CVE-2026-0861: 
NixOS vulnerability analysis and mitigation

CVE-2026-0861 is an integer overflow vulnerability (GLIBC-SA-2026-0001) in the memalign suite of functions (memalign, posix_memalign, aligned_alloc) within the GNU C Library (glibc). Passing an excessively large alignment argument alongside a size parameter close to PTRDIFF_MAX causes an integer overflow in size_t, which can result in heap corruption. Affected versions span glibc 2.30 through 2.42; downstream products from IBM (Netezza Appliance, Cloud Pak for AIOps, API Connect, Cloud Pak for Business Automation, Business Automation Insights) and Microsoft (Azure Linux 3 and CBL-Mariner 2 glibc packages) are also affected. The vulnerability was published on January 14, 2026, with the formal advisory (GLIBC-SA-2026-0001) released on January 16, 2026. It carries a CVSS v3.1 base score of 8.4 (High) (Openwall OSS-Sec, Microsoft MSRC, Oracle CPU Apr 2026).

The root cause is an integer overflow (CWE-190) in glibc's heap allocation routines when processing alignment arguments to the memalign family of functions. When both the size parameter is near PTRDIFF_MAX and the alignment argument is in the range [1<<62 + 1, 1<<63] (or exactly 1<<63 for posix_memalign and aligned_alloc), the internal arithmetic overflows size_t, causing the allocator to return a heap chunk that is smaller than expected — leading to heap corruption. Exploitation requires local access and attacker control over both the size and alignment arguments simultaneously; in practice, alignment values are typically fixed constants (page size, struct size), making direct exploitation uncommon unless a secondary bug (e.g., another integer overflow or buffer overflow in the application) exposes the alignment parameter to attacker influence. The vulnerable commit was introduced in glibc 2.30 (commit 9bf8e29ca136094f73f69f725f15c51facc97206), and a proof-of-concept is tracked in the glibc bug tracker (Openwall OSS-Sec, glibc Bugzilla).

Successful exploitation can result in heap corruption, which may be leveraged to achieve arbitrary code execution with the privileges of the affected process, as well as high impacts to confidentiality, integrity, and availability. Because glibc is a foundational library present on virtually all Linux systems, the vulnerability has a broad potential scope — any application that passes attacker-influenced values to memalign functions could be affected. In environments where the affected process runs with elevated privileges, exploitation could facilitate privilege escalation or lateral movement within a compromised host (Openwall OSS-Sec, Microsoft MSRC).

A proof-of-concept exploit is publicly available via the glibc Bugzilla tracker, but there is no evidence of in-the-wild exploitation at this time (glibc Bugzilla). The EPSS score is very low at approximately 0.013%, reflecting the significant preconditions required — an attacker must control both the size and alignment arguments to the vulnerable functions, which is an uncommon application pattern. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported. The attack vector is local (AV:L), further limiting opportunistic exploitation.

1. Identify a vulnerable target: Locate a system running glibc versions 2.30–2.42 where an application passes attacker-influenced values to memalign, posix_memalign, or aligned_alloc.
2. Identify an input path: Find an application-level bug (e.g., a secondary integer overflow or buffer overflow) that allows an attacker to control the alignment argument passed to a memalign function, setting it to a value in the range [1<<62 + 1, 1<<63].
3. Craft the size argument: Simultaneously ensure the size argument is close to PTRDIFF_MAX (e.g., near 0x7FFFFFFFFFFFFFFF on 64-bit systems) so that adding the large alignment causes size_t to overflow.
4. Trigger the allocation: Cause the vulnerable application to call the memalign function with the crafted arguments, resulting in glibc returning a heap chunk smaller than requested.
5. Exploit heap corruption: Use the undersized allocation to write beyond the chunk boundary, corrupting adjacent heap metadata or objects to achieve arbitrary code execution with the process's privileges (Openwall OSS-Sec, glibc Bugzilla).

• Process Behavior: Unexpected crashes or segmentation faults in applications that use memalign, posix_memalign, or aligned_alloc, particularly with unusually large alignment values near 1<<62 or 1<<63.
• Logs: Application crash logs or core dumps referencing heap corruption errors in glibc memory allocation routines; malloc assertion failures or glibc detected error messages in system logs.
• File System: Unexpected core dump files (core.*) generated by processes that use memalign functions; presence of exploit PoC files referencing glibc bug 33796.
• Network: Unusual outbound connections from processes that do not normally initiate network activity, potentially indicating post-exploitation activity following local code execution.

The primary remediation is to upgrade glibc to a patched version. Fix commits are available for glibc 2.30 through 2.42 (e.g., fix commit c9188d333717d3ceb7e3020011651f424f749f93 for glibc 2.43, and backport commits for each stable branch from 2.30-153 through 2.42-49) (Openwall OSS-Sec). Major Linux distributions have released updated packages: Red Hat (RHSA-2026:1334, RHSA-2026:2786, RHSA-2026:3228, RHSA-2026:4501, RHSA-2026:4943), Ubuntu (USN-8005-1), Debian (DLA-4621-1), Fedora, openSUSE, AlmaLinux, Rocky Linux, and Mageia. IBM has issued patches for Netezza Appliance, Cloud Pak for AIOps, API Connect, Cloud Pak for Business Automation, and Business Automation Insights. Oracle addressed the issue in its April 2026 Critical Patch Update (Oracle CPU Apr 2026). As a workaround where patching is not immediately possible, audit applications to ensure alignment arguments to memalign functions are derived from trusted, bounded sources (e.g., compile-time constants) and not from user-controlled input.

The vulnerability received coverage from security news outlets including SecurityOnline.info, which described it as a "decades-old flaw" given that the vulnerable code path dates to glibc 2.30 (2018). Phoronix covered the fix in the context of glibc's security advisory process. The glibc maintainer Siddhesh Poyarekar published the formal advisory to the oss-security mailing list, crediting Igor Morgenstern and Aisle Research for the discovery (Openwall OSS-Sec). Community discussion on Mastodon (GNU Tools Weekly) and Bluesky noted the broad distribution impact given glibc's ubiquity. General sentiment among security researchers is that while the CVSS score is High, real-world exploitability is constrained by the requirement to control both function arguments simultaneously.