Downstream-only patch to restore internal GLIBC_PRIVATE ABI change due
to glibc-RHEL-119431-2.patch.  Adding an entry to rtld_global_ro struct
changes offsets.  This patch corrects that.

RHEL does not support fortify inside shared objects loaded from
statically linked programs, so that test is xfail'd.

diff --git a/debug/readonly-area.c b/debug/readonly-area.c
index 0648121846cdd5d1..86e3e9b9c3b03958 100644
--- a/debug/readonly-area.c
+++ b/debug/readonly-area.c
@@ -21,7 +21,7 @@
 enum readonly_error_type
 __readonly_area (const void *ptr, size_t size)
 {
-  switch (GLRO(dl_readonly_area (ptr, size)))
+  switch (_dl_readonly_area (ptr, size))
     {
     case dl_readonly_area_rdonly:
       return readonly_noerror;
diff --git a/elf/Versions b/elf/Versions
index 4b8b155d8e2bef70..17834c7d1c371e1d 100644
--- a/elf/Versions
+++ b/elf/Versions
@@ -79,5 +70,8 @@ ld {
     # Set value of a tunable.
     __tunable_is_initialized;
     __tunable_get_val;
+
+    # Check if an address range within a loaded ELF object is read-only.
+    _dl_readonly_area;
   }
 }
diff --git a/elf/rtld.c b/elf/rtld.c
index d421750734e113e6..d02ecc834c9a4d43 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -456,7 +456,6 @@ _dl_start_final (void *arg, struct dl_st
   /* Do not use an initializer for these members because it would
      interfere with __rtld_static_init.  */
   GLRO (dl_find_object) = &_dl_find_object;
-  GLRO (dl_readonly_area) = &_dl_readonly_area;
 
   /* If it hasn't happen yet record the startup time.  */
   rtld_timer_start (&start_time);
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index 15c21491a291d1ae..537d1293c7b5543b 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -691,10 +691,6 @@ struct rtld_global_ro
      dlopen.  */
   int (*_dl_find_object) (void *, struct dl_find_object *);
 
-  /* Implementation of _dl_readonly_area, used in fortify routines to check
-     if memory area is within a read-only ELF segment.  */
-  enum dl_readonly_area_error_type (*_dl_readonly_area) (const void *, size_t);
-
   /* Dynamic linker operations used after static dlopen.  */
   const struct dlfcn_hook *_dl_dlfcn_hook;
 
@@ -1308,8 +1304,7 @@ extern struct link_map *_dl_find_dso_for_object (const ElfW(Addr) addr);
 rtld_hidden_proto (_dl_find_dso_for_object)
 
 extern enum dl_readonly_area_error_type _dl_readonly_area (const void *ptr,
-							   size_t size)
-     attribute_hidden;
+							   size_t size);
 
 /* Initialization which is normally done by the dynamic linker.  */
 extern void _dl_non_dynamic_init (void)
diff -rup a/debug/Makefile b/debug/Makefile
--- a/debug/Makefile      2025-11-13 15:43:52.493437313 -0500
+++ b/debug/Makefile	2025-11-18 14:18:05.311656186 -0500
@@ -190,6 +190,8 @@ CFLAGS-tst-sprintf-fortify-rdonly-static
 CFLAGS-tst-fortify-syslog.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
 CFLAGS-tst-fortify-wide.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
 
+test-xfail-tst-sprintf-fortify-rdonly-static = yes
+
 $(objpfx)tst-sprintf-fortify-rdonly: $(objpfx)tst-sprintf-fortify-rdonly-mod.so
 $(objpfx)tst-sprintf-fortify-rdonly.out: \
   $(objpfx)tst-sprintf-fortify-rdonly-dlopen.so
diff -rup a/elf/rtld_static_init.c b/elf/rtld_static_init.c
--- a/elf/rtld_static_init.c	2025-11-18 15:48:15.355621059 -0500
+++ b/elf/rtld_static_init.c	2025-11-18 17:35:21.427465597 -0500
@@ -79,7 +79,6 @@ __rtld_static_init (struct link_map *map
     attribute_hidden;
   dl->_dl_tls_static_size = _dl_tls_static_size;
   dl->_dl_find_object = _dl_find_object;
-  dl->_dl_readonly_area = _dl_readonly_area;
 
   __rtld_static_init_arch (map, dl);
 }