diff mbox series

[scarthgap,08/15] glibc: patch CVE-2026-80489

Message ID 20261022224711.3783258-8-peter.marko@siemens.com
State New
Headers show
Series [scarthgap,01/15] glibc: patch CVE-2026-5928 | expand

Commit Message

Marko, Peter Oct. 22, 2026, 10:47 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Pick patch referencing this CVE from 3.41 branch (oldest release
still receiving security updates).

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../glibc/glibc/0038-CVE-2026-80489.patch     | 32 +++++++++++++++++++
 meta/recipes-core/glibc/glibc_2.39.bb         |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch
diff mbox series

Patch

diff --git a/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch b/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch
new file mode 100644
index 00000000000..3ca1c959bb2
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch
@@ -0,0 +1,32 @@ 
+From ec116a0fbedcc860631e525e70b409cf295f27da Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 28 Aug 2026 10:26:07 +0200
+Subject: [PATCH] iconvdata: EUC_JISX0213 decoding lacks pending character
+ reset (CVE-2026-80489)
+
+This fixes bug 34568.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+(cherry picked from commit 4dafa087ff5fe7df45bd37dc727e988da6b8c935)
+
+CVE: CVE-2026-80489
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=ec116a0fbedcc860631e525e70b409cf295f27da]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ iconvdata/euc-jisx0213.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/iconvdata/euc-jisx0213.c b/iconvdata/euc-jisx0213.c
+index 9c3f28da2d..f0305c113a 100644
+--- a/iconvdata/euc-jisx0213.c
++++ b/iconvdata/euc-jisx0213.c
+@@ -224,6 +224,9 @@
+ 	    STANDARD_FROM_LOOP_ERR_HANDLER (1);				      \
+ 	  }								      \
+       }									      \
++    else 								      \
++      /* There was a pending character.  Clear it.  */			      \
++      *statep = 0;							      \
+ 									      \
+     put32 (outptr, ch);							      \
+     outptr += 4;							      \
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 3090b9cd277..bd0b4f06190 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -70,6 +70,7 @@  SRC_URI =  "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
            file://0035-CVE-2026-19542.patch \
            file://0036-CVE-2026-19499.patch \
            file://0037-CVE-2026-77117.patch \
+           file://0038-CVE-2026-80489.patch \
 "
 S = "${WORKDIR}/git"
 B = "${WORKDIR}/build-${TARGET_SYS}"