similarity index 100%
rename from meta/recipes-core/util-linux/util-linux-libuuid_2.41.3.bb
rename to meta/recipes-core/util-linux/util-linux-libuuid_2.41.5.bb
@@ -20,10 +20,8 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://0001-lsfd-mkfds-foreign-sockets-skip-when-lacking-sock_di.patch \
file://0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch \
file://0001-tests-script-Disable-size-option-test.patch \
- file://0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch \
- file://CVE-2026-13595.patch \
"
-SRC_URI[sha256sum] = "3330d873f0fceb5560b89a7dc14e4f3288bbd880e96903ed9b50ec2b5799e58b"
+SRC_URI[sha256sum] = "f586e35d320ff537aab3ffeca37e9ecd482ccbe013590db4429a414d8aa6a728"
CVE_PRODUCT = "util-linux"
deleted file mode 100644
@@ -1,114 +0,0 @@
-From f55f9906b4f6eeb2b4a4120317df9de935253c10 Mon Sep 17 00:00:00 2001
-From: Karel Zak <kzak@redhat.com>
-Date: Thu, 19 Feb 2026 13:59:46 +0100
-Subject: [PATCH] loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks
-
-Add a new LOOPDEV_FL_NOFOLLOW flag for loop device context that
-prevents symlink following in both path canonicalization and file open.
-
-When set:
-- loopcxt_set_backing_file() uses strdup() instead of
- ul_canonicalize_path() (which calls realpath() and follows symlinks)
-- loopcxt_setup_device() adds O_NOFOLLOW to open() flags
-
-The flag is set for non-root (restricted) mount operations in
-libmount's loop device hook. This prevents a TOCTOU race condition
-where an attacker could replace the backing file (specified in
-/etc/fstab) with a symlink to an arbitrary root-owned file between
-path resolution and open().
-
-Vulnerable Code Flow:
-
- mount /mnt/point (non-root, SUID)
- mount.c: sanitize_paths() on user args (mountpoint only)
- mnt_context_mount()
- mnt_context_prepare_mount()
- mnt_context_apply_fstab() <-- source path from fstab
- hooks run at MNT_STAGE_PREP_SOURCE
- hook_loopdev.c: setup_loopdev()
- backing_file = fstab source path ("/home/user/disk.img")
- loopcxt_set_backing_file() <-- calls realpath() as ROOT
- ul_canonicalize_path() <-- follows symlinks!
- loopcxt_setup_device()
- open(lc->filename, O_RDWR|O_CLOEXEC) <-- no O_NOFOLLOW
-
-Two vulnerabilities in the path:
-
-1) loopcxt_set_backing_file() calls ul_canonicalize_path() which uses
- realpath() -- this follows symlinks as euid=0. If the attacker swaps
- the file to a symlink before this call, lc->filename becomes the
- resolved target path (e.g., /root/secret.img).
-
-2) loopcxt_setup_device() opens lc->filename without O_NOFOLLOW. Even
- if canonicalization happened correctly, the file can be swapped to a
- symlink between canonicalize and open.
-
-Addresses: https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g
-Signed-off-by: Karel Zak <kzak@redhat.com>
-(cherry picked from commit 5e390467b26a3cf3fecc04e1a0d482dff3162fc4)
-
-CVE: CVE-2026-27456
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- include/loopdev.h | 3 ++-
- lib/loopdev.c | 7 ++++++-
- libmount/src/hook_loopdev.c | 3 ++-
- 3 files changed, 10 insertions(+), 3 deletions(-)
-
-diff --git a/include/loopdev.h b/include/loopdev.h
-index e5ec1c98a..6bdb1393a 100644
---- a/include/loopdev.h
-+++ b/include/loopdev.h
-@@ -140,7 +140,8 @@ enum {
- LOOPDEV_FL_NOIOCTL = (1 << 6),
- LOOPDEV_FL_DEVSUBDIR = (1 << 7),
- LOOPDEV_FL_CONTROL = (1 << 8), /* system with /dev/loop-control */
-- LOOPDEV_FL_SIZELIMIT = (1 << 9)
-+ LOOPDEV_FL_SIZELIMIT = (1 << 9),
-+ LOOPDEV_FL_NOFOLLOW = (1 << 10) /* O_NOFOLLOW, don't follow symlinks */
- };
-
- /*
-diff --git a/lib/loopdev.c b/lib/loopdev.c
-index 2359bf781..76685be70 100644
---- a/lib/loopdev.c
-+++ b/lib/loopdev.c
-@@ -1267,7 +1267,10 @@ int loopcxt_set_backing_file(struct loopdev_cxt *lc, const char *filename)
- if (!lc)
- return -EINVAL;
-
-- lc->filename = canonicalize_path(filename);
-+ if (lc->flags & LOOPDEV_FL_NOFOLLOW)
-+ lc->filename = strdup(filename);
-+ else
-+ lc->filename = canonicalize_path(filename);
- if (!lc->filename)
- return -errno;
-
-@@ -1408,6 +1411,8 @@ int loopcxt_setup_device(struct loopdev_cxt *lc)
-
- if (lc->config.info.lo_flags & LO_FLAGS_DIRECT_IO)
- flags |= O_DIRECT;
-+ if (lc->flags & LOOPDEV_FL_NOFOLLOW)
-+ flags |= O_NOFOLLOW;
-
- if ((file_fd = open(lc->filename, mode | flags)) < 0) {
- if (mode != O_RDONLY && (errno == EROFS || errno == EACCES))
-diff --git a/libmount/src/hook_loopdev.c b/libmount/src/hook_loopdev.c
-index 444d69d6f..34351116c 100644
---- a/libmount/src/hook_loopdev.c
-+++ b/libmount/src/hook_loopdev.c
-@@ -272,7 +272,8 @@ static int setup_loopdev(struct libmnt_context *cxt,
- }
-
- DBG(LOOP, ul_debugobj(cxt, "not found; create a new loop device"));
-- rc = loopcxt_init(&lc, 0);
-+ rc = loopcxt_init(&lc,
-+ mnt_context_is_restricted(cxt) ? LOOPDEV_FL_NOFOLLOW : 0);
- if (rc)
- goto done_no_deinit;
- if (mnt_opt_has_value(loopopt)) {
-2.43.0
-
deleted file mode 100644
@@ -1,148 +0,0 @@
-From c3844c348f2903d929dd5ded0ea8147394cce607 Mon Sep 17 00:00:00 2001
-From: Karel Zak <kzak@redhat.com>
-Date: Thu, 7 May 2026 12:50:48 +0200
-Subject: [PATCH] libblkid: fix use-after-free in nested partition probing
-
-The partitions list stores partitions in a contiguous array grown by
-reallocarray(). When the array is reallocated to a new address, all
-existing blkid_partition pointers (tab->parent, ls->next_parent, local
-parent variables in nested probers) become dangling.
-
-Fix this by changing the storage from an array of structs to an array
-of pointers, where each partition is individually allocated via
-calloc(). This makes all blkid_partition pointers stable across
-reallocations -- only the pointer array itself may move, which is
-harmless since no code caches pointers into the pointer array.
-
-This eliminates the need for callers to re-fetch parent pointers after
-every blkid_partlist_add_partition() call.
-
-CVE: CVE-2026-13595
-Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa]
-
-Reported-by: Thai Duong <thaidn@gmail.com>
-Signed-off-by: Karel Zak <kzak@redhat.com>
-(cherry picked from commit c0186f14fbdb02f64c8e0ba701ce727ea764ff4c)
-(cherry picked from commit 132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa)
-Signed-off-by: Deepak Rathore <deeratho@cisco.com>
----
- libblkid/src/partitions/partitions.c | 34 +++++++++++++++++-----------
- 1 file changed, 21 insertions(+), 13 deletions(-)
-
-diff --git a/libblkid/src/partitions/partitions.c b/libblkid/src/partitions/partitions.c
-index 9df813c92..e600e5e45 100644
---- a/libblkid/src/partitions/partitions.c
-+++ b/libblkid/src/partitions/partitions.c
-@@ -198,7 +198,7 @@ struct blkid_struct_partlist {
-
- int nparts; /* number of partitions */
- int nparts_max; /* max.number of partitions */
-- blkid_partition parts; /* array of partitions */
-+ blkid_partition *parts; /* array of pointers to partitions */
-
- struct list_head l_tabs; /* list of partition tables */
- };
-@@ -357,13 +357,16 @@ static void reset_partlist(blkid_partlist ls)
- free_parttables(ls);
-
- if (ls->next_partno) {
-- /* already initialized - reset */
-- int tmp_nparts = ls->nparts_max;
-- blkid_partition tmp_parts = ls->parts;
-+ /* already initialized - free individually allocated partitions */
-+ int i, tmp_nparts_max = ls->nparts_max;
-+ blkid_partition *tmp_parts = ls->parts;
-+
-+ for (i = 0; i < ls->nparts; i++)
-+ free(ls->parts[i]);
-
- memset(ls, 0, sizeof(struct blkid_struct_partlist));
-
-- ls->nparts_max = tmp_nparts;
-+ ls->nparts_max = tmp_nparts_max;
- ls->parts = tmp_parts;
- }
-
-@@ -398,6 +401,7 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)),
- void *data)
- {
- blkid_partlist ls = (blkid_partlist) data;
-+ int i;
-
- if (!ls)
- return;
-@@ -405,6 +409,8 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)),
- free_parttables(ls);
-
- /* deallocate partitions and partlist */
-+ for (i = 0; i < ls->nparts; i++)
-+ free(ls->parts[i]);
- free(ls->parts);
- free(ls);
- }
-@@ -438,15 +444,17 @@ static blkid_partition new_partition(blkid_partlist ls, blkid_parttable tab)
- * generic Linux machine -- let start with 32 partitions.
- */
- void *tmp = reallocarray(ls->parts, ls->nparts_max + 32,
-- sizeof(struct blkid_struct_partition));
-+ sizeof(blkid_partition));
- if (!tmp)
- return NULL;
- ls->parts = tmp;
- ls->nparts_max += 32;
- }
-
-- par = &ls->parts[ls->nparts++];
-- memset(par, 0, sizeof(struct blkid_struct_partition));
-+ par = calloc(1, sizeof(struct blkid_struct_partition));
-+ if (!par)
-+ return NULL;
-+ ls->parts[ls->nparts++] = par;
-
- ref_parttable(tab);
- par->tab = tab;
-@@ -851,7 +859,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr,
-
- /* check if the partition table fits into the device */
- for (i = 0; i < nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if (par->start + par->size > (pr->size >> 9)) {
- DBG(LOWPROBE, ul_debug("partition #%d overflows "
-@@ -863,7 +871,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr,
-
- /* check if the requested area is covered by PT */
- for (i = 0; i < nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if (start >= par->start && end <= par->start + par->size) {
- rc = 1;
-@@ -962,7 +970,7 @@ blkid_partition blkid_partlist_get_partition(blkid_partlist ls, int n)
- if (n < 0 || n >= ls->nparts)
- return NULL;
-
-- return &ls->parts[n];
-+ return ls->parts[n];
- }
-
- blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start)
-@@ -1074,7 +1082,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno
- * and an entry in partition table.
- */
- for (i = 0; i < ls->nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if (partno != blkid_partition_get_partno(par))
- continue;
-@@ -1090,7 +1098,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno
- DBG(LOWPROBE, ul_debug("searching by offset/size"));
-
- for (i = 0; i < ls->nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if ((uint64_t)blkid_partition_get_start(par) == start &&
- (uint64_t)blkid_partition_get_size(par) == size)
similarity index 100%
rename from meta/recipes-core/util-linux/util-linux_2.41.3.bb
rename to meta/recipes-core/util-linux/util-linux_2.41.5.bb