[wrynose,0/2] binutils: fix CVE-2026-15003 and CVE-2026-18220

Message ID	20260812072907.22268-1-jaipaul.cheernam@est.tech
Headers	show Return-Path: <jaipaul.cheernam@est.tech> ip: 40.107.159.40, mailfrom: jaipaul.cheernam@est.tech) From: Jaipaul Cheernam <jaipaul.cheernam@est.tech> To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Subject: [wrynose][PATCH 0/2] binutils: fix CVE-2026-15003 and CVE-2026-18220 Date: Wed, 12 Aug 2026 09:29:05 +0200 Message-ID: <20260812072907.22268-1-jaipaul.cheernam@est.tech> In-Reply-To: <20260807140902.4732-1-jaipaul.cheernam@est.tech> References: <20260807140902.4732-1-jaipaul.cheernam@est.tech> Content-Transfer-Encoding: quoted-printable Content-Type: text/plain MIME-Version: 1.0
Series	binutils: fix CVE-2026-15003 and CVE-2026-18220 \| expand [wrynose,0/2] binutils: fix CVE-2026-15003 and CVE-2026-18220 [wrynose,1/2] binutils: Patch for CVE-2026-15003 [wrynose,2/2] binutils: fix CVE-2026-18220

Message ID

20260812072907.22268-1-jaipaul.cheernam@est.tech

Headers

From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
To: openembedded-core@lists.openembedded.org
CC: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Subject: [wrynose][PATCH 0/2] binutils: fix CVE-2026-15003 and CVE-2026-18220
Date: Wed, 12 Aug 2026 09:29:05 +0200
Message-ID: <20260812072907.22268-1-jaipaul.cheernam@est.tech>
In-Reply-To: <20260807140902.4732-1-jaipaul.cheernam@est.tech>
References: <20260807140902.4732-1-jaipaul.cheernam@est.tech>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
 BsMxHuC52y8PRaYKsCKXRmgwIKbWOhFeTJCjlqZM0iozNXxVSdd8rbD1WTXjcXd43Q5yBuqMUIVxIBHfLgBhF5p+lItu0dW+Q8818vM0n31pfWPf8yMUNLkYqIC/4HBIeu6IatETM8ZJEYk4orbMM65qBK1Dy3SfbFtTxUa4YJfb+Kmcvx/2FJlbsQXE7jDiZHnb51pyZxpPvYHKWYWwAay/QFVuqGhEBTXLe9uf6emPJmFv2f3Gdd9uYLvdAeMY1TiG+ylJOZeeLh6D0mJNMbVmly8MZiF/G2bGCrAANz1x0JwzqEzwLYHPQIs4IGvTWUzAhgJRR0nbR0msh479qo+8ei6CF+LFj9BqpKooC7mP3YgywXqoEukqAhnhoR4LKTEh+3yX6mFqr9Oo64cJ5QHa8fPdoUFSz+m6AxiMUYpDgNiXg/9iN+vZyt+WCt1WGTTUfoVSaSMMP+/KW5BU/MrYtN1/SSXlR+3QiqdCNnajTQG/JZTBjH8BRZAIvlKRaJ7MW36ZNbJYNqvmenz0k6V0d8Gqjql9mYq+lyjtYRONOb8jErgXtm7jpFtiKxYFBt2UgA/drpVZ9vNuqBGNPNG5G2PYLlegJmRllag8Z9DVw+1L+g/ajdmZSgUDKMz8zNdOOFc3+od3jte05BI/qgnCyL6hTyLTgQrsEv2M/5J+CGu38lDG5A7tW2cfk0E/bGap2uxDU7ytqTQEDpBVG/fpN8Vc2wEFUOces1iCyExpqu59q7/u75wXDBgKCon81pugc5Inr3zb+c8HPlD3LHuchdrbDwR8ckOjlGnbAlyL0Eiu/qeNWJm3b+A3fUPTOfnH9UR9euFCj/IcXEgxrLXvygJpkzM3ObY/UQQrWrKHYSNFVK2MyHKNZdC/nZhlgkc/Lr+r5/7ckj/UQ3CUgUUSsLw/ntRshKWLkbtQ+S+0r8NAg7wt5NMAoaoKimX8oBFyjjB+lexOKfCRSLNfz07b1v8il0d//9iVU1ZiCkIIb3Ly86CatxNFnYxM7TUnAKZvPvcwVZisd3l2nkJZBY4A/kxdJ6oPGSzcrouEq0PGrc8dggGCrU2xnOFsRTIMye9YuH+3orNMDgHeGCsiTS42ZDhu6sfrCK8WVKRJc1lSLPbCRVx5+dnD8bb/M2UHzmfgaE59/PitcxfCjeQJfyU7t+1g0o3G0bzAGq+JHAL6eQxiDHMk1sY/HUSX6LqtYH7dBHE9///2YRqeGs5+AgKLj3wkqEd1mFxkgLeueZYv8I1RS3f9nOmusqmJ3/ho/Uktxst13D4ltEXL2g5x1b/jx6NBs48Xwlvx23S8uuLMhkyGhJwO+T/+Mwa1qequo2ioMn3kKexKxWbqE5do311KfWagvJIdgKQgMeAMtNgiQqqBzYi5hc5mqQpbIHRhCLT7gt4OKKQEImkHo/F28AVkP+oHP0ObZFXq+bz7YRos2QrzSE93os1f2mhHLGIGPxFPgKtX4PgoIjVmd80BfHbtgm5a9Pqv9hksmo8hlUNLjan/2ukiyVw3kDgOIu01LFEW9oaYOAnct5dJQ4P0Kbo7zhsMZ35cVFJ/nprcOhhJMrcDm55z2lW7WGy6Dmnh6M7LiZ9u2Vlf8PGxOMx/NQdUJL3qt/PwqwZjOfQqSctqSI8Z3OhoczeLnFmMxyaYd7BnNUm0S0TiX0Xtiaea/VS6Q+zW0CKHkCwjTfACUCsihWzW5hI/L0NkT6WVyyDykmDppfOMIZ6Cqj/tk9ACRNkR3RKeh0x/4yQBwMxVN00=
X-OriginatorOrg: est.tech
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 bc4dc8f6-4e7a-43f9-bd8b-08def84366c6
X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 07:29:10.5431
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 WYJcPuX6Ltu7g5l8ZXqZh693IUwujGsiJVTvL7tHIiys65I7gTnMDQpgZ4foD/FXlrtzVwrISlT4hCANh6R/IclUvQMEIBJEvw7fDR7tevQ=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESP189MB3212
List-Id: <openembedded-core.lists.openembedded.org>
X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com
 [45.33.107.173] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <openembedded-core@lists.openembedded.org>; Wed, 12 Aug 2026 07:29:13 -0000
X-Groupsio-URL: 
 https://lists.openembedded.org/g/openembedded-core/message/243252

Series

binutils: fix CVE-2026-15003 and CVE-2026-18220 | expand

Message

Jaipaul Cheernam Aug. 12, 2026, 7:29 a.m. UTC

Backport two upstream fixes for binutils 2.46.1:

- CVE-2026-15003: buffer overflow in xcoff_link_add_symbols (PR 34053)
- CVE-2026-18220: buffer overflow in elf32_dlx_relocate26

Both patches apply cleanly and all tests pass with no regressions.

Test results:
  binutils-testsuite 2.46.1 (x86_64-oe-linux) - All tests PASSED

  binutils: 327 passed, 5 untested, 9 unsupported
  gas:      2091 passed, 4 unsupported
  ld:       1899 passed, 7 expected failures, 20 untested, 109 unsupported

Jaipaul Cheernam (2):
  binutils: Patch for CVE-2026-15003
  binutils: fix CVE-2026-18220

 .../binutils/binutils-2.46.inc                |   2 +
 .../binutils/binutils/CVE-2026-15003.patch    | 402 ++++++++++++++++++
 .../binutils/binutils/CVE-2026-18220.patch    |  65 +++
 3 files changed, 469 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch