package/glibc: security bump to v2.41-123

This contains backports for the following vulnerabilities:
- CVE-2025-15281:
    Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the
    GNU C Library version 2.0 to version 2.42 may cause the interface to
    return uninitialized memory in the we_wordv member, which on
    subsequent calls to wordfree may abort the process.
    https://www.cve.org/CVERecord?id=CVE-2025-15281

- CVE-2026-0861:
    Passing too large an alignment to the memalign suite of functions
    (memalign, posix_memalign, aligned_alloc) in the GNU C Library version
    2.30 to 2.42 may result in an integer overflow, which could
    consequently result in a heap corruption.  Note that the attacker must
    have control over both, the size as well as the alignment arguments of
    the memalign function to be able to exploit this.  The size parameter
    must be close enough to PTRDIFF_MAX so as to overflow size_t along
    with the large alignment argument.  This limits the malicious inputs
    for the alignment for memalign to the range [1<<62+ 1, 1<<63] and
    exactly 1<<63 for posix_memalign and aligned_alloc.  Typically the
    alignment argument passed to such functions is a known constrained
    quantity (e.g. page size, block size, struct sizes) and is not
    attacker controlled, because of which this may not be easily
    exploitable in practice.  An application bug could potentially result
    in the input alignment being too large, e.g. due to a different buffer
    overflow or integer overflow in the application or its dependent
    libraries, but that is again an uncommon usage pattern given typical
    sources of alignments.
    https://www.cve.org/CVERecord?id=CVE-2026-0861

- CVE-2026-0915:
    Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf
    that specifies the library's DNS backend for networks and queries for
    a zero-valued network in the GNU C Library version 2.0 to version 2.42
    can leak stack contents to the configured DNS resolver.
    https://www.cve.org/CVERecord?id=CVE-2026-0915

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
(cherry picked from commit 18de297a5a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>

package/glibc/glibc.hash

@@ -1,5 +1,5 @@
 # Locally calculated (fetched from Github)
-sha256  166b6e7637bb45cb9352e4813005f83dd48f03ef634d3e9e94a30aa5a0300fab  glibc-2.41-70-g1502c248d58cb99a203731707987a4342926e830.tar.gz
+sha256  7ed7900a90fd1b05fd49a25b1877515c6c3f1ab9ea9248af9d5d0e7fdb3fdd82  glibc-2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2.tar.gz
 
 # Hashes for license files
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING

package/glibc/glibc.mk

@@ -7,7 +7,7 @@
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
 # When updating the version, please also update localedef
-GLIBC_VERSION = 2.41-70-g1502c248d58cb99a203731707987a4342926e830
+GLIBC_VERSION = 2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2
 
 # Upstream doesn't officially provide an https download link.
 # There is one (https://sourceware.org/git/glibc.git) but it's not reliable,
@@ -39,6 +39,15 @@ GLIBC_IGNORE_CVES += CVE-2025-8058
 #  https://security-tracker.debian.org/tracker/CVE-2010-4756
 GLIBC_IGNORE_CVES += CVE-2010-4756
 
+# Fixed by glibc-2.41-121-g1e2c1ea4307197ccece0cda574bcfebf9080894c
+GLIBC_IGNORE_CVES += CVE-2026-0861
+
+# Fixed by glibc-2.41-122-g15c9839a0b853f552b4ed9047841b6223f3c104d
+GLIBC_IGNORE_CVES += CVE-2026-0915
+
+# Fixed by glibc-2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2
+GLIBC_IGNORE_CVES += CVE-2025-15281
+
 # glibc is part of the toolchain so disable the toolchain dependency
 GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO
 

package/localedef/localedef.mk

@@ -7,7 +7,7 @@
 # Use the same VERSION and SITE as target glibc
 # As in glibc.mk, generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
-LOCALEDEF_VERSION = 2.41-70-g1502c248d58cb99a203731707987a4342926e830
+LOCALEDEF_VERSION = 2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2
 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz
 LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION))
 HOST_LOCALEDEF_DL_SUBDIR = glibc