@@ -63,6 +63,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2026-78410-02.patch \
file://CVE-2026-78410-03.patch \
file://CVE-2026-76642.patch \
+ file://CVE-2026-53615.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
new file mode 100644
@@ -0,0 +1,109 @@
+From 05c2dbadf34cc74192287f377904afaaf4061623 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Wed, 25 Mar 2026 11:54:28 +0100
+Subject: [PATCH] libblkid: dos: validate EBR data and links within extended
+ partition
+
+The parse_dos_extended() function processes EBR (Extended Boot Record)
+chains, but does not properly validate that partitions and links stay
+within the master extended partition area [ex_start, ex_start+ex_size).
+
+For EBR data partitions at index 0 and 1, there are no bounds checks
+at all, unlike entries at index 2 and 3. This allows a crafted disk
+image to register partitions at arbitrary sectors via uint32_t overflow
+in the abs_start calculation (cur_start + start wraps to a small value).
+
+Fix by:
+ - using 64-bit arithmetic for the abs_start calculation to avoid
+ uint32_t wraparound
+ - applying the extended partition area bounds check to all EBR data
+ entries, not just index >= 2
+ - validating EBR link targets stay within the extended area and
+ advance forward (preventing backward links that could loop)
+
+Reported-by: Michele Piccinni <piccinni.michele@gmail.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit e9d544d013267ea86b70ee8ff78abd280e6641af)
+
+CVE: CVE-2026-53615
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libblkid/src/partitions/dos.c | 38 +++++++++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 8 deletions(-)
+
+diff --git a/libblkid/src/partitions/dos.c b/libblkid/src/partitions/dos.c
+index d5a8aa3ae..5c78aac21 100644
+--- a/libblkid/src/partitions/dos.c
++++ b/libblkid/src/partitions/dos.c
+@@ -46,6 +46,7 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab,
+ {
+ blkid_partlist ls = blkid_probe_get_partlist(pr);
+ uint32_t cur_start = ex_start, cur_size = ex_size;
++ uint64_t ex_end = (uint64_t) ex_start + ex_size;
+ unsigned char *data;
+ int ct_nodata = 0; /* count ext.partitions without data partitions */
+ int i;
+@@ -88,24 +89,31 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab,
+ /* Parse data partition */
+ for (p = p0, i = 0; i < 4; i++, p++) {
+ uint32_t abs_start;
++ uint64_t abs;
+ blkid_partition par;
+
+ /* the start is relative to the parental ext.partition */
+ start = dos_partition_get_start(p) * ssf;
+ size = dos_partition_get_size(p) * ssf;
+- abs_start = cur_start + start; /* absolute start */
+
+ if (!size || is_extended(p))
+ continue;
++
++ abs = (uint64_t) cur_start + start;
++
++ /* data partition must be within the extended area */
++ if (abs < ex_start || abs + size > ex_end) {
++ DBG(LOWPROBE, ul_debug("#%d: EBR data partition outside "
++ "extended -- ignore", i + 1));
++ continue;
++ }
++ abs_start = (uint32_t) abs;
++
+ if (i >= 2) {
+- /* extra checks to detect real data on
++ /* extra check to detect real data on
+ * 3rd and 4th entries */
+ if (start + size > cur_size)
+ continue;
+- if (abs_start < ex_start)
+- continue;
+- if (abs_start + size > ex_start + ex_size)
+- continue;
+ }
+
+ /* Avoid recursive non-empty links, see ct_nodata counter */
+@@ -142,8 +150,22 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab,
+ if (i == 4)
+ goto leave;
+
+- cur_start = ex_start + start;
+- cur_size = size;
++ {
++ uint64_t next = (uint64_t) ex_start + start;
++
++ if (next + size > ex_end) {
++ DBG(LOWPROBE, ul_debug("EBR link outside "
++ "extended area -- leave"));
++ goto leave;
++ }
++ if (next <= cur_start) {
++ DBG(LOWPROBE, ul_debug("EBR link does not "
++ "advance -- leave"));
++ goto leave;
++ }
++ cur_start = (uint32_t) next;
++ cur_size = size;
++ }
+ }
+ leave:
+ return BLKID_PROBE_OK;