Ubuntu Fixes Crash in Perl XS::Parse::Keyword Module (USN-8940-1)

Canonical published security advisory USN-8940-1 on 20 October 2026, fixing a denial of service bug in the Perl XS::Parse::Keyword module distributed with Ubuntu. The affected package is libxs-parse-keyword-perl, used by those with Perl modules compiled with support for custom keyword syntax: it's not an exotic package, you often find it as a dependency in older automation tools and system scripts.\n\n## What the Advisory Says\n\nAccording to Canonical, it was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs, and if a user or automated system were tricked into receiving specially crafted input, an attacker could cause a denial of service.\n\nThe issue is tracked as CVE-2026-85644. Looking at the CVE technical record, the defect is not actually in the keyword parser but in a related component, XS::Parse::Infix: the wrapper function generated for a list-associative infix operator checks whether arguments are array references using SvRV() instead of SvROK(), so for a numeric value that slot contains the number itself and SvTYPE() dereferences it at offset 12. The typical result, as confirmed by the same technical record, is a segmentation fault—that is, a crash of the Perl process that loaded the module.\n\n## Affected Packages and Corrected Versions\n\n| Ubuntu Release | Code Name | Package | Corrected Version |\n|---|---|---|---|\n| 26.10 | stonking | libxs-parse-keyword-perl | 0.49-1ubuntu1 |\n| 26.04 LTS | resolute | libxs-parse-keyword-perl | 0.49-1ubuntu0.1 |\n\nThe update arrives via standard apt update && apt upgrade on supported systems. Those using Ubuntu Pro follow the same procedure: Ubuntu Pro provides ten years of security coverage for over 25,000 packages in the Main and Universe repositories, and is free for up to five machines.\n\nIt's worth noting that the same CVE also appeared in openSUSE security advisories published on 18 October 2026 for the perl-XS-Parse-Keyword package, indicating that the upstream fix (version 0.50 on MetaCPAN) is reaching the major distributions on a similar timeline. Anyone managing mixed Ubuntu/openSUSE VPS environments with production Perl scripts would be well advised to check both sides of their machine fleet.