new file mode 100644
@@ -0,0 +1,66 @@
+From 46014ec220989897d7ea53ccc780cea767cc0862 Mon Sep 17 00:00:00 2001
+From: Yves Orton <demerphq@gmail.com>
+Date: Fri, 7 Feb 2025 10:06:10 +0100
+Subject: [PATCH] regexec.c - Fix GH 22892 - AHO-CORASICK edge case issue
+
+In some circumstances the AHO-CORASICK logic wasn't matching properly
+when there were two possibilities whose proper prefix matches a proper
+suffix of a third possibilty, and one of those possibilities was shorter
+than the other.
+
+This was because we were NOT resetting the 'failed' flag properly.
+This bug must be rare because it took more than a decade for anyone
+to notice.
+
+This patch fixes the problem by resetting the failed flag after a
+successful transition.
+
+A good example of this problem is as follows:
+
+ "ABCDE" =~ m/ABCF|BCDE|C/
+
+This should match 'BCDE' and not 'C'. Because of the flag issue we were
+matching 'C' instead.
+
+This fixes https://github.com/Perl/perl5/issues/22892
+
+Note: t/re/re_tests hunk adjusted for 5.38.4 context (line numbers and
+surrounding test data differ from upstream which targets a newer perl).
+
+Upstream-Status: Backport [https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb]
+CVE: CVE-2026-19487
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ regexec.c | 1 +
+ t/re/re_tests | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/regexec.c b/regexec.c
+index e96b622..1eb59bb 100644
+--- a/regexec.c
++++ b/regexec.c
+@@ -3406,6 +3406,7 @@ S_find_byclass(pTHX_ regexp * prog, const regnode *c, char *s,
+ {
+ DEBUG_TRIE_EXECUTE_r(
+ Perl_re_printf( aTHX_ " - legal\n"));
++ failed = 0;
+ state = tmp;
+ break;
+ }
+diff --git a/t/re/re_tests b/t/re/re_tests
+index 10da625..eefa579 100644
+--- a/t/re/re_tests
++++ b/t/re/re_tests
+@@ -2157,6 +2157,12 @@ AB\s+\x{100} AB \x{100}X y - -
+ /^(xa|(?:[Z=])*\1a){2}$/ xa=xaaa n - - # GH 10073 - RT72020
+ /^(xa|(?:[Z=]|zzzz)*\1a){2}$/ xa=xaaa n - - # GH 10073 - RT72020
+
++ABCF|BCDE|C ABCDEX y $& BCDE - # GH 22892 - AHO-CORASICK bug
++ABCF|BCDE|C ABCDX y $& C - # GH 22892 - AHO-CORASICK bug
++ABCF|BCDE|C(G) ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug
++ABCF|BCDE|C[Gg] ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug
++ABCF|BCD[Ee]|C[Gg] ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug
++
+ # Keep these lines at the end of the file
+ # pat string y/n/etc expr expected-expr skip-reason comment
+ # vim: softtabstop=0 noexpandtab
@@ -20,6 +20,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \
file://0001-Fix-intermittent-failure-of-test-t-op-sigsystem.t.patch \
file://CVE-2026-8376-01.patch \
file://CVE-2026-8376-02.patch \
+ file://CVE-2026-19487.patch \
"
SRC_URI:append:class-native = " \
file://perl-configpm-switch.patch \
Backport fix for CVE-2026-19487 - AHO-CORASICK regex engine bug Includes 5 regression test cases in t/re/re_tests. Tested by running re/pat.t on qemux86-64 target: 1267/1267 tests passed (only pre-existing TODOs as expected failures). NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19487 Upstream-commit: https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- .../perl/files/CVE-2026-19487.patch | 66 +++++++++++++++++++ meta/recipes-devtools/perl/perl_5.38.4.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-19487.patch