new file mode 100644
@@ -0,0 +1,142 @@
+From 056e37ce04bd4d599dd014d305963d2194e30026 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 16 Sep 2026 15:17:37 +0200
+Subject: [PATCH] ftplistparser: no more overwriting set.write_func
+
+The entries in the 'set' struct should remain as set by the application.
+
+Closes #22969
+
+Conflicts Resolved:
+
+lib/ftp-int.h (1 conflict):
+- File does not exist in this branch; struct ftp_wc with its backup
+ member lives in lib/ftp.h instead. Applied the same removal of the
+ backup member to lib/ftp.h.
+
+Assisted-by: kiro:claude-sonnet-5
+
+CVE: CVE-2026-92388
+Upstream-Status: Backport [https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212b90b35a93559163e]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/cw-out.c | 10 ++++++++--
+ lib/ftp.c | 13 -------------
+ lib/ftp.h | 5 -----
+ lib/ftplistparser.c | 10 ++++++++++
+ lib/ftplistparser.h | 5 +++++
+ 5 files changed, 23 insertions(+), 20 deletions(-)
+
+diff --git a/lib/cw-out.c b/lib/cw-out.c
+index 554c32e84e..2500ea8ab3 100644
+--- a/lib/cw-out.c
++++ b/lib/cw-out.c
+@@ -148,8 +148,14 @@ static void cw_get_writefunc(struct Curl_easy *data, cw_out_type otype,
+ switch(otype) {
+ case CW_OUT_BODY:
+ case CW_OUT_BODY_0LEN:
+- *pwcb = data->set.fwrite_func;
+- *pwcb_data = data->set.out;
++ if(Curl_ftp_listmode(data)) {
++ *pwcb = Curl_ftp_parselist;
++ *pwcb_data = data;
++ }
++ else {
++ *pwcb = data->set.fwrite_func;
++ *pwcb_data = data->set.out;
++ }
+ *pmax_write = CURL_MAX_WRITE_SIZE;
+ /* if we ever want buffering of BODY output, we can set `min_write`
+ * the preferred size. The default should always be to pass data
+diff --git a/lib/ftp.c b/lib/ftp.c
+index 6047759e78..6b13fb6629 100644
+--- a/lib/ftp.c
++++ b/lib/ftp.c
+@@ -3988,15 +3988,6 @@ static CURLcode init_wc_data(struct Curl_easy *data,
+ goto fail;
+ }
+
+- /* backup old write_function */
+- ftpwc->backup.write_function = data->set.fwrite_func;
+- /* parsing write function */
+- data->set.fwrite_func = Curl_ftp_parselist;
+- /* backup old file descriptor */
+- ftpwc->backup.file_descriptor = data->set.out;
+- /* let the writefunc callback know the transfer */
+- data->set.out = data;
+-
+ infof(data, "Wildcard - Parsing started");
+ return CURLE_OK;
+
+@@ -4032,10 +4023,6 @@ static CURLcode wc_statemach(struct Curl_easy *data,
+ /* In this state is LIST response successfully parsed, so lets restore
+ previous WRITEFUNCTION callback and WRITEDATA pointer */
+ struct ftp_wc *ftpwc = wildcard->ftpwc;
+- data->set.fwrite_func = ftpwc->backup.write_function;
+- data->set.out = ftpwc->backup.file_descriptor;
+- ftpwc->backup.write_function = ZERO_NULL;
+- ftpwc->backup.file_descriptor = NULL;
+ wildcard->state = CURLWC_DOWNLOADING;
+
+ if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
+diff --git a/lib/ftp.h b/lib/ftp.h
+index 20b360033e..b1d3706db2 100644
+--- a/lib/ftp.h
++++ b/lib/ftp.h
+@@ -85,11 +85,6 @@ struct ftp_parselist_data; /* defined later in ftplistparser.c */
+
+ struct ftp_wc {
+ struct ftp_parselist_data *parser;
+-
+- struct {
+- curl_write_callback write_function;
+- FILE *file_descriptor;
+- } backup;
+ };
+
+ typedef enum {
+diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c
+index f82895d57a..9c7ad6e9a0 100644
+--- a/lib/ftplistparser.c
++++ b/lib/ftplistparser.c
+@@ -1010,6 +1010,16 @@ static CURLcode parse_winnt(struct Curl_easy *data,
+ return CURLE_OK;
+ }
+
++/* returns TRUE if in wildcard listing mode */
++bool Curl_ftp_listmode(struct Curl_easy *data)
++{
++ if(data->state.wildcardmatch) {
++ struct WildcardData * const wildcard = data->wildcard;
++ return wildcard && (wildcard->state <= CURLWC_MATCHING);
++ }
++ return FALSE;
++}
++
+ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
+ void *connptr)
+ {
+diff --git a/lib/ftplistparser.h b/lib/ftplistparser.h
+index 5d7aa492ba..942e102894 100644
+--- a/lib/ftplistparser.h
++++ b/lib/ftplistparser.h
+@@ -27,6 +27,9 @@
+
+ #ifndef CURL_DISABLE_FTP
+
++/* returns TRUE if in wildcard listing mode */
++bool Curl_ftp_listmode(struct Curl_easy *data);
++
+ /* WRITEFUNCTION callback for parsing LIST responses */
+ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
+ void *connptr);
+@@ -71,6 +74,8 @@ void Curl_wildcard_dtor(struct WildcardData **wcp);
+ struct Curl_easy;
+
+ #else /* CURL_DISABLE_FTP */
++#define Curl_ftp_listmode(x) FALSE
++#define Curl_ftp_parselist ZERO_NULL
+ #define Curl_wildcard_dtor(x)
+ #endif /* !CURL_DISABLE_FTP */
+
new file mode 100644
@@ -0,0 +1,31 @@
+From 5f8207e667910351d7d5883910eac80f5b215b12 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 17 Sep 2026 14:32:52 +0200
+Subject: [PATCH] ftplistparser: only use the list parser in CURLWC_MATCHING
+ state
+
+Follow-up to ba8f8a7f27a5c5e1
+
+Closes #22985
+
+CVE: CVE-2026-92388
+Upstream-Status: Backport [https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc992e77b5f665d4]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/ftplistparser.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c
+index 9c7ad6e9a0..91b24251c9 100644
+--- a/lib/ftplistparser.c
++++ b/lib/ftplistparser.c
+@@ -1015,7 +1015,7 @@ bool Curl_ftp_listmode(struct Curl_easy *data)
+ {
+ if(data->state.wildcardmatch) {
+ struct WildcardData * const wildcard = data->wildcard;
+- return wildcard && (wildcard->state <= CURLWC_MATCHING);
++ return wildcard && (wildcard->state == CURLWC_MATCHING);
+ }
+ return FALSE;
+ }
@@ -40,6 +40,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-9546-02.patch \
file://CVE-2026-80230.patch \
file://CVE-2026-87864.patch \
+ file://CVE-2026-92388-1.patch \
+ file://CVE-2026-92388-2.patch \
"
SRC_URI:append:class-nativesdk = " \
Backport patch to fix CVE-2026-92388. References: https://nvd.nist.gov/vuln/detail/CVE-2026-92388 Upstream fix: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212 https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc9 Tested with ptest: Before: PASSED: 1006, FAILED: 0, SKIPPED: 0, ABORTED: 0 After: PASSED: 1006, FAILED: 0, SKIPPED: 0, ABORTED: 0 Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> --- .../curl/curl/CVE-2026-92388-1.patch | 142 ++++++++++++++++++ .../curl/curl/CVE-2026-92388-2.patch | 31 ++++ meta/recipes-support/curl/curl_8.19.0.bb | 2 + 3 files changed, 175 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-2.patch