{"cves":["CVE-2025-15281","CVE-2026-0915"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[2.28-251.0.4.31]\n- Forward port of Oracle patches\n  Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  Oracle history:\n  February-24-2026 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.4.27\n  - Fixed orabug 38834066 stpcpy MTE support\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  December-8-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.27\n  - Forward port of Oracle patches\n    Reviewed-by: David Faust david.faust@oracle.com\n  August-5-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.25\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  June-9-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.22\n  - Forward port of Oracle patches\n    Reviewed-by: David Faust david.faust@oracle.com\n  April-14-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.16\n  - Forward port of Oracle patches\n    Reviewed-by: Elena Zannoni elena.zannoni@oracle.com\n  March-26-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.14\n  - OraBug: 36625686 Add MTE support on string functions\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-17-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.14\n  - Forward port of Oracle patches\n    Reviewed-by: David Faust david.faust@oracle.com\n  February-19-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.13\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  January-28-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.11\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  September-24-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.5\n  - Forward port of Oracle patches over 2.28-251.5\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  August-26-2024 Jose E. Marchesi jose.marchesi@oracle.com - 2.28-251.0.2.4\n  - Forward port of Oracle patches over 2.28-251.4\n    Reviewed-by: David Faust david.faust@oracle.com\n  May-24-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.2\n  - Forward port of Oracle patches over 2.28-251.2\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-23-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.1\n  - Forward port of Oracle patches over 2.28-251.1\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-22-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2\n  - Forward port of Oracle patches for ol8-u10\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-28-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.1\n  - Forward port of Oracle patches for ol8-u10-beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-5-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-236.0.1.12\n  - Forward port of Oracle patches.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  November-14-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-236.0.1.7\n  - Forward port of Oracle patches.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  October-4-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-236.0.1.6\n  - Forward port of Oracle patches.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  April-21-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-225.0.3\n  - OraBug 35317410 Glibc tunable to disable huge pages on pthread_create stacks\n  - Created tunable glibc.pthread.stack_hugetlb to control when hugepages\n    can be used for stack allocation.\n  - In case THP are enabled and glibc.pthread.stack_hugetlb is set to\n    0, glibc will madvise the kernel not to use allow hugepages for stack\n    allocations.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  April-11-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-225.0.2\n  - OraBug: 35268809 Fixed initialization of VDSO for tcache_key_initialize\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-28-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-225.0.1\n  - Merge of Oracle patches for ol8u8 beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  September-28-2022 Patrick McGehearty patrick.mcgehearty@oracle.com - 2.28-211.0.1\n  - Merge of Oracle patches for ol8u7 beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  August-8-2022 Patrick McGehearty patrick.mcgehearty@oracle.com - 2.28-189.5.0.2\n  - Enable VDSO on x86_64, aarch64, i386, arm, and mips statically linked programs.\n  - These changes enable reading the realtime clock without a kernel syscall.\n    OraBug: 30478315\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-2-2022 Patrick McGehearty patrick.mcgehearty@oracle.com - 2.28-199.0.1\n  - Merge of patches from c8s 199 with ol8u6 beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  - Update siginfo constants from linux kernel (OraBug: 33734528)\n  - Remove limit on MALLOC_MMAP_THRESHOLD tunable (Orabug: 29630826)\n  - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive\n  - spin mutex (Orabug: 27982358)\n    Reviewed-by: Qing Zhao qing.zhao@oracle.com\n  - add Ampere emag  to tunable cpu list (Patrick McGehearty)\n  - add optimized memset for emag\n  - add an ASIMD variant of strlen for falkor\n    Orabug: 2700101.\n  - Modify glibc-ora28849085.patch so it works with RHCK kernels. (Orabug: 28849085)\n  - Make _IO_funlockfile match __funlockfile and _IO_flockfile match __flockfile\n    Both should test\n      if (stream-_flags  _IO_USER_LOCK) == 0)\n        _IO_lock_lock (*stream-_lock);\n    OraBug: 28481550.\n    Reviewed-by: Qing Zhao qing.zhao@oracle.com\n\n[2.28-251.31]\n- CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-142787)\n\n[2.28-251.30]\n- Remove default /var/tmp for LD_PROFILE_OUTPUT (RHEL-142194)\n\n[2.28-251.29]\n- rpminspect.yaml: note that glibc-minimal-langpack is empty (RHEL-123889)\n\n[2.28-251.28]\n- CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141849)\n\n[2.28-251.27]\n- Fix a segmentation fault in multi-threaded multi-namespace programs using\n  ctype.h macros (RHEL-72011)\n\n[2.28-251.26]\n- nss: Group merge does not react to ERANGE during merge (RHEL-114260)\n\n[2.28-251.25]\n- CVE-2025-8058: Double free in regcomp (RHEL-105326)\n\n[2.28-251.24]\n- Keep reloading /etc/resolv.conf after timeouts with getaddrinfo\n  and AF_UNSPEC.\n- Avoid timeouts with getaddrinfo, AF_UNSPEC, and certain DNS error\n  responses. (RHEL-18039)\n\n[2.28-251.23]\n- Reduce spurious rebuilds while running tests (RHEL-93937)","id":"ELSA-2026-4772","ovalId":"oval:com.oracle.elsa:def:20264772","source":"oracle_linux","title":"ELSA-2026-4772:  glibc security update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2026-4772.html"}