new file mode 100644
@@ -0,0 +1,39 @@
+From 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Tue, 14 Apr 2026 04:32:00 +0000
+Subject: [PATCH] tools:gpgtar: Fix for a case of non existing dir with -C.
+
+* tools/gpgtar-extract.c (gpgtar_extract): Call the
+check_output_directory function only when DIRNAME exists.
+
+--
+GnuPG-bug-id: 8159
+
+CVE: CVE-2026-105712
+Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5]
+
+Backport Changes:
+- Used gnupg_access() for the existence check because 2.5.17 does not
+ have the upstream COMPAT_NO_DIR_CHECK compatibility flag.
+
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+(cherry picked from commit 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ tools/gpgtar-extract.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c
+index 5ca80cb..a5a925c 100644
+--- a/tools/gpgtar-extract.c
++++ b/tools/gpgtar-extract.c
+@@ -504,7 +504,8 @@ gpgtar_extract (const char *filename, int decrypt)
+ goto leave;
+ }
+
+- if (!check_output_directory (dirname))
++ if (gnupg_access (dirname, F_OK) == 0
++ && !check_output_directory (dirname))
+ {
+ err = gpg_error (GPG_ERR_INV_ARG);
+ goto leave;
new file mode 100644
@@ -0,0 +1,194 @@
+From 8df56dd913f3c910c9b265691efaac6c36a007a1 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 20 Mar 2026 13:33:00 +0900
+Subject: [PATCH] tool:gpgtar: Check the output directory with --directory.
+
+* doc/tools.texi (gpgtar): Clarify about the --directory option.
+* tools/gpgtar-extract.c (check_output_directory): New.
+(gpgtar_extract): Call check_output_directory.
+
+--
+
+GnuPG-bug-id: 8159
+
+CVE: CVE-2026-105712
+Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88]
+
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+(cherry picked from commit 7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ doc/tools.texi | 11 ++--
+ tools/gpgtar-extract.c | 123 ++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 128 insertions(+), 6 deletions(-)
+
+diff --git a/doc/tools.texi b/doc/tools.texi
+index 45f3e897d..691b7dc9c 100644
+--- a/doc/tools.texi
++++ b/doc/tools.texi
+@@ -2024,11 +2024,12 @@ Do not actually output the extracted files.
+ @item --directory @var{dir}
+ @itemx -C @var{dir}
+ @opindex directory
+-Extract the files into the directory @var{dir}. The default is to
+-take the directory name from the input filename. If no input filename
+-is known a directory named @file{GPGARCH} is used. For tarball
+-creation, switch to directory @var{dir} before performing any
+-operations.
++Extract the files into the directory @var{dir}. It raises an error
++when @var{dir} is not empty, or @var{dir} is a symlink to other
++directory. When this option is not given, the default is to take the
++directory name from the input filename. If no input filename is known
++a directory, named @file{GPGARCH} is used. For tarball creation,
++switch to directory @var{dir} before performing any operations.
+
+ @item --files-from @var{file}
+ @itemx -T @var{file}
+diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c
+index d23ccc579..5ca80cb89 100644
+--- a/tools/gpgtar-extract.c
++++ b/tools/gpgtar-extract.c
+@@ -24,6 +24,8 @@
+ #include <errno.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <dirent.h>
++#include <fcntl.h>
+ #include <string.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+@@ -369,6 +371,112 @@ create_directory (const char *dirprefix)
+ }
+
+
++/* Check the output directory DIRNAME if it's not symlink and empty.
++ Return 1 if good, 0 otherwise. */
++static int
++check_output_directory (const char *dirname)
++{
++#ifdef HAVE_W32_SYSTEM
++#define dirent _wdirent
++#define DIR _WDIR
++#define readdir _wreaddir
++#define closedir _wclosedir
++#endif
++ DIR *d;
++ struct dirent *dent;
++ int count = 0;
++
++#ifdef HAVE_W32_SYSTEM
++ wchar_t *wdirname;
++ DWORD attr;
++
++ wdirname = utf8_to_wchar (dirname);
++ if (!wdirname)
++ return 0;
++
++ attr = GetFileAttributesW (wdirname);
++
++ if (attr == INVALID_FILE_ATTRIBUTES)
++ {
++ log_error ("error getting attributes '%s': %s\n", dirname, w32_strerror (-1));
++ xfree (wdirname);
++ return 0;
++ }
++ else if ((attr & FILE_ATTRIBUTE_REPARSE_POINT))
++ {
++ /* It's reparse point (possibly symlink), not good. */
++ log_error ("Not a regular directory (may be symlink): %s\n", dirname);
++ xfree (wdirname);
++ return 0;
++ }
++
++ d = _wopendir (wdirname);
++ xfree (wdirname);
++#else
++# if O_NOFOLLOW == 0
++ struct stat sbuf;
++
++ if (lstat (dirname, &sbuf))
++ return 0;
++
++ if (S_ISLNK (sbuf.st_mode))
++ {
++ /* It's symlink, not good. */
++ log_error ("It's symbolic link: %s\n", dirname);
++ return 0;
++ }
++
++ d = opendir (dirname);
++# else
++ int fd;
++
++ /* With O_NOFOLLOW, make sure it's not symlink. */
++ fd = open (dirname, (O_RDONLY | O_NOFOLLOW));
++ if (fd < 0)
++ {
++ log_error ("Can't open (symlink?): %s\n", dirname);
++ return 0;
++ }
++
++ d = fdopendir (fd);
++# endif
++#endif
++
++ if (d == NULL)
++ return 0;
++
++ while ((dent = readdir (d)) != NULL)
++ {
++ if (dent->d_name[0] == '.' && dent->d_name[1] == 0)
++ continue;
++
++ if (dent->d_name[0] == '.' && dent->d_name[1] == '.'
++ && dent->d_name[2] == 0)
++ continue;
++
++ count++;
++ }
++
++ /* In case of fdopendir, FD is released by closedir. */
++ closedir (d);
++
++ if (count)
++ {
++ /* It's not empty, not good. */
++ log_error ("Directory not empty: %s\n", dirname);
++ return 0;
++ }
++
++ /* Good. */
++ return 1;
++}
++
++#ifdef HAVE_W32_SYSTEM
++#undef dirent
++#undef DIR
++#undef readdir
++#undef closedir
++#endif
+
+ gpg_error_t
+ gpgtar_extract (const char *filename, int decrypt)
+@@ -388,7 +496,20 @@ gpgtar_extract (const char *filename, int decrypt)
+ memset (&tarinfo_buffer, 0, sizeof tarinfo_buffer);
+
+ if (opt.directory)
+- dirname = xtrystrdup (opt.directory);
++ {
++ dirname = xtrystrdup (opt.directory);
++ if (!dirname)
++ {
++ err = gpg_error_from_syserror ();
++ goto leave;
++ }
++
++ if (!check_output_directory (dirname))
++ {
++ err = gpg_error (GPG_ERR_INV_ARG);
++ goto leave;
++ }
++ }
+ else
+ {
+ if (opt.filename)
@@ -20,6 +20,8 @@ SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \
file://0002-use-pkgconfig-instead-of-npth-config.patch \
file://0001-Woverride-init-is-not-needed-with-gcc-9.patch \
file://CVE-2026-57062.patch \
+ file://CVE-2026-105712.patch \
+ file://CVE-2026-105712-regression.patch \
"
SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \
file://relocate.patch"