QSN-8692-1: GNU diffutils vulnerability
2026-08-31

Summary:
GNU diffutils could be made to crash if it received specially crafted
input.

Details:
It was discovered that GNU diffutils incorrectly handled certain integer
arithmetic when mapping line ranges in diff3. A local attacker could
possibly use this issue to cause diff3 to crash, resulting in a denial of
service.

Affected QuantaStor releases:
  6.9.1.001 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.9.0.464 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.8.6.015 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.8.5.018 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.8.4.038 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.8.3.018 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.8.2.002 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.8.1.007 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)
  6.8.0.205 jammy: diffutils 1:3.8-0ubuntu2 (fixed in 1:3.8-0ubuntu2.1)

CVEs: CVE-2026-53910

References:
  https://ubuntu.com/security/notices/USN-8692-1