diff --git a/glibc.spec b/glibc.spec
index b2c0781..30ace3e 100644
--- a/glibc.spec
+++ b/glibc.spec
@@ -1,6 +1,6 @@
-%define glibcsrcdir glibc-2.26-123-g069c3dd05a
+%define glibcsrcdir glibc-2.26-131-gfabef2edbc
 %define glibcversion 2.26
-%define glibcrelease 22%{?dist}
+%define glibcrelease 23%{?dist}
 # Pre-release tarballs are pulled in from git using a command that is
 # effectively:
 #
@@ -2286,6 +2286,15 @@ rm -f *.filelist*
 %endif
 
 %changelog
+* Mon Jan 15 2018 Florian Weimer <fweimer@redhat.com> - 2.26-23
+- CVE-2018-1000001: Make getcwd fail if it cannot obtain an absolute path
+  (#1533837)
+- CVE-2017-16997: Check for empty tokens before dynamic string token
+  expansion in the dynamic linker (#1526866)
+- Auto-sync with upstream branch release/2.26/master,
+  commit fabef2edbc29424a8048bdd60eba1a201f95682b:
+- elf: do not substitute dst in $LD_LIBRARY_PATH twice (swbz#22627)
+
 * Mon Jan 15 2018 Florian Weimer <fweimer@redhat.com> - 2.26-22
 - Add BuildRequires: cpp (for rpcgen)
 
diff --git a/sources b/sources
index 6cc41fd..583d168 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (glibc-2.26-123-g069c3dd05a.tar.gz) = b82e3f144d6d3e0a9c2834a2ccbdd99935929366d1130873932557ae550544c31daa008f7120fd4324124a2cbcee377021a6d190c4d267bc9fce95aa35e20d8d
+SHA512 (glibc-2.26-131-gfabef2edbc.tar.gz) = 84f852c613deb7e94cd36597cd4731ee850351df6425e73060394d594215e67dd003af101ebe01cbe5a4455c320c3a14d46c1953dc09cd9f74445b5ccf1b1a5e