Packages
- glibc - GNU C Library
Details
It was discovered that the GNU C Library incorrectly handled the ccs=
option in the fopen function. An attacker could possibly use this issue
to cause GNU C Library to crash or execute arbitrary code.
(CVE-2026-18374)
It was discovered that the GNU C Library incorrectly handled long domain
names in DNS search lists. An attacker on the local network could
possibly use this issue to cause GNU C Library to crash, resulting in a
denial of service. (CVE-2026-8674)
It was discovered that the GNU C Library dynamic loader had a
time-of-check to time-of-use race condition when handling the $ORIGIN
path expansion in setuid or setgid programs. A local attacker could
possibly use this issue to execute arbitrary code with elevated
privileges. (CVE-2026-86805)
It was discovered that the GNU C Library dynamic loader...
It was discovered that the GNU C Library incorrectly handled the ccs=
option in the fopen function. An attacker could possibly use this issue
to cause GNU C Library to crash or execute arbitrary code.
(CVE-2026-18374)
It was discovered that the GNU C Library incorrectly handled long domain
names in DNS search lists. An attacker on the local network could
possibly use this issue to cause GNU C Library to crash, resulting in a
denial of service. (CVE-2026-8674)
It was discovered that the GNU C Library dynamic loader had a
time-of-check to time-of-use race condition when handling the $ORIGIN
path expansion in setuid or setgid programs. A local attacker could
possibly use this issue to execute arbitrary code with elevated
privileges. (CVE-2026-86805)
It was discovered that the GNU C Library dynamic loader incorrectly
handled $ORIGIN path expansion, leading to a stack-based buffer
overflow. A local attacker could possibly use this issue to cause GNU C
Library to crash, resulting in a denial of service, or obtain sensitive
information. (CVE-2026-95818)
It was discovered that the GNU C Library nscd service incorrectly
handled large DNS responses. An attacker could possibly use this issue
to cause nscd to crash, resulting in a denial of service.
(CVE-2026-89092)
It was discovered that the GNU C Library strncasecmp function optimized
for the Power8 architecture incorrectly handled certain inputs. An
attacker could possibly use this issue to cause GNU C Library to crash,
resulting in a denial of service. (CVE-2026-97399)
It was discovered that the GNU C Library incorrectly restricted path
traversal when processing the LANGUAGE environment variable in gettext.
A local attacker could possibly use this issue to load message catalogs
from arbitrary locations and execute arbitrary code.
(CVE-2026-84243)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.10 stonking | libc6 – 2.44-1ubuntu2.1 | ||
| 26.04 LTS resolute | libc6 – 2.43-2ubuntu2.7 | ||
| 24.04 LTS noble | libc6 – 2.39-0ubuntu8.12 | ||
| 22.04 LTS jammy | libc6 – 2.35-0ubuntu3.18 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.