diff --git a/NEWS b/NEWS
index faa7ec1871..6b8db4e947 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,17 @@ See the end for copying conditions.
 
 Please send GNU C library bug reports via <https://sourceware.org/bugzilla/>
 using `glibc' in the "product" field.
+
+Version 2.35.1
+
+The following bugs are resolved with this release:
+
+  [28850] linux: __get_nprocs_sched reads uninitialized memory from the stack
+  [28853] libc: tst-spawn6 changes current foreground process group
+    (breaks test isolation)
+  [28860] build: --enable-kernel=5.1.0 build fails because of missing
+    __convert_scm_timestamps
+
 
 Version 2.35
 
diff --git a/configure b/configure
index 00dc638388..8e5bee775a 100755
--- a/configure
+++ b/configure
@@ -730,7 +730,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -845,7 +844,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1098,15 +1096,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1244,7 +1233,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1397,7 +1386,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]
diff --git a/posix/tst-spawn6.c b/posix/tst-spawn6.c
index 911e90a461..044abd8535 100644
--- a/posix/tst-spawn6.c
+++ b/posix/tst-spawn6.c
@@ -29,7 +29,14 @@
 #include <support/check.h>
 #include <support/xunistd.h>
 #include <sys/wait.h>
+#include <sys/ioctl.h>
 #include <stdlib.h>
+#include <termios.h>
+
+#ifndef PATH_MAX
+# define PATH_MAX 1024
+#endif
+static char ptmxpath[PATH_MAX];
 
 static int
 handle_restart (const char *argv1, const char *argv2)
@@ -115,7 +122,7 @@ run_subprogram (int argc, char *argv[], const posix_spawnattr_t *attr,
 }
 
 static int
-do_test (int argc, char *argv[])
+run_test (int argc, char *argv[])
 {
   /* We must have either:
      - four parameters left if called initially:
@@ -127,16 +134,7 @@ do_test (int argc, char *argv[])
        + --setgrpr             optional
    */
 
-  if (restart)
-    return handle_restart (argv[1], argv[2]);
-
-  int tcfd = open64 (_PATH_TTY, O_RDONLY, 0600);
-  if (tcfd == -1)
-    {
-      if (errno == ENXIO)
-	FAIL_UNSUPPORTED ("terminal not available, skipping test");
-      FAIL_EXIT1 ("open64 (\"%s\", 0x%x, 0600): %m", _PATH_TTY, O_RDONLY);
-    }
+  int tcfd = xopen (ptmxpath, O_RDONLY, 0600);
 
   /* Check setting the controlling terminal without changing the group.  */
   {
@@ -198,5 +196,47 @@ do_test (int argc, char *argv[])
   return 0;
 }
 
+static int
+do_test (int argc, char *argv[])
+{
+  if (restart)
+    return handle_restart (argv[1], argv[2]);
+
+  pid_t pid = xfork ();
+  if (pid == 0)
+    {
+      /* Create a pseudo-terminal to avoid interfering with the one using by
+	 test itself, creates a new session (so there is no controlling
+	 terminal), and set the pseudo-terminal as the controlling one.  */
+      int ptmx = posix_openpt (0);
+      if (ptmx == -1)
+	{
+	  if (errno == ENXIO)
+	    FAIL_UNSUPPORTED ("terminal not available, skipping test");
+	  FAIL_EXIT1 ("posix_openpt (0): %m");
+	}
+      TEST_VERIFY_EXIT (grantpt (ptmx) == 0);
+      TEST_VERIFY_EXIT (unlockpt (ptmx) == 0);
+
+      TEST_VERIFY_EXIT (setsid () != -1);
+      TEST_VERIFY_EXIT (ioctl (ptmx, TIOCSCTTY, NULL) == 0);
+      while (dup2 (ptmx, STDIN_FILENO) == -1 && errno == EBUSY)
+	;
+      while (dup2 (ptmx, STDOUT_FILENO) == -1 && errno == EBUSY)
+	;
+      while (dup2 (ptmx, STDERR_FILENO) == -1 && errno == EBUSY)
+	;
+      TEST_VERIFY_EXIT (ptsname_r (ptmx, ptmxpath, sizeof ptmxpath) == 0);
+      xclose (ptmx);
+
+      run_test (argc, argv);
+      _exit (0);
+    }
+  int status;
+  xwaitpid (pid, &status, 0);
+  TEST_VERIFY (WIFEXITED (status));
+  exit (0);
+}
+
 #define TEST_FUNCTION_ARGV do_test
 #include <support/test-driver.c>
diff --git a/sysdeps/unix/sysv/linux/convert_scm_timestamps.c b/sysdeps/unix/sysv/linux/convert_scm_timestamps.c
index 82171bf325..dfc8c2beff 100644
--- a/sysdeps/unix/sysv/linux/convert_scm_timestamps.c
+++ b/sysdeps/unix/sysv/linux/convert_scm_timestamps.c
@@ -16,9 +16,9 @@
    License along with the GNU C Library; if not, see
    <https://www.gnu.org/licenses/>.  */
 
-#include <kernel-features.h>
+#include <bits/timesize.h>
 
-#ifndef __ASSUME_TIME64_SYSCALLS
+#if __TIMESIZE != 64
 # include <stdint.h>
 # include <string.h>
 # include <sys/socket.h>
diff --git a/sysdeps/unix/sysv/linux/getsysstats.c b/sysdeps/unix/sysv/linux/getsysstats.c
index 4798cc337e..c98c8ce3d4 100644
--- a/sysdeps/unix/sysv/linux/getsysstats.c
+++ b/sysdeps/unix/sysv/linux/getsysstats.c
@@ -44,7 +44,7 @@ __get_nprocs_sched (void)
   int r = INTERNAL_SYSCALL_CALL (sched_getaffinity, 0, cpu_bits_size,
 				 cpu_bits);
   if (r > 0)
-    return CPU_COUNT_S (cpu_bits_size, (cpu_set_t*) cpu_bits);
+    return CPU_COUNT_S (r, (cpu_set_t*) cpu_bits);
   else if (r == -EINVAL)
     /* The input buffer is still not enough to store the number of cpus.  This
        is an arbitrary values assuming such systems should be rare and there
diff -pruN glibc-2.32.orig/sysdeps/unix/sysv/linux/x86_64/64/configure glibc-2.32/sysdeps/unix/sysv/linux/x86_64/64/configure
--- glibc-2.32.orig/sysdeps/unix/sysv/linux/x86_64/64/configure	2021-09-18 21:02:32.741186019 +1000
+++ glibc-2.32/sysdeps/unix/sysv/linux/x86_64/64/configure	2021-09-18 21:03:05.314302356 +1000
@@ -4,10 +4,10 @@
 test -n "$libc_cv_slibdir" ||
 case "$prefix" in
 /usr | /usr/)
-  libc_cv_slibdir='/lib64'
-  libc_cv_rtlddir='/lib64'
+  libc_cv_slibdir='/lib'
+  libc_cv_rtlddir='/lib'
   if test "$libdir" = '${exec_prefix}/lib'; then
-    libdir='${exec_prefix}/lib64';
+    libdir='${exec_prefix}/lib';
     # Locale data can be shared between 32-bit and 64-bit libraries.
     libc_cv_complocaledir='${exec_prefix}/lib/locale'
   fi
diff -pruN glibc-2.32.orig/sysdeps/unix/sysv/linux/x86_64/ldconfig.h glibc-2.32/sysdeps/unix/sysv/linux/x86_64/ldconfig.h
--- glibc-2.32.orig/sysdeps/unix/sysv/linux/x86_64/ldconfig.h	2021-09-18 21:02:32.742186053 +1000
+++ glibc-2.32/sysdeps/unix/sysv/linux/x86_64/ldconfig.h	2021-09-18 21:03:05.314302356 +1000
@@ -18,9 +18,9 @@
 #include <sysdeps/generic/ldconfig.h>
 
 #define SYSDEP_KNOWN_INTERPRETER_NAMES \
-  { "/lib/ld-linux.so.2", FLAG_ELF_LIBC6 }, \
+  { "/lib32/ld-linux.so.2", FLAG_ELF_LIBC6 }, \
   { "/libx32/ld-linux-x32.so.2", FLAG_ELF_LIBC6 }, \
-  { "/lib64/ld-linux-x86-64.so.2", FLAG_ELF_LIBC6 },
+  { "/lib/ld-linux-x86-64.so.2", FLAG_ELF_LIBC6 },
 #define SYSDEP_KNOWN_LIBRARY_NAMES \
   { "libc.so.6", FLAG_ELF_LIBC6 },	\
   { "libm.so.6", FLAG_ELF_LIBC6 },