Important Crash Information Leak Vulnerabilities in Fedora 42 glibc 2026

The glibc package contains standard libraries which are used by

multiple programs on the system. In order to save disk space and

memory, as well as to make upgrading easier, common system code is

kept in one place and shared between programs. This particular package

contains the most important sets of shared libraries: the standard C

library and the standard math library. Without these two libraries, a

Linux system will not function.

This update switches the currency symbol for Bulgaria to the Euro. Furthermore, it addresses several security vulnerabilities: A crash when wordexp is used with WRDE_REUSE (CVE-2025-15281) Information leakage from the stack if getnetbyaddr is called for the zero address (CVE-2026-0915) An integer overflow in memalign and related functions if they are called with out-of-bounds size/alignment combinations (CVE-2026-0861) LD_PROFILE is now ignored with a warning if LD_PROFILE_OUTPUT is not specified, rather than using the insecure /var/tmp default. The changes updates from the upstream stable release branch are applied: nptl: Optimize trylock for high cache contention workloads (BZ #33704) (Sunil K Pandey) sprof: fix -Wformat warnings on 32-bit hosts (Collin Funk) sprof: check pread size and offset for overflow (DJ Delorie)