diff mbox series

[wrynose,6/9] curl: fix CVE-2026-92392

Message ID 20261106071932.490299-7-dkelaiya@cisco.com
State New
Headers show
Series curl: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 6, 2026, 7:19 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

Finish request flushing before connection filters release their
references to the easy handle. Detach or return the connection before
resuming pending transfers, including HTTP/2 upload retry paths.

Adapt the order to curl 8.19.0's Curl_cpool_do_locked() callback and
process_pending_handles(). Keep detachment under the existing pool
share lock rather than importing the newer pool APIs.

[1] https://github.com/curl/curl/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321
[2] https://curl.se/docs/CVE-2026-92392.html

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../curl/curl/CVE-2026-92392.patch            | 59 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  1 +
 2 files changed, 60 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92392.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-92392.patch b/meta/recipes-support/curl/curl/CVE-2026-92392.patch
new file mode 100644
index 0000000000..4129d7f013
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-92392.patch
@@ -0,0 +1,59 @@ 
+From 8b0744af5b1b631da5b938ca31c3f9895ad5a321 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 12 Oct 2026 07:40:45 +0200
+Subject: [PATCH] multi: adjust the cleanup order in multi_done
+
+Closes #23370
+
+CVE: CVE-2026-92392
+Upstream-Status: Backport [https://github.com/curl/curl/commit/8b0744af5b1b631da5b938ca31c3f9895ad5a321]
+
+Backport Changes:
+- Use curl 8.19.0's process_pending_handles() and retain its
+  connection/multiplex comment; multi_schedule_pending() is absent.
+- Keep Curl_cpool_do_locked(), whose callback detaches the connection,
+  instead of the newer Curl_cpool_return() and outer detach calls.
+  Notify filters after request cleanup and before that callback,
+  then process pending transfers after the pool lock is released.
+- Apply this to the older function's connection-required layout,
+  which has no outer if(conn) block. Keep a blank line between the
+  pending-transfer block and netrc cleanup.
+
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/multi.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/lib/multi.c b/lib/multi.c
+index ec2d531..4e81001 100644
+--- a/lib/multi.c
++++ b/lib/multi.c
+@@ -720,19 +720,21 @@ static CURLcode multi_done(struct Curl_easy *data,
+   /* Make sure that transfer client writes are really done now. */
+   result = Curl_1st_fatal(result, Curl_xfer_write_done(data, premature));
+ 
+-  /* Inform connection filters that this transfer is done */
+-  Curl_conn_ev_data_done(data, premature);
+-
+-  process_pending_handles(data->multi); /* connection / multiplex */
+-
+   if(!result)
+     result = Curl_req_done(&data->req, data, premature);
+ 
++  /* Inform connection filters that this transfer is done and they
++   * need to give up any references to `data`. */
++  Curl_conn_ev_data_done(data, premature);
++
+   /* Under the potential connection pool's share lock, decide what to
+    * do with the transfer's connection. */
+   mdctx.premature = premature;
+   Curl_cpool_do_locked(data, data->conn, multi_done_locked, &mdctx);
+ 
++  if(data->multi)
++    process_pending_handles(data->multi); /* connection / multiplex */
++
+   /* flush the netrc cache */
+   Curl_netrc_cleanup(&data->state.netrc);
+   return result;
+-- 
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 5abde681e7..71b7c06e71 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -67,6 +67,7 @@  SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-92390_p2.patch \
            file://CVE-2026-92388_p1.patch \
            file://CVE-2026-92388_p2.patch \
+           file://CVE-2026-92392.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \