diff mbox series

[scarthgap,3/6] libxml2: set CVE_STATUS for CVE-2026-86139

Message ID 20260910200329.842463-3-sdoshi@mvista.com
State New
Headers show
Series [scarthgap,1/6] libxml2: Security Fix for CVE-2026-86137 | expand

Commit Message

Siddharth Sept. 10, 2026, 8:03 p.m. UTC 
From: Siddharth Doshi <sdoshi@mvista.com>

Analysis:
- The patch adds return NULL guard when xmlStrlen returns 0. [1]
- However, in libxml2-2.10.12, an older iteration of the guard clause is present, which was removed in future versions and then added back as patch via CVE-2026-86139.
- Hence, adding the patch as fixed-version.

Reference:
[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-86139

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 meta/recipes-core/libxml/libxml2_2.12.10.bb | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 28ae601118..581f38197f 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -46,6 +46,9 @@  CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail
 # https://gitlab.gnome.org/GNOME/libxml2/-/issues/958
 CVE_STATUS[CVE-2025-8732] = "disputed: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided.  https://gitlab.gnome.org/GNOME/libxml2/-/issues/958"
 
+#The codebase contains an older iteration of the guard clause if (!(len > 0)) return(NULL); which inherently mitigates the len == 0 attack vector described in CVE-2026-86139.
+CVE_STATUS[CVE-2026-86139] = "fixed-version: Length guard safety logic natively present in version 2.12.10 protects against zero-length integer overflows."
+
 BINCONFIG = "${bindir}/xml2-config"
 
 PACKAGECONFIG ??= "python \