[AutoPR- Security] Patch elixir for CVE-2026-75758 [MEDIUM]

[Azure Linux Security Servicing Account (azurelinux-security)]

Auto Patch elixir for CVE-2026-75758.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1193959&view=results

CVE-2026-75758 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1193972&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch elixir for CVE-2026-75758 (MEDIUM).

Change Log

• CVE-2026-75758

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-75758

Test Methodology

• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Ratiranjan5]

CVE-2026-75758:

• The CVE-2026-75758 affects elixir as the packaged version 1.16.1 is in the affected range (>= 1.15.0-rc.0 and < 1.18.5). After reviewing the source, I was able to verify that affected files— lib/elixir/lib/inspect.ex, lib/elixir/lib/list.ex, and lib/elixir/lib/inspect/algebra.ex and and the affected functions (Inspect.List.inspect, List.to_string, List.to_charlist) are all present in the source code.

• Backported: Yes — manually backported from upstream commit 5230d73968f1b4969d2a2646786fa6c71475f5cc and adapted to the 1.16.1 source tree.

  • Added the missing unicode_list? and decrement private helper definitions. The original AI patch called these functions but never defined them, so it would fail to compile (undefined function unicode_list?/2). These definitions were taken from the upstream commit.

• Adjusted context (line numbers, and color/3 vs upstream's color_doc/3) to fit the 1.16.1 source.

• Now, AI patch completely matches with the upstream patch after modification.

• Files dropped:

  • lib/elixir/test/elixir/inspect_test.exs
  • lib/elixir/test/elixir/list_test.exs
    These test files were dropped because the spec has no %check section (tests are never run during the build) and they add no functional value to the delivered package.

• The patch includes the upstream reference in its header:

• The local build passed.

• Patch applies cleanly.

[Ratiranjan5]

Pipeline build id: Buddy Build has passed.

[Aditya Singh (v-aaditya)]

Peer-review analysis -

1. The Patch has been backported and it has been modified to include the function definitions for unicode_list and decrement which the AI has missed and which resulted in Buddy Build failure.
2. After modification the patch completely matches with upstream patch, except the changes made in test files lib/elixir/test/elixir/inspect_test.exs and lib/elixir/test/elixir/list_test.exs are not included as there is no %check section in the spec file.
3. The patch has upstream patch reference.
4. The Buddy Build is successful.
5. The patch applies cleanly. (Checked .rpm.log)
6. The PR has security tag.

Final Verdict - LGTM. PR can be opened for FTE review.