I've uploaded libsocket-perl/2.038-1+deb13u1 to trixie, in the hope
that in can be included in the upcoming point release.

This upload has been prepared in cooperation with ntyni and carnil
and is part of the Perl no-DSA security fixes, as decribed in
#1146369.

This upload fixes #1146063 aka CVE-2026-12087.

The update was prepared by Kentaro Hayashi in advance. It consists of
two new patches:
- - CVE-2026-12087.patch: the actual fixes, taken from newer upstream
  versions of libsocket-perl;
- - CVE-2026-12087-test.patch: an additional regression test

The same upstream fix is applied to the Socket module in src:perl.

Changelog entry:

#v+
libsocket-perl (2.038-1+deb13u1) trixie; urgency=medium

  [ Kentaro Hayashi ]
  * Backport patch to fix CVE-2026-12087
    (out-of-bounds heap read in pack_ip_mreq_source()).
    - Added CVE-2026-12087.patch
    - Added CVE-2026-12087-test.patch for testing

    Closes: #1146063
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXTexfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgZtLBAAmj6wbKCDXFPJio8rbpyFQd781Y9iI7HGNxC3GuaxF3qptxRFc6HNGnwq
CRNX/Nj2G0rvBdEUtLdBAl/Qv4Q+vCNove6ShQY+Q/ZVX1MsMcHhbK60NrMwTpZq
81Du968ppe9xnegROBX48DmUuzHciBwPyQXb3+gHtbm+oYnt4mdCXoPyFkE4Cpli
bPsAlNg7Kq/3C96qtAzrAjqO45yhr6jOWNG74s/FXlgR2znHgNZZJsNmBE5TrRZ2
fU3zDHG8XxRc8B/DjTsDx8+9aLyW3pukoI6T7iT07mjjfgkDw7PIDbjhc/SeEb+W
T2dxQZRMKhU+oy6YkpipmNFMTvqilBv24zeJMe1V8wQEsxn6RfTmUY1swE08s4Xw
AlJX/7QdtakUoU0So400l40xxnojd+LkaIBrvvotqJW84gNeIgIbiWuRu5ipp9jc
5RSuLSrnYkNAH1xBltvXmLcFV2H+1Di6JGLA/kODL7oD8gcWg9SXH632acvWyXnK
GxVZUvezaFVCUFlKefXBU+tHbJ1CRGHoKpq7xvmU+Q+N8JB7D8Ypigw1b2B8GhWO
DRTqaTxkkYBfnRstWHWPiW5300QKtybZbKgicXps3kE5Xhjsz+uzOY7BSldxdrvE
6pPid3rJYhhdAXnYI4jinjp7zjTNqOpSjQB+8r372bi5UufbHfA=
=UYIW
-----END PGP SIGNATURE-----