From patchwork Wed Nov 4 10:41:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 102884 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from AS8PR04CU009.outbound.protection.outlook.com (AS8PR04CU009.outbound.protection.outlook.com [52.101.70.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6417.1793788908801517273 for ; Wed, 04 Nov 2026 02:41:49 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=txU27JlY; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.70.43, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=baS1/RPDQmmkn2OQYTh/LUtdSnIQQvSwoHdmsIbdCTYxSVhHP+CuFrYeJWSJx4QGZjaRiSNOu/RUtSJtElverYm42UJwUEInPfntH5a20Q3jGPzQNZl4Fl+3/S9Q9trhq1y3Ko4vHa1DWeFLLy/HNtbRrUg4M6grcbHgztbRSqcx9gFxLufEeG9N5wF9YeVKQ6HGNuSMZVDHTR2O5uAkrnKJT4TFjUr/5dhFip4gjHEyvNSuzHTHImcvTwUX6WOmKFIe+bq0JYRBSla6uSB/39NWNqyV6+t8I52pLDLeOL3NNypC7EoBmyLmHJCJyX+0rL0bDUarz9j42o4a4ikFdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ykcDBRSt2FwS+u0YojyS/WV7XQRLg8u3c6DSjnXbawY=; b=AeOun87lREEZGTICspz3tvNGHlP2cBiCgH68Y/QkxmgBC9pa2zo+Z3OSs1zxWRkW1gaRyYK+LhLVb6ARL6wuMpZd+LFLp+43LYUXavjRFkz/hVQ11PKhIPgnc8QJRZkIHvaD2Q+PkTYRYZVAofWf656moLqIPAz6DsCsdPXq+imJm3dZivXu1quxGQIoijCzA+zvZGB2S/Ho40o+98mtIplR2daZDjsn79p0KjVJbW2K5ras3zDl/o9A6eyr0J/ozgPm5tDybGI8BQf8u6xBt/4QOye+86ZeHSUpELUQr4taErktWyYrN5q5AlcjQEkw4aS1OsWSLaitD89/OCSKIA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ykcDBRSt2FwS+u0YojyS/WV7XQRLg8u3c6DSjnXbawY=; b=txU27JlYbdITQ3AUNJXXoVpS/K9yvXmQRIhCIZ60Mtz7YM8Ga13OzahYkDKYCbMUiattybRi0vavO0BK2refn2pHYMD0uYSi5YhlQNeHusZ6NyGoj6MqYGB2GlmBlciUSJag33bOGawfFeIJDP+qYQPA8f8gmicraJpJ+fYY8UoC2fkAC0MZfaaWWqiZaVyrfuJa9hYDpkdWHQXZDAIa7pjzPXnFFO6KnTx6deLrDOvLmqIo8o2wguRQbSWttxmj8OWF0gSL254yjYKR8nlvyBBTkNr20TmduCe3BZGL1TtTkG3fGwF9TgdfNyiDoMD1Y8IPyRonY1irI7hPukqgdA== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AM9PR07MB7281.eurprd07.prod.outlook.com (2603:10a6:20b:2c4::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.9; Wed, 4 Nov 2026 10:41:44 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0592.009; Wed, 4 Nov 2026 10:41:43 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH] Backport patch to fix CVE-2026-12087. Thread-Topic: [wrynose][PATCH] Backport patch to fix CVE-2026-12087. Thread-Index: AQHdbEkV8nzaZpjoFE6C1fkWDi1/EQ== Date: Wed, 4 Nov 2026 10:41:43 +0000 Message-ID: <20261104104137.2043865-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AM9PR07MB7281:EE_ x-ms-office365-filtering-correlation-id: 30474998-70a0-4d1c-b5c0-08df3a6037e9 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|376014|38070700021|260925022911599003|260925021911599003|260925021311599003|11063799006|56012099006|261021121427099003|261009223027099003|261021123027099003|261102123227099003|261026140227099003|261026121527099003|261028144727099003|261022105027099003|10067099003|12006099003|18002099003|6133799003|13003099007; x-microsoft-antispam-message-info: Me2hKmwSNujtvAyTr0/Ny5dTJcLOatjFatAqpl+gIpc7J+YWlhzGAzlPoQIurZT98DADHOJdxdW3/naY4ATsXQQ/BdMHTMp7WHF/Sql+s1DRDkg0x5DAgOyBD+MUpC5ppKJD5d83znwkKmW1DP8fBoqxOEhsKUSAnMSaFKrNl6hCYKVRWeEVXk/sHe00T6lWoeTemFkCuGG9SjVtbdJyepjEfvfZj9pq6dRxcT3oTkM7HlgvxpnzVppbX7czar3qKpl3adXUgDuBOR5OZdg2hYU+/L1yq4Bsisaq56cjgcLPbQXYqS19mXUflz7qRmyhXGNZYQF42fpqK1kAsOKGualS96Wy/9ANAIXaCX7H9NE9GTNZeUAHWUflLYyIHfh2VOn07Fggi5YeDqTt2/cT9b6ORXlZMtBukjEYZArQyIivChDE0+jLfErr8OGud2OO7NQd+JngTEqutMXvVF2YbXe+FRNZ8JgZbhXHQkNLGdGg7X/PuNNgfFYssbj8eHSc+UNxHPdWxx5V73+MUu6ZBlCU7j6tkrShVC+YzT3yDwqk7gmPD/aOGj0sXYpsyTCokm8lEGBhwhTWy17/9w265G3eZHS7N/Cv6GEiyPWY909V/nfDU+uZY5nJoIpU0sRqkOKTakEM4MdvL8WirkJVEYrB/oDKoolpy1aqfozMHIY= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(376014)(38070700021)(260925022911599003)(260925021911599003)(260925021311599003)(11063799006)(56012099006)(261021121427099003)(261009223027099003)(261021123027099003)(261102123227099003)(261026140227099003)(261026121527099003)(261028144727099003)(261022105027099003)(10067099003)(12006099003)(18002099003)(6133799003)(13003099007);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?XqydKc0YdItHNol5HjK/NmzwC1r3?= =?utf-8?q?GVzgN2oKd5fFaxCABut+M/+NOU1PU0c/ZkoI7nhCXc0MYocA277KIOnxnKfi2qjXk?= =?utf-8?q?b0YOsH+eWyvis99ZTPnn1/D+LAVuFEZwwtkaLjBzLMI0BtmBSYlV4RVpKsS3MHhsJ?= =?utf-8?q?BJvzlVUb3E+eFu55TeDjQI/t4Wx7s3ySHV21t/YeIhs0QxutWYyPB0+QPog8NTxEN?= =?utf-8?q?JHLVrfbJHKA03GOsb0BnsNEOJM3Plac98WKjhGMNAgT6SL99ZOQmbpu6cjv6Z1jrW?= =?utf-8?q?pbGtLyS+7XC2McXD7z8TnoK7hNysATa0IZ10KV8M+f/aY3qQEiGGspFbtOlbltOGM?= =?utf-8?q?6kilsxmRfzWN9D9jVp+y9s2Mw90gpXNo/pxfwwt4nKMyTTkodgQmbR0ToM59q59ox?= =?utf-8?q?/J7SZEtCO/OiDFTzpQlK31kWfHGf4rNfwAAyrUfXzj27rx0Dr/EgWoCACC933p1+x?= =?utf-8?q?0mpZAfk91LXrVGCUSa7Sdg/pBvvGLCg/5XX2EHEaRxTUjJI9w7ccXE8YpO1xFVOib?= =?utf-8?q?eZGAdP9S9cSJmQCGZ5NcMloSrdKbipB1C0PYsdtlu9jjaBbn65juDq4pC0fcuqTQf?= =?utf-8?q?VwHHs3TXYggJW6JLGgBKNck5aejYshSjybIdnYEVCEWuzXTDiRVYMrKT4zMit1OgX?= =?utf-8?q?neCQCfIniB4gxBI2W/QNAkRsSA4Y42RyUuyla199q5k3Q2jcQQ8cJb3ZIBubhKCI9?= =?utf-8?q?BTGd8VRhAxYnI8pnGwF+OtFEA1Yqr0/WM0rVHL6Hi1nQVPiWr8nMjhI0G4oSSliN6?= =?utf-8?q?SYq3SLQNdEtL+E2eeUofYQCZVMFqjsg0HAI4Gid5S6SqS4fz2Ld0syJL5b8acGwcD?= =?utf-8?q?5csGjPhoPe+KTuJzuM14Ja+ZiDqqTQI1zDiRscvZ7zjAZEMurq0n13wVklN3Ci3Pn?= =?utf-8?q?2mFhJC7fxL7DcM9oOlfypJM3iUWYA9wsabUiHasDbqh8gLMPBB4LtJqPyQhiUkORi?= =?utf-8?q?Zgclmioqahl+3tKZWqbkn+ok9LcfSRHryG0cLnBIBSvfwoc2QkU2U136ioTDxBLY1?= =?utf-8?q?JZeA/ycCDaGEd0NK2ktaCXcEsgC801ef4VSDlawK0UwEpMesrvrqSR9SI1Gq1OL17?= =?utf-8?q?nWE4X2Ws+KLbzHCiO+JSC+4kEthCRksIw373TWyUyYmWtI82GBmwdFydbZ8z9elxG?= =?utf-8?q?hYW3YU0r97fw0JYfY4Cfukd01uhzTp12AZQCxs2kIUhpmLBkGtXIvs+XEpfg/f7y6?= =?utf-8?q?VLqFMEnSO/rL1t9sLOI4m1UkktNGL7JUvWEQKSSe5YJmzXOKG9/EqQSDQAMvrzomt?= =?utf-8?q?N31OeeNDC5SzfoVbAvRYqan8w9y4qF0j2ZJdzBq6AUt3N4IGU5yUyz4gDWVsdjJY5?= =?utf-8?q?NmYY58uOi75XlMn3gAICotHdns7UJ/ygl5BAfEj9CNPftWK2a7jLXqxZ9rjQthief?= =?utf-8?q?jFUHrSx5DBR32XeA2aX5oce7DymqcPC3RHUxg3PYhOALoKHCoTWE52J+dwvpLQ4/t?= =?utf-8?q?YqoAJU3sTKzVNVoT7lTXJe9kItleVLID0WnpHl5yVBPzfzl+Ao5gyQ5vztCHTElap?= =?utf-8?q?/oCFond/UrDSqSzeV/5x+q6KRv5kulfS70uCNzBL32mUW85ntstYxNSfTOklFH8cr?= =?utf-8?q?Uku+V/lFYFVuD2BUnZ6kV6L/Jau+y4D8sNJrT/aXxJQUY+J/fSDDJqJsYE9CbqhLv?= =?utf-8?q?9A/xlRmN9OvrljQMAUyEgDoPN1olvkUw=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 30474998-70a0-4d1c-b5c0-08df3a6037e9 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2026 10:41:43.8812 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: VkB6A68zCa7GimcGmCJJ1OeudSc+E+CY/dYqbeCq7q7IzXa3cbNLpsYldsIGUlJZ5IPU7okFtIWY5FTvW81WrprDryJMaz3Ki/qs9kwypaU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR07MB7281 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 10:41:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249352 References: https://nvd.nist.gov/vuln/detail/CVE-2026-12087 Upstream fix: https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb Tested with ptest Signed-off-by: Jakub Szczudlo --- .../perl/files/CVE-2026-12087.patch | 161 ++++++++++++++++++ meta/recipes-devtools/perl/perl_5.42.0.bb | 1 + 2 files changed, 162 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-12087.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-12087.patch b/meta/recipes-devtools/perl/files/CVE-2026-12087.patch new file mode 100644 index 0000000000..d362146e3a --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-12087.patch @@ -0,0 +1,161 @@ +From: Paul LeoNerd Evans +Date: Mon, 4 May 2026 16:12:49 +0100 +Subject: cpan/Socket - Update to version 2.041 + +2.041 2026-03-26 + [CHANGES] + * Modernise Pod documentation formatting + + [BUGFIXES] + * Fix reuse of `STRLEN len` variable in pack_ip_mreq_source() + +Backport changes: +- Adjusted the upstream hunks to match the perl 5.42 code layout. +- Drop not code files from the backport. + +CVE: CVE-2026-12087 +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb] + +Signed-off-by: Jakub Szczudlo +--- + cpan/Socket/Socket.xs | 84 ++++++++++++++++++++++++++++++----------------- + 1 file changed, 57 insertions(+), 27 deletions(-) + +diff --git a/cpan/Socket/Socket.xs b/cpan/Socket/Socket.xs +--- a/cpan/Socket/Socket.xs ++++ b/cpan/Socket/Socket.xs +@@ -1272,26 +1272,35 @@ + struct ip_mreq mreq; + char * multiaddrbytes; + char * interfacebytes; +- STRLEN len; +- if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) +- croak("Wide character in %s", "Socket::pack_ip_mreq"); +- multiaddrbytes = SvPVbyte(multiaddr, len); +- if (len != sizeof(mreq.imr_multiaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); ++ ++ { ++ if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) ++ croak("Wide character in %s", "Socket::pack_ip_mreq"); ++ ++ STRLEN len; ++ multiaddrbytes = SvPVbyte(multiaddr, len); ++ if (len != sizeof(mreq.imr_multiaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); ++ } ++ + Zero(&mreq, sizeof(mreq), char); + Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char); + if(SvOK(interface)) { + if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1)) + croak("Wide character in %s", "Socket::pack_ip_mreq"); ++ ++ STRLEN len; + interfacebytes = SvPVbyte(interface, len); + if (len != sizeof(mreq.imr_interface)) + croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, + "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_interface)); ++ + Copy(interfacebytes, &mreq.imr_interface, sizeof(mreq.imr_interface), char); + } + else + mreq.imr_interface.s_addr = INADDR_ANY; ++ + ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq))); + #else + not_here("pack_ip_mreq"); +@@ -1331,33 +1340,48 @@ + char * multiaddrbytes; + char * sourcebytes; + char * interfacebytes; +- STRLEN len; +- if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) +- croak("Wide character in %s", "Socket::pack_ip_mreq_source"); +- multiaddrbytes = SvPVbyte(multiaddr, len); +- if (len != sizeof(mreq.imr_multiaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); +- if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1)) +- croak("Wide character in %s", "Socket::pack_ip_mreq_source"); +- if (len != sizeof(mreq.imr_sourceaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr)); +- sourcebytes = SvPVbyte(source, len); ++ ++ { ++ if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) ++ croak("Wide character in %s", "Socket::pack_ip_mreq_source"); ++ ++ STRLEN len; ++ multiaddrbytes = SvPVbyte(multiaddr, len); ++ if (len != sizeof(mreq.imr_multiaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); ++ } ++ ++ { ++ if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1)) ++ croak("Wide character in %s", "Socket::pack_ip_mreq_source"); ++ ++ STRLEN len; ++ sourcebytes = SvPVbyte(source, len); ++ if (len != sizeof(mreq.imr_sourceaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr)); ++ } ++ + Zero(&mreq, sizeof(mreq), char); + Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char); + Copy(sourcebytes, &mreq.imr_sourceaddr, sizeof(mreq.imr_sourceaddr), char); ++ + if(SvOK(interface)) { + if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1)) + croak("Wide character in %s", "Socket::pack_ip_mreq"); ++ ++ STRLEN len; + interfacebytes = SvPVbyte(interface, len); + if (len != sizeof(mreq.imr_interface)) + croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, + "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_interface)); ++ + Copy(interfacebytes, &mreq.imr_interface, sizeof(mreq.imr_interface), char); + } + else + mreq.imr_interface.s_addr = INADDR_ANY; ++ + ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq))); + #else + PERL_UNUSED_VAR(multiaddr); +@@ -1398,16 +1422,22 @@ + #ifdef HAS_IPV6_MREQ + struct ipv6_mreq mreq; + char * multiaddrbytes; +- STRLEN len; +- if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) +- croak("Wide character in %s", "Socket::pack_ipv6_mreq"); +- multiaddrbytes = SvPVbyte(multiaddr, len); +- if (len != sizeof(mreq.ipv6mr_multiaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr)); ++ ++ { ++ if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) ++ croak("Wide character in %s", "Socket::pack_ipv6_mreq"); ++ ++ STRLEN len; ++ multiaddrbytes = SvPVbyte(multiaddr, len); ++ if (len != sizeof(mreq.ipv6mr_multiaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr)); ++ } ++ + Zero(&mreq, sizeof(mreq), char); + Copy(multiaddrbytes, &mreq.ipv6mr_multiaddr, sizeof(mreq.ipv6mr_multiaddr), char); + mreq.ipv6mr_interface = ifindex; ++ + ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq))); + #else + PERL_UNUSED_VAR(multiaddr); diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.0.bb index 886eaaaa37..bbe979ab69 100644 --- a/meta/recipes-devtools/perl/perl_5.42.0.bb +++ b/meta/recipes-devtools/perl/perl_5.42.0.bb @@ -23,6 +23,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://CVE-2026-57432-02.patch \ file://CVE-2026-42496.patch \ file://CVE-2026-57433.patch \ + file://CVE-2026-12087.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \