From 6ed1f7386aa7227891cd9e1006d35b58a0b665b4 Mon Sep 17 00:00:00 2001 From: Chris Gunn Date: Fri, 14 Aug 2026 16:49:35 -0700 Subject: [PATCH 1/2] memcached: patch: fix crash in binary protocol --- ...1-proto-fix-crash-in-binary-protocol.patch | 29 +++++++++++++++++++ SPECS/memcached/memcached.spec | 6 +++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch diff --git a/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch b/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch new file mode 100644 index 00000000000..6f611fb172c --- /dev/null +++ b/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch @@ -0,0 +1,29 @@ +From 2e623108dec9759ad3e258aa695288a1ef6a0c72 Mon Sep 17 00:00:00 2001 +From: dormando +Date: Fri, 1 May 2026 13:48:44 -0700 +Subject: [PATCH] proto: fix crash in binary protocol + +If `watch mutations` is running and a binary protocol SET fails the +logger code attempts to resolve a NULL item reference and will crash. + +Reported by Haruto Kimura (Stella) +--- + proto_bin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/proto_bin.c b/proto_bin.c +index 778ea9a..0e92539 100644 +--- a/proto_bin.c ++++ b/proto_bin.c +@@ -1136,7 +1136,7 @@ static void process_bin_update(conn *c, char *extbuf) { + /* FIXME: losing c->cmd since it's translated below. refactor? */ + LOGGER_LOG(c->thread->l, LOG_MUTATIONS, LOGGER_ITEM_STORE, + NULL, status, 0, key, nkey, req->message.body.expiration, +- ITEM_clsid(it), c->sfd); ++ 0, c->sfd); + + /* Avoid stale data persisting in cache because we failed alloc. + * Unacceptable for SET. Anywhere else too? */ +-- +2.55.0 + diff --git a/SPECS/memcached/memcached.spec b/SPECS/memcached/memcached.spec index abbbaa0dad4..1ef8da24186 100644 --- a/SPECS/memcached/memcached.spec +++ b/SPECS/memcached/memcached.spec @@ -7,7 +7,7 @@ Summary: High Performance, Distributed Memory Object Cache Name: memcached Version: 1.6.27 -Release: 5%{?dist} +Release: 6%{?dist} License: BSD Vendor: Microsoft Corporation Distribution: Azure Linux @@ -19,6 +19,7 @@ Patch1: CVE-2021-43519.patch Patch2: CVE-2021-44647.patch Patch3: CVE-2026-24809.patch Patch4: CVE-2026-47783.patch +Patch5: 0001-proto-fix-crash-in-binary-protocol.patch BuildRequires: gcc BuildRequires: libevent-devel BuildRequires: systemd-devel @@ -133,6 +134,9 @@ exit 0 %{_unitdir}/memcached.service %changelog +* Thu Aug 14 2026 Chris Gunn - 1.6.27-6 +- Patch: fix crash in binary protocol + * Thu May 21 2026 Azure Linux Security Servicing Account - 1.6.27-5 - Patch for CVE-2026-47783 From 6301599b1ddbd2381ae68dbe3fb50c0d988da39c Mon Sep 17 00:00:00 2001 From: Chris Gunn Date: Mon, 17 Aug 2026 11:11:52 -0700 Subject: [PATCH 2/2] Feedback updates --- SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch | 2 ++ SPECS/memcached/memcached.spec | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch b/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch index 6f611fb172c..46ae9cbf033 100644 --- a/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch +++ b/SPECS/memcached/0001-proto-fix-crash-in-binary-protocol.patch @@ -7,6 +7,8 @@ If `watch mutations` is running and a binary protocol SET fails the logger code attempts to resolve a NULL item reference and will crash. Reported by Haruto Kimura (Stella) + +Upstream Patch Reference : https://github.com/memcached/memcached/commit/32ea7d8b5b --- proto_bin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SPECS/memcached/memcached.spec b/SPECS/memcached/memcached.spec index 1ef8da24186..694d143cc7e 100644 --- a/SPECS/memcached/memcached.spec +++ b/SPECS/memcached/memcached.spec @@ -134,7 +134,7 @@ exit 0 %{_unitdir}/memcached.service %changelog -* Thu Aug 14 2026 Chris Gunn - 1.6.27-6 +* Fri Aug 14 2026 Chris Gunn - 1.6.27-6 - Patch: fix crash in binary protocol * Thu May 21 2026 Azure Linux Security Servicing Account - 1.6.27-5