glibc CVE-2026-86805 and CVE-2026-95818

[Xi Ruoyao]

The exploits of them require existing setuid/setgid executable with $ORIGIN in DT_RPATH or DT_RUNPATH. LFS does not have such an executable and I guess BLFS is unlikely to have one, at least my system does not:

$ sudo readelf -d $(find /usr /opt -perm 4755 -or -perm 2755 -or -perm 4750) | grep -E 'R(UN)?PATH'
 0x000000000000001d (RUNPATH)            Library runpath: [/usr/lib/sudo]

So I'm inclined to just issue an advisory telling to audit the setuid/setgid executables using the command above instead of updating (unless someone else finds an exploitable executable on BLFS).

[Bruce Dubbs]

In my case I needed to do something slightly different.

find /usr /opt -perm 4755 -or -perm 2755 -or -perm 4750 > xxx
for f in $(cat xxx); do echo $f; readelf -d $f | grep -E 'R(UN)?PATH'; done

The result was:

/usr/bin/sudo
 0x000000000000001d (RUNPATH)            Library runpath: [/usr/lib/sudo]
/opt/kf6-6.29.0/bin/kwrited
 0x000000000000001d (RUNPATH)            Library runpath: [/opt/kf6/lib:/opt/qt6/lib]

This was on a compete LFS/BLFS system. I needed to do the above because it was not obvious what file produced that last line.

Doing more investigation, we can get rid of kwrited by installing a separate package, libutempter. What it actually installs is libutempter.so

The package builds:

libutempter.so - the shared library KPty links against

The setgid helper /usr/lib/utempter/utempter (group utmp, mode 2755 typically), which does the actual privileged write to /var/run/utmpvar/log/wtmp on behalf of the calling library.

However, that appears to be more trouble than it's worth.

[Xi Ruoyao]

The RPATH/RUNPATH must contains the string "$ORIGIN" explicitly to be exploitable. Thus sudo and kwrited are not exploitable.

[Bruce Dubbs]

Closing as wontfix because it does not affect BLFS. However the issues will be addressed in a security advisory associated with ticket #6023 - Fix various security vulnerabilities in glibc-2.44.