CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction
GNU Inetutils CVE-2026-95510 uses an uninitialized sigaction in rlogin, rlogind, and telnetd, risking crashes.
Collin Funk disclosed CVE-2026-95510 in GNU Inetutils after Brian Mak privately reported a bug in libinetutils on 2026-09-14. A function used by rlogin, rlogind, and telnetd uses an uninitialized struct sigaction. Mak saw telnetd crash, which can cause denial of service, and maintainers also discussed possible code execution on some platforms. Possible exploits are not fully clear, and no in-the-wild exploitation is reported.
- Uninitialized struct sigaction in libinetutils affects rlogin, rlogind, and telnetd.
- Brian Mak observed telnetd crashing, which can cause denial of service.
- Maintainers also discussed possible code execution; exploitability remains unclear.
- No in-the-wild exploitation is reported.
- CVEs
- CVE-2026-95510
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95510 | — | — | — |
From the original article
Posted by Collin Funk on Sep 25 On 2026-09-14, Brian Mak privately reported a security issue with a function defined in libinetutils, a part of GNU Inetutils. The function is used by rlogin, rlogind, and telnetd. The possible exploits using the bug aren't entirely clear.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.