From patchwork Wed Nov 4 10:55:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jakub Szczudlo (Nokia)" X-Patchwork-Id: 102891 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.27]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6693.1793789763639856368 for ; Wed, 04 Nov 2026 02:56:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@nokia.com header.s=selector1 header.b=QD3hyue8; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: nokia.com, ip: 52.101.66.27, mailfrom: jakub.szczudlo@nokia.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DTPFosnk2o28yTy1/rrruY4LS4P6hMdWRggO1hJhUv674WuKny2LGmnOHB9sYw0k8kBXWn6B3TCU7av6wh35x0tvZZCIrC2ZMHE6QLRHWGuZ2XmfwfDARnkMyKRrZDuSeshSYLM1luOUjxT4rL4RXkiz+T4mIA4GTE84cpYfOXihaX7++8Ry62Ujoo3TIoNoizg6ijxM+y/G/PiowHoYMNtRbA8sIsJM+R9t9HMydlTx3rc+MqXP3igHyvMsW4iXYKbb67BpOBh5zkH6PjaGUZGY0XESk1TwnI3+oSaG3uXYVJisEZqRvut8G/2nCIZsNBx+FKwaAji0xqasvQOLDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=L07NG6dCdvg8AJRMsyr7tkM+T76ItKl3YTZUQEDEKcs=; b=Q+m3W1nfwBTyaBLGJL3SLdz/uu9/FWGKRUh9wcv+DiQgrxFZs17LgGoVVnTa3dTZQJb1swbxApr+fGcHTahiIrvVwnvmqItYaOQWcu/Lq97/0yLrMw5+mXhgXODYgeGxf/x8CdUUFPHEUO8/K4wpJxr/xiR9ajt4Ez8ABU6R0ouGH+hQYjcMj4DEifdJb6e88G5f8l0HAfxbvILdpPgqfIgT0CETcsXGHg2VIw3fQLlPMJxNyJQejm5tGooKAt9iqCdZ0ol7YAcUOF8PNFR3kvvIY9+T2EJH8hYvlMERJGV+/WCb33nhfBTkCamvFGaLzcPzknt+5LmtEag+EJq4PA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=L07NG6dCdvg8AJRMsyr7tkM+T76ItKl3YTZUQEDEKcs=; b=QD3hyue8qQCP145drNIfIhG/dlU7+LnQ0inSLcdI2ZFqDozLBlMXUFXE3IesI2rTPC3U6N6s8K65CiuqiZ9ZPVHVWteOn5le/1W4VKyl5wIgwAE/qSA0PkVB23Rn344ca8sMdAz9Fy55veDvEtjmBpp2aC1b8HyK9gQHCUS5Ow0yE8dh8VXhxhlFy8OIZI/h2MNuJJJZ1uq/oR/4q387aodlus+r9GzKsMa4AUpMEpcmrssgJ+yXyHvzTR52auNhBIsdCYJpX9e44cX9kevBnxruQIN4pTd47UmBZq9GfRH1I5MkMLibPTDGaDODsyCrJ5QyY5Ke0phYBF7+Xh1v5g== Received: from GV2PR07MB11919.eurprd07.prod.outlook.com (2603:10a6:150:357::20) by AM8PR07MB8245.eurprd07.prod.outlook.com (2603:10a6:20b:324::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.9; Wed, 4 Nov 2026 10:55:59 +0000 Received: from GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680]) by GV2PR07MB11919.eurprd07.prod.outlook.com ([fe80::159a:9a82:1362:e680%3]) with mapi id 15.21.0592.009; Wed, 4 Nov 2026 10:55:59 +0000 From: "Jakub Szczudlo (Nokia)" To: "openembedded-core@lists.openembedded.org" CC: "yoann.congal@smile.fr" , "Jakub Szczudlo (Nokia)" Subject: [wrynose][PATCH v2] perl: fix CVE-2026-12087 Thread-Topic: [wrynose][PATCH v2] perl: fix CVE-2026-12087 Thread-Index: AQHdbEsTWU8DySDZTEWHtBtHM99GWw== Date: Wed, 4 Nov 2026 10:55:59 +0000 Message-ID: <20261104105552.2044799-1-jakub.szczudlo@nokia.com> Accept-Language: en-US, en-150 Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nokia.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV2PR07MB11919:EE_|AM8PR07MB8245:EE_ x-ms-office365-filtering-correlation-id: 7cc60903-986a-4e24-6ecd-08df3a6235bc x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|23010399003|38070700021|260925021911599003|260925022911599003|260925021311599003|11063799006|56012099006|261021121427099003|261021123027099003|261009223027099003|261102123227099003|261022105027099003|261028144727099003|261026140227099003|261026121527099003|10067099003|12006099003|18002099003|6133799003|13003099007; x-microsoft-antispam-message-info: UqzJ/2w8umKEUlrl2Yqpriz318tndXjYd2gZKKDj0V3/Ugk4l6P1WTKarPPuXypXTnjZjnDzaFNJ7GkXXGgiWHyzf9tgU5yoQwfDdhsEUSWfABmqM//377AG4W/ChpjMDz8Koyc6NJe7t9oaYGEGJFoZIfdeK5HHKyr/PVv3PWgGjYRS2XFy1CLLwuJzfj5tpSNQxnWNVczfEgtLmAyQsuxEjGif6vM87stsk5QTTpwImuS4Rj/qcuTUBQUKF/Yqqd3gMoS+zCYUeVA6Q0yS3ddEYI/Dl05rA9aPw+100NlZjcIUUp4fFV4hmO900LN7HNOjYp9WJ4Qt7OXngXS+9GfoQZqhcZjqIucrbUrL1PDoVv24vXybDWatnR2xAYh1ZGYzYKXe4E4bEUiwySaD8EUXzJgnsix+Qe2fptOOY5KFyxTO+yLxSH/YsLdxJfEfzJKgyey/cYe/mgFhKT4vZKleo2Dk8BulvNXEuWSL6rbTYxqf+s9ulMOPYhlatF8++yzAE7E8Mt2NOBlYQxHAtk6LSBlE2ckGsp97HKRXuRGxQtr8ONJiX84KsMtUU1YTbW/bJlAIypM+le7+slG0AWwvSJ6Kcba8juZepmQQ0zO2YKdxgviGxqH4tt/ueLvXdh+Q77ST0/1lYB22JiEsTEar2IwG4Yc0MxPRYxRdVH0= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV2PR07MB11919.eurprd07.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(38070700021)(260925021911599003)(260925022911599003)(260925021311599003)(11063799006)(56012099006)(261021121427099003)(261021123027099003)(261009223027099003)(261102123227099003)(261022105027099003)(261028144727099003)(261026140227099003)(261026121527099003)(10067099003)(12006099003)(18002099003)(6133799003)(13003099007);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?Ot3yPvrq22zfnk1iEcJUZ9eW2XtU?= =?utf-8?q?hr/fG8P9cAF9F6iernYaDzmnLiC1n+UyEaATUr1R2rfmEsQiYv/ldp+WU7UlDhXiT?= =?utf-8?q?jyhPqOklSRzP4KAEONi4VXWRrXvaRWdm5MEYOxS6HSi7DCOz+pj4pOkL5SRofwjm8?= =?utf-8?q?rLSj88/rSMeaY8JUrV1QtXEs3bWxF4NIn0myiDnbGuZ5NKD1zAOJOrvZUv8vsEBsC?= =?utf-8?q?+WtxVQWJHBfU0mviJMBzuGuvlkeoSpjitWxOCmCyo7FLSiEN+DB6D5DAVWu+4EK5G?= =?utf-8?q?zIc0jeTpgcEZRn1VMcn3AfcRiUAVwULJN+WXv5QE+RwBP5mWzeuzn7y031951WLvL?= =?utf-8?q?8A5VERFOO1b/KVh5o8Med1q5rihe4uB9UUP1EkpfkCxEu6oYA+ZQ002nFzS/I80IF?= =?utf-8?q?jHq1vcmt571isMLkd0hOo4fV0KxDM26cJhyUU7+j0OGwQFyysqz3cxsmtjS/YBgtF?= =?utf-8?q?x/83+U7zdKteZ5CtGmRBFI0eoeXMbdlGXZ/ClnScjpP3lnbJiCryqKqSjOhpJmQ6h?= =?utf-8?q?BdSuZmEN+1l3fayC/rM21y4Uafz5iiiq5IaFrztTg88MBN5WdWutPIvzupi4WxSgy?= =?utf-8?q?YaqpizTEiGfucu9qfbzY6+AN4ydBkkLt+ZErMi5cuu/xIMXpifJhKbVus+fXTXnyO?= =?utf-8?q?ihnOh7lv0y/nsStcsodKJWWt4gBSdQDaMGpOfPeM20Qp67eGL1IzPxZrjV60RcoY0?= =?utf-8?q?qq4/HUCCLG/MYVr+lLyoYqwWMiQXpCnmfMOhn4HwI7jWY1LyRKdFeDZYNa4sXxpq7?= =?utf-8?q?kKpxpE+yDtzVlQleBkK2+FDB8ypaileTo5zVErXkSbt31xPRlgLIFBHBQNWa0Hvv/?= =?utf-8?q?GB45+x5zoxP2VmJzj7l/O0QUAUE6HJnu4bg1sozbjg9aH8H9AQixkIrZ7X5fTBoCi?= =?utf-8?q?cPJqX5G0E6LrbQPFZ8Ou2l85eiRM2iRMAoB6icJmgCeI2wpuFE5MsUfkGIIuUxJJ9?= =?utf-8?q?Bj4FIi3ljwoxP8VNx9bNO9qkQlv49QfHPYGXHyj85AtAetu6DVVu01xQza8K2kW2O?= =?utf-8?q?y0bk4oN0gzUpQlIdKSBayAVD45ljLSALXsuv12bxUpqB63md1TcECV0U41CwAQw+p?= =?utf-8?q?UMyIG8FqG6NnndddRu5b8f0eU+vkSa2R5JShW3GY7ZUuCmnhcag6TUi5zrb8F1n/Z?= =?utf-8?q?+TS41rCtls+VDBFJzcWklC61A6P35S3L5iWS/aVlESEtkyi0M6O63KT//99B8+fzT?= =?utf-8?q?8n3/+HrbLqKaw7gJMb+NWSFbNuY/WjEcAox5/YQGNdUZplU2HIArk5CUSIFVCMXA3?= =?utf-8?q?JewPap7zDWhhf0kp+HgSKw3Q4PrBbJP4g/ToKrN7VWpBWdWgOyo10tlCUwG1wClj9?= =?utf-8?q?/O/7nFQRLArJusxSJ8hEVOc8wt08/LUg/0rGMwCzzDNWL5K6pEp+vEeDeRn4FvizO?= =?utf-8?q?DDPbwt1r3HU9glG07nWsgxkHEin5khzNAv7p7pKdGLdAeFDE025xScxtFv2PWn+PQ?= =?utf-8?q?3EEAuqZyonlhSBqCUnAcuE//vebIOLIuRVJJko47NuBoEcIJS8sIIGOhq6buH1pY2?= =?utf-8?q?zK8cqPm8DKhITuXJUlbYmJ3mvmixxNyulOUS8NBsRcR6ZrWZpM1u6hJd4HVex6c80?= =?utf-8?q?0gW4y/IGSiWppOFontVsFWfO0uUh6gUCrzk1D0TtTOYAymMvbQvaqRh8zQwRaBgwv?= =?utf-8?q?oyVvwX+unJW5LsiTpoPb8q/vSKY1+0kA=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV2PR07MB11919.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7cc60903-986a-4e24-6ecd-08df3a6235bc X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2026 10:55:59.1401 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: +szfvnrwvpGmBGjXRD4ZPqZQ3FmM0QtExKayxS7+IVgk6EX4GpbaWsT3rk1gqsXzHcygBM5N7RhHAbajD49KqlAabQmoC7Ip8zm2+649oqA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM8PR07MB8245 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Wed, 04 Nov 2026 10:56:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249357 Backport patch to fix CVE-2026-12087. References: https://nvd.nist.gov/vuln/detail/CVE-2026-12087 Upstream fix: https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb Tested with ptest Signed-off-by: Jakub Szczudlo --- .../perl/files/CVE-2026-12087.patch | 161 ++++++++++++++++++ meta/recipes-devtools/perl/perl_5.42.0.bb | 1 + 2 files changed, 162 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-12087.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-12087.patch b/meta/recipes-devtools/perl/files/CVE-2026-12087.patch new file mode 100644 index 0000000000..d362146e3a --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-12087.patch @@ -0,0 +1,161 @@ +From: Paul LeoNerd Evans +Date: Mon, 4 May 2026 16:12:49 +0100 +Subject: cpan/Socket - Update to version 2.041 + +2.041 2026-03-26 + [CHANGES] + * Modernise Pod documentation formatting + + [BUGFIXES] + * Fix reuse of `STRLEN len` variable in pack_ip_mreq_source() + +Backport changes: +- Adjusted the upstream hunks to match the perl 5.42 code layout. +- Drop not code files from the backport. + +CVE: CVE-2026-12087 +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb] + +Signed-off-by: Jakub Szczudlo +--- + cpan/Socket/Socket.xs | 84 ++++++++++++++++++++++++++++++----------------- + 1 file changed, 57 insertions(+), 27 deletions(-) + +diff --git a/cpan/Socket/Socket.xs b/cpan/Socket/Socket.xs +--- a/cpan/Socket/Socket.xs ++++ b/cpan/Socket/Socket.xs +@@ -1272,26 +1272,35 @@ + struct ip_mreq mreq; + char * multiaddrbytes; + char * interfacebytes; +- STRLEN len; +- if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) +- croak("Wide character in %s", "Socket::pack_ip_mreq"); +- multiaddrbytes = SvPVbyte(multiaddr, len); +- if (len != sizeof(mreq.imr_multiaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); ++ ++ { ++ if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) ++ croak("Wide character in %s", "Socket::pack_ip_mreq"); ++ ++ STRLEN len; ++ multiaddrbytes = SvPVbyte(multiaddr, len); ++ if (len != sizeof(mreq.imr_multiaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); ++ } ++ + Zero(&mreq, sizeof(mreq), char); + Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char); + if(SvOK(interface)) { + if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1)) + croak("Wide character in %s", "Socket::pack_ip_mreq"); ++ ++ STRLEN len; + interfacebytes = SvPVbyte(interface, len); + if (len != sizeof(mreq.imr_interface)) + croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, + "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_interface)); ++ + Copy(interfacebytes, &mreq.imr_interface, sizeof(mreq.imr_interface), char); + } + else + mreq.imr_interface.s_addr = INADDR_ANY; ++ + ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq))); + #else + not_here("pack_ip_mreq"); +@@ -1331,33 +1340,48 @@ + char * multiaddrbytes; + char * sourcebytes; + char * interfacebytes; +- STRLEN len; +- if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) +- croak("Wide character in %s", "Socket::pack_ip_mreq_source"); +- multiaddrbytes = SvPVbyte(multiaddr, len); +- if (len != sizeof(mreq.imr_multiaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); +- if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1)) +- croak("Wide character in %s", "Socket::pack_ip_mreq_source"); +- if (len != sizeof(mreq.imr_sourceaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr)); +- sourcebytes = SvPVbyte(source, len); ++ ++ { ++ if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) ++ croak("Wide character in %s", "Socket::pack_ip_mreq_source"); ++ ++ STRLEN len; ++ multiaddrbytes = SvPVbyte(multiaddr, len); ++ if (len != sizeof(mreq.imr_multiaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr)); ++ } ++ ++ { ++ if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1)) ++ croak("Wide character in %s", "Socket::pack_ip_mreq_source"); ++ ++ STRLEN len; ++ sourcebytes = SvPVbyte(source, len); ++ if (len != sizeof(mreq.imr_sourceaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr)); ++ } ++ + Zero(&mreq, sizeof(mreq), char); + Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char); + Copy(sourcebytes, &mreq.imr_sourceaddr, sizeof(mreq.imr_sourceaddr), char); ++ + if(SvOK(interface)) { + if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1)) + croak("Wide character in %s", "Socket::pack_ip_mreq"); ++ ++ STRLEN len; + interfacebytes = SvPVbyte(interface, len); + if (len != sizeof(mreq.imr_interface)) + croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, + "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_interface)); ++ + Copy(interfacebytes, &mreq.imr_interface, sizeof(mreq.imr_interface), char); + } + else + mreq.imr_interface.s_addr = INADDR_ANY; ++ + ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq))); + #else + PERL_UNUSED_VAR(multiaddr); +@@ -1398,16 +1422,22 @@ + #ifdef HAS_IPV6_MREQ + struct ipv6_mreq mreq; + char * multiaddrbytes; +- STRLEN len; +- if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) +- croak("Wide character in %s", "Socket::pack_ipv6_mreq"); +- multiaddrbytes = SvPVbyte(multiaddr, len); +- if (len != sizeof(mreq.ipv6mr_multiaddr)) +- croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, +- "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr)); ++ ++ { ++ if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1)) ++ croak("Wide character in %s", "Socket::pack_ipv6_mreq"); ++ ++ STRLEN len; ++ multiaddrbytes = SvPVbyte(multiaddr, len); ++ if (len != sizeof(mreq.ipv6mr_multiaddr)) ++ croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf, ++ "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr)); ++ } ++ + Zero(&mreq, sizeof(mreq), char); + Copy(multiaddrbytes, &mreq.ipv6mr_multiaddr, sizeof(mreq.ipv6mr_multiaddr), char); + mreq.ipv6mr_interface = ifindex; ++ + ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq))); + #else + PERL_UNUSED_VAR(multiaddr); diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.0.bb index 886eaaaa37..bbe979ab69 100644 --- a/meta/recipes-devtools/perl/perl_5.42.0.bb +++ b/meta/recipes-devtools/perl/perl_5.42.0.bb @@ -23,6 +23,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://CVE-2026-57432-02.patch \ file://CVE-2026-42496.patch \ file://CVE-2026-57433.patch \ + file://CVE-2026-12087.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \