Hi, On Sun, Oct 11, 2026 at 07:00:17PM +0200, Tobias Frost wrote: > Short Update: > > the below poc stop crashing when applying the upstream fix for > CVE-2026-85091 [1]. Additionally, there are many upstream marked as > "fixed with df84af2", e.g. some of the issues in the table of > [2], e.g upstram issues #1256, #1286, #1292, #1302, #1307 [3], > so this fix caused a lot of issues. > > CVE-2026-85091 defined its scope to the non-blocking calls, however > whether the non-non-blocking issues will have a dedicated CVE will > depend on upstream view on this issue.
Correct, we asked both upstream but so far with no answer on it. > For LTS/ELTS I will at this time go with CVE-2026-85091 when preparing > the updates, but the first step will be to fix unstable. For unstable I already proposed a debdiff here in https://bugs.debian.org/1146895#27 but after talking to Mark (Cc'ed) I understand he prefers to upload a new upstream version instread. In any case my debdiff would be still ready and is tested on https://debusine.debian.net/debian/developers/work-request/1293184/ . If Mark is OTOH fine with it I can upload my NMU fixing the issue. Regards, Salvatore
