Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
I’m not sure that it makes sense to file bugs against packages just because they use llvm compat packages. (At least, I guess that was the rationale). Packages that do so generally do it for a reason, and can’t just upgrade willy-nilly. Besides, the bug is in LLVM, not in the packages that link it. It happens that llvmlite upstream just released version 0.48.0 with support for llvm 22, just a few hours ago, so this can be “fixed,” at least in Rawhide. (Scare quotes because it seems awfully difficult to exploit. It would at minimum require JIT’ing untrusted code that was extraordinarily well-crafted, and then it’s merely a denial of service?)
FEDORA-2026-ebbaee3606 (python-llvmlite-0.48.0-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ebbaee3606
FEDORA-2026-ebbaee3606 (python-llvmlite-0.48.0-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.