| Message ID | 20260722170120.3071307-1-reatmon@ti.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-arago,scarthgap] libyang: Fix CVE-2026-41401 | expand |
meta-arago / na / 20260722170120.3071307-1-reatmon
PRC Results: FAIL
=========================================================
check-yocto-patches: PASS
=========================================================
Patches
----------------------------------------
All patches passed
=========================================================
apply-yocto-patch: PASS
=========================================================
scarthgap
=====================
Summary:
- Patch Series: [meta-arago][scarthgap][PATCH] libyang: Fix CVE-2026-41401
- Submitter: From: Ryan Eatmon <reatmon@ti.com>
+From: Michal Vasko <mvasko@cesnet.cz>
- Date: Date: Wed, 22 Jul 2026 12:01:20 -0500
+Date: Thu, 26 Mar 2026 08:33:44 +0100
- Num Patches: 1
- Mailing List (public inbox) Commit SHA: d9f05bcd65aaeb72455f193d4a51e18b26329231
Applied to:
- Repository: lcpd-prc-meta-arago
- Base Branch: scarthgap-wip
- Commit Author: Ryan Eatmon <reatmon@ti.com>
- Commit Subject: libyang: Fix CVE-2026-41401
- Commit SHA: 73ab0405254988a501b849d221acf5f468cb8997
Patches
----------------------------------------
All patches applied
=========================================================
check-yocto-repo: FAIL
=========================================================
scarthgap
=====================
FAIL
ERROR: Patch is not referenced in any recipe. (REPO-1)
meta-arago-extras/recipes-connectivity/hostap/hostap-daemon-wl18xx/0001-hostapd-change-conf-file-for-better-oob-startup.patch
ERROR: Patch is not referenced in any recipe. (REPO-1)
meta-arago-extras/recipes-connectivity/open62541/open62541/0001-CMakeLists-do-not-install-git-directories.patch
ERROR: Patch is not referenced in any recipe. (REPO-1)
meta-arago-extras/recipes-connectivity/open62541/open62541/0001-tests-fix-typing-of-size_t-in-printf.patch
ERROR: Patch is not referenced in any recipe. (REPO-1)
meta-arago-extras/recipes-devtools/abseil-cpp/abseil-cpp/0001-absl-always-use-asm-sgidefs.h.patch
ERROR: Patch is not referenced in any recipe. (REPO-1)
meta-arago-extras/recipes-devtools/abseil-cpp/abseil-cpp/0002-Remove-maes-option-from-cross-compilation.patch
ERROR: Patch is not referenced in any recipe. (REPO-1)
meta-arago-extras/recipes-devtools/abseil-cpp/abseil-cpp/0003-Remove-neon-option-from-cross-compilation.patch
ERROR: Patch is not referenced in any recipe. (REPO-1)
meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
diff --git a/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc b/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc index 9744ea3a..7f20c94f 100644 --- a/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc +++ b/meta-arago-extras/recipes-extended/sysrepo/libyang-arago.inc @@ -1,3 +1,5 @@ +FILESEXTRAPATHS:prepend := "${THISDIR}/libyang:" + PV = "3.7.8" LIC_FILES_CHKSUM = "file://LICENSE;md5=9bb3d334294e8719f41c531e28a9a697" diff --git a/meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch b/meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch new file mode 100644 index 00000000..7b2ba37a --- /dev/null +++ b/meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch @@ -0,0 +1,48 @@ +From 54c3276d871023da266d4ed3ceaee7e8d71d0b04 Mon Sep 17 00:00:00 2001 +From: Michal Vasko <mvasko@cesnet.cz> +Date: Thu, 26 Mar 2026 08:33:44 +0100 +Subject: [PATCH] parser common BUGFIX invalid metadata removal + +Fix incorrect metadata list pointer update in lyd_parse_set_data_flags() +when freeing the head metadata entry via a separate meta pointer. The +condition must verify that meta2 is actually the head of *meta before +updating the list head pointer, and must use meta2->next (which is +saved before the free) rather than (*meta)->next. + +Without this fix, crafted YANG XML documents with specific metadata +ordering (e.g., operation + default metadata) can trigger invalid +pointer states in the metadata linked list. + +CVE: CVE-2026-41401 +Upstream-Status: Backport [https://github.com/CESNET/libyang/commit/54c3276d871023da266d4ed3ceaee7e8d71d0b04] + +Backport Changes: +- Adapted for v3.7.8: The fix logic is identical: change the else-if + condition to also check (meta2 == *meta) and use meta2->next instead of (*meta)->next. + +(cherry picked from commit 54c3276d871023da266d4ed3ceaee7e8d71d0b04) +Signed-off-by: Ryan Eatmon <reatmon@ti.com> +Signed-off-by: Yunseong Kim <yunseong.kim@est.tech> +--- + src/parser_common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/parser_common.c b/src/parser_common.c +index 32152759e..f8a3b1c01 100644 +--- a/src/parser_common.c ++++ b/src/parser_common.c +@@ -411,8 +411,8 @@ lyd_parser_set_data_flags(struct lyd_node *node, struct lyd_meta **meta, struct + next_meta = meta2->next; + + /* delete the metadata */ +- if (meta != &node->meta) { +- *meta = (*meta)->next; ++ if ((meta != &node->meta) && (meta2 == *meta)) { ++ *meta = meta2->next; + } + lyd_free_meta_single(meta2); + if (prev_meta) { + +-- +2.43.0 +
This is an adaptation of a CVE fix posted in meta-openembedded [1]. We have advanced the libyang version to 3.7.8 and one of the patches did not apply cleanly. [1] https://git.openembedded.org/meta-openembedded/commit/?h=scarthgap&id=c8dc986a39e74c5611a3e3222d55b0d1239a1119 Signed-off-by: Ryan Eatmon <reatmon@ti.com> --- .../sysrepo/libyang-arago.inc | 2 + .../sysrepo/libyang/CVE-2026-41401.patch | 48 +++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 meta-arago-extras/recipes-extended/sysrepo/libyang/CVE-2026-41401.patch