CLSA-2026-1787401254
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787401254.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787401254
- Upstream
- Published
- 2026-08-24T08:04:07Z
- Modified
- 2026-10-26T09:31:52Z
- Summary
- Fix CVE(s): CVE-2026-29111
- Details
-
- CVE-2026-29111: validate the GetUnitByControlGroup cgroup path
- debian/patches/CVE-2026-29111.patch: an unprivileged D-Bus caller could hand PID 1 a cgroup path that is neither absolute nor normalized via the GetUnitByControlGroup method, which on v249 and older overwrites stack memory with attacker-controlled content. Validate with path_is_absolute() and path_is_normalized() before manager_get_unit_by_cgroup().
- test: skip the meson suite on armel
- debian/rules: the debian10-els armel worker runs under qemu-user (TCG) rather than native ARM hardware, so nine tests abort and two time out on interfaces qemu does not emulate (raw clone(), PR_SET_MM_ARG_*, SO_ATTACH_FILTER, netlink, netns, SIGBUS), and test-capability crashes the emulator itself. None of it is reachable from the package source. The full suite still runs on amd64 and arm64.
- test: fix two test failures on the current build nodes
- debian/patches/test-seccomp-accept-ENOSYS-from-sysctl-2-too.patch: _sysctl(2) was removed from the kernel and now fails with ENOSYS rather than EFAULT, so test_protect_sysctl() aborted (upstream commit 0af05e485a3a).
- debian/patches/fs-util-do-not-chmod-symlinks-in-touch_file.patch: touch_file() chmod()ed symlinks through /proc/self/fd, which newer kernels reject, so test_touch_file() aborted. Skip the chmod() for symlinks as upstream does in fchmod_and_chown(), and drop the now meaningless mode assertion from the test.
- CVE-2026-29111: validate the GetUnitByControlGroup cgroup path
- References