glibc: wordexp() reads out of bounds on a crafted pattern, crashing or leaking memory

Impact

wordexp() in glibc through 2.33 uses atoi() instead of strtoul() when parsing positional parameters, so a crafted pattern can push the parser out of bounds and either crash the caller or expose adjacent heap memory. The exposure on a GPU node depends entirely on whether anything privileged calls wordexp() on attacker-supplied text - most daemons do not, and the function is mainly reached through shell-like expansion in job wrappers, prologue/epilogue scripts and legacy service code. Where such a path exists on a scheduler or login node, a tenant who controls the expanded string gets a service crash or a small information leak in the context of whatever runs the expansion. Because glibc is linked into every process on the host, the fix is a system-wide library update rather than a change to one service.

Who can reach it

A local or remote user who can get an untrusted string passed to wordexp() by a privileged or shared process; no authentication is needed beyond whatever reaches that code path. There is no exposure on a node where nothing calls wordexp() on foreign input.

What to do

Update glibc to a version carrying the upstream fix (sourceware commit 5adda61f62b7) from your distribution - Debian LTS, Gentoo and NetApp have shipped advisories. Because glibc is loaded by every running process, the patch only fully takes effect after the processes that use it restart; on a GPU node that means either a rolling restart of the affected daemons or a drain and reboot during the next maintenance window. The advisories do not name a single upstream release with the fix, so track your distribution's package version.

References

Related entries

• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• OpenSSL: SSL_select_next_proto() over-reads and can send up to 255 bytes of process memory to the peerCVE-2024-5535 · OpenSSL SSL_select_next_proto() (ALPN/NPN protocol negotiation)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical
• Linux kernel libceph: corrupted message frame causes out-of-bounds reads in process_message_header()CVE-2026-43406 · Linux kernel libceph (process_message_header bounds check)Critical
• Linux kernel libceph: signed payload_len in auth replies causes slab out-of-bounds readCVE-2026-43407 · Linux kernel libceph (ceph_handle_auth_reply payload_len integer overflow)Critical
• Linux kernel libceph: positive result field in an auth reply sends kernel memory past the front bufferCVE-2026-46119 · Linux kernel libceph (auth reply result field / __send_prepared_auth_request length)Critical