CVE-2026-15534 and binary compatibility for Perl stable releases

Hi,

I'm looking at CVE-2026-15534 for Debian (currently still at Perl 5.42):

 https://lists.security.metacpan.org/cve-announce/msg/42536248/

  Perl versions through 5.45.1 have out-of-bounds heap reads and writes
  during regular expression matching via an undersized superlinear cache
  in S_regmatch.

This is recommending to apply the patches from

  https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0

  https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb

The patches apply cleanly on 5.42.3, but I'm somewhat worried about this
hunk in the latter one:

  --- a/regexp.h
  +++ b/regexp.h
  @@ -839,8 +839,8 @@ typedef struct {
       char *cutpoint;      /* (*COMMIT) position (if any) */
       regmatch_info_aux      *info_aux; /* extra fields that need cleanup */
       regmatch_info_aux_eval *info_aux_eval; /* extra saved state for (?{}) */
  -    I32  poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
  -    I32  poscache_iter;    /* current countdown from _maxiter to zero */
  +    STRLEN poscache_maxiter; /* how many whilems todo before S-L cache kicks in */
  +    STRLEN poscache_iter;    /* current countdown from _maxiter to zero */
       STRLEN poscache_size;  /* size of regmatch_info_aux.poscache */
       bool intuit;    /* re_intuit_start() is the top-level caller */
       bool is_utf8_pat;    /* regex is utf8 */

This is modifying struct regmatch_info in the public regexp.h header,
growing two members from 32 bits to 64 bits on 64-bit architectures.
Is there a risk of binary incompatibility issues here?

While the struct looks internal to Perl and there's no code in Debian
that uses the struct (not even re-engine-RE2), it's nevertheless included
in perlapi.pod as part of the public API. So I thought I'd check first.

Are there plans for maint-* backports of this? I don't see any at
the moment.

Many thanks for your work on Perl.
-- 
Niko Tyni    [email protected]