CVE-2026-19542 The GNU C Library CVE debrief

Who should care

Defenders of systems using GNU C Library versions 2.1 to 2.44, especially those with applications that use tsearch and tdelete, should assess exposure and prioritize verification. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review compensating controls and monitor for potential crashes or instability.

Why it matters

A flaw in the GNU C Library's tdelete function may cause an application crash when processing a sufficiently deep tree, requiring defenders to assess exposure and prioritize verification.

• Potential application crashes or instability
• Need for verification of affected systems and applications
• Possible impact on systems with large data sets

Technical summary

The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. This issue requires a node at a depth of exactly 40 (or 40 plus a multiple of 20) in a tree with at least a million nodes. The written value is a pointer into a tree node and is not directly attacker controlled. The affected product context is GNU C Library versions 2.1 to 2.44.

Defensive priority

Assess exposure and prioritize verification for applications using tsearch and tdelete, especially in systems with large data sets.

Recommended defensive actions

• Assess exposure of applications using tsearch and tdelete
• Prioritize verification for systems with large data sets
• Monitor for potential crashes or instability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is triggered by a node at a depth of exactly 40 (or 40 plus a multiple of 20) in a tree with at least a million nodes. The written value is a pointer into a tree node and is not directly attacker controlled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.