new file mode 100644
@@ -0,0 +1,87 @@
+From ff3c83475ac303c6b681c52ad0b6e14795a8e0ce Mon Sep 17 00:00:00 2001
+From: Denis Ovsienko <denis@ovsienko.info>
+Date: Thu, 30 Jul 2026 13:34:33 +0100
+Subject: [PATCH] CVE-2026-6554: Limit "ja L" looping in pcap_offline_filter().
+
+This vulnerability has been discovered by Kaixuan LI.
+
+The current revision of pcapint_filter_with_aux_data() assumes that any
+"ja L" instruction in a filter program does not jump to itself or to a
+prior instruction that is guaranteed to reach the same "ja L" again.
+This holds for programs that have been generated by libpcap.
+
+However, this does not necessarily hold for programs that come from an
+external source via pcap_offline_filter() or [deprecated] bpf_filter().
+If the interpreter executes such a program, upon reaching such an
+instruction it will begin looping infinitely.
+
+To mitigate this problem, in pcapint_filter_with_aux_data() enforce a
+hard-coded limit on the number of backward jumps per packet. Ibid., and
+in pcapint_validate_filter() as well, reject the only immediately
+detectable case of an infinite loop.
+
+(backported from commit 63c005c25aeabf1404968add49fc885da3e127e0)
+
+(cherry picked from commit ff3c83475ac303c6b681c52ad0b6e14795a8e0ce)
+
+Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce]
+CVE: CVE-2026-6554
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+diff --git a/bpf_filter.c b/bpf_filter.c
+index df92c433..ae8a3a36 100644
+--- a/bpf_filter.c
++++ b/bpf_filter.c
+@@ -72,6 +72,8 @@ enum {
+ BPF_S_ANC_VLAN_TAG_PRESENT,
+ };
+
++#define MAX_BACKWARD_JUMPS 64U
++
+ /*
+ * Kernel BPF implementations tend to define BPF_MAXINSNS to 512 or 4096, the
+ * userland interpreter in libpcap is meant to support much longer filter
+@@ -146,6 +148,7 @@ pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen,
+ A = 0;
+ X = 0;
+ const struct bpf_insn *pc0 = pc;
++ unsigned backward_jumps = 0;
+ --pc;
+ for (;;) {
+ ++pc;
+@@ -320,6 +323,17 @@ DIAG_ON_DEFAULT_ONLY_SWITCH
+ */
+ if ((bpf_u_int32)(pc - pc0) + 1 + pc->k >= proglen)
+ return 0;
++ /*
++ * Terminate the program if this is a non-forward jump
++ * and is:
++ * - a guaranteed infinite loop because it jumps to
++ * itself (exactly the same as in the validator), or
++ * - a backward jump after many enough backward jumps
++ * already made for this packet.
++ */
++ if ((bpf_int32)pc->k < 0 && ((bpf_int32)pc->k == -1 ||
++ backward_jumps++ >= MAX_BACKWARD_JUMPS))
++ return 0;
+ /*
+ * XXX - we currently implement "ip6 protochain"
+ * with backward jumps, so sign-extend pc->k.
+@@ -607,6 +621,17 @@ pcap_validate_filter(const struct bpf_insn *f, int len)
+ */
+ if (from + p->k >= (u_int)len)
+ return 0;
++ /*
++ * The only type of infinite loop that can be
++ * detected in this function is a "ja L" that
++ * jumps to itself. For this only k == -1
++ * needs to be tested because the check above
++ * has already rejected all other values that
++ * would wrap the pointer equivalently on
++ * 32-bit architectures.
++ */
++ if ((bpf_int32)p->k == -1)
++ return 0;
+ break;
+ case BPF_JEQ:
+ case BPF_JGT:
@@ -21,6 +21,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \
file://02-CVE-2026-31912.patch \
file://03-CVE-2026-31911.patch \
file://04-CVE-2026-6244.patch \
+ file://05-CVE-2026-6554.patch \
"
SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f"
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-6554 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> --- .../libpcap/libpcap/05-CVE-2026-6554.patch | 87 +++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 88 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/05-CVE-2026-6554.patch