CVE-2026-56288: GNU patch NULL Pointer Dereference DoS

CVE-2026-56288 Overview

CVE-2026-56288 is a NULL pointer dereference vulnerability [CWE-476] in GNU patch, the widely deployed utility for applying unified-diff files to source code. The flaw resides in the hunk-processing logic, where improper handling of consecutive end-of-file newline markers corrupts internal hunk data structures. During patch application, the utility passes a NULL pointer to fwrite(), causing a crash and denial of service.

An attacker crafts a malicious unified-diff file and induces a user or automated pipeline to apply it. Successful exploitation halts the patching process, disrupting build systems, package managers, and CI/CD workflows that depend on GNU patch.

Critical Impact
A malformed patch file crashes GNU patch via a NULL pointer passed to fwrite(), producing a denial-of-service condition against build pipelines and automated update processes.

Affected Products

GNU patch versions prior to commit e6d6a4e021660679d7fc9150f981d4920f722313
Linux and Unix distributions bundling vulnerable GNU patch builds
CI/CD systems and package managers invoking GNU patch for source updates

Discovery Timeline

2026-07-09 - CVE-2026-56288 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-56288

Vulnerability Analysis

GNU patch parses unified-diff input by tokenizing hunk headers, context lines, and end-of-file markers. When two consecutive \ No newline at end of file markers appear in a crafted hunk, the parser fails to allocate or link the expected line buffer for the second marker. The internal hunk structure retains a NULL line pointer where valid data is required.

During the write phase, GNU patch iterates the hunk lines and calls fwrite() on each buffer. The uninitialized pointer reaches fwrite() unchecked, and the C library dereferences NULL, terminating the process with a segmentation fault.

Exploitation requires only that a target apply the malicious diff. No authentication, network access, or privilege is needed against the local process. The attack surface expands where automated tooling ingests untrusted patches, such as source mirrors, distribution build farms, or third-party package updates.

Root Cause

The root cause is missing validation of hunk state after parsing consecutive newline markers. The parser advances its state machine without confirming that the current line buffer is non-NULL before appending it to the hunk. This omission propagates a NULL pointer into downstream write operations.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .patch or .diff file through email, source repository, package tarball, or shared build artifact. When a developer or automated system executes patch < malicious.diff, the utility crashes before completing the operation.

The vulnerability manifests in the hunk-writing routine after parsing malformed end-of-file markers. See the GNU Commit Details for the exact code path and remediation.

Detection Methods for CVE-2026-56288

Indicators of Compromise

Unexpected termination or segmentation faults from patch processes during build or update tasks
Presence of unified-diff files containing two or more consecutive \ No newline at end of file markers
Core dumps referencing fwrite() in the call stack of the patch binary
CI/CD job failures correlated with newly introduced or third-party patch files

Detection Strategies

Scan incoming patch files for repeated \ No newline at end of file markers using static content inspection
Monitor process telemetry for patch binary crashes and abnormal exit codes on build hosts
Correlate patch application failures with the source and integrity of the diff file
Track package inventory to identify hosts running GNU patch builds predating commit e6d6a4e021660679d7fc9150f981d4920f722313

Monitoring Recommendations

Log all invocations of patch in build and CI environments, including source file paths and exit status
Alert on segmentation faults involving GNU utilities on developer workstations and build servers
Review third-party patch submissions in code review workflows before automated application

How to Mitigate CVE-2026-56288

Immediate Actions Required

Update GNU patch to a build that includes commit e6d6a4e021660679d7fc9150f981d4920f722313 or later
Audit build pipelines and package managers to confirm they use the patched binary
Restrict automated application of unified-diff files sourced from untrusted contributors

Patch Information

The upstream fix is committed to the GNU patch repository as e6d6a4e021660679d7fc9150f981d4920f722313. Distribution maintainers should rebuild packages against this commit. Refer to the CERT Security Advisory and the GNU Patch Repository for release status.

Workarounds

Validate patch files before application by rejecting inputs with consecutive \ No newline at end of file markers
Run patch in a sandboxed environment or container so a crash does not disrupt the host build process
Require code review and signature verification for all patch files consumed by automated pipelines

bash

# Configuration example: pre-validate patch files before applying
if grep -Pzq '\\ No newline at end of file\n\\ No newline at end of file' "$PATCH_FILE"; then
  echo "Rejected: suspicious consecutive EOF markers in $PATCH_FILE"
  exit 1
fi
patch -p1 < "$PATCH_FILE"