mbox series

[wrynose,v2,0/2] binutils: fix CVE-2026-15003 and CVE-2026-18220

Message ID 20260812085633.22846-1-jaipaul.cheernam@est.tech
Headers show
Series binutils: fix CVE-2026-15003 and CVE-2026-18220 | expand

Message

Jaipaul Cheernam Aug. 12, 2026, 8:56 a.m. UTC 
Backport two upstream fixes for binutils 2.46.1:

- CVE-2026-15003: buffer overflow in xcoff_link_add_symbols (PR 34053)
- CVE-2026-18220: buffer overflow in elf32_dlx_relocate26

Both patches apply cleanly and all tests pass with no regressions.

Changes v1 -> v2:
- Fixed Upstream-Status placement to be in commit message (before scissors line)

Test results:
  binutils-testsuite 2.46.1 (x86_64-oe-linux) - All tests PASSED

  binutils: 327 passed, 5 untested, 9 unsupported
  gas:      2091 passed, 4 unsupported
  ld:       1899 passed, 7 expected failures, 20 untested, 109 unsupported

Jaipaul Cheernam (2):
  binutils: Patch for CVE-2026-15003
  binutils: fix CVE-2026-18220

 .../binutils/binutils-2.46.inc                |   2 +
 .../binutils/binutils/CVE-2026-15003.patch    | 402 ++++++++++++++++++
 .../binutils/binutils/CVE-2026-18220.patch    |  65 +++
 3 files changed, 469 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch