[Git][security-tracker-team/security-tracker][master] CVE-2026-85091/zlib [bookworm] not affected, vulnerable code introduced later

[Tobias Frost (@tobi)]

Tobias Frost pushed to branch master at Debian Security Tracker / security-tracker


Commits:
62f95d84 by Tobias Frost at 2026-10-03T18:43:59+02:00
CVE-2026-85091/zlib [bookworm] not affected, vulnerable code introduced later

CVE-2026-85091 is triggered by a stalled write to a non-blocking file
descriptor. The vulnerable code relies on non-blocking support in the
gz* functions.

This functionality is not present in zlib 1.2.13 shipped in bookworm.
Support for non-blocking devices in the gz* routines was introduced
upstream by commit
https://github.com/madler/zlib/commit/81cc0bebedd935daeb81b0b6e475d8786b51af3d
and was first released in zlib 1.3.2. See also upstream issue
https://github.com/madler/zlib/issues/1292.

An application can nevertheless pass a file descriptor with O_NONBLOCK
set to zlib 1.2.13. However, zlib 1.2.13 does not handle non-blocking I/O
specially. If a write would block and therefore returns EAGAIN or
EWOULDBLOCK, it is treated as a regular I/O error. gz_comp() calls
gz_error() and puts the stream into the Z_ERRNO error state.

This is significant for the CVE: subsequent calls to gzwrite() are
rejected while the stream is in an error state and therefore cannot reach
the code which processes the new input buffer using the stale stream
state. In other words, zlib 1.2.13 does not support continuing a gzwrite()
operation after a non-blocking write has stalled; it fails the stream
instead.

The later non-blocking support changes this behavior: EAGAIN is treated
as a temporary stall rather than a permanent stream error, allowing
subsequent gzwrite() calls to continue using the stream. The vulnerable
state handling occurs in this newly introduced functionality.

Therefore, the code path required to trigger CVE-2026-85091 is not present
in zlib 1.2.13, and the zlib package in bookworm is not affected.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -41205,9 +41205,11 @@ CVE-2026-85092 (LiME through 1.12.0 fails to validate the disk acquisition outpu
 	NOT-FOR-US: LiME
 CVE-2026-85091 (zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...)
 	- zlib <unfixed> (bug #1146895)
+	[bookworm] - zlib <not-affected> (vulnerable code introduced later)
 	NOTE: https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
 	NOTE: https://github.com/madler/zlib/issues/1310
 	NOTE: Fixed by: https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148
+	NOTE: non-blocking operations introduced with https://github.com/madler/zlib/commit/81cc0bebedd9 (v1.3.2)
 CVE-2026-91947 (FreeRDP server versions before 3.31.0 contain a use-after-free vulnera ...)
 	- freerdp3 3.31.0+dfsg-1
 	- freerdp2 <removed>



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62f95d845208ea3588d70ee3da322c6a0040af25

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62f95d845208ea3588d70ee3da322c6a0040af25
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/fb01bb85/attachment.htm>