Update glibc from 2.36 to 2.43 #3354

Paul Menzel (pmenzel) · 2026-05-01T20:02:48Z

Update with

$ sudo bee remove glibc-memusage-fixup-2.36-0.x86_64 && sudo bee install libxcrypt-4.5.2 && sudo bee update glibc-2.43

Tested on dose: SSH and sudo work afterward. Restarting dose with sudo mxgrub --reboot also worked.
Tested on maleficent (amdgpu): Xfce keeps running and working while doing the glibc update.
Test on afk with HTTPD servers

Paul Menzel (pmenzel) · 2026-05-01T20:04:54Z

Currently breaks PAM, and therefore SSH and sudo.

$ ssh dose
Connection closed by 141.14.17.51 port 22

@dose:~$ sudo bee remove glibc-memusage-fixup-2.36-0.x86_64
sudo: PAM account management error: Module is unknown
sudo: a password is required
$ su
su: Module is unknown

I’ll fix dose in the next days.

Thomas Kreitler (thomas) · 2026-05-02T09:19:12Z

Maybe this is related to the removal/deprecation of libcrypt.so.1 in glibc 2.38 /1/ ?
I guess introducing libxcrypt /2/ will solve the issue.

/1/ https://sourceware.org/glibc/wiki/Release/2.38#Building_libcrypt_is_disabled_by_default
/2/ https://github.com/besser82/libxcrypt

Paul Menzel (pmenzel) · 2026-05-05T20:38:59Z

Thomas Kreitler (@thomas), thank you for the tip. That was indeed it. After

$ sudo bee install libxcrypt-4.5.2
$ sudo bee update glibc-2.43

sudo still works, and I am able to log in over SSH.

Paul Menzel (pmenzel) · 2026-05-27T12:54:56Z

Tested on maleficent.

Donald Buczek (donald) · 2026-05-27T14:07:54Z

tested on theinternet

Donald Buczek (donald) · 2026-06-03T05:03:53Z

Possible problem: mariux64/mariux64-issues#217

glibc.be0

Donald Buczek (donald) · 2026-06-26T12:24:39Z

Can we get C.UTF8 locale?

Peter Marquardt (wwwutz) · 2026-06-26T21:44:36Z

Can we get C.UTF8 locale?

Are there cookies included ? Ice ?

Go for it.

Release notes: https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;hb=refs/tags/glibc-2.43

glibc 2.43 already contains the three fixes below, so drop the patches: glibc-linux-Fix-sys-mount.h-usage-with-kernel-headers.patch glibc-2.36-0004-tunables-Terminate-if-end-of-input-is-reached-CVE-2023-4911.patch glibc-2.36-Makerules-fix-MAKEFLAGS-assignment-for-upcoming-make.patch The two ldconfig patches are MarIuX specific and have to stay.

Update to the latest stable Linux release, so glibc is built against up to date kernel headers.

Building glibc 2.43 against the Linux 7.0 headers fails, because glibc's <sys/mount.h> and the kernel's <linux/mount.h> both define OPEN_TREE_CLONE, and the two definitions differ: In file included from ../sysdeps/unix/sysv/linux/include/sys/mount.h:22, from ../sysdeps/unix/sysv/linux/umount.c:18: ../sysdeps/unix/sysv/linux/sys/mount.h:268: error: "OPEN_TREE_CLONE" redefined [-Werror] 268 | #define OPEN_TREE_CLONE 1 /* Clone the target tree and attach the clone */ | In file included from ../sysdeps/unix/sysv/linux/sys/mount.h:32: /usr/include/linux/mount.h:64: note: this is the location of the previous definition 64 | #define OPEN_TREE_CLONE (1 << 0) /* Clone the target tree and attach the clone */ | In file included from ../sysdeps/unix/sysv/linux/include/sys/mount.h:22, from ../sysdeps/unix/sysv/linux/umount2.c:19: ../sysdeps/unix/sysv/linux/sys/mount.h:268: error: "OPEN_TREE_CLONE" redefined [-Werror] 268 | #define OPEN_TREE_CLONE 1 /* Clone the target tree and attach the clone */ | In file included from ../sysdeps/unix/sysv/linux/sys/mount.h:32: /usr/include/linux/mount.h:64: note: this is the location of the previous definition 64 | #define OPEN_TREE_CLONE (1 << 0) /* Clone the target tree and attach the clone */ | cc1: all warnings being treated as errors cc1: all warnings being treated as errors make[2]: *** [/dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/sysd-rules:263: /dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/misc/umount.os] Error 1 make[2]: *** Waiting for unfinished jobs.... make[2]: *** [/dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/sysd-rules:263: /dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/misc/umount2.os] Error 1 cc1: all warnings being treated as errors cc1: all warnings being treated as errors make[2]: *** [/dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/sysd-rules:247: /dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/misc/umount.o] Error 1 make[2]: *** [/dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/sysd-rules:247: /dev/shm/bee-pmenzel/glibc/glibc-2.43-0/build/misc/umount2.o] Error 1 make[2]: Leaving directory '/dev/shm/bee-pmenzel/glibc/glibc-2.43-0/source/misc' make[1]: *** [Makefile:484: misc/subdir_lib] Error 2 make[1]: Leaving directory '/dev/shm/bee-pmenzel/glibc/glibc-2.43-0/source' make: *** [Makefile:20: all] Error 2 So go back to the 6.18 series, whose headers glibc 2.43 builds against.

Building glibc 2.43 against the Linux 7.0 headers fails, because glibc's <sys/mount.h> redefines OPEN_TREE_CLONE, which the kernel's <linux/mount.h> already defines: ../sysdeps/unix/sysv/linux/sys/mount.h:268: error: "OPEN_TREE_CLONE" redefined [-Werror] 268 | #define OPEN_TREE_CLONE 1 /* Clone the target tree and attach the clone */ So backport the two upstream commits fixing bug 33921 [1]: Commit 419245719ccb ("include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h", 2026-01-26) stops <sys/mount.h> from pulling in <fcntl.h>, and commit d12b017cddfe ("Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)", 2026-03-04) only defines the OPEN_TREE_* macros if the kernel headers did not already define them. [1]: https://sourceware.org/bugzilla/show_bug.cgi?id=33921

`--enable-kernel` tells glibc the oldest Linux version it has to support at runtime. The higher the version, the more compatibility code glibc can drop, but the resulting binaries refuse to start on older kernels. Raise it from 5.15.77 to the current Linux release 7.0.3.

glibc 2.38 stopped building libcrypt by default [1]: * libcrypt is no longer built by default; one may use the "--enable-crypt" option to build libcrypt. libcrypt is likely to be removed from the GNU C Library in a future release; we recommend that distributions and applications port away from it to an alternative such as libxcrypt. As `glibc.be0` does not pass `--enable-crypt`, updating glibc to 2.43 leaves MarIuX without `libcrypt.so.1` and `<crypt.h>`. So add libxcrypt, the replacement recommended above, which by default (`--enable-obsolete-api=yes`) ships a `libcrypt.so.1` compatible with the one from glibc. [1]: https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;hb=refs/tags/glibc-2.38

libxcrypt requires Perl 5.14 or later — `configure.ac` calls `zw_PROG_PERL([5.14.0])` and uses Perl to generate the hash tables and the symbol version floor — but MarIuX' system Perl is 5.12.1, so `configure` aborts with *Perl version 5.14.0 or later is required*. So source the profile of the packaged Perl 5.34.0.

Requiring Linux 7.0.3 makes the glibc binaries refuse to start on every kernel MarIuX currently ships, the oldest being 5.15.77: $ fakeroot bee list linux | grep ^linux linux-5.15.77-440.x86_64 linux-5.15.86-443.x86_64 linux-5.15.94-447.x86_64 linux-5.15.112-449.x86_64 linux-5.15.131-457.x86_64 linux-5.15.160-476.x86_64 linux-6.1.53-458.x86_64 linux-6.6.12-461.x86_64 linux-6.6.35-477.x86_64 linux-6.12.11-479.x86_64 linux-6.12.29-483.x86_64 linux-6.12.40-484.x86_64 linux-6.12.49-487.x86_64 linux-6.12.74-489.x86_64 linux-firmware-20230804_p7_g789aa815-2.x86_64 linux-headers-6.15.3-0.x86_64 So lower `--enable-kernel` to 5.15 again.

`mee_install_post()` only generates the locales listed there, and C.UTF-8 is not among them. It is the locale independent UTF-8 locale more and more programs expect, and without it `LC_ALL=C.UTF-8` fails and programs fall back to the ASCII only C locale. So generate it, too.

Donald Buczek (donald) · 2026-09-23T14:36:26Z

When we update we need to make sure, that fixes for these are included:

GLIBC-SA-2026-0022:
===================
AT_SECURE programs may load attacker-controlled code via $ORIGIN

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic
loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44
allows a local attacker to escalate privileges. When expanding $ORIGIN
in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the
lexically normalized search path against the trusted directories but
then opens the raw, un-normalized path. On systems where the Linux
fs.protected_hardlinks sysctl is disabled, a local attacker who
hard-links such a program into an attacker-controlled directory and wins
a race to replace an intermediate path component with a symbolic link
can direct the loader outside the trusted directory, causing it to load
an attacker-controlled shared object and execute arbitrary code with the
elevated privileges of the program.

Exploitation requires an installed setuid or setgid binary whose DT_RPATH
uses $ORIGIN followed by ".." traversal that normalizes into a trusted
directory, and the ability to hard-link that binary and win the race by
swapping a path component for a symbolic link. Major Linux-based OS
distributions ship with fs.protected_hardlinks enabled by default and
mitigate the vulnerability.

CVE-Id: CVE-2026-86805
Public-Date: 2026-07-06
Vulnerable-Commit: 47c3cd7a74e8c089d60d603afce6d9cf661178d6 (2.13-113)
Fix-Commit: ed0c137b97eb940b4b64981e84ed806d3276edd9 (2.45)
Reported-by: Jann Horn [<jannh@google.com>](mailto:jannh@google.com)
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L - 6.3

GLIBC-SA-2026-0023:
===================
AT_SECURE program buffer overflow via $ORIGIN processing

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C
Library (glibc) versions 2.14 through 2.44 allows a local attacker to
crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.

When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is
followed by NUL or '/' the loader both reads past the end of the path
buffer and writes past the end of a stack-allocated internal buffer.
The corrupted loader stack can lead to a loader crash (denial of
service) and limited disclosure of process memory.

CVE Id: CVE-2026-95818
Public-Date: 2026-08-14
Vulnerable-Commit: 47c3cd7a74e8c089d60d603afce6d9cf661178d6 (2.13-113)
Fix-Commit: ed0c137b97eb940b4b64981e84ed806d3276edd9 (2.45)
Reported-by: AISLE in partnership with Red Hat
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - 3.6

Donald Buczek (donald) · 2026-10-08T07:58:21Z

The patches are not in 2.43 and they don't apply naively to 2.43. They are complex, adding new modules. 2.45 is not yet released, last tag in git://sourceware.org/git/glibc.git is glibc-2.44. 2.45 is development branch, expected February 2027. I think we shouldn't risk to update to master. So the patches will not be included this time. Paul Menzel (@pmenzel): Can I merge and distribute this as is now before the power shutdown tomorrow?

Paul Menzel (pmenzel) · 2026-10-08T08:04:37Z

Yes, go ahead. I wanted to clean up the commit history a little, but it’s good enough.

$ ls -l --full-time /src/mariux/beeroot/bee-files/glibc-2.43-0.bee
-rw-r--r-- 1 pmenzel pmenzel 4070 2026-07-01 12:14:21.935465647 +0200 /src/mariux/beeroot/bee-files/glibc-2.43-0.bee
$ grep enable-kernel /src/mariux/beeroot/bee-files/glibc-2.43-0.bee
        --enable-kernel=5.15 \

Looks like this was resolved and closed, no idea, why github still shows it.

Donald Buczek (donald) · 2026-10-08T08:11:27Z

Oh dear

buczek@deinemuddah:~/git/bee-files (master)$ sudo -s
sudo: PAM account management error: Module is unknown
sudo: a password is required
buczek@deinemuddah:~/git/bee-files (master)$ 

buczek@afk:~$ ssh root@deinemuddah
kex_exchange_identification: read: Connection reset by peer
Connection reset by 141.14.30.156 port 22
buczek@afk:~$

Donald Buczek (donald) · 2026-10-08T08:13:59Z

Forgot the libxcrypt :-)

Donald Buczek (donald) · 2026-10-08T08:20:27Z

Hmm. Removal of glibc-memusage-fixup was not part of the PR. Did it nontheless and made sure glibc versions are in place.

Peter Marquardt (wwwutz) · 2026-10-08T08:21:06Z

static. static. static.

Donald Buczek (donald) previously requested changes Jun 11, 2026

View reviewed changes

glibc.be0 Outdated Show resolved Hide resolved

Paul Menzel (pmenzel) added 11 commits August 1, 2026 08:24

glibc: Update version from 2.36 to 2.43

df8e85f

Release notes: https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;hb=refs/tags/glibc-2.43

linux-headers: Update version from 6.15.3 to 7.0.3

50d0e50

Update to the latest stable Linux release, so glibc is built against up to date kernel headers.

libxcrypt: Download source archive from beehive.molgen.mpg.de

2452ab8

Paul Menzel (pmenzel) force-pushed the update-glibc-from-2.36-to-2.43 branch from 761da85 to 63302e1 Compare August 1, 2026 08:47

Donald Buczek (donald) merged commit 35a665f into master Oct 8, 2026

Donald Buczek (donald) mentioned this pull request Oct 8, 2026

glibc-memusage-fixup: Remove #3467

Merged

Update glibc from 2.36 to 2.43 #3354

Update glibc from 2.36 to 2.43 #3354

Uh oh!

Conversation

Paul Menzel (pmenzel) commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Paul Menzel (pmenzel) commented May 1, 2026

Uh oh!

Thomas Kreitler (thomas) commented May 2, 2026

Uh oh!

Paul Menzel (pmenzel) commented May 5, 2026

Uh oh!

Paul Menzel (pmenzel) commented May 27, 2026

Uh oh!

Donald Buczek (donald) commented May 27, 2026

Uh oh!

Donald Buczek (donald) commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Donald Buczek (donald) commented Jun 26, 2026

Uh oh!

Peter Marquardt (wwwutz) commented Jun 26, 2026

Uh oh!

Donald Buczek (donald) commented Sep 23, 2026

Uh oh!

Donald Buczek (donald) commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Paul Menzel (pmenzel) commented Oct 8, 2026

Uh oh!

Donald Buczek (donald) commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Donald Buczek (donald) commented Oct 8, 2026

Uh oh!

Donald Buczek (donald) commented Oct 8, 2026

Uh oh!

Peter Marquardt (wwwutz) commented Oct 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Paul Menzel (pmenzel) commented May 1, 2026 •

edited

Loading

Donald Buczek (donald) commented Jun 3, 2026 •

edited

Loading

Donald Buczek (donald) commented Oct 8, 2026 •

edited

Loading

Donald Buczek (donald) commented Oct 8, 2026 •

edited

Loading