Skip to content

Patch musl's CVE-2026-6042 and CVE-2026-40200#155171

Open
cuviper wants to merge 1 commit intorust-lang:mainfrom
cuviper:musl-cves
Open

Patch musl's CVE-2026-6042 and CVE-2026-40200#155171
cuviper wants to merge 1 commit intorust-lang:mainfrom
cuviper:musl-cves

Conversation

@cuviper
Copy link
Copy Markdown
Member

@cuviper cuviper commented Apr 11, 2026 •
edited
Loading

Neither is relevant to Rust itself, but they could be used in mixed-language projects that link with our self-contained/libc.a.

@rustbot rustbot added A-CI Area: Our Github Actions CI A-testsuite Area: The testsuite used to check the correctness of rustc S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-infra Relevant to the infrastructure team, which will review and decide on the PR/issue. labels Apr 11, 2026
@rustbot
Copy link
Copy Markdown
Collaborator

rustbot commented Apr 11, 2026

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

  • Owners of files modified in this PR: infra-ci
  • infra-ci expanded to Kobzol, Mark-Simulacrum, jdno, jieyouxu, marcoieni
  • Random selection from Mark-Simulacrum, jdno, marcoieni

@cuviper
Copy link
Copy Markdown
Member Author

cuviper commented Apr 11, 2026

Nominating for 1.96-beta and 1.95-stable.

@rustbot label +beta-nominated +stable-nominated

@rustbot rustbot added beta-nominated Nominated for backporting to the compiler in the beta channel. stable-nominated Nominated for backporting to the compiler in the stable channel. labels Apr 11, 2026
@cuviper
Copy link
Copy Markdown
Member Author

cuviper commented Apr 11, 2026

@bors try jobs=dist-arm-linux-musl,dist-i586-gnu-i586-i686-musl,dist-various-1,dist-various-2,dist-x86_64-musl,test-various

@rust-bors

This comment has been minimized.

Sign in to view
rust-bors bot pushed a commit that referenced this pull request Apr 11, 2026
@bors
Auto merge of #155171 - cuviper:musl-cves, r=<try>
c072ac5 
Patch musl's CVE-2026-6042 and CVE-2025-26519


try-job: dist-arm-linux-musl
try-job: dist-i586-gnu-i586-i686-musl
try-job: dist-various-1
try-job: dist-various-2
try-job: dist-x86_64-musl
try-job: test-various
@cuviper cuviper changed the title Patch musl's CVE-2026-6042 and CVE-2025-26519 Patch musl's CVE-2026-6042 and CVE-2026-40200 Apr 11, 2026
@cuviper
Patch musl's CVE-2026-6042 and CVE-2026-40200
8830551 
- [CVE-2026-6042] is a denial of service in `iconv`.
- [CVE-2026-40200] is an out-of-bounds write in `qsort`.

Neither is relevant to Rust itself, but they could be used in mixed-
language projects that link with our `self-contained/libc.a`.

[CVE-2026-6042]: https://www.openwall.com/lists/oss-security/2026/04/09/19
[CVE-2026-40200]: https://www.openwall.com/lists/musl/2026/04/10/3
@cuviper
Copy link
Copy Markdown
Member Author

cuviper commented Apr 11, 2026

Sorry, I mixed up my CVE numbers and links when writing the commit message, now fixed. The patches were the right ones though, so the try build should still be testing the right thing.

@Mark-Simulacrum
Copy link
Copy Markdown
Member

Mark-Simulacrum commented Apr 11, 2026

r=me in principle, and I think I'll probably pull this into stable artifact building ~Monday. Not sure we really have a team to approve the backport (compiler? libs?) but it feels like it should be uncontroversial.

@rust-bors
Copy link
Copy Markdown
Contributor

rust-bors bot commented Apr 12, 2026

☀️ Try build successful (CI)
Build commit: c072ac5 (c072ac5e4268735cbce40bf48eccf5a70e127378, parent: bf4fbfb7a18d74e7cd8eef93af7329c58fbb5344)

@Mark-Simulacrum
Copy link
Copy Markdown
Member

Mark-Simulacrum commented Apr 12, 2026

@bors r+ p=1

@rust-bors
Copy link
Copy Markdown
Contributor

rust-bors bot commented Apr 12, 2026

📌 Commit 8830551 has been approved by Mark-Simulacrum

It is now in the queue for this repository.

@rust-bors rust-bors bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@Mark-Simulacrum Mark-Simulacrum

Labels

A-CI Area: Our Github Actions CI A-testsuite Area: The testsuite used to check the correctness of rustc beta-nominated Nominated for backporting to the compiler in the beta channel. S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. stable-nominated Nominated for backporting to the compiler in the stable channel. T-infra Relevant to the infrastructure team, which will review and decide on the PR/issue.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@cuviper @rustbot @Mark-Simulacrum