Executive brief
musl libc is a fundamental software library used by many Linux-based systems to perform basic operations like sorting data. A flaw in its sorting function (qsort) can cause a system crash or potentially allow an attacker to take control of a program when it processes extremely large lists of data. This issue primarily affects 32-bit systems, as the requirements to trigger it on 64-bit systems are too large to be practical in most real-world scenarios.
Technical details
A stack-based memory corruption vulnerability exists in the musl libc implementation of qsort, which utilizes the smoothsort algorithm. The root cause is a logic error in double-word 'count trailing zeros' and bitshift primitives, where a shift by the word size invokes undefined behavior and incorrect bit counting occurs at word boundaries. To trigger the vulnerability, an application must call qsort on an array exceeding approximately seven million elements on a 32-bit platform. While 64-bit platforms are technically affected, the required array size (exceeding 34 trillion elements) makes exploitation impractical. Successful exploitation could lead to arbitrary code execution, though it requires specific input ordering to trigger the corrupted state. Users are advised to upgrade to version 1.2.7 or apply the provided patch.
Affected products
- musl libc musl libc 0.7.10 through 1.2.6
Timeline
- 2026-04-10: disclosed: Initial disclosure on oss-security mailing list
- 2026-04-10: advisory: CVE-2026-40200 published