elsa-2026-20587

{
  "cves": [
    "CVE-2026-4046"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[2.28-251.0.4.37]\n- Forward port of Oracle patches\n  Reviewed-by: David Faust david.faust@oracle.com\n  Oracle history:\n  May-7-2026 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.4.34\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-18-2026 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.4.31\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  February-24-2026 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.4.27\n  - Fixed orabug 38834066 stpcpy MTE support\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  December-8-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.27\n  - Forward port of Oracle patches\n    Reviewed-by: David Faust david.faust@oracle.com\n  August-5-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.25\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  June-9-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.22\n  - Forward port of Oracle patches\n    Reviewed-by: David Faust david.faust@oracle.com\n  April-14-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.16\n  - Forward port of Oracle patches\n    Reviewed-by: Elena Zannoni elena.zannoni@oracle.com\n  March-26-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.3.14\n  - OraBug: 36625686 Add MTE support on string functions\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-17-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.14\n  - Forward port of Oracle patches\n    Reviewed-by: David Faust david.faust@oracle.com\n  February-19-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.13\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  January-28-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.11\n  - Forward port of Oracle patches\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  September-24-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.5\n  - Forward port of Oracle patches over 2.28-251.5\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  August-26-2024 Jose E. Marchesi jose.marchesi@oracle.com - 2.28-251.0.2.4\n  - Forward port of Oracle patches over 2.28-251.4\n    Reviewed-by: David Faust david.faust@oracle.com\n  May-24-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.2\n  - Forward port of Oracle patches over 2.28-251.2\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-23-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2.1\n  - Forward port of Oracle patches over 2.28-251.1\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-22-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.2\n  - Forward port of Oracle patches for ol8-u10\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-28-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-251.0.1\n  - Forward port of Oracle patches for ol8-u10-beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-5-2024 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-236.0.1.12\n  - Forward port of Oracle patches.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  November-14-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-236.0.1.7\n  - Forward port of Oracle patches.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  October-4-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-236.0.1.6\n  - Forward port of Oracle patches.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  April-21-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-225.0.3\n  - OraBug 35317410 Glibc tunable to disable huge pages on pthread_create stacks\n  - Created tunable glibc.pthread.stack_hugetlb to control when hugepages\n    can be used for stack allocation.\n  - In case THP are enabled and glibc.pthread.stack_hugetlb is set to\n    0, glibc will madvise the kernel not to use allow hugepages for stack\n    allocations.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  April-11-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-225.0.2\n  - OraBug: 35268809 Fixed initialization of VDSO for tcache_key_initialize\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-28-2023 Cupertino Miranda cupertino.miranda@oracle.com - 2.28-225.0.1\n  - Merge of Oracle patches for ol8u8 beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  September-28-2022 Patrick McGehearty patrick.mcgehearty@oracle.com - 2.28-211.0.1\n  - Merge of Oracle patches for ol8u7 beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  August-8-2022 Patrick McGehearty patrick.mcgehearty@oracle.com - 2.28-189.5.0.2\n  - Enable VDSO on x86_64, aarch64, i386, arm, and mips statically linked programs.\n  - These changes enable reading the realtime clock without a kernel syscall.\n    OraBug: 30478315\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  May-2-2022 Patrick McGehearty patrick.mcgehearty@oracle.com - 2.28-199.0.1\n  - Merge of patches from c8s 199 with ol8u6 beta\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  - Update siginfo constants from linux kernel (OraBug: 33734528)\n  - Remove limit on MALLOC_MMAP_THRESHOLD tunable (Orabug: 29630826)\n  - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive\n  - spin mutex (Orabug: 27982358)\n    Reviewed-by: Qing Zhao qing.zhao@oracle.com\n  - add Ampere emag  to tunable cpu list (Patrick McGehearty)\n  - add optimized memset for emag\n  - add an ASIMD variant of strlen for falkor\n    Orabug: 2700101.\n  - Modify glibc-ora28849085.patch so it works with RHCK kernels. (Orabug: 28849085)\n  - Make _IO_funlockfile match __funlockfile and _IO_flockfile match __flockfile\n    Both should test\n      if (stream-_flags  _IO_USER_LOCK) == 0)\n        _IO_lock_lock (*stream-_lock);\n    OraBug: 28481550.\n    Reviewed-by: Qing Zhao qing.zhao@oracle.com\n\n[2.28-251.37]\n- Add tests for CVE-2026-4437 and CVE-2026-4438 (RHEL-173358)\n\n[2.28-251.36]\n- Fix __nss_get_default_domain logic to restore netgroup user enumeration\n  (RHEL-168095)\n\n[2.28-251.35]\n- CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules\n  (RHEL-162891)\n\n[2.28-251.34]\n- Update locales for Croatia to use EUR as currency symbol. (RHEL-140104)\n\n[2.28-251.33]\n- Change the currency symbol for the bg_BG locale to euro. (RHEL-137185)\n\n[2.28-251.32]\n- Improve qsort implementation (RHEL-24169)\n\n[2.28-251.31]\n- CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-142787)\n\n[2.28-251.30]\n- Remove default /var/tmp for LD_PROFILE_OUTPUT (RHEL-142194)\n\n[2.28-251.29]\n- rpminspect.yaml: note that glibc-minimal-langpack is empty (RHEL-123889)",
  "id": "ELSA-2026-20587",
  "ovalId": "oval:com.oracle.elsa:def:202620587",
  "source": "oracle_linux",
  "title": "ELSA-2026-20587:  glibc security update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-20587.html"
}