@@ -41,4 +41,5 @@ SRC_URI = "\
file://CVE-2026-4647.patch \
file://CVE-2026-6846.patch \
file://CVE-2026-15003.patch \
+ file://CVE-2026-18220.patch \
"
new file mode 100644
@@ -0,0 +1,65 @@
+From 114e3aae2b7e34057c8909301eaf78c15687e8e5 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Sun, 28 Jun 2026 09:11:46 +0930
+Subject: [PATCH] asan: buffer overflow in elf32_dlx_relocate26
+
+ * elf32-dlx.c (elf32_dlx_relocate26): Sanity check reloc offset.
+ (elf32_dlx_relocate16): Likewise.
+ (_bfd_dlx_elf_hi16_reloc): Likewise, and remove ineffective
+ existing check.
+---
+ bfd/elf32-dlx.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=114e3aae2b7e34057c8909301eaf78c15687e8e5]
+CVE: CVE-2026-18220
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+
+diff --git a/bfd/elf32-dlx.c b/bfd/elf32-dlx.c
+index 2dfeb4d7390..0f9a49695d7 100644
+--- a/bfd/elf32-dlx.c
++++ b/bfd/elf32-dlx.c
+@@ -77,6 +77,10 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd,
+ return bfd_reloc_ok;
+ }
+
++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd,
++ input_section, reloc_entry->address))
++ return bfd_reloc_outofrange;
++
+ ret = bfd_reloc_ok;
+
+ if (bfd_is_und_section (symbol->section)
+@@ -89,9 +93,6 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd,
+ relocation += reloc_entry->addend;
+ relocation += bfd_get_16 (abfd, (bfd_byte *)data + reloc_entry->address);
+
+- if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
+- return bfd_reloc_outofrange;
+-
+ bfd_put_16 (abfd, (short)((relocation >> 16) & 0xFFFF),
+ (bfd_byte *)data + reloc_entry->address);
+
+@@ -143,6 +144,10 @@ elf32_dlx_relocate16 (bfd *abfd,
+ return bfd_reloc_undefined;
+ }
+
++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd,
++ input_section, reloc_entry->address))
++ return bfd_reloc_outofrange;
++
+ insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address);
+ allignment = 1 << (input_section->output_section->alignment_power - 1);
+ vallo = insn & 0x0000FFFF;
+@@ -206,6 +211,10 @@ elf32_dlx_relocate26 (bfd *abfd,
+ return bfd_reloc_undefined;
+ }
+
++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd,
++ input_section, reloc_entry->address))
++ return bfd_reloc_outofrange;
++
+ insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address);
+ allignment = 1 << (input_section->output_section->alignment_power - 1);
+ vallo = insn & 0x03FFFFFF;
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-18220 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=114e3aae2b7e34057c8909301eaf78c15687e8e5 Test results: binutils-testsuite 2.46.1 (x86_64-oe-linux) - All tests PASSED binutils: 327 passed, 5 untested, 9 unsupported gas: 2091 passed, 4 unsupported ld: 1899 passed, 7 expected failures, 20 untested, 109 unsupported Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- .../binutils/binutils-2.46.inc | 1 + .../binutils/binutils/CVE-2026-18220.patch | 65 +++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch