new file mode 100644
@@ -0,0 +1,118 @@
+From c97fdd483232a831829aaff458a212307f1bf4bc Mon Sep 17 00:00:00 2001
+From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date: Mon, 14 Sep 2026 17:08:03 -0300
+Subject: [PATCH] resolv: Fix assertion failure on search list truncation [BZ
+ 31026, CVE-2026-8674]
+
+update_from_conf copies the search list into the 256-byte
+resp->defdname and truncates it when an entry does not fit, then
+asserts that resolv_conf_matches accepts the result.
+
+The truncation check there compared the accumulated size against
+sizeof (resp->dnsrch) (the pointer array) instead of resp->defdname,
+and the empty-list case did not account for a first entry that does
+not fit at all. A long search domain in resolv.conf or LOCALDOMAIN
+thus aborts any process using the resolver.
+
+Check whether the entry fits in the remaining defdname space, matching
+alloc_buffer_copy_string, and also accept an empty resp->dnsrch when
+the first entry is too long. Add tests covering both cases through
+the search and domain directives.
+
+Checked on x86_64-linux-gnu and i686-linux-gnu.
+Reviewed-by: Florian Weimer <fweimer@redhat.com>
+
+(cherry picked from commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a)
+(cherry picked from commit c0c8a45dee30c8089822d859575a3ad4324b15ff)
+
+CVE: CVE-2026-8674
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=c97fdd483232a831829aaff458a212307f1bf4bc]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ resolv/resolv_conf.c | 19 +++++++++------
+ resolv/tst-resolv-res_init-skeleton.c | 35 +++++++++++++++++++++++++++
+ 2 files changed, 47 insertions(+), 7 deletions(-)
+
+diff --git a/resolv/resolv_conf.c b/resolv/resolv_conf.c
+index dcf92ee90e..0418267044 100644
+--- a/resolv/resolv_conf.c
++++ b/resolv/resolv_conf.c
+@@ -281,8 +281,12 @@ resolv_conf_matches (const struct __res_state *resp,
+ {
+ if (resp->dnsrch[0] == NULL)
+ {
+- /* Empty search list. No default domain name. */
+- return conf->search_list_size == 0 && resp->defdname[0] == '\0';
++ /* Empty search list, or the first entry does not fit in
++ resp->defdname. No default domain name. */
++ return resp->defdname[0] == '\0'
++ && (conf->search_list_size == 0
++ || (strlen (conf->search_list[0]) + 1
++ > sizeof (resp->defdname)));
+ }
+
+ if (resp->dnsrch[0] != resp->defdname)
+@@ -309,11 +313,12 @@ resolv_conf_matches (const struct __res_state *resp,
+ }
+ else
+ {
+- /* resp->dnsrch is truncated if the number of elements
+- exceeds MAXDNSRCH, or if the combined storage space for
+- the search list exceeds what can be stored in
+- resp->defdname. */
+- if (i == MAXDNSRCH || search_list_size > sizeof (resp->dnsrch))
++ /* resp->dnsrch is truncated if the number of elements exceeds
++ MAXDNSRCH, or if conf->search_list[i] does not fit in the
++ remaining space of resp->defdname. */
++ if (i == MAXDNSRCH
++ || (search_list_size + strlen (conf->search_list[i]) + 1
++ > sizeof (resp->defdname)))
+ break;
+ /* Otherwise, a mismatch indicates a match failure. */
+ return false;
+diff --git a/resolv/tst-resolv-res_init-skeleton.c b/resolv/tst-resolv-res_init-skeleton.c
+index 3ccbe71db9..4e9c57f3cb 100644
+--- a/resolv/tst-resolv-res_init-skeleton.c
++++ b/resolv/tst-resolv-res_init-skeleton.c
+@@ -713,6 +713,41 @@ struct test_case test_cases[] =
+ "nameserver 192.0.2.1\n"
+ "; nameserver[0]: [192.0.2.1]:53\n"
+ },
++/* Search list entries which do not fit in the legacy 256-byte
++ resp->defdname buffer (bug 31026). LONG244 is 244 characters long,
++ so it does not fit after "example.com\0" (12 bytes). LONG256 is 256
++ characters long, so it does not fit even as the first entry. */
++#define LBL63 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++#define LONG244 LBL63 "." LBL63 "." LBL63 "." \
++ "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
++#define LONG256 LBL63 "." LBL63 "." LBL63 "." LBL63 "a"
++ {.name = "search list truncated at long entry after short entry",
++ .conf = "nameserver 192.0.2.1\n"
++ "search example.com " LONG244 "\n",
++ .expected = "search example.com\n"
++ "; search[0]: example.com\n"
++ "; search[1]: " LONG244 "\n"
++ "nameserver 192.0.2.1\n"
++ "; nameserver[0]: [192.0.2.1]:53\n"
++ },
++ {.name = "search list truncated at long first entry",
++ .conf = "nameserver 192.0.2.1\n"
++ "search " LONG256 " example.com\n",
++ .expected = "; search[0]: " LONG256 "\n"
++ "; search[1]: example.com\n"
++ "nameserver 192.0.2.1\n"
++ "; nameserver[0]: [192.0.2.1]:53\n"
++ },
++ {.name = "long first entry from the domain directive",
++ .conf = "nameserver 192.0.2.1\n"
++ "domain " LONG256 "\n",
++ .expected = "; search[0]: " LONG256 "\n"
++ "nameserver 192.0.2.1\n"
++ "; nameserver[0]: [192.0.2.1]:53\n"
++ },
++#undef LONG256
++#undef LONG244
++#undef LBL63
+ {.name = "trust-ad flag",
+ .conf = "options trust-ad\n"
+ "nameserver 192.0.2.1\n",
@@ -74,6 +74,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0039-CVE-2026-77117-CVE-2026-80489.patch \
file://0040-CVE-2026-18374-01.patch \
file://0041-CVE-2026-18374-02.patch \
+ file://0042-CVE-2026-8674.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"