[glibc] Add advisory text for CVE-2026-6368

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=cdfa80fad3d52217ae986f9acdcbdbfc94b3da3e

commit cdfa80fad3d52217ae986f9acdcbdbfc94b3da3e
Author: Adhemerval Zanella <[email protected]>
Date:   Wed Jul 1 15:24:34 2026 -0300

    Add advisory text for CVE-2026-6368

Diff:
---
 advisories/GLIBC-SA-2026-0014 | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/advisories/GLIBC-SA-2026-0014 b/advisories/GLIBC-SA-2026-0014
new file mode 100644
index 0000000000..1e9a0039f0
--- /dev/null
+++ b/advisories/GLIBC-SA-2026-0014
@@ -0,0 +1,19 @@
+wordexp with WRDE_APPEND may result in an invalid call to free()
+
+Calling wordexp with WRDE_APPEND in conjunction with an invalid expansion
+(where an error like WRDE_BADCHAR would be returned) can create a stale
+address in the wordexp_t that can cause an invalid free from wordfree.
+This affects the GNU C Library version 2.0 to version 2.43.
+
+In WRDE_APPEND mode, wordexp saves the caller-visible wordexp_t state
+before appending the processing input.  If the word expansion grows
+we_wordv via realloc, and realloc requires moving we_wordv to a new memory
+location (instead of expanding in-place), and the expansion later fails,
+the rollback fails to properly restore all previous we_wordv values and
+may add stale pointers into the caller-visible state.  A subsequent
+wordfree may then issue an invalid call to free().
+
+CVE-Id: CVE-2026-6368
+Public-Date: 2026-07-14
+Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (1.93-260)
+Reported-by: shinobu