "author": "Benjamin Drung ", "date": "Tue, 06 Oct 2026 00:27:18 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut-core", "from_version": { "source_package_name": "dracut", "source_package_version": "112-6", "version": "112-6" }, "to_version": { "source_package_name": "dracut", "source_package_version": "112-7", "version": "112-7" }, "cves": [], "launchpad_bugs_fixed": [ 2168989, 2168725 ], "changes": [ { "cves": [], "log": [ "", " * Cherry-pick several upstream commits (LP: #2168989):", " - fix(drm): also include i2c/panel/bridge/backlight modules on riscv64", " - fix(drm): include the SpacemiT K3 DisplayPort PHY module", " * fix(systemd-udevd): do not install loginctl override in /bin (LP: #2168725)", " * fix(systemd-udevd): support busybox for loginctl override", "" ], "package": "dracut", "version": "112-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2168989, 2168725 ], "author": "Benjamin Drung ", "date": "Tue, 06 Oct 2026 00:27:18 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut-install", "from_version": { "source_package_name": "dracut", "source_package_version": "112-6", "version": "112-6" }, "to_version": { "source_package_name": "dracut", "source_package_version": "112-7", "version": "112-7" }, "cves": [], "launchpad_bugs_fixed": [ 2168989, 2168725 ], "changes": [ { "cves": [], "log": [ "", " * Cherry-pick several upstream commits (LP: #2168989):", " - fix(drm): also include i2c/panel/bridge/backlight modules on riscv64", " - fix(drm): include the SpacemiT K3 DisplayPort PHY module", " * fix(systemd-udevd): do not install loginctl override in /bin (LP: #2168725)", " * fix(systemd-udevd): support busybox for loginctl override", "" ], "package": "dracut", "version": "112-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2168989, 2168725 ], "author": "Benjamin Drung ", "date": "Tue, 06 Oct 2026 00:27:18 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dracut-network", "from_version": { "source_package_name": "dracut", "source_package_version": "112-6", "version": "112-6" }, "to_version": { "source_package_name": "dracut", "source_package_version": "112-7", "version": "112-7" }, "cves": [], "launchpad_bugs_fixed": [ 2168989, 2168725 ], "changes": [ { "cves": [], "log": [ "", " * Cherry-pick several upstream commits (LP: #2168989):", " - fix(drm): also include i2c/panel/bridge/backlight modules on riscv64", " - fix(drm): include the SpacemiT K3 DisplayPort PHY module", " * fix(systemd-udevd): do not install loginctl override in /bin (LP: #2168725)", " * fix(systemd-udevd): support busybox for loginctl override", "" ], "package": "dracut", "version": "112-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2168989, 2168725 ], "author": "Benjamin Drung ", "date": "Tue, 06 Oct 2026 00:27:18 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "fwupd", "from_version": { "source_package_name": "fwupd", "source_package_version": "2.1.6-3ubuntu1", "version": "2.1.6-3ubuntu1" }, "to_version": { "source_package_name": "fwupd", "source_package_version": "2.1.6-3ubuntu2", "version": "2.1.6-3ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2169304 ], "changes": [ { "cves": [], "log": [ "", " * Drop delayed activation shutdown flow (LP: #2169304)", "" ], "package": "fwupd", "version": "2.1.6-3ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169304 ], "author": "Mario Limonciello ", "date": "Tue, 06 Oct 2026 15:14:34 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libapparmor1", "from_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu3", "version": "6.0.0~alpha1-0ubuntu3" }, "to_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu4", "version": "6.0.0~alpha1-0ubuntu4" }, "cves": [], "launchpad_bugs_fixed": [ 2169395, 2169294 ], "changes": [ { "cves": [], "log": [ "", " * Update patches to fix loupe printing and editing (LP: #2169395)", " - d/p/u/0002-profiles-begin-adding-abstractions-for-the-XDG-Deskt.patch", " - d/p/u/0004-profiles-rewrite-the-loupe-profile.patch", " * Add and update autopkgtests for libvirt-daemon-system removal on", " 32-bit architectures (LP: #2169294):", " - debian/tests/control", " - debian/tests/compile-policy", " - debian/tests/compile-policy-64bit-only", "" ], "package": "apparmor", "version": "6.0.0~alpha1-0ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169395, 2169294 ], "author": "Ryan Lee ", "date": "Mon, 05 Oct 2026 16:35:10 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu2", "version": "2.44-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167365 ], "changes": [ { "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "log": [ "", " * fixes gettext ftbfs. (LP: #2167365)", " * d/p/git-updates.diff: pull upstream stable branch", " - powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399)", " - realloc: Fix mmap non-mremap reallocation case [BZ #34697]", " - CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache", " - Revert \"posix: Add POSIX aliases to some spawn functions\" (BZ 34437)", " - stdlib: Don't call clearenv from __libc_setenv_freemem", " - elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)", " - resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674]", " - fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313]", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - Revert \"io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]\"", " - x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600]", " - libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling", " - powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530)", " - powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530)", " - iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489)", " - iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117)", " - stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499)", " - posix: Remove unnecessary overflow check in wordexp (BZ 34090)", " - misc: Fix out-of-bounds array write n tdelete (bug 34506)", "" ], "package": "glibc", "version": "2.44-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167365 ], "author": "Simon Poirier ", "date": "Tue, 06 Oct 2026 10:18:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-dev-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu2", "version": "2.44-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167365 ], "changes": [ { "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "log": [ "", " * fixes gettext ftbfs. (LP: #2167365)", " * d/p/git-updates.diff: pull upstream stable branch", " - powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399)", " - realloc: Fix mmap non-mremap reallocation case [BZ #34697]", " - CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache", " - Revert \"posix: Add POSIX aliases to some spawn functions\" (BZ 34437)", " - stdlib: Don't call clearenv from __libc_setenv_freemem", " - elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)", " - resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674]", " - fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313]", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - Revert \"io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]\"", " - x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600]", " - libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling", " - powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530)", " - powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530)", " - iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489)", " - iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117)", " - stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499)", " - posix: Remove unnecessary overflow check in wordexp (BZ 34090)", " - misc: Fix out-of-bounds array write n tdelete (bug 34506)", "" ], "package": "glibc", "version": "2.44-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167365 ], "author": "Simon Poirier ", "date": "Tue, 06 Oct 2026 10:18:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc-gconv-modules-extra", "from_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu2", "version": "2.44-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167365 ], "changes": [ { "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "log": [ "", " * fixes gettext ftbfs. (LP: #2167365)", " * d/p/git-updates.diff: pull upstream stable branch", " - powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399)", " - realloc: Fix mmap non-mremap reallocation case [BZ #34697]", " - CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache", " - Revert \"posix: Add POSIX aliases to some spawn functions\" (BZ 34437)", " - stdlib: Don't call clearenv from __libc_setenv_freemem", " - elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)", " - resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674]", " - fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313]", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - Revert \"io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]\"", " - x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600]", " - libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling", " - powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530)", " - powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530)", " - iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489)", " - iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117)", " - stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499)", " - posix: Remove unnecessary overflow check in wordexp (BZ 34090)", " - misc: Fix out-of-bounds array write n tdelete (bug 34506)", "" ], "package": "glibc", "version": "2.44-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167365 ], "author": "Simon Poirier ", "date": "Tue, 06 Oct 2026 10:18:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6", "from_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu2", "version": "2.44-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167365 ], "changes": [ { "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "log": [ "", " * fixes gettext ftbfs. (LP: #2167365)", " * d/p/git-updates.diff: pull upstream stable branch", " - powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399)", " - realloc: Fix mmap non-mremap reallocation case [BZ #34697]", " - CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache", " - Revert \"posix: Add POSIX aliases to some spawn functions\" (BZ 34437)", " - stdlib: Don't call clearenv from __libc_setenv_freemem", " - elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)", " - resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674]", " - fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313]", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - Revert \"io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]\"", " - x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600]", " - libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling", " - powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530)", " - powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530)", " - iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489)", " - iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117)", " - stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499)", " - posix: Remove unnecessary overflow check in wordexp (BZ 34090)", " - misc: Fix out-of-bounds array write n tdelete (bug 34506)", "" ], "package": "glibc", "version": "2.44-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167365 ], "author": "Simon Poirier ", "date": "Tue, 06 Oct 2026 10:18:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6-dev", "from_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu2", "version": "2.44-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167365 ], "changes": [ { "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "log": [ "", " * fixes gettext ftbfs. (LP: #2167365)", " * d/p/git-updates.diff: pull upstream stable branch", " - powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399)", " - realloc: Fix mmap non-mremap reallocation case [BZ #34697]", " - CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache", " - Revert \"posix: Add POSIX aliases to some spawn functions\" (BZ 34437)", " - stdlib: Don't call clearenv from __libc_setenv_freemem", " - elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)", " - resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674]", " - fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313]", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - Revert \"io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]\"", " - x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600]", " - libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling", " - powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530)", " - powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530)", " - iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489)", " - iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117)", " - stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499)", " - posix: Remove unnecessary overflow check in wordexp (BZ 34090)", " - misc: Fix out-of-bounds array write n tdelete (bug 34506)", "" ], "package": "glibc", "version": "2.44-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167365 ], "author": "Simon Poirier ", "date": "Tue, 06 Oct 2026 10:18:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfreetype6", "from_version": { "source_package_name": "freetype", "source_package_version": "2.14.3+dfsg-2", "version": "2.14.3+dfsg-2" }, "to_version": { "source_package_name": "freetype", "source_package_version": "2.14.3+dfsg-2ubuntu1", "version": "2.14.3+dfsg-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-95512", "url": "https://ubuntu.com/security/CVE-2026-95512", "cve_description": "A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.", "cve_priority": "medium", "cve_public_date": "2026-10-02 09:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-95512", "url": "https://ubuntu.com/security/CVE-2026-95512", "cve_description": "A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.", "cve_priority": "medium", "cve_public_date": "2026-10-02 09:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: DoS in CID font loader", " - debian/patches/CVE-2026-95512.patch: * src/cid/cidload.c (cid_read_subrs):", " Limit overlaps. in src/cid/cidload.c.", " - CVE-2026-95512", "" ], "package": "freetype", "version": "2.14.3+dfsg-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 05 Oct 2026 10:40:55 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfwupd3", "from_version": { "source_package_name": "fwupd", "source_package_version": "2.1.6-3ubuntu1", "version": "2.1.6-3ubuntu1" }, "to_version": { "source_package_name": "fwupd", "source_package_version": "2.1.6-3ubuntu2", "version": "2.1.6-3ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2169304 ], "changes": [ { "cves": [], "log": [ "", " * Drop delayed activation shutdown flow (LP: #2169304)", "" ], "package": "fwupd", "version": "2.1.6-3ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169304 ], "author": "Mario Limonciello ", "date": "Tue, 06 Oct 2026 15:14:34 -0500" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsgutils2-1.48", "from_version": { "source_package_name": "sg3-utils", "source_package_version": "1.48-3ubuntu4", "version": "1.48-3ubuntu4" }, "to_version": { "source_package_name": "sg3-utils", "source_package_version": "1.48-3ubuntu5", "version": "1.48-3ubuntu5" }, "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: command injection via udev property injection", " - debian/patches/CVE-2026-16313.patch: apply udev-conforming character", " encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA", " subfield output of sg_inq --export, so a crafted SCSI device cannot", " inject udev properties and execute commands as root (fix released", " upstream in sg3_utils 1.49).", " - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI", " name strings (upstream follow-up fix).", " - CVE-2026-16313", "" ], "package": "sg3-utils", "version": "1.48-3ubuntu5", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 01 Oct 2026 14:12:09 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-9.9", "" ], "package": "linux-meta", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:57:49 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-9.9", "" ], "package": "linux-meta", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:57:49 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-9.9", "" ], "package": "linux-meta", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:57:49 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-libc-dev", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-perf", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-common", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-9.9", "" ], "package": "linux-meta", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:57:49 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "locales", "from_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu2", "version": "2.44-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2167365 ], "changes": [ { "cves": [ { "cve": "CVE-2026-97399", "url": "https://ubuntu.com/security/CVE-2026-97399", "cve_description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "cve_priority": "medium", "cve_public_date": "2026-09-28 16:17:00 UTC" }, { "cve": "CVE-2026-89092", "url": "https://ubuntu.com/security/CVE-2026-89092", "cve_description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for a DNS query, resulting in degraded DNS resolution for the system. Exploitation of this bug needs a system that has nscd enabled and using an untrusted DNS server for name resolution, with the compromised DNS server being capable of processing records large enough to result in a stack overflow in an nscd thread stack.  During experimentation, bind 9 was unable to handle large records, but that could change in future or with a different name server.  In typical installations, nscd is executed in an isolated context as its own user without a shell, due to which any compromise of that service is isolated. There is a remote possibility of nscd cache corruption if an attacker manages to get the stack pointer into a desired point in the heap, potentially resulting in other caches in nscd being overwritten with corrupt data through the stack overflow, until the buggy code path eventually results in a crash. Finally, a crash in nscd may result in performance degradation when resolving names, but it does not result in a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-09-11 02:18:00 UTC" }, { "cve": "CVE-2026-8674", "url": "https://ubuntu.com/security/CVE-2026-8674", "cve_description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process. The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "cve_priority": "medium", "cve_public_date": "2026-09-17 17:16:00 UTC" }, { "cve": "CVE-2026-18374", "url": "https://ubuntu.com/security/CVE-2026-18374", "cve_description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "cve_priority": "medium", "cve_public_date": "2026-08-27 20:17:00 UTC" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "cve_priority": "medium", "cve_public_date": "2026-09-15 11:17:00 UTC" }, { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known.", "cve_priority": "medium", "cve_public_date": "2026-09-14 18:17:00 UTC" } ], "log": [ "", " * fixes gettext ftbfs. (LP: #2167365)", " * d/p/git-updates.diff: pull upstream stable branch", " - powerpc: Fix one byte overread in strncasecmp (bug 34683, CVE-2026-97399)", " - realloc: Fix mmap non-mremap reallocation case [BZ #34697]", " - CVE-2026-89092: nscd: replace alloca with malloc in aicache, hstcache", " - Revert \"posix: Add POSIX aliases to some spawn functions\" (BZ 34437)", " - stdlib: Don't call clearenv from __libc_setenv_freemem", " - elf: Open the normalized $ORIGIN rpath in AT_SECURE programs (BZ 34360)", " - resolv: Fix assertion failure on search list truncation [BZ 31026, CVE-2026-8674]", " - fcntl: drop nonnull attribute for openat, openat2's path argument [BZ #34313]", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - Revert \"io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]\"", " - x86-64: Link tst-shstk-legacy-1{f,g} with -Wl,--no-as-needed", " - io: drop nonnull attribute for fchmodat, faccessat, fchownat's path argument [BZ #34313]", " - elf: Do not load cache extensions from an old-format ld.so.cache [BZ #34600]", " - libio: Fix CVE-2026-18374 heap buffer overflow in ccs= handling", " - powerpc: Fix preprocessor conditional in soft-float __longjmp (bug 34530)", " - powerpc: Fix non-atomic stack pointer update in fortified longjmp (bug 34530)", " - iconvdata: EUC_JISX0213 decoding lacks pending character reset (CVE-2026-80489)", " - iconvdata: SHIFT_JISX0213 decoding lacks pending character reset (CVE-2026-77117)", " - stdlib: Fix right-justification in strfmon (bug 34510, CVE-2026-19499)", " - posix: Remove unnecessary overflow check in wordexp (BZ 34090)", " - misc: Fix out-of-bounds array write n tdelete (bug 34506)", "" ], "package": "glibc", "version": "2.44-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167365 ], "author": "Simon Poirier ", "date": "Tue, 06 Oct 2026 10:18:36 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "motd-news-config", "from_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu1", "version": "14.2ubuntu1" }, "to_version": { "source_package_name": "base-files", "source_package_version": "14.2ubuntu2", "version": "14.2ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * /etc/issue{,.net}, /etc/os-release: Prepare for 26.10 release.", "" ], "package": "base-files", "version": "14.2ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Florent 'Skia' Jacquet ", "date": "Thu, 08 Oct 2026 17:18:54 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python-apt-common", "from_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu1", "version": "3.1.0ubuntu1" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu2", "version": "3.1.0ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Refresh mirror lists for Stonking release.", "" ], "package": "python-apt", "version": "3.1.0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Florent 'Skia' Jacquet ", "date": "Thu, 08 Oct 2026 14:53:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-apt", "from_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu1", "version": "3.1.0ubuntu1" }, "to_version": { "source_package_name": "python-apt", "source_package_version": "3.1.0ubuntu2", "version": "3.1.0ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Refresh mirror lists for Stonking release.", "" ], "package": "python-apt", "version": "3.1.0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Florent 'Skia' Jacquet ", "date": "Thu, 08 Oct 2026 14:53:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distupgrade", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.10", "version": "1:26.10.10" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.11", "version": "1:26.10.11" }, "cves": [], "launchpad_bugs_fixed": [ 2169541 ], "changes": [ { "cves": [], "log": [ "", " [ Alessandro Astone ]", " * deb2snap: Add hwctl (See LP #2156756)", "", " [ Will Cooke ]", " * DistUpgradeController: use \"anyway\" in the foreign packages prompt", " (LP: #2169541)", "", " [ Nick Rosbrook ]", " * Run pre-build.sh: updating mirrors and translations.", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.10.11", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169541 ], "author": "Nick Rosbrook ", "date": "Tue, 06 Oct 2026 12:14:59 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "sg3-utils", "from_version": { "source_package_name": "sg3-utils", "source_package_version": "1.48-3ubuntu4", "version": "1.48-3ubuntu4" }, "to_version": { "source_package_name": "sg3-utils", "source_package_version": "1.48-3ubuntu5", "version": "1.48-3ubuntu5" }, "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: command injection via udev property injection", " - debian/patches/CVE-2026-16313.patch: apply udev-conforming character", " encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA", " subfield output of sg_inq --export, so a crafted SCSI device cannot", " inject udev properties and execute commands as root (fix released", " upstream in sg3_utils 1.49).", " - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI", " name strings (upstream follow-up fix).", " - CVE-2026-16313", "" ], "package": "sg3-utils", "version": "1.48-3ubuntu5", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 01 Oct 2026 14:12:09 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "sg3-utils-udev", "from_version": { "source_package_name": "sg3-utils", "source_package_version": "1.48-3ubuntu4", "version": "1.48-3ubuntu4" }, "to_version": { "source_package_name": "sg3-utils", "source_package_version": "1.48-3ubuntu5", "version": "1.48-3ubuntu5" }, "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-16313", "url": "https://ubuntu.com/security/CVE-2026-16313", "cve_description": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "cve_priority": "medium", "cve_public_date": "2026-07-28 17:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: command injection via udev property injection", " - debian/patches/CVE-2026-16313.patch: apply udev-conforming character", " encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA", " subfield output of sg_inq --export, so a crafted SCSI device cannot", " inject udev properties and execute commands as root (fix released", " upstream in sg3_utils 1.49).", " - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI", " name strings (upstream follow-up fix).", " - CVE-2026-16313", "" ], "package": "sg3-utils", "version": "1.48-3ubuntu5", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Allen Huang ", "date": "Thu, 01 Oct 2026 14:12:09 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "sudo", "from_version": { "source_package_name": "sudo", "source_package_version": "1.9.17p2-7ubuntu4", "version": "1.9.17p2-7ubuntu4" }, "to_version": { "source_package_name": "sudo", "source_package_version": "1.9.17p2-7ubuntu5", "version": "1.9.17p2-7ubuntu5" }, "cves": [ { "cve": "CVE-2026-96512", "url": "https://ubuntu.com/security/CVE-2026-96512", "cve_description": "A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.", "cve_priority": "medium", "cve_public_date": "2026-09-23 14:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-96512", "url": "https://ubuntu.com/security/CVE-2026-96512", "cve_description": "A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.", "cve_priority": "medium", "cve_public_date": "2026-09-23 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: NOTBEFORE or NOTAFTER restrictions bypass via TZ", " - debian/patches/CVE-2026-96512-pre1.patch: sudo: ignore user-specified TZ", " environment variable in src/sudo.c.", " - debian/patches/CVE-2026-96512.patch: Remove TZ from sudo's working", " environment without modifying envp. in src/sudo.c.", " - CVE-2026-96512", "" ], "package": "sudo", "version": "1.9.17p2-7ubuntu5", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 06 Oct 2026 09:11:55 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "trace-cmd", "from_version": { "source_package_name": "trace-cmd", "source_package_version": "3.4-1", "version": "3.4-1" }, "to_version": { "source_package_name": "trace-cmd", "source_package_version": "3.4-2", "version": "3.4-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Rafael Laboissière ]", " * Add patch for fixing FTBFS with swig 4.5.0 (Closes: #1145859)", "" ], "package": "trace-cmd", "version": "3.4-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sudip Mukherjee ", "date": "Sat, 26 Sep 2026 20:53:43 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-release-upgrader-core", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.10", "version": "1:26.10.10" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.11", "version": "1:26.10.11" }, "cves": [], "launchpad_bugs_fixed": [ 2169541 ], "changes": [ { "cves": [], "log": [ "", " [ Alessandro Astone ]", " * deb2snap: Add hwctl (See LP #2156756)", "", " [ Will Cooke ]", " * DistUpgradeController: use \"anyway\" in the foreign packages prompt", " (LP: #2169541)", "", " [ Nick Rosbrook ]", " * Run pre-build.sh: updating mirrors and translations.", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.10.11", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169541 ], "author": "Nick Rosbrook ", "date": "Tue, 06 Oct 2026 12:14:59 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "linux-headers-7.3.0-9", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": "linux-headers-7.3.0-9 version '7.3.0-9.9' (source package linux version '7.3.0-9.9') was added. linux-headers-7.3.0-9 version '7.3.0-9.9' has the same source package name, linux, as removed package linux-headers-7.3.0-8. As such we can use the source package version of the removed package, '7.3.0-8.8', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-9-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": "linux-headers-7.3.0-9-generic version '7.3.0-9.9' (source package linux version '7.3.0-9.9') was added. linux-headers-7.3.0-9-generic version '7.3.0-9.9' has the same source package name, linux, as removed package linux-headers-7.3.0-8. As such we can use the source package version of the removed package, '7.3.0-8.8', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-7.3.0-9-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-8.8", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-9.9", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:58:00 +0200" } ], "notes": "linux-image-7.3.0-9-generic version '7.3.0-9.9' (source package linux-signed version '7.3.0-9.9') was added. linux-image-7.3.0-9-generic version '7.3.0-9.9' has the same source package name, linux-signed, as removed package linux-image-7.3.0-8-generic. As such we can use the source package version of the removed package, '7.3.0-8.8', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-v4l2loopback-7.3.0-9-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-8.8+1", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-9.9", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.10.05)", "" ], "package": "linux-main-signed", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:58:22 +0200" } ], "notes": "linux-main-modules-v4l2loopback-7.3.0-9-generic version '7.3.0-9.9' (source package linux-main-signed version '7.3.0-9.9') was added. linux-main-modules-v4l2loopback-7.3.0-9-generic version '7.3.0-9.9' has the same source package name, linux-main-signed, as removed package linux-main-modules-v4l2loopback-7.3.0-8-generic. As such we can use the source package version of the removed package, '7.3.0-8.8+1', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.3.0-9-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-8.8+1", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-9.9", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.10.05)", "" ], "package": "linux-main-signed", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:58:22 +0200" } ], "notes": "linux-main-modules-zfs-7.3.0-9-generic version '7.3.0-9.9' (source package linux-main-signed version '7.3.0-9.9') was added. linux-main-modules-zfs-7.3.0-9-generic version '7.3.0-9.9' has the same source package name, linux-main-signed, as removed package linux-main-modules-v4l2loopback-7.3.0-8-generic. As such we can use the source package version of the removed package, '7.3.0-8.8+1', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.3.0-9-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": "linux-modules-7.3.0-9-generic version '7.3.0-9.9' (source package linux version '7.3.0-9.9') was added. linux-modules-7.3.0-9-generic version '7.3.0-9.9' has the same source package name, linux, as removed package linux-headers-7.3.0-8. As such we can use the source package version of the removed package, '7.3.0-8.8', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-9", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": "linux-tools-7.3.0-9 version '7.3.0-9.9' (source package linux version '7.3.0-9.9') was added. linux-tools-7.3.0-9 version '7.3.0-9.9' has the same source package name, linux, as removed package linux-headers-7.3.0-8. As such we can use the source package version of the removed package, '7.3.0-8.8', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-9-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-9.9", "version": "7.3.0-9.9" }, "cves": [], "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-9.9 -proposed tracker (LP: #2169521)", "", " * 26.10 mini-iso: screen hangs after selecting target (LP: #2169198)", " - [Config] Disable KEXEC_HANDOVER_ENABLE_DEFAULT", "", " * Support additional 2888x1808@30fps 900MHz for OVTI05C1 camera sensor", " (LP: #2147409)", " - media: ipu-bridge: Add support additional link frequency", " - platform/x86: int3472: Increase handshake GPIO delay to 200 ms", "", " * AMD system hangs on resume when a Thunderbolt dock is plugged in during", " s2idle (LP: #2168944)", " - platform/x86/amd: Stop counting intermediate cycles with metrics table", "", " * Fix TI TAS2783 amplifier firmware load issue (LP: #2169023)", " - ASoC: tas2783-sdw: add firmware download status check", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Restore the linux-doc transitional stub", " - [Config] updateconfigs after v7.3-rc6 rebase", " - [Config] Enable ARM64_ERRATUM_3821522", "" ], "package": "linux", "version": "7.3.0-9.9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169521, 2169198, 2147409, 2168944, 2169023 ], "author": "Paolo Pisati ", "date": "Mon, 05 Oct 2026 10:56:27 +0200" } ], "notes": "linux-tools-7.3.0-9-generic version '7.3.0-9.9' (source package linux version '7.3.0-9.9') was added. linux-tools-7.3.0-9-generic version '7.3.0-9.9' has the same source package name, linux, as removed package linux-headers-7.3.0-8. As such we can use the source package version of the removed package, '7.3.0-8.8', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "libssl3t64", "from_version": { "source_package_name": "openssl", "source_package_version": "3.5.5-1ubuntu4", "version": "3.5.5-1ubuntu4" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-8", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-8-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-7.3.0-8-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-v4l2loopback-7.3.0-8-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-8.8+1", "version": "7.3.0-8.8+1" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.3.0-8-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-8.8+1", "version": "7.3.0-8.8+1" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.3.0-8-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-8", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-8-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.10 stonking image from daily image serial 20261006 to 20261011", "from_series": "stonking", "to_series": "stonking", "from_serial": "20261006", "to_serial": "20261011", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }