USN-9065-1: GNU C Library vulnerabilities

It was discovered that the GNU C Library incorrectly handled the ccs= option in the fopen function. An attacker could possibly use this issue to cause GNU C Library to crash or execute arbitrary code. (CVE-2026-18374)

It was discovered that the GNU C Library incorrectly handled long domain names in DNS search lists. An attacker on the local network could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service. (CVE-2026-8674)

It was discovered that the GNU C Library dynamic loader had a time-of-check to time-of-use race condition when handling the $ORIGIN path expansion in setuid or setgid programs. A local attacker could possibly use this issue to execute arbitrary code with elevated privileges. (CVE-2026-86805)

It was discovered that the GNU C Library dynamic loader incorrectly handled $ORIGIN path expansion, leading to a stack-based buffer overflow. A local attacker could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service, or obtain sensitive information. (CVE-2026-95818)

It was discovered that the GNU C Library nscd service incorrectly handled large DNS responses. An attacker could possibly use this issue to cause nscd to crash, resulting in a denial of service. (CVE-2026-89092)

It was discovered that the GNU C Library strncasecmp function optimized for the Power8 architecture incorrectly handled certain inputs. An attacker could possibly use this issue to cause GNU C Library to crash, resulting in a denial of service. (CVE-2026-97399)

It was discovered that the GNU C Library incorrectly restricted path traversal when processing the LANGUAGE environment variable in gettext. A local attacker could possibly use this issue to load message catalogs from arbitrary locations and execute arbitrary code. (CVE-2026-84243)