@@ -42,4 +42,5 @@ SRC_URI = "\
file://CVE-2025-11414.patch \
file://CVE-2025-11412.patch \
file://CVE-2025-11413.patch \
+ file://CVE-2025-11495.patch \
"
new file mode 100644
@@ -0,0 +1,153 @@
+From 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 Mon Sep 17 00:00:00 2001
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Tue, 30 Sep 2025 08:18:29 +0800
+Subject: [PATCH] x86: Disallow TLS relocation in non executable section
+
+Since TLS relocations are applied to executable machine instructions,
+disallow TLS relocation in non-SHT_PROGBITS, non-SHF_EXECINSTR section.
+
+ PR ld/33451
+ PR ld/33502
+ * elf32-i386.c (elf_i386_tls_transition): Disallow TLS relocation
+ in non-SHT_PROGBITS, non-SHF_EXECINSTR section.
+ (elf_i386_scan_relocs): Likewise.
+ * elf64-x86-64.c (elf_x86_64_tls_transition): Likewise.
+ (elf_x86_64_scan_relocs): Likewise.
+ * elfxx-x86.c (_bfd_x86_elf_link_report_tls_invalid_section_error):
+ New.
+ * elfxx-x86.h (_bfd_x86_elf_link_report_tls_invalid_section_error):
+ Likewise.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+
+CVE: CVE-2025-11495
+Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ bfd/elf32-i386.c | 19 +++++++++++++++++++
+ bfd/elf64-x86-64.c | 20 ++++++++++++++++++++
+ bfd/elfxx-x86.c | 20 ++++++++++++++++++++
+ bfd/elfxx-x86.h | 4 ++++
+ 4 files changed, 63 insertions(+)
+
+diff --git a/bfd/elf32-i386.c b/bfd/elf32-i386.c
+index 507a0762aff..0d60eded701 100644
+--- a/bfd/elf32-i386.c
++++ b/bfd/elf32-i386.c
+@@ -1166,6 +1166,15 @@ elf_i386_tls_transition (struct bfd_link_info *info, bfd *abfd,
+ return true;
+ }
+
++ if ((elf_section_type (sec) != SHT_PROGBITS
++ || (sec->flags & SEC_CODE) == 0))
++ {
++ reloc_howto_type *howto = elf_i386_rtype_to_howto (from_type);
++ _bfd_x86_elf_link_report_tls_invalid_section_error
++ (abfd, sec, symtab_hdr, h, sym, howto);
++ return false;
++ }
++
+ /* Return TRUE if there is no transition. */
+ if (from_type == to_type)
+ return true;
+@@ -1727,6 +1736,16 @@ elf_i386_scan_relocs (bfd *abfd,
+ tls_type = GOT_TLS_IE_POS; break;
+ }
+
++ if (tls_type >= GOT_TLS_GD
++ && tls_type <= GOT_TLS_GDESC
++ && (elf_section_type (sec) != SHT_PROGBITS
++ || (sec->flags & SEC_CODE) == 0))
++ {
++ _bfd_x86_elf_link_report_tls_invalid_section_error
++ (abfd, sec, symtab_hdr, h, isym, howto);
++ goto error_return;
++ }
++
+ if (h != NULL)
+ {
+ h->got.refcount = 1;
+diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
+index 620b6a380cd..59b43149897 100644
+--- a/bfd/elf64-x86-64.c
++++ b/bfd/elf64-x86-64.c
+@@ -1626,6 +1626,16 @@ elf_x86_64_tls_transition (struct bfd_link_info *info, bfd *abfd,
+ return true;
+ }
+
++ if ((elf_section_type (sec) != SHT_PROGBITS
++ || (sec->flags & SEC_CODE) == 0))
++ {
++ reloc_howto_type *howto = elf_x86_64_rtype_to_howto (abfd,
++ from_type);
++ _bfd_x86_elf_link_report_tls_invalid_section_error
++ (abfd, sec, symtab_hdr, h, sym, howto);
++ return false;
++ }
++
+ /* Return TRUE if there is no transition. */
+ if (from_type == to_type
+ || (from_type == R_X86_64_CODE_4_GOTTPOFF
+@@ -2748,6 +2758,16 @@ elf_x86_64_scan_relocs (bfd *abfd, struct bfd_link_info *info,
+ break;
+ }
+
++ if (tls_type >= GOT_TLS_GD
++ && tls_type <= GOT_TLS_GDESC
++ && (elf_section_type (sec) != SHT_PROGBITS
++ || (sec->flags & SEC_CODE) == 0))
++ {
++ _bfd_x86_elf_link_report_tls_invalid_section_error
++ (abfd, sec, symtab_hdr, h, isym, howto);
++ goto error_return;
++ }
++
+ if (h != NULL)
+ {
+ h->got.refcount = 1;
+diff --git a/bfd/elfxx-x86.c b/bfd/elfxx-x86.c
+index 0d389968c91..d8c653a9ad2 100644
+--- a/bfd/elfxx-x86.c
++++ b/bfd/elfxx-x86.c
+@@ -3348,6 +3348,26 @@ _bfd_x86_elf_link_report_tls_transition_error
+ bfd_set_error (bfd_error_bad_value);
+ }
+
++/* Report TLS invalid section error. */
++
++void
++_bfd_x86_elf_link_report_tls_invalid_section_error
++ (bfd *abfd, asection *sec, Elf_Internal_Shdr *symtab_hdr,
++ struct elf_link_hash_entry *h, Elf_Internal_Sym *sym,
++ reloc_howto_type *howto)
++{
++ const char *name;
++ if (h)
++ name = h->root.root.string;
++ else
++ name = bfd_elf_sym_name (abfd, symtab_hdr, sym, NULL);
++ _bfd_error_handler
++ /* xgettext:c-format */
++ (_("%pB: relocation %s against thread local symbol `%s' in "
++ "invalid section `%pA'"), abfd, howto->name, name, sec);
++ bfd_set_error (bfd_error_bad_value);
++}
++
+ /* Return TRUE if symbol should be hashed in the `.gnu.hash' section. */
+
+ bool
+diff --git a/bfd/elfxx-x86.h b/bfd/elfxx-x86.h
+index 1ebc9d2f2e5..f8a24a77577 100644
+--- a/bfd/elfxx-x86.h
++++ b/bfd/elfxx-x86.h
+@@ -939,6 +939,10 @@ extern void _bfd_x86_elf_link_report_tls_transition_error
+ const Elf_Internal_Rela *, const char *, const char *,
+ enum elf_x86_tls_error_type);
+
++extern void _bfd_x86_elf_link_report_tls_invalid_section_error
++ (bfd *, asection *, Elf_Internal_Shdr *, struct elf_link_hash_entry *,
++ Elf_Internal_Sym *, reloc_howto_type *);
++
+ #define bfd_elf64_mkobject \
+ _bfd_x86_elf_mkobject
+ #define bfd_elf32_mkobject \