CVE-2026-56288: GNU Patch NULL Pointer Dereference DoS Vulnerability

Technical summary

CVE-2026-56288 is a NULL pointer dereference vulnerability in GNU patch stemming from improper handling of end-of-file newline sequences in unified-diff format patch files. During hunk data structure processing, consecutive EOF newline markers can corrupt internal state, causing a NULL pointer to be passed to fwrite(). This results in an unhandled null dereference and application crash. The vulnerability is rooted in CWE-476 (NULL pointer dereference) and has been remediated in commit e6d6a4e021660679d7fc9150f981d4920f722313.

Business impact

The primary business impact is denial of service: a malicious or compromised patch file can cause patch to crash, interrupting automated patching workflows, CI/CD pipelines, or manual code maintenance. Organizations relying on patch as part of security update deployment or software development processes could experience operational delays. However, because the vulnerability requires local or indirect file-based attack vectors and produces only a crash (not code execution), the blast radius is constrained compared to memory corruption vulnerabilities.

Affected systems

GNU patch in all versions prior to the fix commit are affected. Any system or user account with patch installed and privileges to execute it is potentially at risk. This includes Linux distributions that package GNU patch, embedded systems using patch for firmware updates, and development environments where patch is part of the build or update toolchain. Version numbers and specific affected releases should be verified against vendor advisories and distribution-specific security bulletins.

Exploitability

Exploitability is moderate. The CVSS 3.1 score of 5.5 (MEDIUM) reflects that the attack vector is local, requires low privileges, and does not require user interaction beyond executing patch with a crafted input file. An attacker must already have the ability to place or control a patch file on the target system, or trick a user into applying a malicious patch. Remote exploitation would require an upstream injection point (e.g., a compromised patch repository or man-in-the-middle scenario). The vulnerability does not enable privilege escalation or data exfiltration—impact is limited to availability disruption.

Remediation

Apply a patch or update from your GNU patch vendor or Linux distribution that includes commit e6d6a4e021660679d7fc9150f981d4920f722313 or later. Most major distributions (Debian, Red Hat, Ubuntu, etc.) will release patched packages; users should check their package management system for available updates. Verify the patched version number against the vendor advisory before deployment. Until patched, restrict file-based inputs to patch to known, trusted sources and consider sandboxing patch execution in untrusted workflows.

Patch guidance

1. Check your current GNU patch version: run 'patch --version'. 2. Consult your Linux distribution's security bulletin (Debian, Red Hat, Ubuntu, etc.) for the patched version number specific to your platform. 3. Update via your package manager (apt, yum, dnf, etc.). 4. Verify the updated version no longer exhibits the vulnerability by re-running 'patch --version' and confirming it matches the vendor's released version. 5. Test patch functionality on non-critical systems first if possible.

Detection guidance

Log and alert on unexpected patch utility crashes, particularly when patch processes files from external or untrusted sources. Monitor for error messages referencing NULL pointer dereferences or segmentation faults from patch processes. In SIEM or log aggregation systems, look for process exit codes indicating abnormal termination (e.g., signal 11 for SIGSEGV). Endpoint detection and response (EDR) tools can flag repeated crash patterns. Implement file integrity monitoring on patch files in version control or patch repositories to detect injection of malformed unified-diff content.

Why prioritize this

Prioritize this vulnerability for patching because: (1) GNU patch is a fundamental utility with broad distribution across Linux systems and development environments, (2) Although the CVSS score is MEDIUM, denial of service in patch workflows can cascade to delay critical security updates or system maintenance, (3) It is not on the CISA KEV list, meaning it has not yet been widely exploited in the wild, providing a window for proactive remediation before threat actors develop automated tools, (4) Exploitation is relatively simple (craft a malicious patch file), making it suitable for adversaries who have supply-chain or file-injection capabilities.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: AV:L (local attack vector—attacker must place file on target or user must run patch locally), AC:L (low complexity—no special conditions), PR:L (low privilege—any user with patch execution rights), UI:N (no user interaction beyond running patch), S:U (impact is to the application process scope, not system-wide), C:N (no confidentiality loss), I:N (no integrity loss), A:H (high availability impact via crash). The score does not account for supply-chain amplification (a single malicious patch file distributed through a repository could affect many systems) but reflects single-system worst-case risk.

Frequently asked questions