new file mode 100644
@@ -0,0 +1,86 @@
+From 4db2f19f4caac03c7f4da6363c140bd70df31386 Mon Sep 17 00:00:00 2001
+From: Erik Auerswald <auerswal@unix-ag.uni-kl.de>
+Date: Sun, 15 Feb 2026 15:38:50 +0100
+Subject: [PATCH] telnetd: don't allow systemd service credentials
+
+The login(1) implementation of util-linux added support for
+systemd service credentials in release 2.40. This allows to
+bypass authentication by specifying a directory name in the
+environment variable CREDENTIALS_DIRECTORY. If this directory
+contains a file named 'login.noauth' with the content of 'yes',
+login(1) skips authentication.
+
+GNU Inetutils telnetd supports to set arbitrary environment
+variables using the 'Environment' and 'New Environment'
+Telnet options. This allows specifying a directory containing
+'login.noauth'. A local user can create such a directory
+and file, and, e.g., specify the user name 'root' to escalate
+privileges.
+
+This problem was reported by Ron Ben Yizhak in
+<https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>.
+
+This commit clears CREDENTIALS_DIRECTORY from the environment
+before executing login(1) to implement a simple fix that can
+be backported easily.
+
+* NEWS.md: Mention fix.
+* THANKS: Mention Ron Ben Yizhak.
+* telnetd/pty.c: Clear CREDENTIALS_DIRECTORY from the environment
+before executing 'login'.
+
+CVE: CVE-2026-28372
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=4db2f19f4caac03c7f4da6363c140bd70df31386]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ NEWS | 5 +++++
+ THANKS | 1 +
+ telnetd/pty.c | 8 ++++++++
+ 3 files changed, 14 insertions(+)
+
+diff --git a/NEWS b/NEWS
+index 877ca53b..f5172a71 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,5 +1,10 @@
+ GNU inetutils NEWS -- history of user-visible changes.
+
++** Prevent privilege escalation via telnetd abusing systemd service
++credentials support added to the login(1) implementation of util-linux
++in release 2.40. Reported by Ron Ben Yizhak in
++<https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html>.
++
+ * Noteworthy changes in release 2.6 (2025-02-21) [stable]
+
+ ** The release tarball is now reproducible.
+diff --git a/THANKS b/THANKS
+index 8d1d3dbb..ef5f6063 100644
+--- a/THANKS
++++ b/THANKS
+@@ -9,6 +9,7 @@ In particular:
+ NIIBE Yutaka (Security fixes & making talk finally work)
+ Nathan Neulinger (tftpd)
+ Thomas Bushnell (sockaddr sin_len field)
++ Ron Ben Yizhak (reported privilege escalation via telnetd)
+
+ Please see version control logs and ChangeLog.? for full credits.
+
+diff --git a/telnetd/pty.c b/telnetd/pty.c
+index c727e7be..f3518049 100644
+--- a/telnetd/pty.c
++++ b/telnetd/pty.c
+@@ -129,6 +129,14 @@ start_login (char *host, int autologin, char *name)
+ if (!cmd)
+ fatal (net, "can't expand login command line");
+ argcv_get (cmd, "", &argc, &argv);
++
++ /* util-linux's "login" introduced an authentication bypass method
++ * via environment variable "CREDENTIALS_DIRECTORY" in version 2.40.
++ * Clear it from the environment before executing "login" to prevent
++ * abuse via Telnet.
++ */
++ unsetenv ("CREDENTIALS_DIRECTORY");
++
+ execv (argv[0], argv);
+ syslog (LOG_ERR, "%s: %m\n", cmd);
+ fatalperror (net, cmd);
@@ -20,6 +20,7 @@ SRC_URI = "${GNU_MIRROR}/inetutils/inetutils-${PV}.tar.xz \
file://tftpd.xinetd.inetutils \
file://CVE-2026-24061-01.patch \
file://CVE-2026-24061-02.patch \
+ file://CVE-2026-28372.patch \
"
inherit autotools gettext update-alternatives texinfo