glibc CVE-2026-86805 and CVE-2026-95818

[Xi Ruoyao]

The exploits of them require existing setuid/setgid executable with $ORIGIN in DT_RPATH or DT_RUNPATH. LFS does not have such an executable and I guess BLFS is unlikely to have one, at least my system does not:

$ sudo readelf -d $(find /usr /opt -perm 4755 -or -perm 2755 -or -perm 4750) | grep -E 'R(UN)?PATH'
 0x000000000000001d (RUNPATH)            Library runpath: [/usr/lib/sudo]

So I'm inclined to just issue an advisory telling to audit the setuid/setgid executables using the command above instead of updating (unless someone else finds an exploitable executable on BLFS).