# Ubuntu releases security updates for GNU C Library to fix multiple vulnerabilities

> **Key takeaway:** Multiple critical vulnerabilities in glibc, including privilege escalation and arbitrary code execution, have been patched across four Ubuntu releases.

**Published:** 2026-11-12T14:08:35+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-releases-security-updates-for-gnu-c-library-to-fix-mu.html 

## Summary
Ubuntu has issued security notice USN-9065-1 to address several vulnerabilities within the GNU C Library (glibc). These flaws affect core system functions, including the dynamic loader, the Name Service Cache Daemon (nscd), and various string and file handling utilities.

The updates impact multiple Ubuntu versions, including 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10. Affected users can mitigate these risks by updating the libc6 package to the specific patched versions provided for their respective release.

## Vulnerability breakdown and affected subsystems
- **Dynamic Loader & Privilege Escalation:** A time-of-check to time-of-use (TOCTOU) race condition in $ORIGIN path expansion for setuid or setgid programs could allow local attackers to execute arbitrary code with elevated privileges (CVE-2026-86805).
- **Memory Safety & Buffer Overflows:** The dynamic loader contains a stack-based buffer overflow during $ORIGIN path expansion, which may lead to crashes or sensitive information disclosure (CVE-2026-95818).
- **File & Environment Handling:** Vulnerabilities in the fopen function's ccs= option (CVE-2026-18374) and the gettext LANGUAGE environment variable (CVE-2026-84243) could allow for arbitrary code execution via path traversal or improper option handling.
- **Network & DNS Services:** The nscd service is susceptible to crashes from large DNS responses (CVE-2026-89092), and long domain names in DNS search lists can cause crashes via local network attacks (CVE-2026-8674).
- **Architecture-Specific Flaws:** An optimization in the strncasecmp function specifically for the Power8 architecture was found to handle certain inputs incorrectly, leading to denial of service (CVE-2026-97399).

## Why it matters
Because glibc is the fundamental interface between the Linux kernel and user-space applications, these vulnerabilities pose a high risk to system stability and security. System administrators must prioritize these updates to prevent local privilege escalation and potential remote denial of service in networked environments.