diff mbox series

glibc: set status for CVE-2026-5435

Message ID 20260801092437.6273-1-peter.marko@siemens.com
State New
Headers show
Series glibc: set status for CVE-2026-5435 | expand

Commit Message

Peter Marko Aug. 1, 2026, 9:24 a.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Commit fixing this CVE [3] is available in current hash.
It is listed via [1] -> [2] and has CVE reference in commit message.

Additionally add comment that CVE_STATUS_STABLE_BACKPORTS variable
should be kept during recipe upgrades.

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-5435
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=34033
[3] https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ca44a6609c29a683b03575fa035c6d17aa591e72

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta/recipes-core/glibc/glibc_2.44.bb | 7 +++++++
 1 file changed, 7 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-core/glibc/glibc_2.44.bb b/meta/recipes-core/glibc/glibc_2.44.bb
index 9c93c05fe9..c629b30827 100644
--- a/meta/recipes-core/glibc/glibc_2.44.bb
+++ b/meta/recipes-core/glibc/glibc_2.44.bb
@@ -16,6 +16,13 @@  CVE_STATUS[CVE-2019-1010025] = "disputed: \
 Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow \
 easier access for another. 'ASLR bypass itself is not a vulnerability.'"
 
+# when upgrading, clear CVE list but keep the variables
+CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
+CVE_STATUS_STABLE_BACKPORTS = "\
+    CVE-2026-5435 \
+"
+CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
+
 DEPENDS += "gperf-native bison-native"
 
 NATIVESDKFIXES ?= ""