The GNU C Library (glibc, installed as libc6) sits under almost every program on a Debian server, so its security fixes matter. Yet Debian has not issued a glibc security advisory (DSA) for Debian 12 (bookworm) or Debian 13 (trixie) since DSA-5678-1 in May 2024. The 2025 and 2026 glibc fixes reached these releases through regular stable point-release updates instead. This guide shows which versions contain which fixes and how to make sure your servers actually receive them.
Why there was no DSA
According to the security tracker documentation, an issue that does not warrant an immediate advisory, for example because its severity is minor, is marked no-dsa (or postponed, when it will ride along with a later advisory). Such issues are generally still fixed, through a point update or together with a later security update. That is what happened to the glibc issues below. The tracker table for each CVE shows the fixed version with no advisory in the "Origin" column, which is how you recognise a point-release fix.
One practical consequence: these packages are published in the main Debian archive, not in the security archive. On 31 October 2026 the tracker lists 2.36-9+deb12u14 in bookworm but only 2.36-9+deb12u7 in bookworm-security. A server whose APT sources point only at the security archive will not receive these fixes.
Which glibc flaws were fixed, and where
| CVE | Issue (per the glibc CNA) | Debian 12 (bookworm) fixed in | Debian 13 (trixie) |
|---|---|---|---|
| CVE-2025-0395 | Buffer overflow when assert() fails (2.13 to 2.40) | 2.36-9+deb12u10 | Not affected (ships 2.41) |
| CVE-2025-4802 | LD_LIBRARY_PATH honoured by static setuid binaries that call dlopen (2.27 to 2.38) | 2.36-9+deb12u11 | Not affected |
| CVE-2025-8058 | Double free in regcomp after an allocation failure | 2.36-9+deb12u13 | Fixed before release (2.41-11) |
| CVE-2025-15281 | wordexp with WRDE_REUSE and WRDE_APPEND may abort the process | 2.36-9+deb12u14 | 2.41-12+deb13u2 |
| CVE-2026-0861 | Integer overflow in the memalign family with huge alignments | 2.36-9+deb12u14 | 2.41-12+deb13u2 |
| CVE-2026-0915 | getnetbyaddr can leak stack contents to the DNS resolver | 2.36-9+deb12u14 | 2.41-12+deb13u2 |
| CVE-2026-4046 | iconv() crash on IBM1390/IBM1399 input | 2.36-9+deb12u14 | 2.41-12+deb13u3 |
| CVE-2026-4437, CVE-2026-4438 | gethostbyaddr with the DNS backend can return invalid host names from crafted DNS responses | 2.36-9+deb12u14 | 2.41-12+deb13u3 |
Most of these need special conditions: a setuid static binary, an application that passes attacker-controlled alignment values, or a crafted answer from the DNS server the machine uses. The CNA scored CVE-2025-8058 at CVSS 4.0 5.9 (Medium) and left most of the others unscored; none is in the CISA Known Exploited Vulnerabilities catalog. That is consistent with Debian treating them as point-release material. In short: bookworm 2.36-9+deb12u14 and trixie 2.41-12+deb13u4 (the current versions) contain every fix in the table.
Debian 11 (bullseye) received the same kind of fixes through LTS advisories DLA-4143-1, DLA-4181-1 and DLA-4621-1, but its LTS period ended on 31 August 2026.
Check what you run
dpkg-query -W -f='${Package} ${Version}\n' libc6 libc-bin
apt policy libc6Compare the installed version with the table. Do not use ldd --version for this: it prints only the upstream version (2.36 or 2.41), not the Debian revision that carries the fix. In the apt policy output, the candidate version should come from the main archive (for example deb.debian.org/debian bookworm/main). If you only see a -security line, add the main suite to your sources.
Update
sudo apt update
sudo apt upgrade
apt policy libc6The source package builds several binaries, among them libc6, libc-bin, libc6-dev, locales and nscd. A normal apt upgrade updates all that are installed.
Restart after a glibc update
Every running process keeps the old library in memory until it restarts. The needrestart package lists the affected services; for glibc that is nearly all of them, so a reboot at a convenient time is the simplest option:
sudo needrestart -r l
sudo rebootWhat is still open
The tracker also lists glibc issues that are not fixed yet in bookworm or trixie. For example, CVE-2026-95818, a stack overflow in the dynamic loader that a local user could use to crash or corrupt setuid programs (CNA score 3.6, Low), is marked as a minor issue (no-dsa) for trixie and still open for bookworm. Fixes for such issues are expected in later updates rather than as urgent advisories. Check the tracker page if a specific CVE matters to you.
What you should do
- Make sure your APT sources include the main Debian archive as well as the security archive, so point-release fixes reach you.
- Bring
libc6to at least2.36-9+deb12u14on bookworm or2.41-12+deb13u4on trixie. - Reboot after glibc updates, or at least restart every service that
needrestartreports. - Do not rely on DSA e-mails alone; follow the tracker for core packages such as glibc.
- Move any remaining Debian 11 systems to a supported release.
Sources
- security-tracker.debian.org/tracker/source-package/glibc
- security-team.debian.org/security_tracker.html
- security-tracker.debian.org/tracker/CVE-2025-0395
- security-tracker.debian.org/tracker/CVE-2025-4802
- security-tracker.debian.org/tracker/CVE-2025-8058
- security-tracker.debian.org/tracker/CVE-2025-15281
- security-tracker.debian.org/tracker/CVE-2026-0861
- security-tracker.debian.org/tracker/CVE-2026-0915
- security-tracker.debian.org/tracker/CVE-2026-4046
- security-tracker.debian.org/tracker/CVE-2026-4437
- security-tracker.debian.org/tracker/CVE-2026-4438
- security-tracker.debian.org/tracker/CVE-2026-95818
- cve.org/CVERecord?id=CVE-2025-8058
- cve.org/CVERecord?id=CVE-2026-95818
- security-tracker.debian.org/tracker/DSA-5678-1
- packages.debian.org/source/bookworm/glibc
- manpages.debian.org/trixie/needrestart/needrestart.1.en.html
- debian.org/releases
Comments
0 total · 0 threads