new file mode 100644
@@ -0,0 +1,53 @@
+From f806c45178dbca3be08a25cc5dd6d5542ce84a59 Mon Sep 17 00:00:00 2001
+From: Dongkyun Son <dongkyun.s@samsung.com>
+Date: Fri, 4 Sep 2026 21:28:41 +0900
+Subject: [PATCH] libio: Fix CVE-2026-18374 heap buffer overflow in ccs=
+ handling
+
+When fopen() is called with a ,ccs= parameter whose value becomes empty
+after strip(), the code must reject it with EINVAL instead of attempting
+to use it. The original upstr() fallback could read past the ',' delimiter
+and cause a heap buffer overflow.
+
+The fix checks if the charset specification is empty after strip() and
+returns EINVAL immediately, preventing the overflow and following the
+approach described in BZ #34574.
+
+CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
+
+Reported-by: AISLE in partnership with Red Hat
+Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com>
+Reviewed-by: Florian Weimer <fweimer@redhat.com>
+(cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4)
+
+CVE: CVE-2026-18374
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=f806c45178dbca3be08a25cc5dd6d5542ce84a59]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libio/fileops.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/libio/fileops.c b/libio/fileops.c
+index 775999deb3..18efe8e0c0 100644
+--- a/libio/fileops.c
++++ b/libio/fileops.c
+@@ -305,12 +305,14 @@ _IO_new_file_fopen (FILE *fp, const char *filename, const char *mode,
+ *((char *) __mempcpy (ccs, cs + 5, endp - (cs + 5))) = '\0';
+ strip (ccs, ccs);
+
+- if (__wcsmbs_named_conv (&fcts, ccs[2] == '\0'
+- ? upstr (ccs, cs + 5) : ccs) != 0)
++ /* After stripping, ccs[2] == '\0' means the charset name is empty.
++ This is not a valid charset and would cause problems downstream.
++ Reject it with EINVAL (BZ #34574, CVE-2026-18374). */
++ if (ccs[2] == '\0' || __wcsmbs_named_conv (&fcts, ccs) != 0)
+ {
+- /* Something went wrong, we cannot load the conversion modules.
+- This means we cannot proceed since the user explicitly asked
+- for these. */
++ /* Either the charset name is empty after strip(), or conversion
++ modules cannot be loaded. This means we cannot proceed since
++ the user explicitly asked for character conversion. */
+ (void) _IO_file_close_it (fp);
+ free (ccs);
+ __set_errno (EINVAL);
new file mode 100644
@@ -0,0 +1,103 @@
+From 5dd252cf1d113644b3679f5a158e9ef20217865e Mon Sep 17 00:00:00 2001
+From: Shamil Abdulaev <ashamil435@gmail.com>
+Date: Thu, 3 Sep 2026 20:19:42 +0300
+Subject: [PATCH] libio: Add test for fopen with an empty ", ccs=" value [BZ
+ #34574]
+
+This goes on top of the fix for CVE-2026-18374. The test runs the
+reproducer from the bug report, plus "w,ccs=" and "w,ccs=,", and
+expects NULL with errno set to EINVAL.
+
+Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
+Reviewed-by: Florian Weimer <fweimer@redhat.com>
+(cherry picked from commit cca93e5d88d3d4ed073c03100467696f652269e7)
+
+CVE: CVE-2026-18374
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=5dd252cf1d113644b3679f5a158e9ef20217865e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libio/Makefile | 1 +
+ libio/tst-fopen-ccs-empty.c | 62 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 63 insertions(+)
+ create mode 100644 libio/tst-fopen-ccs-empty.c
+
+diff --git a/libio/Makefile b/libio/Makefile
+index 43ee8db06d..5b9929c3de 100644
+--- a/libio/Makefile
++++ b/libio/Makefile
+@@ -99,6 +99,7 @@ tests = \
+ tst-fgetc-after-eof \
+ tst-fgetwc \
+ tst-fgetws \
++ tst-fopen-ccs-empty \
+ tst-fopenloc2 \
+ tst-fputws \
+ tst-freopen \
+diff --git a/libio/tst-fopen-ccs-empty.c b/libio/tst-fopen-ccs-empty.c
+new file mode 100644
+index 0000000000..64723965e1
+--- /dev/null
++++ b/libio/tst-fopen-ccs-empty.c
+@@ -0,0 +1,62 @@
++/* Test fopen with an empty ",ccs=" value in the mode string (bug 34574).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include <errno.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <support/check.h>
++#include <support/support.h>
++#include <support/temp_file.h>
++#include <support/xunistd.h>
++
++static void
++check_fopen_fails (const char *path, const char *mode)
++{
++ errno = 0;
++ FILE *fp = fopen (path, mode);
++ TEST_VERIFY (fp == NULL);
++ TEST_COMPARE (errno, EINVAL);
++ if (fp != NULL)
++ fclose (fp);
++}
++
++static int
++do_test (void)
++{
++ char *path;
++ xclose (create_temp_file ("tst-fopen-ccs-empty", &path));
++
++ /* The value is blank and the mode string continues well past it. */
++ enum { size = 1024 * 1024 };
++ char *mode = xmalloc (size);
++ memset (mode, 'X', size);
++ mode[size - 1] = '\0';
++ static const char prefix[] = "w,ccs= ,";
++ memcpy (mode, prefix, sizeof (prefix) - 1);
++ check_fopen_fails (path, mode);
++ free (mode);
++
++ check_fopen_fails (path, "w,ccs=");
++ check_fopen_fails (path, "w,ccs=,");
++
++ free (path);
++ return 0;
++}
++
++#include <support/test-driver.c>
@@ -72,6 +72,8 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0037-CVE-2026-77117.patch \
file://0038-CVE-2026-80489.patch \
file://0039-CVE-2026-77117-CVE-2026-80489.patch \
+ file://0040-CVE-2026-18374-01.patch \
+ file://0041-CVE-2026-18374-02.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"