* [Buildroot] [PATCH v2 2/2] package/{glibc, localedef}: security bump version to 2.44-23-g11ac3d78f
2026-08-08 10:36 [Buildroot] [PATCH v2 1/2] package/{glibc, localedef}: move to Gitlab mirror repo Bernd Kuhls
@ 2026-08-08 10:36 ` Bernd Kuhls
2026-08-08 12:06 ` [Buildroot] [PATCH v2 1/2] package/{glibc, localedef}: move to Gitlab mirror repo Julien Olivain via buildroot
2026-08-14 14:16 ` Titouan Christophe via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Bernd Kuhls @ 2026-08-08 10:36 UTC (permalink / raw)
To: buildroot; +Cc: Romain Naour, Thomas Petazzoni
https://sourceware.org/pipermail/libc-announce/2026/000058.html
Fixes CVE-2026-4046, CVE-2026-4437, & CVE-2026-4438.
host-localedef:
- added build fix
- added Upstream: tag to patch 0002
- rebased patches
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
v2: no changes
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/a3d264f49d5bdd869d3b1c2c2f7cdd63c0c02478
.checkpackageignore | 1 -
package/glibc/glibc.hash | 2 +-
package/glibc/glibc.mk | 38 +---------------
...ACK-only-build-and-install-localedef.patch | 14 +++---
...y-on-GCC-to-4.8-and-binutils-to-2.24.patch | 10 +++--
.../0005-HACK-Fix-dependencies.patch | 43 +++++++++++++++++++
package/localedef/localedef.mk | 2 +-
7 files changed, 59 insertions(+), 51 deletions(-)
create mode 100644 package/localedef/0005-HACK-Fix-dependencies.patch
diff --git a/.checkpackageignore b/.checkpackageignore
index a31ebe8ea2..dc01a80d81 100644
--- a/.checkpackageignore
+++ b/.checkpackageignore
@@ -557,7 +557,6 @@ package/lm-sensors/0001-no-host-ldconfig.patch lib_patch.Upstream
package/lmbench/0001-scripts-build-use-bin-bash-as-shell.patch lib_patch.Upstream
package/lmbench/0002-src-Makefile-add-lmbench-to-list-of-executables.patch lib_patch.Upstream
package/lmbench/0003-TOO_LONG-100-usec-to-prevent-memsize-from-timingout-.patch lib_patch.Upstream
-package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch lib_patch.Upstream
package/lockfile-progs/0001-sus3v-legacy.patch lib_patch.Sob lib_patch.Upstream
package/lshw/0001-solve-Compile-error-when-g-version-is-less-than-5.patch lib_patch.Upstream
package/ltrace/0001-arm-plt.patch lib_patch.Upstream
diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash
index 97862aef14..750d328287 100644
--- a/package/glibc/glibc.hash
+++ b/package/glibc/glibc.hash
@@ -1,5 +1,5 @@
# Locally calculated (fetched from git)
-sha256 647325cc2e9f2c6260f3c48d0385ac5e30cb60d2ec2e5afd649555c518c9bf60 glibc-2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674-git4.tar.gz
+sha256 a818ca8450ef1e19a2413b2c9a2882f381f05be07b31e9b38085b6ba193d0af2 glibc-2.44-23-g11ac3d78fc5e4f7f2846002e099f773ad8ff82fc-git4.tar.gz
# Hashes for license files
sha256 edaef632cbb643e4e7a221717a6c441a4c1a7c918e6e4d56debc3d8739b233f6 COPYINGv2
diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index 797df314e9..7f12e7ffd0 100644
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -7,7 +7,7 @@
# Generate version string using:
# git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
# When updating the version, please also update localedef
-GLIBC_VERSION = 2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
+GLIBC_VERSION = 2.44-23-g11ac3d78fc5e4f7f2846002e099f773ad8ff82fc
GLIBC_SITE = https://gitlab.com/gnutools/glibc.git
GLIBC_SITE_METHOD = git
@@ -19,42 +19,6 @@ GLIBC_CPE_ID_VENDOR = gnu
# allow proper matching with the CPE database.
GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
-# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
-GLIBC_IGNORE_CVES += CVE-2025-8058
-
-# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
-GLIBC_IGNORE_CVES += CVE-2026-0861
-
-# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
-GLIBC_IGNORE_CVES += CVE-2026-0915
-
-# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
-GLIBC_IGNORE_CVES += CVE-2025-15281
-
-# Fixed by glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
-GLIBC_IGNORE_CVES += CVE-2026-4437
-
-# Fixed by glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
-GLIBC_IGNORE_CVES += CVE-2026-4438
-
-# Fixed by glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
-GLIBC_IGNORE_CVES += CVE-2026-4046
-
-# Fixed by glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
-GLIBC_IGNORE_CVES += CVE-2026-5928
-
-# Fixed by glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
-GLIBC_IGNORE_CVES += CVE-2026-5450
-
-# Fixed by glibc-2.43-42-ge64ae5a591f0604b7504df4df631857bb11cc78b
-GLIBC_IGNORE_CVES += CVE-2026-5435
-
-# Fixed by glibc-2.43-43-g3a418da6a3938756763980541e440dbdd46900fb
-GLIBC_IGNORE_CVES += CVE-2026-6238
-
-# Fixed by glibc-2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
-GLIBC_IGNORE_CVES += CVE-2026-6791
-
# This CVE is considered as not being security issues by
# upstream glibc:
# https://security-tracker.debian.org/tracker/CVE-2010-4756
diff --git a/package/localedef/0001-HACK-only-build-and-install-localedef.patch b/package/localedef/0001-HACK-only-build-and-install-localedef.patch
index b7c51c4ed3..33aab4c3dc 100644
--- a/package/localedef/0001-HACK-only-build-and-install-localedef.patch
+++ b/package/localedef/0001-HACK-only-build-and-install-localedef.patch
@@ -11,7 +11,7 @@ Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Romain Naour <romain.naour@gmail.com>
[yann.morin.1998@free.fr: rebase for 2.39]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
-[Bernd: rebase for 2.43]
+[Bernd: rebase for 2.44]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Rules | 14 ++++++++++----
@@ -19,10 +19,10 @@ Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
2 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/Rules b/Rules
-index b07400a979..4ce2180b49 100644
+index 71495028fb..5e1243e44d 100644
--- a/Rules
+++ b/Rules
-@@ -247,10 +247,16 @@ binaries-shared-notests = $(filter-out $(binaries-pie) $(binaries-static), \
+@@ -263,10 +263,16 @@ binaries-shared-notests = $(filter-out $(binaries-pie) $(binaries-static), \
$(binaries-all-notests))
ifneq "$(strip $(binaries-shared-notests))" ""
@@ -44,10 +44,10 @@ index b07400a979..4ce2180b49 100644
ifneq "$(strip $(binaries-shared-tests))" ""
diff --git a/locale/Makefile b/locale/Makefile
-index fc38c02114..c00bc085b4 100644
+index 25f9b5bbce..5cbcd34bd3 100644
--- a/locale/Makefile
+++ b/locale/Makefile
-@@ -76,7 +76,6 @@ aux = \
+@@ -77,7 +77,6 @@ aux = \
xlocale \
# aux
others = \
@@ -55,7 +55,7 @@ index fc38c02114..c00bc085b4 100644
localedef \
# others
#others-static = \
-@@ -84,7 +83,6 @@ others = \
+@@ -85,7 +84,6 @@ others = \
# locale \
# # others-static
install-bin = \
@@ -63,7 +63,7 @@ index fc38c02114..c00bc085b4 100644
localedef \
# install-bin
extra-objs = \
-@@ -96,7 +94,6 @@ extra-objs = \
+@@ -97,7 +95,6 @@ extra-objs = \
generated += C-translit.h
before-compile += $(objpfx)C-translit.h
diff --git a/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch b/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch
index 30799cfc46..518a0489a7 100644
--- a/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch
+++ b/package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch
@@ -23,6 +23,8 @@ GCC 5+
GCC 6.2+
https://sourceware.org/git/?p=glibc.git;a=commit;h=4dcbbc3b28aaeafe23e1a30db84055aa6f6fa987
+Upstream: Not applicable
+
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
[yann.morin.1998@free.fr: update for 2.37]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
@@ -30,17 +32,17 @@ Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@gmail.com>
[yann.morin.1998@free.fr: rebase for 2.39]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
-[Bernd: rebase for 2.43]
+[Bernd: rebase for 2.44]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
configure | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/configure b/configure
-index 0cd2269859..1c7e42ec10 100755
+index 604279533a..9daca5fb98 100755
--- a/configure
+++ b/configure
-@@ -5350,7 +5350,7 @@ printf %s "checking version of $LD... " >&6; }
+@@ -5307,7 +5307,7 @@ printf %s "checking version of $LD... " >&6; }
ac_prog_version=`$LD --version 2>&1 | sed -n 's/^.*GNU ld.* \([0-9][0-9]*\.[0-9.]*\).*$/\1/p'`
case $ac_prog_version in
'') ac_prog_version="v. ?.??, bad"; ac_verc_fail=yes;;
@@ -49,7 +51,7 @@ index 0cd2269859..1c7e42ec10 100755
ac_prog_version="$ac_prog_version, ok"; ac_verc_fail=no;;
*) ac_prog_version="$ac_prog_version, bad"; ac_verc_fail=yes;;
-@@ -5799,7 +5799,7 @@ int
+@@ -5756,7 +5756,7 @@ int
main (void)
{
diff --git a/package/localedef/0005-HACK-Fix-dependencies.patch b/package/localedef/0005-HACK-Fix-dependencies.patch
new file mode 100644
index 0000000000..36e18271d1
--- /dev/null
+++ b/package/localedef/0005-HACK-Fix-dependencies.patch
@@ -0,0 +1,43 @@
+From 8419660a3dcf8e6780365f7298e7d85ca0c5537f Mon Sep 17 00:00:00 2001
+From: Bernd Kuhls <bernd@kuhls.net>
+Date: Sun, 26 Jul 2026 12:17:36 +0200
+Subject: [PATCH] HACK: Fix dependencies
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Upstream commit 7cac99621e9601f916121bcaa9b7734a2e4c2529 changed the
+handling of dependencies which forced the addition of the make target
+'lib' to the target 'others' causing the build of unneeded targets for
+the host build of localedef including build errors:
+
+/home/bernd/buildroot/output/per-package/host-localedef/host/bin/ccache
+ /usr/bin/gcc gconv_simple.c
+[...]
+In file included from <command-line>:
+../include/wchar.h:154:20: error: ‘wcstof128’ undeclared here (not in a function); did you mean ‘wcstof128_l’?
+
+To fix the problem we remove the addition of the 'lib' make target.
+
+Upstream: Not applicable
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index a6aabca691..0ac1a45c36 100644
+--- a/Makefile
++++ b/Makefile
+@@ -581,7 +581,6 @@ endif
+ # 'tests' and 'xtests' additionally require the 'others' pass. The
+ # testroot used by the container tests performs a full installation in
+ # its recipe, which must not run concurrently with the build passes.
+-$(addsuffix /others,$(subdirs)): lib
+ $(addsuffix /tests,$(subdirs)) $(addsuffix /xtests,$(subdirs)): others
+ $(objpfx)testroot.pristine/install.stamp: | others
+
+--
+2.47.3
+
diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk
index 8eff7f136d..7a6aa8a043 100644
--- a/package/localedef/localedef.mk
+++ b/package/localedef/localedef.mk
@@ -7,7 +7,7 @@
# Use the same VERSION and SITE as target glibc
# As in glibc.mk, generate version string using:
# git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
-LOCALEDEF_VERSION = 2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
+LOCALEDEF_VERSION = 2.44-23-g11ac3d78fc5e4f7f2846002e099f773ad8ff82fc
LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION)$(BR_FMT_VERSION_git).tar.gz
LOCALEDEF_SITE = https://gitlab.com/gnutools/glibc.git
LOCALEDEF_SITE_METHOD = git
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 4+ messages in thread