Patch musl's CVE-2026-6042 and CVE-2026-40200 by cuviper · Pull Request #155171 · rust-lang/rust

cuviper · 2026-04-11T22:12:27Z

CVE-2026-6042 is a denial of service in iconv.
CVE-2026-40200 is an out-of-bounds write in qsort.

Neither is relevant to Rust itself, but they could be used in mixed-language projects that link with our self-contained/libc.a.

rustbot · 2026-04-11T22:12:33Z

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: infra-ci
infra-ci expanded to Kobzol, Mark-Simulacrum, jdno, jieyouxu, marcoieni
Random selection from Mark-Simulacrum, jdno, marcoieni

cuviper · 2026-04-11T22:17:18Z

Nominating for 1.96-beta and 1.95-stable.

@rustbot label +beta-nominated +stable-nominated

cuviper · 2026-04-11T22:21:00Z

@bors try jobs=dist-arm-linux-musl,dist-i586-gnu-i586-i686-musl,dist-various-1,dist-various-2,dist-x86_64-musl,test-various

Patch musl's CVE-2026-6042 and CVE-2025-26519 try-job: dist-arm-linux-musl try-job: dist-i586-gnu-i586-i686-musl try-job: dist-various-1 try-job: dist-various-2 try-job: dist-x86_64-musl try-job: test-various

- [CVE-2026-6042] is a denial of service in `iconv`. - [CVE-2026-40200] is an out-of-bounds write in `qsort`. Neither is relevant to Rust itself, but they could be used in mixed- language projects that link with our `self-contained/libc.a`. [CVE-2026-6042]: https://www.openwall.com/lists/oss-security/2026/04/09/19 [CVE-2026-40200]: https://www.openwall.com/lists/musl/2026/04/10/3

cuviper · 2026-04-11T22:27:40Z

Sorry, I mixed up my CVE numbers and links when writing the commit message, now fixed. The patches were the right ones though, so the try build should still be testing the right thing.

Mark-Simulacrum · 2026-04-11T23:18:03Z

r=me in principle, and I think I'll probably pull this into stable artifact building ~Monday. Not sure we really have a team to approve the backport (compiler? libs?) but it feels like it should be uncontroversial.

rust-bors · 2026-04-12T00:48:17Z

☀️ Try build successful (CI)
Build commit: c072ac5 (c072ac5e4268735cbce40bf48eccf5a70e127378, parent: bf4fbfb7a18d74e7cd8eef93af7329c58fbb5344)

Mark-Simulacrum · 2026-04-12T01:20:47Z

@bors r+ p=1

rust-bors · 2026-04-12T01:20:52Z

📌 Commit 8830551 has been approved by Mark-Simulacrum

It is now in the queue for this repository.

Rollup of 4 pull requests Successful merges: - #155171 (Patch musl's CVE-2026-6042 and CVE-2026-40200) - #153630 (Deprioritize doc(hidden) re-exports in diagnostic paths) - #152613 (unsafe keyword docs: bring back unsafe_op_in_unsafe_fn lint discussion) - #155142 (impl const Residual for ControlFlow)

Rollup merge of #155171 - cuviper:musl-cves, r=Mark-Simulacrum Patch musl's CVE-2026-6042 and CVE-2026-40200 - [CVE-2026-6042] is a denial of service in `iconv`. - [CVE-2026-40200] is an out-of-bounds write in `qsort`. Neither is relevant to Rust itself, but they could be used in mixed-language projects that link with our `self-contained/libc.a`. [CVE-2026-6042]: https://www.openwall.com/lists/oss-security/2026/04/09/19 [CVE-2026-40200]: https://www.openwall.com/lists/musl/2026/04/10/3

Mark-Simulacrum · 2026-04-12T19:51:44Z

Leaving the beta nomination (and acceptance) so this goes into 1.96, manually bringing it into 1.95 (not technically a stable backport).

Mark-Simulacrum · 2026-04-12T19:59:56Z

And included it in the beta branch PR as well, so should be handled.

[stable] Rust 1.95.0 release https://forge.rust-lang.org/release/process.html#stable-pr This also backports: * Patch musl's CVE-2026-6042 and CVE-2026-40200 #155171 and cherry picks latest release notes. r? me

[beta] branch 1.96 release This follows https://forge.rust-lang.org/release/process.html#beta-pr to branch beta. It also includes a backport of: * Patch musl's CVE-2026-6042 and CVE-2026-40200 #155171 since it landed after beta branched but per security discussion is getting backported direct to stable. r? me

[stable] Rust 1.95.0 release https://forge.rust-lang.org/release/process.html#stable-pr This also backports: * Patch musl's CVE-2026-6042 and CVE-2026-40200 #155171 and cherry picks latest release notes. r? me

[beta] branch 1.96 release This follows https://forge.rust-lang.org/release/process.html#beta-pr to branch beta. It also includes a backport of: * Patch musl's CVE-2026-6042 and CVE-2026-40200 #155171 since it landed after beta branched but per security discussion is getting backported direct to stable. r? me

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [rust](https://github.com/rust-lang/rust) | | minor | `1.94.0` → `1.95.0` | | rust | stage | minor | `1.94-bookworm` → `1.95-bookworm` | --- ### Release Notes <details> <summary>rust-lang/rust (rust)</summary> ### [`v1.95.0`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1950-2026-04-16) [Compare Source](rust-lang/rust@1.94.1...1.95.0) \=========================== <a id="1.95-Language"></a> ## Language - [Stabilize `if let` guards on match arms](rust-lang/rust#141295) - [`irrefutable_let_patterns` lint no longer lints on let chains](rust-lang/rust#146832) - [Support importing path-segment keywords with renaming](rust-lang/rust#146972) - [Stabilize inline assembly for PowerPC and PowerPC64](rust-lang/rust#147996) - [const-eval: be more consistent in the behavior of padding during typed copies](rust-lang/rust#148967) - [Const blocks are no longer evaluated to determine if expressions involving fallible operations can implicitly be constant-promoted.](rust-lang/rust#150557). Expressions whose ability to implicitly be promoted would depend on the result of a const block are no longer implicitly promoted. - [Make operational semantics of pattern matching independent of crate and module](rust-lang/rust#150681) <a id="1.95-Compiler"></a> ## Compiler - [Stabilize `--remap-path-scope` for controlling the scoping of how paths get remapped in the resulting binary](rust-lang/rust#147611) - [Apply patches for CVE-2026-6042 and CVE-2026-40200 to vendored musl](rust-lang/rust#155171) <a id="1.95-Platform-Support"></a> ## Platform Support - [Promote `powerpc64-unknown-linux-musl` to Tier 2 with host tools](rust-lang/rust#149962) - [Promote `aarch64-apple-tvos` to Tier 2](rust-lang/rust#152021) - [Promote `aarch64-apple-tvos-sim` to Tier 2](rust-lang/rust#152021) - [Promote `aarch64-apple-watchos` to Tier 2](rust-lang/rust#152021) - [Promote `aarch64-apple-watchos-sim` to Tier 2](rust-lang/rust#152021) - [Promote `aarch64-apple-visionos` to Tier 2](rust-lang/rust#152021) - [Promote `aarch64-apple-visionos-sim` to Tier 2](rust-lang/rust#152021) Refer to Rust's [platform support page][platform-support-doc] for more information on Rust's tiered platform support. [platform-support-doc]: https://doc.rust-lang.org/rustc/platform-support.html <a id="1.95-Libraries"></a> ## Libraries - [`thread::scope`: document how join interacts with TLS destructors](rust-lang/rust#149482) - [Speed up `str::contains` on aarch64 targets with `neon` target feature enabled by default](rust-lang/rust#152176) <a id="1.95-Stabilized-APIs"></a> ## Stabilized APIs - [`MaybeUninit<[T; N]>: From<[MaybeUninit<T>; N]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-From%3CMaybeUninit%3C%5BT;+N%5D%3E%3E-for-%5BMaybeUninit%3CT%3E;+N%5D) - [`MaybeUninit<[T; N]>: AsRef<[MaybeUninit<T>; N]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-AsRef%3C%5BMaybeUninit%3CT%3E;+N%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E) - [`MaybeUninit<[T; N]>: AsRef<[MaybeUninit<T>]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-AsRef%3C%5BMaybeUninit%3CT%3E%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E) - [`MaybeUninit<[T; N]>: AsMut<[MaybeUninit<T>; N]>`](https://doc.rust-lang.org/beta/std/mem/union.MaybeUninit.html#impl-AsMut%3C%5BMaybeUninit%3CT%3E;+N%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E) - [`MaybeUninit<[T; N]>: AsMut<[MaybeUninit<T>]>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-AsMut%3C%5BMaybeUninit%3CT%3E%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E) - [`[MaybeUninit<T>; N]: From<MaybeUninit<[T; N]>>`](https://doc.rust-lang.org/stable/std/mem/union.MaybeUninit.html#impl-From%3C%5BMaybeUninit%3CT%3E;+N%5D%3E-for-MaybeUninit%3C%5BT;+N%5D%3E) - [`Cell<[T; N]>: AsRef<[Cell<T>; N]>`](https://doc.rust-lang.org/stable/std/cell/struct.Cell.html#impl-AsRef%3C%5BCell%3CT%3E;+N%5D%3E-for-Cell%3C%5BT;+N%5D%3E) - [`Cell<[T; N]>: AsRef<[Cell<T>]>`](https://doc.rust-lang.org/stable/std/cell/struct.Cell.html#impl-AsRef%3C%5BCell%3CT%3E%5D%3E-for-Cell%3C%5BT;+N%5D%3E) - [`Cell<[T]>: AsRef<[Cell<T>]>`](https://doc.rust-lang.org/stable/std/cell/struct.Cell.html#impl-AsRef%3C%5BCell%3CT%3E%5D%3E-for-Cell%3C%5BT%5D%3E) - [`bool: TryFrom<{integer}>`](https://doc.rust-lang.org/stable/std/primitive.bool.html#impl-TryFrom%3Cu128%3E-for-bool) - [`AtomicPtr::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicPtr.html#method.update) - [`AtomicPtr::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicPtr.html#method.try_update) - [`AtomicBool::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicBool.html#method.update) - [`AtomicBool::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicBool.html#method.try_update) - [`AtomicIn::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicIsize.html#method.update) - [`AtomicIn::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicIsize.html#method.try_update) - [`AtomicUn::update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicUsize.html#method.update) - [`AtomicUn::try_update`](https://doc.rust-lang.org/stable/std/sync/atomic/struct.AtomicUsize.html#method.try_update) - [`cfg_select!`](https://doc.rust-lang.org/stable/std/macro.cfg_select.html) - [`mod core::range`](https://doc.rust-lang.org/stable/core/range/index.html) - [`core::range::RangeInclusive`](https://doc.rust-lang.org/stable/core/range/struct.RangeInclusive.html) - [`core::range::RangeInclusiveIter`](https://doc.rust-lang.org/stable/core/range/struct.RangeInclusiveIter.html) - [`core::hint::cold_path`](https://doc.rust-lang.org/stable/core/hint/fn.cold_path.html) - [`<*const T>::as_ref_unchecked`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_ref_unchecked) - [`<*mut T>::as_ref_unchecked`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_ref_unchecked-1) - [`<*mut T>::as_mut_unchecked`](https://doc.rust-lang.org/stable/std/primitive.pointer.html#method.as_mut_unchecked) - [`Vec::push_mut`](https://doc.rust-lang.org/stable/std/vec/struct.Vec.html#method.push_mut) - [`Vec::insert_mut`](https://doc.rust-lang.org/stable/std/vec/struct.Vec.html#method.insert_mut) - [`VecDeque::push_front_mut`](https://doc.rust-lang.org/stable/std/collections/struct.VecDeque.html#method.push_front_mut) - [`VecDeque::push_back_mut`](https://doc.rust-lang.org/stable/std/collections/struct.VecDeque.html#method.push_back_mut) - [`VecDeque::insert_mut`](https://doc.rust-lang.org/stable/std/collections/struct.VecDeque.html#method.insert_mut) - [`LinkedList::push_front_mut`](https://doc.rust-lang.org/stable/std/collections/struct.LinkedList.html#method.push_front_mut) - [`LinkedList::push_back_mut`](https://doc.rust-lang.org/stable/std/collections/struct.LinkedList.html#method.push_back_mut) - [`Layout::dangling_ptr`](https://doc.rust-lang.org/stable/std/alloc/struct.Layout.html#method.dangling_ptr) - [`Layout::repeat`](https://doc.rust-lang.org/stable/std/alloc/struct.Layout.html#method.repeat) - [`Layout::repeat_packed`](https://doc.rust-lang.org/stable/std/alloc/struct.Layout.html#method.repeat_packed) - [`Layout::extend_packed`](https://doc.rust-lang.org/stable/std/alloc/struct.Layout.html#method.extend_packed) These previously stable APIs are now stable in const contexts: - [`fmt::from_fn`](https://doc.rust-lang.org/stable/std/fmt/fn.from_fn.html) - [`ControlFlow::is_break`](https://doc.rust-lang.org/stable/core/ops/enum.ControlFlow.html#method.is_break) - [`ControlFlow::is_continue`](https://doc.rust-lang.org/stable/core/ops/enum.ControlFlow.html#method.is_continue) <a id="1.95-Rustdoc"></a> ## Rustdoc - [In search results, rank unstable items lower](rust-lang/rust#149460) - [Add new "hide deprecated items" setting in rustdoc](rust-lang/rust#151091) <a id="1.95-Compatibility-Notes"></a> ## Compatibility Notes - [Array coercions may now result in less inference constraints than before](rust-lang/rust#140283) - Importing `$crate` without renaming, i.e. `use $crate::{self};`, is now no longer permitted due to stricter error checking for `self` imports. - [const-eval: be more consistent in the behavior of padding during typed copies.](rust-lang/rust#148967) In very rare cases, this may cause compilation errors due to bytes from parts of a pointer ending up in the padding bytes of a `const` or `static`. - [A future-incompatibility warning lint `ambiguous_glob_imported_traits` is now reported when using an ambiguously glob imported trait](rust-lang/rust#149058) - [Check lifetime bounds of types mentioning only type parameters](rust-lang/rust#149389) - [Report more visibility-related ambiguous import errors](rust-lang/rust#149596) - [Deprecate `Eq::assert_receiver_is_total_eq` and emit future compatibility warnings on manual impls](rust-lang/rust#149978) - [powerpc64: Use the ELF ABI version set in target spec instead of guessing](rust-lang/rust#150468) (fixes the ELF ABI used by the OpenBSD target) - Matching on a `#[non_exhaustive]` enum [now reads the discriminant, even if the enum has only one variant](rust-lang/rust#150681). This can cause closures to capture values that they previously wouldn't. - `mut ref` and `mut ref mut` patterns, part of the unstable [Match Ergonomics 2024 RFC](rust-lang/rust#123076), were accidentally allowed on stable within struct pattern field shorthand. These patterns are now correctly feature-gated as unstable in this position. - [Add future-compatibility warning for derive helper attributes which conflict with built-in attributes](rust-lang/rust#151152) - [JSON target specs](https://doc.rust-lang.org/rustc/targets/custom.html) have been destabilized and now require `-Z unstable-options` to use. Previously, they could not be used without the standard library, which has no stable build mechanism. In preparation for the `build-std` project adding that support, JSON target specs are being proactively gated to ensure they remain unstable even if `build-std` is stabilized. Cargo now includes the `-Z json-target-spec` CLI flag to automatically pass `-Z unstable-options` to the compiler when needed. See [#150151](rust-lang/rust#150151), [#151534](rust-lang/rust#150151), and [rust-lang/cargo#16557](rust-lang/cargo#16557). - [The arguments of `#[feature]` attributes on invalid targets are now checked](rust-lang/rust#153764) <a id="1.95-Internal-Changes"></a> ## Internal Changes These changes do not affect any public interfaces of Rust, but they represent significant improvements to the performance or internals of rustc and related tools. - [Update to LLVM 22](rust-lang/rust#150722) ### [`v1.94.1`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1941-2026-03-26) [Compare Source](rust-lang/rust@1.94.0...1.94.1) \=========================== <a id="1.94.1"></a> - [Fix `std::thread::spawn` on wasm32-wasip1-threads](rust-lang/rust#153634) - [Remove new methods added to `std::os::windows::fs::OpenOptionsExt`](rust-lang/rust#153491) The new methods were unstable, but the trait itself is not sealed and so cannot be extended with non-default methods. - [Clippy: fix ICE in `match_same_arms`](rust-lang/rust-clippy#16685) - [Cargo: update tar to 0.4.45](rust-lang/cargo#16769) This resolves CVE-2026-33055 and CVE-2026-33056. Users of crates.io are not affected. See [blog](https://blog.rust-lang.org/2026/03/21/cve-2026-33056/) for more details. </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/towonel/pulls/4

rustbot assigned Mark-Simulacrum Apr 11, 2026

rustbot added beta-nominated Nominated for backporting to the compiler in the beta channel. stable-nominated Nominated for backporting to the compiler in the stable channel. labels Apr 11, 2026

This comment has been minimized.

Sign in to view

cuviper changed the title ~~Patch musl's CVE-2026-6042 and CVE-2025-26519~~ Patch musl's CVE-2026-6042 and CVE-2026-40200 Apr 11, 2026

cuviper force-pushed the musl-cves branch from e7f91d9 to 8830551 Compare April 11, 2026 22:26

rust-bors bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 12, 2026

matthiaskrgr mentioned this pull request Apr 12, 2026

Rollup of 4 pull requests #155185

Merged

rust-bors bot merged commit 8bd2996 into rust-lang:main Apr 12, 2026
11 checks passed

rustbot added this to the 1.97.0 milestone Apr 12, 2026

Mark-Simulacrum added beta-accepted Accepted for backporting to the compiler in the beta channel. and removed stable-nominated Nominated for backporting to the compiler in the stable channel. labels Apr 12, 2026

This was referenced Apr 12, 2026

[stable] Rust 1.95.0 release #155210

Merged

[beta] branch 1.96 release #155211

Merged

Mark-Simulacrum removed the beta-nominated Nominated for backporting to the compiler in the beta channel. label Apr 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Patch musl's CVE-2026-6042 and CVE-2026-40200#155171

Patch musl's CVE-2026-6042 and CVE-2026-40200#155171
rust-bors[bot] merged 1 commit intorust-lang:mainfrom
cuviper:musl-cves

cuviper commented Apr 11, 2026 •

edited

Loading

Uh oh!

rustbot commented Apr 11, 2026

Uh oh!

cuviper commented Apr 11, 2026

Uh oh!

cuviper commented Apr 11, 2026

Uh oh!

This comment has been minimized.

cuviper commented Apr 11, 2026

Uh oh!

Mark-Simulacrum commented Apr 11, 2026

Uh oh!

rust-bors bot commented Apr 12, 2026

Uh oh!

Mark-Simulacrum commented Apr 12, 2026

Uh oh!

rust-bors bot commented Apr 12, 2026

Uh oh!

Uh oh!

Mark-Simulacrum commented Apr 12, 2026

Uh oh!

Mark-Simulacrum commented Apr 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

cuviper commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Apr 11, 2026

Uh oh!

cuviper commented Apr 11, 2026

Uh oh!

cuviper commented Apr 11, 2026

Uh oh!

This comment has been minimized.

cuviper commented Apr 11, 2026

Uh oh!

Mark-Simulacrum commented Apr 11, 2026

Uh oh!

rust-bors bot commented Apr 12, 2026

Uh oh!

Mark-Simulacrum commented Apr 12, 2026

Uh oh!

rust-bors bot commented Apr 12, 2026

Uh oh!

Uh oh!

Mark-Simulacrum commented Apr 12, 2026

Uh oh!

Mark-Simulacrum commented Apr 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cuviper commented Apr 11, 2026 •

edited

Loading