CVE-2026-56289: GNU Patch Denial of Service via Malformed Hunk Offsets

Technical summary

The vulnerability stems from insufficient validation of hunk line offsets in unified-diff format input. When patch processes a specially crafted file containing an extremely large line offset value, it enters an inefficient search loop attempting to locate the specified position in the target file. The algorithm lacks bounds checking or early termination conditions, leading to resource exhaustion. The flaw is rooted in CWE-835 (Infinite Loop), where control flow does not properly exit under malformed input conditions. A fix has been committed to the GNU patch repository (commit faba04ef4f2b410257f76c1b9dc85e350929c4b9).

Business impact

Organizations relying on automated patch deployment pipelines—particularly those using patch for configuration management, build systems, or continuous integration—face operational disruption if an attacker or compromised source delivers a malicious patch file. A single crafted patch can render patch instances unresponsive, degrading deployment velocity and requiring manual intervention to recover. The impact is localized to availability; data confidentiality and integrity are not compromised. In environments with strict uptime requirements or high-volume patching workflows, this can cascade into broader system availability issues.

Affected systems

GNU patch is affected across all distributions and operating systems where it is installed. This includes Linux systems (Debian, Ubuntu, Red Hat variants, Alpine, etc.), BSD variants, macOS, and other Unix-like systems where GNU patch is the standard diff application tool. Systems with older versions of GNU patch that predate the fix commit are vulnerable. Organizations should verify their installed patch version against the vendor's advisory to determine exposure.

Exploitability

Exploitability requires local access to the system and the ability to supply a malicious patch file to a patch process. An attacker could deliver a crafted patch via a compromised repository, a man-in-the-middle attack on patch downloads, or social engineering (tricking a user into applying a patch). However, the attack does not yield code execution, privilege escalation, or data exfiltration—only denial of service. The barrier to exploitation is low from a technical standpoint (trivial to craft such a file), but the practical impact depends on how patch is used in the target environment. Automated systems that blindly apply patches from untrusted sources face higher risk.

Remediation

Apply the latest version of GNU patch released after the fix commit faba04ef4f2b410257f76c1b9dc85e350929c4b9. Most Linux distributions have or will provide patched versions through their standard package managers. On most systems, this is a straightforward package update (e.g., 'apt-get upgrade patch' on Debian/Ubuntu or 'yum update patch' on Red Hat systems). Verify the patch version post-upgrade to confirm the fix is in place. Additionally, implement source validation and sandboxing for patch file handling in automated workflows to reduce the risk of processing untrusted or compromised patches.

Patch guidance

Update GNU patch to a version that includes commit faba04ef4f2b410257f76c1b9dc85e350929c4b9 or later. Check your Linux distribution's package repository or the GNU patch project for the specific version number that incorporates this fix. After updating, validate the fix by reviewing the patch binary's build date or version string. For systems on extended support cycles (RHEL, Debian stable), the patch may not be immediately available; check the vendor's security advisory for timeline. In the interim, restrict patch file sources to trusted, authenticated repositories and consider adding file integrity verification (checksums, signatures) to your patch deployment process.

Detection guidance

Monitor system logs for patch processes that consume unusual amounts of CPU or run for unexpectedly long periods. On Linux, tools like 'top', 'htop', or systemd journal logs can reveal hung patch processes. Watch for patch processes that do not terminate gracefully and require SIGKILL. If patch is integrated into build systems or CI/CD pipelines, log the execution time and resource usage of each patch invocation; sustained high CPU usage with a patch process may indicate an attack. Additionally, audit the source of patch files being applied—ensure they originate from authenticated, trusted repositories and have not been tampered with in transit.

Why prioritize this

While this vulnerability carries a MEDIUM severity rating (CVSS 5.5) and does not enable code execution or privilege escalation, it should be prioritized for remediation in any environment where patch is used in automated or user-facing workflows. Availability attacks, though less severe than arbitrary code execution, can significantly degrade operational efficiency. Organizations with high-volume deployment pipelines or SLAs dependent on patching velocity should treat this as a near-term fix. For environments where patch is used infrequently or in isolated, controlled contexts, the priority is lower but should still be addressed within standard patch cycles.

Risk score, explained

The CVSS 5.5 (MEDIUM) score reflects the attack vector (local access required), low complexity, low privilege requirements, and denial of service impact with no confidentiality or integrity compromise. The score correctly captures that this is a localized, availability-only threat that does not escalate privileges or leak data. However, organizations should contextualize this score against their own use of patch—automated systems that process untrusted patches may face higher practical risk than the base CVSS suggests.

Frequently asked questions