new file mode 100644
@@ -0,0 +1,151 @@
+From c6624e91bc9e8726b3cc45692ec0834650719a15 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 16 Sep 2026 15:17:37 +0200
+Subject: [PATCH] ftplistparser: no more overwriting set.write_func
+
+The entries in the 'set' struct should remain as set by the application.
+
+Closes #22969
+
+Backport notes for curl 8.7.1:
+- lib/cw-out.c: no CW_OUT_BODY_0LEN in 8.7.1; listmode handling applied
+ to CW_OUT_BODY only. Added #include "ftplistparser.h".
+- lib/ftplistparser.c: context conflict only; added Curl_ftp_listmode().
+- lib/ftplistparser.h: added Curl_ftp_listmode()/Curl_ftp_parselist
+ stubs to the existing CURL_DISABLE_FTP #else branch.
+- lib/ftp-int.h: does not exist in 8.7.1 (struct ftp_wc is in lib/ftp.h).
+ The now-unused ftp_wc.backup member is removed from lib/ftp.h instead.
+
+Assisted-by: kiro:claude-sonnet-5
+
+CVE: CVE-2026-92388
+Upstream-Status: Backport [https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212]
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/cw-out.c | 11 +++++++++--
+ lib/ftp.c | 13 -------------
+ lib/ftp.h | 5 -----
+ lib/ftplistparser.c | 10 ++++++++++
+ lib/ftplistparser.h | 5 +++++
+ 5 files changed, 24 insertions(+), 20 deletions(-)
+
+diff --git a/lib/cw-out.c b/lib/cw-out.c
+index c168837817..e1527f475e 100644
+--- a/lib/cw-out.c
++++ b/lib/cw-out.c
+@@ -32,6 +32,7 @@
+ #include "multiif.h"
+ #include "sendf.h"
+ #include "cw-out.h"
++#include "ftplistparser.h"
+
+ /* The last 3 #include files should be in this order */
+ #include "curl_printf.h"
+@@ -166,8 +167,14 @@ static void cw_get_writefunc(struct Curl_easy *data, cw_out_type otype,
+ {
+ switch(otype) {
+ case CW_OUT_BODY:
+- *pwcb = data->set.fwrite_func;
+- *pwcb_data = data->set.out;
++ if(Curl_ftp_listmode(data)) {
++ *pwcb = Curl_ftp_parselist;
++ *pwcb_data = data;
++ }
++ else {
++ *pwcb = data->set.fwrite_func;
++ *pwcb_data = data->set.out;
++ }
+ *pmax_write = CURL_MAX_WRITE_SIZE;
+ /* if we ever want buffering of BODY output, we can set `min_write`
+ * the preferred size. The default should always be to pass data
+diff --git a/lib/ftp.c b/lib/ftp.c
+index 5bbdeb0540..3ab395cee8 100644
+--- a/lib/ftp.c
++++ b/lib/ftp.c
+@@ -3949,15 +3949,6 @@ static CURLcode init_wc_data(struct Curl_easy *data)
+ goto fail;
+ }
+
+- /* backup old write_function */
+- ftpwc->backup.write_function = data->set.fwrite_func;
+- /* parsing write function */
+- data->set.fwrite_func = Curl_ftp_parselist;
+- /* backup old file descriptor */
+- ftpwc->backup.file_descriptor = data->set.out;
+- /* let the writefunc callback know the transfer */
+- data->set.out = data;
+-
+ infof(data, "Wildcard - Parsing started");
+ return CURLE_OK;
+
+@@ -3992,10 +3983,6 @@ static CURLcode wc_statemach(struct Curl_easy *data)
+ /* In this state is LIST response successfully parsed, so lets restore
+ previous WRITEFUNCTION callback and WRITEDATA pointer */
+ struct ftp_wc *ftpwc = wildcard->ftpwc;
+- data->set.fwrite_func = ftpwc->backup.write_function;
+- data->set.out = ftpwc->backup.file_descriptor;
+- ftpwc->backup.write_function = ZERO_NULL;
+- ftpwc->backup.file_descriptor = NULL;
+ wildcard->state = CURLWC_DOWNLOADING;
+
+ if(Curl_ftp_parselist_geterror(ftpwc->parser)) {
+diff --git a/lib/ftp.h b/lib/ftp.h
+index 977fc883b1..7e6097af8f 100644
+--- a/lib/ftp.h
++++ b/lib/ftp.h
+@@ -87,11 +87,6 @@ struct ftp_parselist_data; /* defined later in ftplistparser.c */
+
+ struct ftp_wc {
+ struct ftp_parselist_data *parser;
+-
+- struct {
+- curl_write_callback write_function;
+- FILE *file_descriptor;
+- } backup;
+ };
+
+ typedef enum {
+diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c
+index 82f1ea00d3..eae799ff3b 100644
+--- a/lib/ftplistparser.c
++++ b/lib/ftplistparser.c
+@@ -361,6 +361,16 @@ static CURLcode ftp_pl_insert_finfo(struct Curl_easy *data,
+
+ #define MAX_FTPLIST_BUFFER 10000 /* arbitrarily set */
+
++/* returns TRUE if in wildcard listing mode */
++bool Curl_ftp_listmode(struct Curl_easy *data)
++{
++ if(data->state.wildcardmatch) {
++ struct WildcardData * const wildcard = data->wildcard;
++ return wildcard && (wildcard->state <= CURLWC_MATCHING);
++ }
++ return FALSE;
++}
++
+ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
+ void *connptr)
+ {
+diff --git a/lib/ftplistparser.h b/lib/ftplistparser.h
+index 5ba1f6a97d..115f916f60 100644
+--- a/lib/ftplistparser.h
++++ b/lib/ftplistparser.h
+@@ -27,6 +27,9 @@
+
+ #ifndef CURL_DISABLE_FTP
+
++/* returns TRUE if in wildcard listing mode */
++bool Curl_ftp_listmode(struct Curl_easy *data);
++
+ /* WRITEFUNCTION callback for parsing LIST responses */
+ size_t Curl_ftp_parselist(char *buffer, size_t size, size_t nmemb,
+ void *connptr);
+@@ -72,6 +75,8 @@ struct Curl_easy;
+
+ #else
+ /* FTP is disabled */
++#define Curl_ftp_listmode(x) FALSE
++#define Curl_ftp_parselist ZERO_NULL
+ #define Curl_wildcard_dtor(x)
+ #endif /* CURL_DISABLE_FTP */
+ #endif /* HEADER_CURL_FTPLISTPARSER_H */
new file mode 100644
@@ -0,0 +1,30 @@
+From 8d0e0470e1eddf23a2d5c8f613e2a6d662a4b977 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 17 Sep 2026 14:32:52 +0200
+Subject: [PATCH] ftplistparser: only use the list parser in CURLWC_MATCHING
+ state
+
+Follow-up to ba8f8a7
+
+Closes #22985
+
+CVE: CVE-2026-92388
+Upstream-Status: Backport [https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc9]
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/ftplistparser.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/ftplistparser.c b/lib/ftplistparser.c
+index eae799ff3b..daf7f06467 100644
+--- a/lib/ftplistparser.c
++++ b/lib/ftplistparser.c
+@@ -366,7 +366,7 @@ bool Curl_ftp_listmode(struct Curl_easy *data)
+ {
+ if(data->state.wildcardmatch) {
+ struct WildcardData * const wildcard = data->wildcard;
+- return wildcard && (wildcard->state <= CURLWC_MATCHING);
++ return wildcard && (wildcard->state == CURLWC_MATCHING);
+ }
+ return FALSE;
+ }
@@ -43,6 +43,8 @@ SRC_URI = " \
file://CVE-2026-4873.patch \
file://CVE-2026-13608.patch \
file://CVE-2026-8286.patch \
+ file://CVE-2026-92388-1.patch \
+ file://CVE-2026-92388-2.patch \
"
SRC_URI:append:class-nativesdk = " \
Backport patch to fix CVE-2026-92388. References: https://nvd.nist.gov/vuln/detail/CVE-2026-92388 Upstream fix: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212 https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc9 Tested with ptest: Before: PASSED: 857, FAILED: 0, SKIPPED: 0, ABORTED: 0 After: PASSED: 857, FAILED: 0, SKIPPED: 0, ABORTED: 0 Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> --- .../curl/curl/CVE-2026-92388-1.patch | 151 ++++++++++++++++++ .../curl/curl/CVE-2026-92388-2.patch | 30 ++++ meta/recipes-support/curl/curl_8.7.1.bb | 2 + 3 files changed, 183 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-1.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388-2.patch