Backport upstream commit 03f74bbb to fix CVE-2026-13221,

a trie overflow in regcomp_study.c (GH #23388). The fix
prevents construction of a regex trie that would overflow
a 16-bit field. The patch was adapted for perl-5.40.2 by
including only the relevant test block from the upstream
commit.

CVE: CVE-2026-13221
Upstream patches:
 - 03f74bbbd3.patch
Resolves: RHEL-247937

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir

perl-5.40.2-CVE-2026-13221.patch

@@ -0,0 +1,68 @@
+From dee6dd8b65bd8059a24e0beab1e2b057ee40fce0 Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw@cpan.org>
+Date: Thu, 26 Mar 2026 10:13:49 -0600
+Subject: [PATCH] regcomp_study: Don't create a trie that would overflow
+
+This addresses GH #23388
+
+The design of the trie compiling code is to batch extra long tries into
+smaller chunks that fit into whatever limitations there are.  However,
+this ticket shows that that isn't always being done.
+
+In this case, a bunch of branches that have TAIL operands can be
+combined together, and the final TAIL is used.  And the code requires
+that the delta between the first branch and this final TAIL fit into a
+16-bit field.  That is the root cause of this bug.
+
+I'm not familiar enough with the trie construction code to easily
+understand why the final tail needs to be used here.  So this patch
+simply doesn't optimize a sequence of branches into a trie that would
+overflow.
+
+This could be revisited by someone who knows more about this than I, or
+earlier in the development cycle.
+---
+ regcomp_study.c     | 10 ++++++++++
+ t/re/pat_advanced.t |  8 ++++++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/regcomp_study.c b/regcomp_study.c
+index 6f41860cac..43d8dbe385 100644
+--- a/regcomp_study.c
++++ b/regcomp_study.c
+@@ -1840,6 +1840,16 @@ Perl_study_chunk(pTHX_
+                             tail = regnext( tail );
+                         }
+ 
++                        /* The code below currently saves the difference from
++                         * start to finish in a 16-bit field, causing
++                         * GH #23388.  This defeats the design of batching
++                         * tries into chunks that each fit.  khw thinks it is
++                         * too late in the 5.44 cycle to relook at the design,
++                         * so for now anyway, don't make a trie that would
++                         * overflow */
++                        if (tail - startbranch >= U16_MAX) {
++                            continue;
++                        }
+ 
+                         DEBUG_TRIE_COMPILE_r({
+                             regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state);
+diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t
+index 4d62f62c90..28f869ebc4 100644
+--- a/t/re/pat_advanced.t
++++ b/t/re/pat_advanced.t
+@@ -2713,6 +2713,14 @@ EOF_DEBUG_OUT
+         $x =~ s/^[\x{0301}\x{030C}]+//;
+     }
+ 
++    { # GH #23388
++        fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow");
++            my $x = join "|", "aaa".."mzz";
++            my $y = join "|", "naa".."zzz";
++            use re 'Debug';
++            "fnord" =~ m/(?:$x)|(?:$y)/;
++            PROG
++    }
+ 
+     # !!! NOTE that tests that aren't at all likely to crash perl should go
+     # a ways above, above these last ones.  There's a comment there that, like

perl.spec

@@ -117,7 +117,7 @@ License:        GPL-1.0-or-later OR Artistic-1.0-Perl
 Epoch:          %{perl_epoch}
 Version:        %{perl_version}
 # release number must be even higher, because dual-lived modules will be broken otherwise
-Release:        514%{?dist}
+Release:        515%{?dist}
 Summary:        Practical Extraction and Report Language
 Url:            https://www.perl.org/
 Source0:        https://www.cpan.org/src/5.0/perl-%{perl_version}.tar.xz
@@ -187,6 +187,10 @@ Patch13:        perl-5.28.0-Pass-CFLAGS-to-dtrace.patch
 Patch14:        perl-5.42.0-CVE-2025-40909-Clone-dirhandles-without-fchdir.patch
 Patch15:        perl-5.42.0-Use-PerlLIO_dup_cloexec-in-Perl_dirp_dup-to-set-O_CL.patch
 
+# Fix CVE-2026-13221 - regcomp_study: Don't create a trie that would overflow
+# https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7
+Patch16:        perl-5.40.2-CVE-2026-13221.patch
+
 # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
 Patch200:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
 
@@ -4245,6 +4249,7 @@ you're not running VMS, this module does nothing.
 %patch -P13 -p1
 %patch -P14 -p1
 %patch -P15 -p1
+%patch -P16 -p1
 %patch -P200 -p1
 %patch -P201 -p1
 %patch -P202 -p1
@@ -4267,6 +4272,7 @@ perl -x patchlevel.h \
     'Fedora Patch12: Link XS modules to pthread library to fix linking with -z defs' \
     'Fedora Patch13: Pass the correct CFLAGS to dtrace' \
     'Fedora Patch14: Fix CVE-2025-40909' \
+    'Fedora Patch16: Fix CVE-2026-13221' \
     'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
     'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
     'Fedora Patch202: Add definition of OPTIMIZE to .ph files' \
@@ -7294,6 +7300,10 @@ ln -s /app/bin/perl %{buildroot}/usr/bin/perl
 
 # Old changelog entries are preserved in CVS.
 %changelog
+* Fri Aug 21 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4:5.40.2-515
+- Fixes: CVE-2026-13221 - regcomp_study: Don't create a trie that would
+  overflow
+
 * Thu Jul 10 2025 Jitka Plesnikova <jplesnik@redhat.com> - 4:5.40.1-514
 - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir