diff --git a/glibc.spec b/glibc.spec
index b3ad1f8..4ddb112 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -1,4 +1,4 @@
-%global glibcsrcdir glibc-2.38.9000-155-g9e4e896f0f
+%global glibcsrcdir glibc-2.38.9000-157-g1056e5b4c3
 %global glibcversion 2.38.9000
 # Pre-release tarballs are pulled in from git using a command that is
 # effectively:
@@ -159,7 +159,7 @@ Version: %{glibcversion}
 # - It allows using the Release number without the %%dist tag in the dependency
 #   generator to make the generated requires interchangeable between Rawhide
 #   and ELN (.elnYY < .fcXX).
-%global baserelease 11
+%global baserelease 12
 Release: %{baserelease}%{?dist}
 
 # In general, GPLv2+ is used by programs, LGPLv2+ is used for
@@ -2199,6 +2199,12 @@ update_gconv_modules_cache ()
 %files -f compat-libpthread-nonshared.filelist -n compat-libpthread-nonshared
 
 %changelog
+* Tue Oct 03 2023 Arjun Shankar <arjun@redhat.com> - 2.38.9000-12
+- Auto-sync with upstream branch master,
+  1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa:
+- tunables: Terminate if end of input is reached (CVE-2023-4911)
+- Propagate GLIBC_TUNABLES in setxid binaries
+
 * Tue Oct 03 2023 Arjun Shankar <arjun@redhat.com> - 2.38.9000-11
 - Auto-sync with upstream branch master,
   9e4e896f0f5a19a16c1a77567463b013a0f4952d:
diff --git a/sources b/sources
index fd5ab90..fa720dc 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glibc-2.38.9000-155-g9e4e896f0f.tar.xz) = 5ea923cb91f2c474e602aae9a7fc67512dcaa570a2b2b5a2d25338315e43c5922597019baec1480892bb27171b858dd906bdda65fc2a0c6aa2035013a983822e
+SHA512 (glibc-2.38.9000-157-g1056e5b4c3.tar.xz) = c6b4292253463d1ef4db94c4f0d1ca408daaa5b7897d9204a18e22836dd1f0b5c81809718245d06ac022726965e096b922022b4f84685b61327a8b520b06a52c