sort: fix buffer under-read

Resolves: CVE-2025-5278
Resolves: rhbz#2368766

coreutils-8.32-DIR_COLORS.patch

@@ -1,4 +1,4 @@
-From bca11e30e8a6281a8cbddc9fb196dd86ab09c955 Mon Sep 17 00:00:00 2001
+From c7b13f5e1a7ad012c510a8bdd5a8943ab4b55833 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Fri, 17 Jun 2016 16:58:18 +0200
 Subject: [PATCH] downstream changes to default DIR_COLORS
@@ -9,7 +9,7 @@ Subject: [PATCH] downstream changes to default DIR_COLORS
  2 files changed, 23 insertions(+), 7 deletions(-)
 
 diff --git a/DIR_COLORS b/DIR_COLORS
-index 540f6cd..b4785b6 100644
+index b465771..ad42b09 100644
 --- a/DIR_COLORS
 +++ b/DIR_COLORS
 @@ -1,3 +1,7 @@
@@ -30,17 +30,17 @@ index 540f6cd..b4785b6 100644
  # ===================================================================
  # Terminal filters
  # ===================================================================
-@@ -70,7 +77,7 @@ DOOR 01;35	# door
+@@ -69,7 +76,7 @@ DOOR 01;35	# door
  BLK 40;33;01	# block device driver
  CHR 40;33;01	# character device driver
  ORPHAN 40;31;01 # symlink to nonexistent file, or non-stat'able file ...
 -MISSING 00      # ... and the files they point to
 +MISSING 01;37;41 # ... and the files they point to
- SETUID 37;41	# regular file that is setuid (u+s)
- SETGID 30;43	# regular file that is setgid (g+s)
- CAPABILITY 00	# regular file with capability (very expensive to lookup)
+ SETUID 37;41	# file that is setuid (u+s)
+ SETGID 30;43	# file that is setgid (g+s)
+ CAPABILITY 00	# file with capability (very expensive to lookup)
 diff --git a/DIR_COLORS.lightbgcolor b/DIR_COLORS.lightbgcolor
-index e3b0ec3..39a0a4c 100644
+index eab6258..1627b63 100644
 --- a/DIR_COLORS.lightbgcolor
 +++ b/DIR_COLORS.lightbgcolor
 @@ -1,3 +1,9 @@
@@ -63,7 +63,7 @@ index e3b0ec3..39a0a4c 100644
  # ===================================================================
  # Terminal filters
  # ===================================================================
-@@ -60,17 +69,17 @@ TERM xterm*
+@@ -59,17 +68,17 @@ TERM xterm*
  #NORMAL 00	# no color code at all
  #FILE 00	# regular file: use no color at all
  RESET 0		# reset to "normal" color
@@ -83,18 +83,18 @@ index e3b0ec3..39a0a4c 100644
  ORPHAN 40;31;01 # symlink to nonexistent file, or non-stat'able file ...
 -MISSING 00      # ... and the files they point to
 +MISSING 01;37;41 # ... and the files they point to
- SETUID 37;41	# regular file that is setuid (u+s)
- SETGID 30;43	# regular file that is setgid (g+s)
- CAPABILITY 00	# regular file with capability (very expensive to lookup)
-@@ -79,7 +88,7 @@ OTHER_WRITABLE 34;42 # dir that is other-writable (o+w) and not sticky
+ SETUID 37;41	# file that is setuid (u+s)
+ SETGID 30;43	# file that is setgid (g+s)
+ CAPABILITY 00	# file with capability (very expensive to lookup)
+@@ -78,7 +87,7 @@ OTHER_WRITABLE 34;42 # dir that is other-writable (o+w) and not sticky
  STICKY 37;44	# dir with the sticky bit set (+t) and not other-writable
  
- # This is for regular files with execute permission:
+ # This is for files with execute permission:
 -EXEC 01;32
 +EXEC 00;32
  
  # ===================================================================
  # File extension attributes
 -- 
-2.49.0
+2.34.1
 

coreutils-9.9-fix-cut-test-aarch64.patch

@@ -1,28 +0,0 @@
-From 95044cb5eaea83d02f768feb5ab79fcf5e6ad782 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
-Date: Mon, 22 Dec 2025 17:12:48 +0000
-Subject: [PATCH] tests: avoid false failure due to ulimit on aarch64
-
-* tests/cut/cut-huge-range.sh: Add an extra 1MiB headroom,
-which was seen with aarch64.
-Reported at https://bugzilla.redhat.com/2424302
-
-Cherry-picked-by: Lukáš Zaoral <lzaoral@redhat.com>
-Upstream-commit: 95044cb5eaea83d02f768feb5ab79fcf5e6ad782
----
- tests/cut/cut-huge-range.sh | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/tests/cut/cut-huge-range.sh b/tests/cut/cut-huge-range.sh
-index 4bd1b129d8..98d7e8f0b9 100755
---- a/tests/cut/cut-huge-range.sh
-+++ b/tests/cut/cut-huge-range.sh
-@@ -22,6 +22,7 @@ getlimits_
- 
- vm=$(get_min_ulimit_v_ returns_ 0 cut -b1 /dev/null) \
-   || skip_ 'shell lacks ulimit, or ASAN enabled'
-+vm=$(($vm+1000))  # https://bugzilla.redhat.com/2424302
- 
- # Ensure we can cut up to our sentinel value.
- # Don't use expr to subtract one,
-

coreutils-9.9-gnulib-c23.patch

@@ -1,169 +0,0 @@
-From 891761bca1aa78336e5b18c121075b6e4696c5d4 Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Sun, 23 Nov 2025 00:50:40 -0800
-Subject: [PATCH] Port to C23 qualifier-generic fns like strchr
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This ports Gnulib to strict C23 platforms that reject code
-like ‘char *q = strchr (P, 'x');’ when P is a pointer to const,
-because in C23 strchr is a qualifier-generic function so
-strchr (P, 'x') returns char const *.
-This patch does not attempt to do the following two things,
-which might be useful in the future:
-1. When compiling on non-C23 platforms, check user code for
-portability to platforms that define qualifier-generic functions.
-2. Port Gnulib to platforms that have qualifier-generic functions
-not listed in the C23 standard, e.g., strchrnul.  I don’t know
-of any such platforms.
-* lib/mbschr.c (mbschr):
-* lib/memchr2.c (memchr2):
-Port to C23, where functions like strchr are qualifier-generic.
-* lib/c++defs.h (_GL_FUNCDECL_SYS_NAME): New macro.
-* lib/c++defs.h (_GL_FUNCDECL_SYS):
-* lib/stdlib.in.h (bsearch):
-Use it, to prevent C23 names like strchr from acting like macros.
-* lib/string.in.h (memchr, strchr, strpbrk, strrchr):
-Do not #undef when GNULIB_POSIXCHECK is defined, as this could
-cause conforming C23 code to fail to conform.  It’s not clear why
-_GL_WARN_ON_USE_CXX; perhaps it was needed but isn’t any more?
-But for now, limit the removal of #undef to these four functions
-where #undeffing is clearly undesirable in C23.
-* lib/wchar.in.h (wmemchr): Parenthesize function name in decl,
-to prevent it from acting like a macro.
-
-Cherry-picked-by: Lukáš Zaoral <lzaoral@redhat.com>
-Upstream-commit: df17f4f37ed3ca373d23ad42eae51122bdb96626
----
- lib/c++defs.h   | 12 +++++++++++-
- lib/mbschr.c    |  2 +-
- lib/memchr2.c   |  2 +-
- lib/stdlib.in.h |  6 +++---
- lib/string.in.h |  4 ----
- lib/wchar.in.h  |  2 +-
- 6 files changed, 17 insertions(+), 11 deletions(-)
-
-diff --git a/lib/c++defs.h b/lib/c++defs.h
-index b77979a..7384457 100644
---- a/lib/c++defs.h
-+++ b/lib/c++defs.h
-@@ -127,6 +127,16 @@
- #define _GL_FUNCDECL_RPL_1(rpl_func,rettype,parameters,...) \
-   _GL_EXTERN_C_FUNC __VA_ARGS__ rettype rpl_func parameters
- 
-+/* _GL_FUNCDECL_SYS_NAME (func) expands to plain func if C++, and to
-+   parenthsized func otherwise.  Parenthesization is needed in C23 if
-+   the function is like strchr and so is a qualifier-generic macro
-+   that expands to something more complicated.  */
-+#ifdef __cplusplus
-+# define _GL_FUNCDECL_SYS_NAME(func) func
-+#else
-+# define _GL_FUNCDECL_SYS_NAME(func) (func)
-+#endif
-+
- /* _GL_FUNCDECL_SYS (func, rettype, parameters, [attributes]);
-    declares the system function, named func, with the given prototype,
-    consisting of return type, parameters, and attributes.
-@@ -139,7 +149,7 @@
-      _GL_FUNCDECL_SYS (posix_openpt, int, (int flags), _GL_ATTRIBUTE_NODISCARD);
-  */
- #define _GL_FUNCDECL_SYS(func,rettype,parameters,...) \
--  _GL_EXTERN_C_FUNC __VA_ARGS__ rettype func parameters
-+  _GL_EXTERN_C_FUNC __VA_ARGS__ rettype _GL_FUNCDECL_SYS_NAME (func) parameters
- 
- /* _GL_CXXALIAS_RPL (func, rettype, parameters);
-    declares a C++ alias called GNULIB_NAMESPACE::func
-diff --git a/lib/mbschr.c b/lib/mbschr.c
-index c9e14b5..6582134 100644
---- a/lib/mbschr.c
-+++ b/lib/mbschr.c
-@@ -65,5 +65,5 @@ mbschr (const char *string, int c)
-       return NULL;
-     }
-   else
--    return strchr (string, c);
-+    return (char *) strchr (string, c);
- }
-diff --git a/lib/memchr2.c b/lib/memchr2.c
-index 7493823..d7724ae 100644
---- a/lib/memchr2.c
-+++ b/lib/memchr2.c
-@@ -55,7 +55,7 @@ memchr2 (void const *s, int c1_in, int c2_in, size_t n)
-   c2 = (unsigned char) c2_in;
- 
-   if (c1 == c2)
--    return memchr (s, c1, n);
-+    return (void *) memchr (s, c1, n);
- 
-   /* Handle the first few bytes by reading one byte at a time.
-      Do this until VOID_PTR is aligned on a longword boundary.  */
-diff --git a/lib/stdlib.in.h b/lib/stdlib.in.h
-index bef0aaa..fd0e1e0 100644
---- a/lib/stdlib.in.h
-+++ b/lib/stdlib.in.h
-@@ -224,9 +224,9 @@ _GL_INLINE_HEADER_BEGIN
- 
- /* Declarations for ISO C N3322.  */
- #if defined __GNUC__ && __GNUC__ >= 15 && !defined __clang__
--_GL_EXTERN_C void *bsearch (const void *__key,
--                            const void *__base, size_t __nmemb, size_t __size,
--                            int (*__compare) (const void *, const void *))
-+_GL_EXTERN_C void *_GL_FUNCDECL_SYS_NAME (bsearch)
-+  (const void *__key, const void *__base, size_t __nmemb, size_t __size,
-+   int (*__compare) (const void *, const void *))
-   _GL_ATTRIBUTE_NONNULL_IF_NONZERO (2, 3) _GL_ARG_NONNULL ((5));
- _GL_EXTERN_C void qsort (void *__base, size_t __nmemb, size_t __size,
-                          int (*__compare) (const void *, const void *))
-diff --git a/lib/string.in.h b/lib/string.in.h
-index fdcdd21..8b56acf 100644
---- a/lib/string.in.h
-+++ b/lib/string.in.h
-@@ -409,7 +409,6 @@ _GL_CXXALIASWARN1 (memchr, void const *,
- _GL_CXXALIASWARN (memchr);
- # endif
- #elif defined GNULIB_POSIXCHECK
--# undef memchr
- /* Assume memchr is always declared.  */
- _GL_WARN_ON_USE (memchr, "memchr has platform-specific bugs - "
-                  "use gnulib module memchr for portability" );
-@@ -674,7 +673,6 @@ _GL_WARN_ON_USE (stpncpy, "stpncpy is unportable - "
- #if defined GNULIB_POSIXCHECK
- /* strchr() does not work with multibyte strings if the locale encoding is
-    GB18030 and the character to be searched is a digit.  */
--# undef strchr
- /* Assume strchr is always declared.  */
- _GL_WARN_ON_USE_CXX (strchr,
-                      const char *, char *, (const char *, int),
-@@ -981,7 +979,6 @@ _GL_CXXALIASWARN (strpbrk);
-    Even in this simple case, it does not work with multibyte strings if the
-    locale encoding is GB18030 and one of the characters to be searched is a
-    digit.  */
--#  undef strpbrk
- _GL_WARN_ON_USE_CXX (strpbrk,
-                      const char *, char *, (const char *, const char *),
-                      "strpbrk cannot work correctly on character strings "
-@@ -1011,7 +1008,6 @@ _GL_WARN_ON_USE (strspn, "strspn cannot work correctly on character strings "
- #if defined GNULIB_POSIXCHECK
- /* strrchr() does not work with multibyte strings if the locale encoding is
-    GB18030 and the character to be searched is a digit.  */
--# undef strrchr
- /* Assume strrchr is always declared.  */
- _GL_WARN_ON_USE_CXX (strrchr,
-                      const char *, char *, (const char *, int),
-diff --git a/lib/wchar.in.h b/lib/wchar.in.h
-index ab602a2..6be4515 100644
---- a/lib/wchar.in.h
-+++ b/lib/wchar.in.h
-@@ -301,7 +301,7 @@ _GL_EXTERN_C int wcsncmp (const wchar_t *__s1, const wchar_t *__s2, size_t __n)
-   _GL_ATTRIBUTE_NONNULL_IF_NONZERO (1, 3)
-   _GL_ATTRIBUTE_NONNULL_IF_NONZERO (2, 3);
- # ifndef __cplusplus
--_GL_EXTERN_C wchar_t *wmemchr (const wchar_t *__s, wchar_t __wc, size_t __n)
-+_GL_EXTERN_C wchar_t *(wmemchr) (const wchar_t *__s, wchar_t __wc, size_t __n)
-   _GL_ATTRIBUTE_NONNULL_IF_NONZERO (1, 3);
- # endif
- _GL_EXTERN_C wchar_t *wmemset (wchar_t *__s, wchar_t __wc, size_t __n)
--- 
-2.52.0
-

coreutils-CVE-2025-5278.patch

@@ -0,0 +1,107 @@
+From 701a9bdbf78f869e0fb778ed5aede00e42517add Mon Sep 17 00:00:00 2001
+From: Pádraig Brady <P@draigBrady.com>
+Date: Tue, 20 May 2025 16:03:44 +0100
+Subject: [PATCH] sort: fix buffer under-read (CWE-127)
+
+* src/sort.c (begfield): Check pointer adjustment
+to avoid Out-of-range pointer offset (CWE-823).
+(limfield): Likewise.
+* tests/sort/sort-field-limit.sh: Add a new test,
+which triggers with ASAN or Valgrind.
+* tests/local.mk: Reference the new test.
+Fixes https://bugs.gnu.org/78507
+
+(cherry picked from commit 8c9602e3a145e9596dc1a63c6ed67865814b6633)
+---
+ src/sort.c                     | 12 ++++++++++--
+ tests/local.mk                 |  1 +
+ tests/sort/sort-field-limit.sh | 35 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 46 insertions(+), 2 deletions(-)
+ create mode 100755 tests/sort/sort-field-limit.sh
+
+diff --git a/src/sort.c b/src/sort.c
+index b10183b..7af1a25 100644
+--- a/src/sort.c
++++ b/src/sort.c
+@@ -1644,7 +1644,11 @@ begfield (struct line const *line, struct keyfield const *key)
+       ++ptr;
+ 
+   /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
+-  ptr = MIN (lim, ptr + schar);
++  size_t remaining_bytes = lim - ptr;
++  if (schar < remaining_bytes)
++    ptr += schar;
++  else
++    ptr = lim;
+ 
+   return ptr;
+ }
+@@ -1746,7 +1750,11 @@ limfield (struct line const *line, struct keyfield const *key)
+           ++ptr;
+ 
+       /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
+-      ptr = MIN (lim, ptr + echar);
++      size_t remaining_bytes = lim - ptr;
++      if (echar < remaining_bytes)
++        ptr += echar;
++      else
++        ptr = lim;
+     }
+ 
+   return ptr;
+diff --git a/tests/local.mk b/tests/local.mk
+index 4da6756..642d225 100644
+--- a/tests/local.mk
++++ b/tests/local.mk
+@@ -388,6 +388,7 @@ all_tests =					\
+   tests/sort/sort-debug-keys.sh			\
+   tests/sort/sort-debug-warn.sh			\
+   tests/sort/sort-discrim.sh			\
++  tests/sort/sort-field-limit.sh		\
+   tests/sort/sort-files0-from.pl		\
+   tests/sort/sort-float.sh			\
+   tests/sort/sort-h-thousands-sep.sh		\
+diff --git a/tests/sort/sort-field-limit.sh b/tests/sort/sort-field-limit.sh
+new file mode 100755
+index 0000000..52d8e1d
+--- /dev/null
++++ b/tests/sort/sort-field-limit.sh
+@@ -0,0 +1,35 @@
++#!/bin/sh
++# From 7.2-9.7, this would trigger an out of bounds mem read
++
++# Copyright (C) 2025 Free Software Foundation, Inc.
++
++# This program is free software: you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation, either version 3 of the License, or
++# (at your option) any later version.
++
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++
++# You should have received a copy of the GNU General Public License
++# along with this program.  If not, see <https://www.gnu.org/licenses/>.
++
++. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++print_ver_ sort
++getlimits_
++
++# This issue triggers with valgrind or ASAN
++valgrind --error-exitcode=1 sort --version 2>/dev/null &&
++  VALGRIND='valgrind --error-exitcode=1'
++
++{ printf '%s\n' aa bb; } > in || framework_failure_
++
++_POSIX2_VERSION=200809 $VALGRIND sort +0.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++_POSIX2_VERSION=200809 $VALGRIND sort +1 -1.${SIZE_MAX}R in > out || fail=1
++compare in out || fail=1
++
++Exit $fail
+-- 
+2.49.0
+

coreutils-df-direct.patch

@@ -1,4 +1,4 @@
-From 91be1a584108a6a3d96f64382bbf206c4213b3db Mon Sep 17 00:00:00 2001
+From f072852456c545bd89296bc88cf59ccd63287a68 Mon Sep 17 00:00:00 2001
 From: Kamil Dudka <kdudka@redhat.com>
 Date: Mon, 29 Mar 2010 17:20:34 +0000
 Subject: [PATCH] coreutils-df-direct.patch
@@ -11,10 +11,10 @@ Subject: [PATCH] coreutils-df-direct.patch
  create mode 100755 tests/df/direct.sh
 
 diff --git a/doc/coreutils.texi b/doc/coreutils.texi
-index b420606..0ccb368 100644
+index 8f7f43e..230f1f1 100644
 --- a/doc/coreutils.texi
 +++ b/doc/coreutils.texi
-@@ -12597,6 +12597,13 @@ some systems (notably Solaris), doing this yields more up to date results,
+@@ -12427,6 +12427,13 @@ some systems (notably Solaris), doing this yields more up to date results,
  but in general this option makes @command{df} much slower, especially when
  there are many or very busy file systems.
  
@@ -29,7 +29,7 @@ index b420606..0ccb368 100644
  @opindex --total
  @cindex grand total of file system size, usage and available space
 diff --git a/src/df.c b/src/df.c
-index 75e638c..ef9f0a7 100644
+index 994f0e3..ceee209 100644
 --- a/src/df.c
 +++ b/src/df.c
 @@ -121,6 +121,9 @@ static bool print_type;
@@ -42,7 +42,7 @@ index 75e638c..ef9f0a7 100644
  /* Grand total data.  */
  static struct fs_usage grand_fsu;
  
-@@ -248,13 +251,15 @@ enum
+@@ -247,13 +250,15 @@ enum
    NO_SYNC_OPTION = CHAR_MAX + 1,
    SYNC_OPTION,
    TOTAL_OPTION,
@@ -59,10 +59,10 @@ index 75e638c..ef9f0a7 100644
    {"inodes", no_argument, nullptr, 'i'},
    {"human-readable", no_argument, nullptr, 'h'},
    {"si", no_argument, nullptr, 'H'},
-@@ -571,7 +576,10 @@ get_header (void)
-   for (idx_t col = 0; col < ncolumns; col++)
+@@ -574,7 +579,10 @@ get_header (void)
+   for (col = 0; col < ncolumns; col++)
      {
-       char *cell;
+       char *cell = nullptr;
 -      char const *header = _(columns[col]->caption);
 +      char const *header = (columns[col]->field == TARGET_FIELD
 +                            && direct_statfs)?
@@ -71,7 +71,7 @@ index 75e638c..ef9f0a7 100644
  
        if (columns[col]->field == SIZE_FIELD
            && (header_mode == DEFAULT_MODE
-@@ -1446,6 +1454,17 @@ get_point (char const *point, const struct stat *statp)
+@@ -1471,6 +1479,17 @@ get_point (char const *point, const struct stat *statp)
  static void
  get_entry (char const *name, struct stat const *statp)
  {
@@ -89,7 +89,7 @@ index 75e638c..ef9f0a7 100644
    if ((S_ISBLK (statp->st_mode) || S_ISCHR (statp->st_mode))
        && get_device (name))
      return;
-@@ -1516,6 +1535,7 @@ or all file systems by default.\n\
+@@ -1541,6 +1560,7 @@ or all file systems by default.\n\
    -B, --block-size=SIZE  scale sizes by SIZE before printing them; e.g.,\n\
                             '-BM' prints sizes in units of 1,048,576 bytes;\n\
                             see SIZE format below\n\
@@ -97,7 +97,7 @@ index 75e638c..ef9f0a7 100644
    -h, --human-readable  print sizes in powers of 1024 (e.g., 1023M)\n\
    -H, --si              print sizes in powers of 1000 (e.g., 1.1G)\n\
  "), stdout);
-@@ -1610,6 +1630,9 @@ main (int argc, char **argv)
+@@ -1631,6 +1651,9 @@ main (int argc, char **argv)
                xstrtol_fatal (e, oi, c, long_options, optarg);
            }
            break;
@@ -107,7 +107,7 @@ index 75e638c..ef9f0a7 100644
          case 'i':
            if (header_mode == OUTPUT_MODE)
              {
-@@ -1706,6 +1729,13 @@ main (int argc, char **argv)
+@@ -1727,6 +1750,13 @@ main (int argc, char **argv)
          }
      }
  
@@ -183,5 +183,5 @@ index 0000000..8e4cfb8
 +
 +Exit $fail
 -- 
-2.52.0
+2.44.0
 

coreutils-nproc-affinity-1.patch

@@ -0,0 +1,55 @@
+commit 45c2456a56337ebcafe0dd9faa2bd995ccbc3357
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Mon Nov 11 14:05:53 2024 +0100
+
+    nproc: Use affinity mask even on systems with more than 1024 CPUs.
+    
+    * lib/nproc.c (num_processors_via_affinity_mask): Retry
+    with larger affinity masks if CPU_ALLOC_SIZE is available.
+
+diff --git a/lib/nproc.c b/lib/nproc.c
+index 92a07e8289..48bc3d06fa 100644
+--- a/lib/nproc.c
++++ b/lib/nproc.c
+@@ -20,6 +20,7 @@
+ #include <config.h>
+ #include "nproc.h"
+ 
++#include <errno.h>
+ #include <limits.h>
+ #include <stdlib.h>
+ #include <unistd.h>
+@@ -124,6 +125,33 @@ num_processors_via_affinity_mask (void)
+           return count;
+       }
+   }
++#elif HAVE_SCHED_GETAFFINITY_LIKE_GLIBC \
++  && defined CPU_ALLOC_SIZE /* glibc >= 2.6 */
++  {
++    unsigned int alloc_count = 1024;
++    while (1)
++      {
++        cpu_set_t *set = CPU_ALLOC (alloc_count);
++        if (set == NULL)
++          return 0;
++        unsigned int size = CPU_ALLOC_SIZE (alloc_count);
++        if (sched_getaffinity (0, size, set) == 0)
++          {
++            unsigned int count = CPU_COUNT_S (size, set);
++            CPU_FREE (set);
++            return count;
++          }
++        if (errno != EINVAL)
++          {
++            CPU_FREE (set);
++            return 0;
++          }
++        CPU_FREE (set);
++        alloc_count *= 2;
++        if (alloc_count == 0)
++          return 0;
++      }
++  }
+ #elif HAVE_SCHED_GETAFFINITY_LIKE_GLIBC /* glibc >= 2.3.4 */
+   {
+     cpu_set_t set;

coreutils-nproc-affinity-2.patch

@@ -0,0 +1,64 @@
+commit ee0bc695303775da5026091a65e8ec2b764f4a26
+Author: Bruno Haible <bruno@clisp.org>
+Date:   Mon Nov 11 15:40:52 2024 +0100
+
+    nproc: Use affinity mask even in out-of-memory situations.
+    
+    * lib/nproc.c (num_processors_via_affinity_mask): Use a stack-allocated
+    cpu_set_t as fallback. Add comments.
+
+diff --git a/lib/nproc.c b/lib/nproc.c
+index 48bc3d06fa..0b5898d88f 100644
+--- a/lib/nproc.c
++++ b/lib/nproc.c
+@@ -125,15 +125,25 @@ num_processors_via_affinity_mask (void)
+           return count;
+       }
+   }
+-#elif HAVE_SCHED_GETAFFINITY_LIKE_GLIBC \
+-  && defined CPU_ALLOC_SIZE /* glibc >= 2.6 */
++#elif HAVE_SCHED_GETAFFINITY_LIKE_GLIBC /* glibc >= 2.3.4 */
++  /* There are two ways to use the sched_getaffinity() function:
++       - With a statically-sized cpu_set_t.
++       - With a dynamically-sized cpu_set_t.
++     Documentation:
++     <https://www.kernel.org/doc/man-pages/online/pages/man2/sched_getaffinity.2.html>
++     <https://www.kernel.org/doc/man-pages/online/pages/man3/CPU_SET.3.html>
++     The second way has the advantage that it works on systems with more than
++     1024 CPUs.  The first way has the advantage that it works also when memory
++     is tight.  */
++# if defined CPU_ALLOC_SIZE /* glibc >= 2.6 */
+   {
+     unsigned int alloc_count = 1024;
+-    while (1)
++    for (;;)
+       {
+         cpu_set_t *set = CPU_ALLOC (alloc_count);
+         if (set == NULL)
+-          return 0;
++          /* Out of memory.  */
++          break;
+         unsigned int size = CPU_ALLOC_SIZE (alloc_count);
+         if (sched_getaffinity (0, size, set) == 0)
+           {
+@@ -143,16 +153,19 @@ num_processors_via_affinity_mask (void)
+           }
+         if (errno != EINVAL)
+           {
++            /* Some other error.  */
+             CPU_FREE (set);
+             return 0;
+           }
+         CPU_FREE (set);
++        /* Retry with some larger cpu_set_t.  */
+         alloc_count *= 2;
+         if (alloc_count == 0)
++          /* Integer overflow.  Avoid an endless loop.  */
+           return 0;
+       }
+   }
+-#elif HAVE_SCHED_GETAFFINITY_LIKE_GLIBC /* glibc >= 2.3.4 */
++# endif
+   {
+     cpu_set_t set;
+ 

coreutils-prereq-CVE-2025-5278.patch

@@ -0,0 +1,42 @@
+From bfbb3ec7f798b179d7fa7b42673e068b18048899 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Sat, 3 Aug 2024 22:31:20 -0700
+Subject: shuf: fix randomness bug
+
+Problem reported by Daniel Carpenter <https://bugs.gnu.org/72445>.
+* gl/lib/randread.c (randread_new): Fill the ISAAC buffer
+instead of storing at most BYTES_BOUND bytes into it.
+
+(cherry picked from commit bfbb3ec7f798b179d7fa7b42673e068b18048899)
+---
+ gl/lib/randread.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/lib/randread.c b/lib/randread.c
+index cbee224bb..43c0cf09f 100644
+--- a/lib/randread.c
++++ b/lib/randread.c
+@@ -189,9 +189,19 @@ randread_new (char const *name, size_t bytes_bound)
+         setvbuf (source, s->buf.c, _IOFBF, MIN (sizeof s->buf.c, bytes_bound));
+       else
+         {
++          /* Fill the ISAAC buffer.  Although it is tempting to read at
++             most BYTES_BOUND bytes, this is incorrect for two reasons.
++             First, BYTES_BOUND is just an estimate.
++             Second, even if the estimate is correct
++             ISAAC64 poorly randomizes when BYTES_BOUND is small
++             and just the first few bytes of s->buf.isaac.state.m
++             are random while the other bytes are all zero.  See:
++             Aumasson J-P. On the pseudo-random generator ISAAC.
++             Cryptology ePrint Archive. 2006;438.
++             <https://eprint.iacr.org/2006/438>.  */
+           s->buf.isaac.buffered = 0;
+           if (! get_nonce (s->buf.isaac.state.m,
+-                           MIN (sizeof s->buf.isaac.state.m, bytes_bound)))
++                           sizeof s->buf.isaac.state.m))
+             {
+               int e = errno;
+               randread_free_body (s);
+-- 
+2.49.0
+

coreutils-python3.patch

@@ -1,4 +1,4 @@
-From 8927d505ecb5334f09c48ef98ef1f464f581d0f7 Mon Sep 17 00:00:00 2001
+From cef9cccce395cd80cd5ac42a4fe6c3909be1c0b5 Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
 Date: Tue, 2 Apr 2024 14:11:26 +0100
 Subject: [PATCH] coreutils-python3.patch
@@ -10,10 +10,10 @@ Subject: [PATCH] coreutils-python3.patch
  3 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/init.cfg b/init.cfg
-index ac05f7b..26d9516 100644
+index b06965a..08413ee 100644
 --- a/init.cfg
 +++ b/init.cfg
-@@ -601,10 +601,10 @@ seek_data_capable_()
+@@ -581,10 +581,10 @@ seek_data_capable_()
  # Skip the current test if "." lacks d_type support.
  require_dirent_d_type_()
  {
@@ -37,7 +37,7 @@ index 1a2f76f..42d3924 100644
  # Intended to exit 0 only on Linux/GNU systems.
  import os
 diff --git a/tests/du/move-dir-while-traversing.sh b/tests/du/move-dir-while-traversing.sh
-index adf482b..cf9214a 100755
+index 830a69e..7344ddf 100755
 --- a/tests/du/move-dir-while-traversing.sh
 +++ b/tests/du/move-dir-while-traversing.sh
 @@ -21,8 +21,8 @@ print_ver_ du
@@ -61,5 +61,5 @@ index adf482b..cf9214a 100755
  import os,sys
  
 -- 
-2.51.0
+2.44.0
 

coreutils-selinux.patch

@@ -0,0 +1,87 @@
+From 78970c915b8556fcec4622e948a37dd8e34efe6d Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 30 Aug 2023 17:19:58 +0200
+Subject: [PATCH] coreutils-selinux.patch
+
+---
+ src/cp.c      | 19 ++++++++++++++++++-
+ src/install.c | 12 +++++++++++-
+ 2 files changed, 29 insertions(+), 2 deletions(-)
+
+diff --git a/src/cp.c b/src/cp.c
+index 28b0217..897379f 100644
+--- a/src/cp.c
++++ b/src/cp.c
+@@ -997,7 +997,7 @@ main (int argc, char **argv)
+   selinux_enabled = (0 < is_selinux_enabled ());
+   cp_option_init (&x);
+ 
+-  while ((c = getopt_long (argc, argv, "abdfHilLnprst:uvxPRS:TZ",
++  while ((c = getopt_long (argc, argv, "abcdfHilLnprst:uvxPRS:TZ",
+                            long_opts, nullptr))
+          != -1)
+     {
+@@ -1049,6 +1049,23 @@ main (int argc, char **argv)
+           copy_contents = true;
+           break;
+ 
++        case 'c':
++          fprintf (stderr, "%s: warning: option '-c' is deprecated,"
++                  " please use '--preserve=context' instead\n", argv[0]);
++          if (x.set_security_context)
++            {
++              fprintf (stderr,
++                      "%s: cannot force target context and preserve it\n",
++                      argv[0]);
++              exit (1);
++            }
++          else if (selinux_enabled)
++            {
++              x.preserve_security_context = true;
++              x.require_preserve_context = true;
++            }
++          break;
++
+         case 'd':
+           x.preserve_links = true;
+           x.dereference = DEREF_NEVER;
+diff --git a/src/install.c b/src/install.c
+index accd0fd..b686fe9 100644
+--- a/src/install.c
++++ b/src/install.c
+@@ -807,7 +807,7 @@ main (int argc, char **argv)
+   dir_arg = false;
+   umask (0);
+ 
+-  while ((optc = getopt_long (argc, argv, "bcCsDdg:m:o:pt:TvS:Z", long_options,
++  while ((optc = getopt_long (argc, argv, "bcCsDdg:m:o:pPt:TvS:Z", long_options,
+                               nullptr))
+          != -1)
+     {
+@@ -872,6 +872,9 @@ main (int argc, char **argv)
+           no_target_directory = true;
+           break;
+ 
++        case 'P':
++          fprintf (stderr, "%s: warning: option '-P' is deprecated,"
++                  " please use '--preserve-context' instead\n", argv[0]);
+         case PRESERVE_CONTEXT_OPTION:
+           if (! selinux_enabled)
+             {
+@@ -879,6 +882,13 @@ main (int argc, char **argv)
+                              "this kernel is not SELinux-enabled"));
+               break;
+             }
++          if (x.set_security_context)
++            {
++              fprintf (stderr,
++                      "%s: cannot force target context and preserve it\n",
++                      argv[0]);
++              exit (1);
++            }
+           x.preserve_security_context = true;
+           use_default_selinux_context = false;
+           break;
+-- 
+2.44.0
+

coreutils.spec

@@ -1,7 +1,7 @@
 Summary: A set of basic GNU tools commonly used in shell scripts
 Name:    coreutils
-Version: 9.9
-Release: 2%{?dist}
+Version: 9.5
+Release: 12%{?dist}
 # some used parts of gnulib are under various variants of LGPL
 License: GPL-3.0-or-later AND GFDL-1.3-no-invariants-or-later AND LGPL-2.1-or-later AND LGPL-3.0-or-later
 Url:     https://www.gnu.org/software/coreutils/
@@ -32,17 +32,22 @@ Patch103: coreutils-python3.patch
 # df --direct
 Patch104: coreutils-df-direct.patch
 
-# gnulib C23 support
-# https://github.com/coreutils/gnulib/commit/df17f4f37ed3ca373d23ad42eae51122bdb96626
-Patch105: coreutils-9.9-gnulib-c23.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2325167
+Patch105: coreutils-nproc-affinity-1.patch
+Patch106: coreutils-nproc-affinity-2.patch
 
-# fix cut test failure on aarch64 rawhide (rhbz#2424302)
-# https://github.com/coreutils/coreutils/commit/95044cb5eaea83d02f768feb5ab79fcf5e6ad782
-Patch106: coreutils-9.9-fix-cut-test-aarch64.patch
+# sort: fix buffer under-read (CVE-2025-5278)
+# * CVE test prereq: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/patch/?id=bfbb3ec7f798b179d7fa7b42673e068b18048899
+# * CVE fix: https://cgit.git.savannah.gnu.org/cgit/coreutils.git/patch/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
+Patch107: coreutils-prereq-CVE-2025-5278.patch
+Patch108: coreutils-CVE-2025-5278.patch
 
 # (sb) lin18nux/lsb compliance - multibyte functionality patch
 Patch800: coreutils-i18n.patch
 
+# downstream SELinux options deprecated since 2009
+Patch950: coreutils-selinux.patch
+
 Conflicts: filesystem < 3
 
 # To avoid clobbering installs
@@ -63,7 +68,6 @@ BuildRequires: libselinux-utils
 BuildRequires: make
 BuildRequires: openssl-devel
 BuildRequires: strace
-BuildRequires: systemd-devel
 BuildRequires: texinfo
 
 # For gpg verification of source tarball
@@ -125,9 +129,6 @@ packaged as a single multicall binary.
 # https://bugzilla.redhat.com/show_bug.cgi?id=1107973#c7
 Obsoletes: %{name} < 8.24-100
 
-# Gnulib translations are maintained seprately since coreutils 9.6 (#2393892)
-Requires: gnulib-l10n
-
 # info doc refers to "Specifying the Time Zone" from glibc-doc (#959597)
 Suggests: glibc-doc
 
@@ -162,10 +163,6 @@ sed src/dircolors.hin \
 find tests -name '*.sh' -perm 0644 -print -exec chmod 0755 '{}' '+'
 (echo "<<< done") 2>/dev/null
 
-# FIXME: Force a newer gettext version to workaround `autoreconf -i` errors
-# with coreutils 9.6 and bundled gettext 0.19.2 from gettext-common-devel.
-sed -i "s/0.19.2/$(rpm -q --queryformat '%%{VERSION}\n' gettext-devel)/" bootstrap.conf configure.ac
-
 autoreconf -fiv
 
 %build
@@ -199,7 +196,6 @@ for type in separate single; do
              --cache-file=../config.cache \
              --enable-install-program=arch \
              --enable-no-install-program=kill,uptime \
-             --enable-systemd \
              --with-tty-group \
              DEFAULT_POSIX2_VERSION=200112 alternative=199209 || :
   %make_build all V=1
@@ -286,58 +282,17 @@ rm -f $RPM_BUILD_ROOT%{_infodir}/dir
 %license COPYING
 
 %changelog
-* Tue Jan 13 2026 Lukáš Zaoral <lzaoral@redhat.com> - 9.9-2
-- fix cut test failure on aarch64 rawhide (rhbz#2424302)
-
-* Wed Nov 26 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.9-1
-- rebase to latest upstream release (rhbz#2413803)
-
-* Mon Sep 29 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.8-3
-- require gnulib-l10n for translations of gnulib messages (rhbz#2393892)
-
-* Thu Sep 25 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.8-2
-- tail: fix tailing larger number of lines in regular files (rhbz#2398008)
-
-* Wed Sep 24 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.8-1
-- rebase to latest upstream release (rhbz#2397467)
-- remove downstream patch for selinux options deprecated since 2009
-
-* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 9.7-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Mon Jun 30 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.7-4
-- stty: add support for arbitrary baud rates (rhbz#2375439)
-
-* Wed May 28 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.7-3
+* Wed May 28 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-12
 - sort: fix buffer under-read (CVE-2025-5278)
 
-* Mon May 19 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.7-2
-- cp/mv: do not fail when copying of trivial NFSv4 ACLs fails (rhbz#2363149)
-
-* Wed Apr 09 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.7-1
-- rebase to latest upstream release (rhbz#2358624)
-
-* Tue Feb 25 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.6-2
-- fix 'who -m' with guessed tty names (rhbz#2343998)
-
-* Mon Jan 20 2025 Lukáš Zaoral <lzaoral@redhat.com> - 9.6-1
-- rebase to latest upstream version (rhbz#2338620)
-- sync i18n patch with SUSE (Kudos to Berny Völker!)
-
-* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 9.5-13
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 9.5-12
-- Rebuilt for the bin-sbin merge (2nd attempt)
-
 * Wed Nov 13 2024 Florian Weimer <fweimer@redhat.com> - 9.5-11
 - Affinity mask handling in nproc for large CPU counts (rhbz#2325167)
 
 * Fri Sep 27 2024 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-10
 - fix fold -b with UTF8 locale (RHEL-60295)
 
-* Tue Aug 27 2024 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-9
-- show web sessions in who output (rhbz#2307847)
+* Mon Aug 26 2024 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-9
+- disable integration with systemd (rhbz#2307847)
 
 * Wed Aug 21 2024 Lukáš Zaoral <lzaoral@redhat.com> - 9.5-8
 - add missing systemd-devel buildrequires

sources

@@ -1,2 +1,2 @@
-SHA512 (coreutils-9.9.tar.xz.sig) = 0a3dfdfa6b4234e2e1d42142269f959bdf3cf8f6605a50270a27eff84dd22588f182121f7dd3eeb04be45f5109d02690215065b3d3b43882874d0e165a1435d0
-SHA512 (coreutils-9.9.tar.xz) = e7b0e59f7732d2c098ea4934014f470248bd5c4764210e9200a698010a8e3b95bbb26e543f0cd73ed5a4b8e1f8cda932c73f39954d68175e4deaa47526610c65
+SHA512 (coreutils-9.5.tar.xz) = 2ca0deac4dc10a80fd0c6fd131252e99d457fd03b7bd626a6bc74fe5a0529c0a3d48ce1f5da1d3b3a7a150a1ce44f0fbb6b68a6ac543dfd5baa3e71f5d65401c
+SHA512 (coreutils-9.5.tar.xz.sig) = 029997e0f4ee64e561853cff7c8a124f58cc891598595b44c4a46f9813b4b71c9d677464bc8a26d294e9971832f4b87c23777fea4fac6e8e30f06ad93b9957d5