CVE-2026-0915: GNU C Library Information Disclosure Flaw

CVE-2026-0915 Overview

A memory information disclosure vulnerability exists in the GNU C Library (glibc) versions 2.0 through 2.42. Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network can leak stack contents to the configured DNS resolver. This vulnerability allows attackers to potentially obtain sensitive information from the stack memory of affected systems.

Critical Impact

Stack memory contents can be leaked to remote DNS resolvers, potentially exposing sensitive information such as memory addresses, authentication tokens, or other security-critical data that may aid further attacks.

Affected Products

• GNU C Library (glibc) version 2.0 through version 2.42
• Linux distributions using affected glibc versions with DNS backend configured for network lookups
• Systems with nsswitch.conf configured to use DNS backend for networks database

Discovery Timeline

• 2026-01-15 - CVE CVE-2026-0915 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-0915

Vulnerability Analysis

This vulnerability is classified as CWE-908 (Use of Uninitialized Resource). The flaw occurs within the glibc DNS backend implementation for the networks Name Service Switch (NSS) module. When applications call getnetbyaddr() or its reentrant counterpart getnetbyaddr_r() with a zero-valued network parameter, the library fails to properly initialize certain stack variables before transmitting data to the DNS resolver.

The issue manifests specifically when the system's nsswitch.conf file is configured to use the DNS backend for network name resolution. Under these conditions, uninitialized stack memory may be included in DNS queries sent to the configured resolver, potentially leaking sensitive information from the calling process's address space.

Root Cause

The root cause is improper initialization of memory buffers used during DNS query construction within the glibc NSS DNS backend. When processing zero-valued network addresses, the code path fails to sanitize or initialize stack-allocated buffers before they are used in constructing outbound DNS packets. This uninitialized memory use (CWE-908) results in arbitrary stack contents being transmitted to external DNS infrastructure.

Attack Vector

The attack can be executed remotely via network-based interactions. An attacker who controls or monitors DNS resolution infrastructure (such as a malicious DNS server or man-in-the-middle position) could trigger applications to perform network lookups with zero-valued addresses. The leaked stack contents in DNS queries could then be captured and analyzed to extract sensitive information.

Exploitation requires:

1. Target system running glibc version 2.0-2.42
2. nsswitch.conf configured with DNS backend for networks
3. Application calling getnetbyaddr() or getnetbyaddr_r() with zero-valued network
4. Attacker ability to observe DNS traffic or control DNS infrastructure

The vulnerability is triggered when applications perform legitimate network database lookups with malformed or zero-valued parameters, causing the DNS backend to inadvertently transmit uninitialized stack memory in its queries. For detailed technical analysis, refer to the Sourceware Bug Report #33802.

Detection Methods for CVE-2026-0915

Indicators of Compromise

• Unusual DNS queries containing unexpected binary data or non-standard characters in query strings
• Applications making network database lookups to external DNS resolvers with anomalous payloads
• DNS traffic analysis showing queries with embedded memory patterns or pointer-like values

Detection Strategies

• Monitor DNS query traffic for anomalous patterns or binary data that may indicate leaked memory contents
• Implement network-level inspection for DNS queries originating from systems running vulnerable glibc versions
• Deploy endpoint monitoring to detect applications calling getnetbyaddr() or getnetbyaddr_r() with zero-valued parameters
• Use memory safety analysis tools to identify uninitialized memory access during glibc function calls

Monitoring Recommendations

• Enable DNS query logging on resolver infrastructure to capture potentially malicious or anomalous queries
• Implement SIEM rules to correlate DNS traffic anomalies with systems running vulnerable glibc versions
• Monitor for information disclosure attempts by analyzing outbound DNS traffic patterns
• Review application logs for network lookup failures or unusual behavior related to the networks NSS database

How to Mitigate CVE-2026-0915

Immediate Actions Required

• Identify all systems running GNU C Library versions 2.0 through 2.42
• Review nsswitch.conf configuration files to determine if DNS backend is enabled for networks database
• Prioritize patching systems where DNS backend is actively used for network name resolution
• Consider network segmentation to limit DNS traffic exposure from vulnerable systems

Patch Information

Refer to your Linux distribution's security advisories for patched glibc packages. The vulnerability has been tracked in the Sourceware Bug Report #33802 and discussed on the OpenWall Security Mailing List. Contact your distribution vendor for specific patch availability and upgrade instructions for glibc versions beyond 2.42.

Workarounds

• Modify nsswitch.conf to remove or disable DNS backend for the networks database if not required
• Use alternative NSS backends (such as files-only) for network name resolution where DNS is not necessary
• Implement network-level filtering to restrict DNS traffic from sensitive systems to trusted resolvers only
• Deploy application-level input validation to prevent zero-valued network parameters from reaching glibc functions

# Workaround: Modify nsswitch.conf to disable DNS backend for networks
# Edit /etc/nsswitch.conf and change:
# networks: files dns
# To:
# networks: files

sudo cp /etc/nsswitch.conf /etc/nsswitch.conf.backup
sudo sed -i 's/^networks:.*dns.*/networks: files/' /etc/nsswitch.conf