Changes between v2.42.2 and v2.42.3 -------------------------------------------- commit 6f20a5defcf9066d4d2af372424a1576bd3d495d Author: Karel Zak Date: Tue Sep 1 14:57:28 2026 +0200 build-sys: update release dates Signed-off-by: Karel Zak NEWS | 2 +- configure.ac | 2 +- meson.build | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 66948689075ec0af9ac68913e13478ee889f7ddd Author: Karel Zak Date: Tue Sep 1 14:57:19 2026 +0200 docs: update v2.42.3-ReleaseNotes Signed-off-by: Karel Zak Documentation/releases/v2.42.3-ReleaseNotes | 121 ++++++++++++++++++++++++++++ 1 file changed, 121 insertions(+) commit d3c9b8e480746109a5335dae63db3b3b75dc9675 Author: Karel Zak Date: Tue Sep 1 14:52:12 2026 +0200 tests: (partx) settle udev before checking partition count Signed-off-by: Karel Zak (cherry picked from commit e0e6a73a5a7ae78fdbaea72b742d55ddda5f3a2d) tests/ts/partx/partx | 1 + 1 file changed, 1 insertion(+) commit c3abbc15745ced1155d679ea6be45d48d1102b03 Author: Karel Zak Date: Tue Sep 1 13:15:13 2026 +0200 po: merge changes po/ar.po | 725 ++-- po/ca.po | 725 ++-- po/cs.po | 725 ++-- po/da.po | 731 ++-- po/de.po | 725 ++-- po/es.po | 9633 +++++++++++++++++++++++++++++++---------------------- po/et.po | 725 ++-- po/eu.po | 725 ++-- po/fi.po | 731 ++-- po/fr.po | 725 ++-- po/gl.po | 725 ++-- po/hr.po | 725 ++-- po/hu.po | 725 ++-- po/id.po | 725 ++-- po/it.po | 739 ++-- po/ja.po | 725 ++-- po/ka.po | 725 ++-- po/ko.po | 725 ++-- po/nl.po | 725 ++-- po/pl.po | 725 ++-- po/pt.po | 725 ++-- po/pt_BR.po | 725 ++-- po/ro.po | 725 ++-- po/ru.po | 731 ++-- po/sk.po | 725 ++-- po/sl.po | 725 ++-- po/sr.po | 725 ++-- po/sv.po | 725 ++-- po/tr.po | 2174 ++++++------ po/uk.po | 725 ++-- po/util-linux.pot | 727 ++-- po/vi.po | 731 ++-- po/zh_CN.po | 2175 ++++++------ po/zh_TW.po | 725 ++-- 34 files changed, 19114 insertions(+), 17383 deletions(-) commit 38105b1c0e0f9e723b511efb3af0f5a9a3f7f6c1 Author: Boyuan Yang <073plan@gmail.com> Date: Tue Sep 1 13:15:04 2026 +0200 po: update zh_CN.po (from translationproject.org) po/zh_CN.po | 2301 ++++++++++++++++++++++++++++------------------------------- 1 file changed, 1089 insertions(+), 1212 deletions(-) commit 52c685b2b671d20ee394999214910da9fbba2eb8 Author: Emir SARI Date: Tue Sep 1 13:15:04 2026 +0200 po: update tr.po (from translationproject.org) po/tr.po | 2454 +++++++++++++++++++++++++++++--------------------------------- 1 file changed, 1144 insertions(+), 1310 deletions(-) commit 219c739ff3d50c56a8b226e7c3917829ed849907 Author: Antonio Ceballos Roa Date: Tue Sep 1 13:15:04 2026 +0200 po: update es.po (from translationproject.org) po/es.po | 9702 ++++++++++++++++++++++++++------------------------------------ 1 file changed, 4031 insertions(+), 5671 deletions(-) commit 2194861f88b0787154f9ef897008330603466874 Author: Karel Zak Date: Tue Sep 1 13:15:01 2026 +0200 po-man: merge changes po-man/ar.po | 1791 +-- po-man/cs.po | 1953 +-- po-man/de.po | 1791 +-- po-man/es.po | 1887 +-- po-man/fr.po | 1791 +-- po-man/ko.po | 1929 +-- po-man/pl.po | 33579 +++++++++++++++++++++++++++++++++++--------- po-man/pt_BR.po | 1855 +-- po-man/ro.po | 1791 +-- po-man/sr.po | 1791 +-- po-man/sv.po | 1791 +-- po-man/uk.po | 1791 +-- po-man/util-linux-man.pot | 1949 +-- 13 files changed, 37896 insertions(+), 17793 deletions(-) commit 94faad8b45838b3e2784604c125d9145dfa6c658 Author: Michał Kułach Date: Tue Sep 1 13:14:49 2026 +0200 po-man: update pl.po (from translationproject.org) po-man/pl.po | 35743 +++++++++++++++------------------------------------------ 1 file changed, 9082 insertions(+), 26661 deletions(-) commit 1d14676ea70003e9f5b2a6a76af0cadb1190411a Author: Karel Zak Date: Tue Jul 28 11:40:25 2026 +0200 libmount: skip post-mount hooks after failed mount helper [CVE-2026-76642] When an external mount. helper exits nonzero, exec_helper() stores the failure in helper_status but returns zero (meaning the fork/exec/wait infrastructure succeeded). This zero propagates as the mount result, causing MNT_STAGE_MOUNT_POST and MNT_STAGE_POST hooks to execute as if the mount had succeeded. This allows privileged post-mount operations on the pre-existing target filesystem: - X-mount.idmap clones and idmaps the underlying target, creating an overmount that inherits suid/exec from the root filesystem (ignoring nosuid/nodev/noexec from fstab) - X-mount.owner/group/mode changes the physical target inode ownership and permissions even though no mount was created Gate both MNT_STAGE_MOUNT_POST in mnt_context_do_mount() and MNT_STAGE_POST in mnt_context_mount() on is_success_status(), which already correctly distinguishes helper exit status from process execution status. This is a centralized fix -- individual hooks do not need their own guards. Audit of all hooks registered at these stages: MNT_STAGE_MOUNT_POST: - hook_mount.c (attach, propagation, vfsflags): already skip when helper executed (commit f94a7760) - hook_idmap.c: would clone+idmap pre-existing target -- now blocked - hook_subdir.c: deinit calls tmptgt_cleanup() -- safe - hook_mount_legacy.c (propagation, bindremount): no resources to leak - hook_loopdev.c: deinit fixed to call delete_loopdev() when the cleanup hook is skipped (was only free(), leaking fd and device) - hook_veritydev.c: deinit calls delete_veritydev() -- safe MNT_STAGE_POST: - hook_owner.c: would chown/chmod target -- now blocked; deinit only frees uid/gid/mode struct, no resources to leak Signed-off-by: Karel Zak (cherry picked from commit f57cea130839c0af8dc0525274267ae4cfd66bbf) libmount/src/context_mount.c | 23 ++++++++++++++++++++--- libmount/src/hook_loopdev.c | 13 +++++++++++-- 2 files changed, 31 insertions(+), 5 deletions(-) commit 9a8d0d60c55d3a55f89f6f75a17bae31bc5ee1c6 Author: Karel Zak Date: Mon Jul 20 14:59:21 2026 +0200 libmount: pin source path with openat2() for restricted users [CVE-2026-78410] In restricted (non-root) mode, mnt_context_open_tree() resolves the source path via open_tree(AT_FDCWD, path, ...) which follows symlinks in intermediate path components. A local attacker who can replace the fstab-authorized bind source path or an ancestor with a symlink can redirect the privileged mount operation to an arbitrary directory. When combined with X-mount.owner/group/mode the post-mount hook applies root-privileged chown/chmod to the bind source inode, giving a local ownership/permission modification primitive on paths not authorized by fstab. Fix by using mnt_open_tree() with RESOLVE_NO_SYMLINKS in restricted mode. Also fix hook_idmap.c fallback open_tree() call to use the same pattern. Unrestricted (root) callers pass resolve=0 and get the direct open_tree() path. Signed-off-by: Karel Zak (cherry picked from commit fb8e2653553ce2ecd077a294d53a1422d7c6dbc0) libmount/src/context.c | 4 +++- libmount/src/hook_idmap.c | 6 ++++-- 2 files changed, 7 insertions(+), 3 deletions(-) commit 6051830a27a852fed92ebd8493e57aa3d5d9cf18 Author: Karel Zak Date: Thu Jul 9 16:10:08 2026 +0200 libmount: restrict source path canonicalization for non-root users [CVE-2026-78410] In restricted (suid, non-root) mode, mnt_context_prepare_srcpath() calls realpath() as euid=0 to canonicalize the source path. This follows symlinks through directories where the real user has write access (e.g. /home/user/), allowing redirection to arbitrary files. Only canonicalize /dev/ paths (e.g. /dev/cdrom -> /dev/sr0) and verify the result stays within /dev/. For non-/dev/ paths (e.g. disk images in user-writable directories), keep the original fstab path. Symlink protection for these paths is handled at open time by RESOLVE_NO_SYMLINKS in ul_open_no_symlinks(). This is a follow-up to commits: 5e390467b ("loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks") d07aad41e ("libmount: ignore X-mount.nocanonicalize for restricted users") Signed-off-by: Karel Zak (cherry picked from commit e554245ccc165fcdd4b8ba68bf2994ee14b98607) libmount/src/context.c | 17 ++++++++++++++++- sys-utils/mount.8.adoc | 12 +++++++++--- 2 files changed, 25 insertions(+), 4 deletions(-) commit ce4e181aa967a06079851410d82ca4428341ba7b Author: Karel Zak Date: Mon Jul 20 14:45:35 2026 +0200 libmount: fix X-mount.subdir symlink following on detached tree [CVE-2026-78409] The open_tree() call used to open a subdirectory on a detached mount (fsmount() result) follows symlinks in intermediate path components, allowing escape from the detached tree. Replace direct open_tree(fd, subdir, ...) with mnt_open_tree() that uses openat2(RESOLVE_NO_SYMLINKS | RESOLVE_BENEATH) to safely resolve the subdir path within the detached tree, then clone it with open_tree(AT_EMPTY_PATH). Also strip leading '/' from X-mount.subdir= value early in is_subdir_required() to ensure relative path resolution. Signed-off-by: Karel Zak (cherry picked from commit ed072cf2297b68f86af8e08209907f605dd42e5d) libmount/src/hook_mount.c | 14 ++++++++++---- libmount/src/hook_subdir.c | 8 ++++++++ 2 files changed, 18 insertions(+), 4 deletions(-) commit 90a1f3b5b134b775dd30a46155064731ba40c519 Author: Karel Zak Date: Mon Jul 20 14:40:16 2026 +0200 libmount: add mnt_open_tree() helper for safe tree opening Add mnt_open_tree() that combines openat2() path pinning with open_tree() into a single call. When resolve flags are non-zero, the path is first pinned with ul_openat_resolve(), then cloned with open_tree(AT_EMPTY_PATH). When resolve is zero, open_tree() is called directly. This consolidates the openat2+open_tree pattern used for symlink protection in restricted mount operations. Signed-off-by: Karel Zak (cherry picked from commit 37afc15d9e5a0accea94eb067b151e21f8494880) libmount/src/mountP.h | 2 ++ libmount/src/utils.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) commit 1426aa06ff2f6a21cba9102c35e3577641b356ff Author: Karel Zak Date: Mon Jul 20 14:36:16 2026 +0200 lib/fileutils: add ul_openat_resolve() openat2 wrapper Add ul_openat_resolve() as a generic openat2(2) wrapper with caller-specified resolve flags. No fallback to weaker alternatives -- returns -1/ENOSYS if openat2 is unavailable. Rewrite ul_open_no_symlinks() to use ul_openat_resolve() with RESOLVE_NO_SYMLINKS, dropping the unsafe O_NOFOLLOW fallback that only protected the final path component. Add fallback defines for RESOLVE_NO_SYMLINKS and RESOLVE_BENEATH in fileutils.h. Signed-off-by: Karel Zak (cherry picked from commit b9e07ce6f5ad54c38cf3ebc7100101e487be91bd) include/fileutils.h | 9 +++++++++ lib/fileutils.c | 22 ++++++++++++++-------- 2 files changed, 23 insertions(+), 8 deletions(-) commit 3d9e4d5ec49662570b32046e61a7c8deacfafd34 Author: Karel Zak Date: Tue Jul 28 12:41:12 2026 +0200 nsenter, unshare: add O_CLOEXEC to all open() calls [CVE-2026-78408] Add O_CLOEXEC (and EFD_CLOEXEC for eventfd) as defense in depth to all file descriptor creation sites in nsenter and unshare. All these descriptors are already explicitly closed before exec, but O_CLOEXEC provides a safety net against future code changes that might accidentally introduce a leak path. No functional change. Signed-off-by: Karel Zak (cherry picked from commit 003c622428f09fc6544ed06b533d278dc14f88e0) sys-utils/nsenter.c | 8 ++++---- sys-utils/unshare.c | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) commit f358b098d47659837d85b66fb387201224b272a0 Author: Karel Zak Date: Mon Aug 24 16:37:28 2026 +0200 wall, write: sanitize hostname in banner header The CVE-2024-28085 fix sanitized only message bodies via fputs_careful(), but the banner headers in wall(1) and write(1) still interpolate the system hostname without sanitization. An unprivileged user can set a malicious hostname containing terminal escape sequences via a user namespace (unshare -Ur -u + sethostname(2)), and wall/write will deliver those sequences to the terminals of all logged-in users. Fix by routing the banner output through fputs_careful() which strips control characters. This is an additional fix for CVE-2024-28085 (CVSS 3.1 score: 3.3). A new CVE ID has not been assigned (yet). Reported-by: Skyler Ferrante Signed-off-by: Karel Zak (cherry picked from commit 9ce8f2b5aefa011ef5b0c34aa14df9bb9db02dab) term-utils/wall.c | 3 ++- term-utils/write.c | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) commit 004be14e362183806f6d4a21809c3d8a1f05a0b5 Author: Karel Zak Date: Wed Aug 12 13:15:47 2026 +0200 tests: kill/decode: also strip RT0 from signal mask output On glibc NPTL systems, signals 32 and 33 are reserved for internal use and SIGRTMIN is adjusted to 34 (or 35). The sed filter strips these internal signals from the decoded output by their numeric values. This works for signals 32 and 33 because print_signal_name() renders them as raw numbers (they are below SIGRTMIN). However, signal 34 (SIGRTMIN) is rendered as "RT0" because it satisfies the SIGRTMIN <= signum condition, so the numeric sed pattern never matches. On older glibc versions (e.g., Ubuntu 18.04, glibc 2.27), NPTL leaves SIGRTMIN set in the process signal mask, causing RT0 to appear in the output and the test to fail. Add an explicit sed pattern to also strip RT0. (cherry picked from commit 12d905457fcac7145ff6eacf389895ed65657593) tests/ts/kill/decode | 1 + 1 file changed, 1 insertion(+) commit 0eb3a5d93add9a953d939338380983a5c040f9c3 Author: Karel Zak Date: Mon Aug 24 15:53:05 2026 +0200 libmount: fix DBG() macro use Signed-off-by: Karel Zak libmount/src/tab_update.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 216d733770cf48fbc26d9d11bead3a8284442aa3 Author: wangrong Date: Fri Aug 21 11:17:40 2026 +0800 libmount: reuse existing act fd in mnt_update_start on ro retry When mnt_context_mount() retries a failed mount as read-only, it calls mnt_context_prepare_update() again, which invokes mnt_update_start() a second time. Without checking whether act_fd is already open, the old fd is overwritten and leaked, and its LOCK_SH prevents mnt_update_end() from unlinking the act file. Guard mnt_update_start() with an act_fd >= 0 check: if the act file is already open and locked, reuse the existing fd instead of opening a new one. Signed-off-by: wangrong (cherry picked from commit 63bf18c376c4c30eb703355c261893860a791163) libmount/src/tab_update.c | 5 +++++ 1 file changed, 5 insertions(+) commit eff026c4e3c9aa47178102c873e09437f2ff148e Author: wangrong Date: Fri Aug 21 09:25:44 2026 +0800 libmount: properly end act file in mnt_free_update When mnt_context_mount() fails in mnt_context_do_mount(), the mnt_context_update_tabs() call is guarded by if (!rc) and gets skipped. This means mnt_update_end() -- the only function that unlinks /run/mount/utab.act -- never runs, leaving the act file orphaned on disk. mnt_free_update() only close()s act_fd without releasing the lock or unlinking the act file. Fix this by calling mnt_update_end() before unreffing members, which properly unlocks, unlinks and closes the act file. Add a fallback close() for the case where mnt_update_end() fails to acquire the lock and returns early without closing the fd. The utab.act file was introduced in v2.40 (commit 9218c9678a6a) and this leak has been present since then through the current master. A leftover utab.act causes mnt_monitor's kernel_event_verify() to veil all subsequent kernel mount events (monitor.c: kernel_veiled + access(utab.act)==0), making consumers like udisksd miss real mount/umount notifications. Signed-off-by: wangrong (cherry picked from commit fad5341d280a9c0e697323998493911ff108b0f1) libmount/src/tab_update.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 9f64d7d00d468e81cf9023b79398cdddf7f7db6b Author: Karel Zak Date: Wed Aug 19 12:42:30 2026 +0200 docs: add CVE number to v2.42.2-ReleaseNotes Signed-off-by: Karel Zak Documentation/releases/v2.42.2-ReleaseNotes | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 720ae1e20b17e41cc0741147a91b0bb679429941 Author: Karel Zak Date: Tue Aug 11 14:02:15 2026 +0200 libmount: don't ignore "/" target in mount --all when target prefix is set When --target-prefix is used, the root filesystem entry should not be skipped because the actual mount target will be the prefix path (e.g., /mnt), not /. Fixes: https://github.com/util-linux/util-linux/issues/4545 Signed-off-by: Karel Zak (cherry picked from commit 05ee8a9ed4764e66ba6d9d62dbdd298ad787196b) libmount/src/context_mount.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 86319c3cdf4cedce57e83899f00a793cd0d7d9a2 Author: Karel Zak Date: Tue Aug 4 13:01:34 2026 +0200 agetty: fix spurious issue file reprinting on reload Only rotate ie->mem to ie->mem_old when there was actual content printed. Previously, the unconditional rotation would NULL out mem_old when mem was already NULL (e.g. after user pressed Enter), causing issue_is_changed() to always report a change on the next network event — resulting in needless issue file reprints. Without AGETTY_RELOAD, keep ie->mem persistent after print since there is no comparison mechanism and no need to free/regenerate. Co-Authored: Geoff Hanson Addresses: https://github.com/util-linux/util-linux/issues/4306 term-utils/agetty.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit 1b36800ef59fa7b6d0c6493e0a0ff0bae44c5351 Author: WanBingjiang Date: Fri Jul 31 16:27:13 2026 +0800 docs: fix FIEMAP feature attribution in v2.42-ReleaseNotes Signed-off-by: WanBingjiang (cherry picked from commit 403b255fecfe89d2b8f8fd5f666a2c70bd8be01e) Documentation/releases/v2.42-ReleaseNotes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ddd55899430d766cff0a0e9c39862ba596cf6b17 Author: Milan Broz Date: Fri Jul 31 16:27:45 2026 +0200 libblkid: befs: fix possible load of misaligned address The misaligned uint16_t loads can come only form a corrupt metadata. Found by OSS-Fuzz by cryptsetup project fuzzers (issue 507641687). Signed-off-by: Milan Broz (cherry picked from commit 5f00ac15c9da815cb7ed5a6d461c4e2262f59955) libblkid/src/superblocks/befs.c | 4 ++++ 1 file changed, 4 insertions(+) commit 270aa7d52093f8edb621f0953524f65a348e4943 Author: Milan Broz Date: Fri Jul 31 16:27:45 2026 +0200 libblkid: befs: fix possible too large shift The existing guard needs to be evaluated as uint64_t otherwise it wraps around. Found by OSS-Fuzz by cryptsetup project fuzzers (issue 507641687). Signed-off-by: Milan Broz (cherry picked from commit d52617b5369946cf33b0875dee06637289dad34a) libblkid/src/superblocks/befs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 84796d917bcbad37aecfdadf36d71fee5b356efd Author: Karel Zak Date: Thu Jul 23 14:21:06 2026 +0200 lscpu: remove mmu reference not available in stable/v2.42 The cherry-pick 5f3fcf3b (from d44ece2f) added ct->mmu usage, but the mmu member was introduced by b746c5397 which is not in this branch. Fixes: 5f3fcf3b50be07f1865be5fb0de2530dde6e7f32 Signed-off-by: Karel Zak sys-utils/lscpu.c | 2 -- 1 file changed, 2 deletions(-) commit f6fea9738456699ba6a3f894f8639cb6be718725 Author: logical-misha <220645577+logical-misha@users.noreply.github.com> Date: Tue Jul 21 04:55:43 2026 +0000 pg: fix out-of-bounds access past wbuf on a trailing tab endline_for_mb() and its single-byte twin endline() advance the scan pointer twice when the last character of a buffer-filling line is a tab (once in the tab branch, once via the shared *++p) with no terminator re-check in between. A full line (wl == READBUF-1) ending in a tab makes *++p read wbuf[READBUF] and the following *end = L'\0' write it -- one element past the wbuf[READBUF] array. Re-check for the terminator before the second advance. Closes #4495 Signed-off-by: logical-misha <220645577+logical-misha@users.noreply.github.com> (cherry picked from commit 4c10a9aa6310c7a97cfc695c6a2f603cb24633ff) text-utils/pg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e712110b1535e3943cbfb97dc535044a124b5a09 Author: logical-misha <220645577+logical-misha@users.noreply.github.com> Date: Tue Jul 21 04:55:43 2026 +0000 more: fix out-of-bounds write in get_line() on invalid multibyte input In get_line(), the invalid-multibyte switch arm (case (size_t)-1) writes *p++ = mbc[0] without the bounds check that its sibling write paths use, and the "goto process_mbc" back-edge lets it re-run within one loop iteration, bypassing the loop-head guard. A line that first fills line_buf with zero-width combining characters (which advance p but not column) and then supplies an invalid multibyte sequence can step p past the num_columns*4 + 2 byte allocation -- a heap out-of-bounds write. Guard the write the same way the sibling path does. Closes #4494 Signed-off-by: logical-misha <220645577+logical-misha@users.noreply.github.com> (cherry picked from commit e63ab5126a41c9709d975d29dadf49fde0eefd35) text-utils/more.c | 2 ++ 1 file changed, 2 insertions(+) commit 5f3fcf3b50be07f1865be5fb0de2530dde6e7f32 Author: Karel Zak Date: Mon Jul 13 12:15:16 2026 +0200 lscpu: add NULL guards for RISC-V ISA functions [coverity: CID 503785] Signed-off-by: Karel Zak (cherry picked from commit d44ece2fc3de876571888939c6075b6128cc2a27) sys-utils/lscpu-riscv.c | 6 ++++++ sys-utils/lscpu.c | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) commit d87dd42fd5da5fdc3cb09249e437baf829b822f9 Author: Karel Zak Date: Mon Jul 13 12:38:57 2026 +0200 libblkid: dos: fix 32-bit overflow in partition start/size [coverity: CID 503517, 503518] Signed-off-by: Karel Zak (cherry picked from commit d939b29b9dedefcda1eae9ca5b2cd44976f5990d) libblkid/src/partitions/dos.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d6823e360e88a87c29932017487001d6a91486b2 Author: Karel Zak Date: Wed Jul 8 11:53:01 2026 +0200 meson: move header checks before component dependency resolution Move the headers[] array definition, ncurses/slang dependency lookups (which conditionally append to headers[]), and the foreach loop that populates conf with HAVE_
entries to run before the library component checks. This fixes a build failure introduced by commit 25318eb5bc ("meson: gate liblastlog2 on lastlog.h"), which added conf.get('HAVE_LASTLOG_H') to the liblastlog2 requirement but HAVE_LASTLOG_H was only set much later in the file by the foreach header loop. Signed-off-by: Karel Zak meson.build | 228 ++++++++++++++++++++++++++++++------------------------------ 1 file changed, 114 insertions(+), 114 deletions(-) commit bdf0f959dd2e7f63feddf720659effd44c978422 Author: Aizal Khan Date: Tue Jul 7 15:44:38 2026 +0530 col: guard c_width sign before size_t cast in BS branch Signed-off-by: Aizal Khan (cherry picked from commit 8d255a1ea5831a7c72b871a508a5a2cd69f028d6) text-utils/col.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2cde51e822b66ddf8ac0bd0b81fb103fa5d688d0 Author: Aizal Khan Date: Wed Jul 1 18:51:41 2026 +0530 col: fix cur_col underflow on backspace over a wide char The BS handler in handle_not_graphic() subtracts the last stored character's width from lns->cur_col (a size_t) and only guards against cur_col == 0. When the last graphic character is double-width and the column was reset by CR then advanced by a single space, cur_col is 1 and cur_col -= 2 wraps to SIZE_MAX. That feeds l_max_col and the stored c_column, so flush_line() sizes count[] as l_max_col + 1 (== 0) and then memsets sizeof(size_t) * l_max_col bytes and indexes count[SIZE_MAX] -- an out-of-bounds write reachable from stdin under a UTF-8 locale. Clamp the subtraction so the column cannot go below zero. Signed-off-by: Aizal Khan (cherry picked from commit 65627ec56bfeed5fa6fd3edff8e65f3e587fee7e) text-utils/col.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit ad7923a5dad5ff761f43373f6b432103e296e841 Author: WanBingjiang Date: Thu Jun 25 19:08:53 2026 +0800 hexdump: stop after stdout write errors Stop the display loop once stdout reports an error. Otherwise hexdump keeps formatting and writing after the output stream has already failed, which can loop for a long time on errors such as ENOSPC. Save the errno from the first stdout error before cleanup can overwrite it. Report that saved error from hexdump itself and bypass close_stdout_atexit, as ferror() only preserves the stream error state and does not recover the original errno. Add a regression test that writes hexdump output to /dev/full and checks that the command fails with the ENOSPC write error. Addresses: https://github.com/util-linux/util-linux/issues/2205 Signed-off-by: WanBingjiang (cherry picked from commit 4e0a08db808e9089c1335385a45807e9a7e84058) tests/expected/hexdump/write-error | 1 + tests/expected/hexdump/write-error.err | 1 + tests/ts/hexdump/write-error | 29 +++++++++++++++++++++++++++++ text-utils/hexdump-display.c | 5 +++++ text-utils/hexdump.c | 16 +++++++++++++++- text-utils/hexdump.h | 1 + 6 files changed, 52 insertions(+), 1 deletion(-) commit b11aa98c305ea2fc294b0a60ad900de037e6c855 Author: Karel Zak Date: Thu Jun 25 15:11:19 2026 +0200 bitops: avoid macro redefinition on macOS Newer macOS SDKs provide htobe16/htole16/be16toh/etc. via . Skip our OSSwap-based definitions when that header is available to avoid -Wmacro-redefined errors. Signed-off-by: Karel Zak (cherry picked from commit b15742bf5aff23f4d21565fbb6ce31b13c54263d) include/bitops.h | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) commit 25318eb5bc72bc0cb277d43cded1138fafb8e100 Author: Thomas Weißschuh Date: Wed Apr 22 22:51:53 2026 +0200 meson: gate liblastlog2 on lastlog.h The target needs this header, encode this in the build system. Signed-off-by: Thomas Weißschuh (cherry picked from commit 4d6838ff88118d136909f9e51acbe9d1f0814571) meson.build | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f0251533e49ae5aa71697228fdc9c212946a2c50 Author: WanBingjiang Date: Tue Jun 30 14:59:45 2026 +0800 build-sys: require lastlog.h for liblastlog2 Signed-off-by: WanBingjiang (cherry picked from commit ec426c3538d603398fab0cee667b9041ab1e7e23) configure.ac | 2 ++ 1 file changed, 2 insertions(+) commit 294f483cf9a833b86f72ed37a911257fd1efe061 Author: Chris Webb Date: Mon Jun 29 15:37:27 2026 +0000 unshare: Fix --map-auto regression Commit 07935158 fixed an unshare --user bug which wasted a UID/GID when --map-auto was used with --map-root-user. This bug meant that, for example, a user with a single extra UID and GID delegated to them in /etc/subuid and /etc/subgid would not get that user or group mapped at all if they attempted unshare -r --map-auto. Two years later, commit b64b769b added unshare --map-subids to identity-map subuids and subgids into a user namespace, but incorrectly removed a load-bearing 'else if' in passing, and reintroduced the original bug. Ironically, map->inner != -1 for an identity mapping, so the 'if' vs 'else if' change has no effect on the --map-subids option; it only breaks --map-auto. Fix the unshare -r --map-auto behaviour again. Signed-off-by: Chris Webb (cherry picked from commit 872c84e7c4ff577ab723c150f3120cf0bd2cfac1) sys-utils/unshare.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 927ed2e31d883650e3d7d29de6d6193f4da44970 Author: Tigran Sogomonian Date: Mon Jun 29 15:52:06 2026 +0300 disk-utils: fix memory leak in execute function Dynamic memory, referenced by 'argv', is allocated by calling function 'xstrdup' and lost when function returns. Found by the static analyzer Svace. Signed-off-by: Tigran Sogomonian (cherry picked from commit 3c053487dddfee89ffc401822971fc7cb95c934d) disk-utils/fsck.c | 2 ++ 1 file changed, 2 insertions(+) commit 64c54b7bbc6b78caacd0ef61be6a89ac553364bf Author: Aizal Khan Date: Sun Jul 5 13:52:43 2026 +0530 libblkid: (iso9660) fix out-of-bounds read of root dir record root_len comes from the on-disk root directory record (rdr+10) and was only rejected when zero. The extent is then mapped for min(root_len, 2048) bytes and the first record is validated by reading rootdata[0], rootdata[32], rootdata[33] and isonum_731(rootdata+2). blkid_probe_get_buffer() only rounds a request up to io_size when the rounded region still fits the probing area, so a root extent sitting in the final partial io_size block of a crafted image returns a buffer of exactly root_len bytes. With root_len between 1 and 33 and rootdata[0] >= 34, the validation reads offsets 32/33 past that buffer. Reject an extent too small to hold the 34-byte record, which the surrounding comment already assumes. Signed-off-by: Aizal Khan (cherry picked from commit f2d3f1040550430a720b5e5bdc9f5fa1f09a6b6b) libblkid/src/superblocks/iso9660.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit bde345937fb769f1ade9c402e8c0e24a4925550e Author: Adam Sampson Date: Mon May 18 14:41:40 2026 +0100 tests: test_scols_termreduce needs libsmartcols This helper needs libsmartcols, so it can't be built if util-linux is configured with --disable-libsmartcols. (It's still reasonable to want to run the test suite in this case, for example if you're configuring util-linux to only build libuuid.) Signed-off-by: Adam Sampson tests/helpers/Makemodule.am | 2 ++ 1 file changed, 2 insertions(+) commit 00bc5cd4b8b886c6257c236511548c134e960edf Author: Karel Zak Date: Mon Jun 22 10:25:12 2026 +0200 libfdisk: fix OOM on GPT with huge partition entries array Add sanity checks to gpt_read_entries() to prevent out-of-memory when reading a crafted GPT header with an absurdly large npartition_entries value. The entries array size is now limited by: - GPT_NPARTITIONS_MAX hard cap (~4MiB) - first_usable_lba, since entries must fit before the first usable sector Also reorder validation in gpt_read_header() to perform all cheap header-only checks (my_lba, LBA sanity) before attempting to allocate and read the entries array. Addresses: https://github.com/util-linux/util-linux/issues/4432 Signed-off-by: Karel Zak (cherry picked from commit c6a01958c4eb01833a2b2325562e8ff6921a67a0) libfdisk/src/gpt.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit 46498f46a752ca4a8a712003001e2222e7864727 Author: aizu-m Date: Mon Jun 22 20:59:26 2026 +0530 mbsalign: check remaining buffer space before writing hex escapes Signed-off-by: aizu-m (cherry picked from commit e6a765c8948e75ca36c061a01eb18c18e4396901) lib/mbsalign.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)