GNU Inetutils CVE-2026-95510

Requires that a vulnerable libinetutils-based daemon - telnetd, rlogind, or rlogin - is actually running and reachable, and that the uninitialized sa_flags value happens to include the SA_RESTORER bit (non-deterministic, dependent on process stack contents at the time setsig() runs). The DoS path needs only that the crash condition is hit; the far more limited code-execution path is additionally constrained to platforms/architectures that honor the SA_RESTORER flag and use the sa_restorer signal trampoline, which the advisory (via a glibc maintainer) says excludes most new generic Linux ports. Practical limiting factors: telnet/rlogin are legacy protocols usually disabled by default, the trigger value is not directly attacker-controlled, and reliability is low.

No CVSS vector, EPSS score, KEV entry, or public POC is available for this issue - all quantitative risk signals are absent, so assessment relies on the oss-security advisory text alone. The only CONFIRMED impact is a denial of service: the reporter observed telnetd crashing due to use of an uninitialized 'struct sigaction' (sa_flags is OR'd with SA_RESTART before initialization, and sa_restorer is left as whatever stack garbage exists). Code execution is explicitly SPECULATIVE - the advisory states 'the possible exploits using the bug aren't entirely clear' and raises code execution only as a concern 'on platforms that use the SA_RESTORER bit,' with a glibc maintainer noting that most new generic Linux ports are NOT affected. Because the dangerous value derives from non-attacker-controlled stack contents, exploitation is non-deterministic and high-complexity. This reads as a genuine but low-priority correctness/robustness bug: a plausible unauthenticated DoS against exposed legacy daemons, with a mostly theoretical, platform-dependent RCE ceiling. Note the conflict: the affected daemons are network-facing (implying network reach), yet the bug's trigger condition depends on process stack state rather than attacker input, which caps real-world exploitability - verify architecture-specific SA_RESTORER behavior with the vendor before treating RCE as credible.

An attacker reaches an exposed telnetd, rlogind, or rlogin service that calls the vulnerable libinetutils setsig() function; when the uninitialized sa_flags happens to carry the SA_RESTORER bit, signal delivery jumps through an uninitialized sa_restorer function pointer, crashing the daemon (a confirmed DoS). On specific architectures using the sa_restorer signal trampoline, this uninitialized pointer could theoretically be steered toward code execution, but no public exploit exists and the outcome depends on non-attacker-controlled stack contents.