diff mbox series

[scarthgap] dhcpcd: set status for CVE-2026-56116

Message ID 20261003113837.4008405-1-peter.marko@siemens.com
State New
Headers show
Series [scarthgap] dhcpcd: set status for CVE-2026-56116 | expand

Commit Message

Peter Marko Oct. 3, 2026, 11:38 a.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Patch [1] mentioned as commit fixing this CVE in NVD or Debian reports
is fixing code adding new feature (route advertisment processing) which
is also mentioned in the CVE descripiton.
That was introduced in commit [2] which is v10.0.7 (>10.0.6)

[1] https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0
[2] https://github.com/NetworkConfiguration/dhcpcd/commit/f1cf924ad691bc1e6bf33013407fbf838fa40fbe

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb
index e6854e1c7f2..c32db0adf5d 100644
--- a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb
+++ b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb
@@ -62,3 +62,5 @@  do_install:append () {
 }
 
 FILES:${PN}-dbg += "${libdir}/dhcpcd/dev/.debug"
+
+CVE_STATUS[CVE-2026-56116] = "fixed-version: vulnerability was only introduced in v10.0.7"