new file mode 100644
@@ -0,0 +1,133 @@
+From 2beb5ec65a71022cc4d29aed72872d44c8dc05e5 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 16 Sep 2026 15:17:37 +0200
+Subject: [PATCH] ftplistparser: no more overwriting set.write_func
+
+The entries in the 'set' struct should remain as set by the application.
+
+Closes #22969
+
+CVE: CVE-2026-92388
+Upstream-Status: Backport [https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/cw-out.c | 10 ++++++++--
+ lib/ftp-int.h | 5 -----
+ lib/ftp.c | 13 -------------
+ lib/ftplistparser.c | 10 ++++++++++
+ lib/ftplistparser.h | 5 +++++
+ 5 files changed, 23 insertions(+), 20 deletions(-)
+
+diff --git a/lib/cw-out.c b/lib/cw-out.c
+index 0137975b1e..cceebf8c4e 100644
+--- a/lib/cw-out.c
++++ b/lib/cw-out.c
+@@ -147,8 +147,14 @@ static void cw_get_writefunc(struct Curl_easy *data, cw_out_type otype,
+ switch(otype) {
+ case CW_OUT_BODY:
+ case CW_OUT_BODY_0LEN:
+- *pwcb = data->set.fwrite_func;
+- *pwcb_data = data->set.out;
++ if(Curl_ftp_listmode(data)) {
++ *pwcb = Curl_ftp_parselist;
++ *pwcb_data = data;
++ }
++ else {
++ *pwcb = data->set.fwrite_func;
++ *pwcb_data = data->set.out;
++ }
+ *pmax_write = CURL_MAX_WRITE_SIZE;
+ /* if we ever want buffering of BODY output, we can set `min_write`
+ * the preferred size. The default should always be to pass data
+diff --git a/lib/ftp-int.h b/lib/ftp-int.h
+index 8d7e141274..0bf6b9a245 100644
+--- a/lib/ftp-int.h
++++ b/lib/ftp-int.h
+@@ -79,11 +79,6 @@ struct ftp_parselist_data; /* defined later in ftplistparser.c */
+
+ struct ftp_wc {
+ struct ftp_parselist_data *parser;
+-
+- struct {
+- curl_write_callback write_function;
+- FILE *file_descriptor;
+- } backup;
+ };
+
+ /* This FTP struct is used in the Curl_easy. All FTP data that is
+diff --git a/lib/ftp.c b/lib/ftp.c
+index 70bf654bf9..36cc73397f 100644
+--- a/lib/ftp.c
++++ b/lib/ftp.c
+@@ -4017,15 +4017,6 @@ static CURLcode init_wc_data(struct Curl_easy *data,
+ goto fail;
+ }
+
+- /* backup old write_function */
+- ftpwc->backup.write_function = data->set.fwrite_func;
+- /* parsing write function */
+- data->set.fwrite_func = Curl_ftp_parselist;
+- /* backup old file descriptor */
+- ftpwc->backup.file_descriptor = data->set.out;
+- /* let the writefunc callback know the transfer */
+- data->set.out = data;
+-
+ infof(data, "Wildcard - Parsing started");
+ return CURLE_OK;
+
+@@ -4061,10 +4052,6 @@ static CURLcode wc_statemach(struct Curl_easy *data,
+ /* In this state is LIST response successfully parsed, so lets restore
+ previous WRITEFUNCTION callback and WRITEDATA pointer */
+ struct ftp_wc *ftpwc = wildcard->ftpwc;
+- data->set.fwrite_func = ftpwc->backup.write_function;
+- data->set.out = ftpwc->backup.file_descriptor;
+- ftpwc->backup.write_function = ZERO_NULL;
+- ftpwc->backup.file_descriptor = NULL;
+ wildcard->state = CURLWC_DOWNLOADING;
+
+ if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
+diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c
+index 47e3d75d94..2ee5fe3faf 100644
+--- a/lib/ftplistparser.c
++++ b/lib/ftplistparser.c
+@@ -1012,6 +1012,16 @@ static CURLcode parse_winnt(struct Curl_easy *data,
+ return CURLE_OK;
+ }
+
++/* returns TRUE if in wildcard listing mode */
++bool Curl_ftp_listmode(struct Curl_easy *data)
++{
++ if(data->state.wildcardmatch) {
++ struct WildcardData * const wildcard = data->wildcard;
++ return wildcard && (wildcard->state <= CURLWC_MATCHING);
++ }
++ return FALSE;
++}
++
+ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
+ void *connptr)
+ {
+diff --git a/lib/ftplistparser.h b/lib/ftplistparser.h
+index 5d7aa492ba..942e102894 100644
+--- a/lib/ftplistparser.h
++++ b/lib/ftplistparser.h
+@@ -27,6 +27,9 @@
+
+ #ifndef CURL_DISABLE_FTP
+
++/* returns TRUE if in wildcard listing mode */
++bool Curl_ftp_listmode(struct Curl_easy *data);
++
+ /* WRITEFUNCTION callback for parsing LIST responses */
+ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
+ void *connptr);
+@@ -71,6 +74,8 @@ void Curl_wildcard_dtor(struct WildcardData **wcp);
+ struct Curl_easy;
+
+ #else /* CURL_DISABLE_FTP */
++#define Curl_ftp_listmode(x) FALSE
++#define Curl_ftp_parselist ZERO_NULL
+ #define Curl_wildcard_dtor(x)
+ #endif /* !CURL_DISABLE_FTP */
+
new file mode 100644
@@ -0,0 +1,31 @@
+From 318019e91cae747d1d5d85be8556466e6943408f Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 17 Sep 2026 14:32:52 +0200
+Subject: [PATCH] ftplistparser: only use the list parser in CURLWC_MATCHING
+ state
+
+Follow-up to ba8f8a7f27a5c5e1
+
+Closes #22985
+
+CVE: CVE-2026-92388
+Upstream-Status: Backport [https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc9]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/ftplistparser.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c
+index 2ee5fe3faf..77f90c763d 100644
+--- a/lib/ftplistparser.c
++++ b/lib/ftplistparser.c
+@@ -1017,7 +1017,7 @@ bool Curl_ftp_listmode(struct Curl_easy *data)
+ {
+ if(data->state.wildcardmatch) {
+ struct WildcardData * const wildcard = data->wildcard;
+- return wildcard && (wildcard->state <= CURLWC_MATCHING);
++ return wildcard && (wildcard->state == CURLWC_MATCHING);
+ }
+ return FALSE;
+ }
@@ -14,6 +14,8 @@ SRC_URI = " \
file://run-ptest \
file://disable-tests \
file://no-test-timeout.patch \
+ file://CVE-2026-92388-1.patch \
+ file://CVE-2026-92388-2.patch \
"
SRC_URI:append:class-nativesdk = " \
Backport patch to fix CVE-2026-92388. References: https://nvd.nist.gov/vuln/detail/CVE-2026-92388 Upstream fix: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212 https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc9 Tested with ptest: Before: PASSED: 980, FAILED: 0, SKIPPED: 0, ABORTED: 0 After: PASSED: 980, FAILED: 0, SKIPPED: 0, ABORTED: 0 Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> --- .../curl/curl/CVE-2026-92388-1.patch | 133 ++++++++++++++++++ .../curl/curl/CVE-2026-92388-2.patch | 31 ++++ meta/recipes-support/curl/curl_8.22.0.bb | 2 + 3 files changed, 166 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-2.patch