glibc-2.44

[Xi Ruoyao]

New minor version with CVE-2026-6368, CVE-2026-6791, CVE-2026-6238, CVE-2026-5435 fixes.

[Xi Ruoyao]

tst-ldconfig-cache fails with rootsbindir=/usr/sbin: ​https://sourceware.org/pipermail/libc-alpha/2026-July/179160.html

[Bruce Dubbs]

I could not find CVE-2026-6368 or CVE-2026-6791.
CVE-2026-6238 is rated MEDIUM.
CVE-2026-5435 is rared HIGH.

I note that CVE-2026-5435 was published at the end of April.

[Bruce Dubbs]

Replying to Xi Ruoyao:

tst-ldconfig-cache fails with rootsbindir=/usr/sbin: ​https://sourceware.org/pipermail/libc-alpha/2026-July/179160.html

Hmm, In chapter 8 we have

echo "rootsbindir=/usr/sbin" > configparms

Do we really need that? In 4.2. Creating a Limited Directory Layout in the LFS Filesystem we have:

for i in bin lib sbin; do
  ln -sv usr/$i $LFS/$i
done

Removing the rootsbindir line should fix the test failure.

[Xi Ruoyao]

Some package management users said installing into /sbin will break their package manager, IIRC. Thus in the book we have a lot of this kind of thing.

[Bruce Dubbs]

Then perhaps this command should be in a note and not a part of the default build.

[Xi Ruoyao]

The problem is jhalfs supports (supported? I don't remember if it still does so today) package management and it cannot take things in a note.

[Xi Ruoyao]

Anyway we have a more serious issue: ​https://sourceware.org/pipermail/libc-alpha/2026-July/179161.html

To be clear this is not a test-suite-only issue: the compiled m4 binary really have the infinite recursing posix_spawn_file_actions_addchdir_np function.

[Bruce Dubbs]

I was not planning on starting the next LFS update until next Wednesday, so hopefully we should get some resolution, or at least a work around, by then.

[Joe Locash]

From ​https://www.openwall.com/lists/oss-security/2026/07/25/1

Security related changes:

The following CVEs were fixed in this release, details of which can be
found in the advisories directory of the release tarball:

   GLIBC-SA-2026-0005:
     gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS
     response (CVE-2026-4437)

   GLIBC-SA-2026-0006:
     gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
     (CVE-2026-4438)

   GLIBC-SA-2026-0007:
     iconv crash due to assertion failure with untrusted input
     (CVE-2026-4046)

[Xi Ruoyao]

Replying to Joe Locash:

From ​https://www.openwall.com/lists/oss-security/2026/07/25/1

Security related changes:

The following CVEs were fixed in this release, details of which can be
found in the advisories directory of the release tarball:

   GLIBC-SA-2026-0005:
     gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS
     response (CVE-2026-4437)

   GLIBC-SA-2026-0006:
     gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
     (CVE-2026-4438)

   GLIBC-SA-2026-0007:
     iconv crash due to assertion failure with untrusted input
     (CVE-2026-4046)

The list is incomplete and these three are already fixed by glibc-2.43-upstream_fixes-1.patch in the book. See the list in description for security issues fixed in 2.44 but not covered by the patch.

[pierre]

Replying to Xi Ruoyao:

The problem is jhalfs supports (supported? I don't remember if it still does so today) package management and it cannot take things in a note.

Sure jhalfs cannot read a note. But for this case, I think anyway package management is done with "ad hoc" instructions generated by lfs.xsl. And lfs.xsl is written by a human who can read a note (although more than often this human is distracted and may miss it :)

So if removing rootsbindir setting is needed, just go for it.

[Xi Ruoyao]

Replying to Xi Ruoyao:

Anyway we have a more serious issue: ​https://sourceware.org/pipermail/libc-alpha/2026-July/179161.html

To be clear this is not a test-suite-only issue: the compiled m4 binary really have the infinite recursing posix_spawn_file_actions_addchdir_np function.

Adding ac_cv_func_posix_spawn_file_actions_addchdir=yes to m4, gettext, and bison is enough for LFS. Maybe there are more cases in BLFS. Perhaps adding it into $LFS/usr/share/config.site as a big hammer would be better.

[Bruce Dubbs]

Replying to Xi Ruoyao:

Adding ac_cv_func_posix_spawn_file_actions_addchdir=yes to m4, gettext, and bison is enough for LFS. Maybe there are more cases in BLFS. Perhaps adding it into $LFS/usr/share/config.site as a big hammer would be better.

I'll give that a try when I start testing.

[Xi Ruoyao]

We should add $LFS/usr/share/config.site at the end of ch.05 glibc if we use this workaround. Adding it earlier may cause issues with binutils & gcc pass 1 as they runs on the host distro with the host glibc, not the LFS one.

Even in ch. 06 we still have host builds for File and Ncurses, fortunately they don't check ac_cv_func_posix_spawn_file_actions_addchdir. If we want technical correctness we can env -u CONFIG_SITE for the host build of File and Ncurses.

[Xi Ruoyao]

There's another affected probe ac_cv_func_posix_spawn_file_actions_addfchdir (an additional f) also affected. It seems not used in LFS but perhaps it's used in BLFS, so for simplicity we can just put it into config.site too.

[Bruce Dubbs]

How about the beginning of '6.2. M4-1.4.21'?

<para>

Ensure packages that use gnulib detect some newer functions found in glibc-2.44.

</para>

cat > $LFS/usr/share/config.site << EOF
ac_cv_func_posix_spawn_file_actions_addchdir=yes
ac_cv_func_posix_spawn_file_actions_addfchdir=yes
EOF

[Xi Ruoyao]

Yes, something like that.

[Xi Ruoyao]

I'd still put it at the end of ch.05 glibc as in the future maybe M4 is fixed while the others are not, then putting it in M4 would seem out-of-place.

[Bruce Dubbs]

I just ran a full lfs build with all tests. I used the above $LFS/usr/share/config.site install and looked for FAILs. I found:

glibc     documented io/tst-lchmod
binutils  documented tmpdir/gp-gmon
acl       documented test/cp.run
findutils undocumented test-regex-el
groff     documented neqn-smoke-test.sh
tar       documented capabilities: binary store/restore
systemd   documented core - systemd:test-namespace
          documented test - systemd:test-chase
          documented test - systemd:test-copy
          undocumented tmpfiles - systemd:test-systemd-tmpfiles

gcc is a bunch of unexpected gcc (38/~400,000) and g++ (66/~500,000) failures and I've not checked them all against the book.

I don't see why a fixed m4 would cause a need to remove $LFS/usr/share/config.site. I don't think it would hurt anything.

[Xi Ruoyao]

I mean it would seem unnatural to have an adaption for other packages on the M4 page, after M4 is fixed?

[Bruce Dubbs]

I think m4 is the first package that uses gnulib, What I have implies it is for other packages that use gnulib also.

[Xi Ruoyao]

I see the point... Let's just go with your layout and we can recheck when we update M4 anyway.

[Bruce Dubbs]

Updated at commit f1476cdc33c. Leaving open for security advisory.

Update to vim-9.2.0858 (Security Update).
Update to glibc-2.44 (Security Update).

[Bruce Dubbs]

Advisory sa-13.0-186 has been issued.