diff mbox series

[wrynose,27/38] u-boot-tools: Ignore CVE-2026-29007

Message ID	3d02f9f0f0ac74275633f2f9eff9c568e351457d.1788938909.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 74.125.225.76, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][wrynose 27/38] u-boot-tools: Ignore CVE-2026-29007 Date: Wed, 9 Sep 2026 09:29:26 +0200 Message-ID: <3d02f9f0f0ac74275633f2f9eff9c568e351457d.1788938909.git.yoann.congal@smile.fr> In-Reply-To: <cover.1788938908.git.yoann.congal@smile.fr> References: <cover.1788938908.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[wrynose,01/38] linux-yocto/6.18: update to v6.18.41 \| expand [wrynose,01/38] linux-yocto/6.18: update to v6.18.41 [wrynose,02/38] linux-yocto/6.18: update to v6.18.43 [wrynose,03/38] linux-yocto/6.18: update to v6.18.44 [wrynose,04/38] linux-yocto/6.18: update to v6.18.48 [wrynose,05/38] testimage: handle bootlog variants on failed qemu tests [wrynose,06/38] openssl: upgrade 3.5.7 -> 3.5.8 [wrynose,07/38] apr-util: upgrade 1.6.3 -> 1.6.5 [wrynose,08/38] python3-pip: Fix CVE-2026-13346 [wrynose,09/38] time64: enable 64-bit time/file-offset flags for 32-bit nativesdk [wrynose,10/38] grub: disable grub-protect for native builds [wrynose,11/38] procps: ptest: skip flaky pgrep full process name match test [wrynose,12/38] vim: Fix for CVE-2026-73072 [wrynose,13/38] vim: Fix for CVE-2026-73073 [wrynose,14/38] vim: Fix for CVE-2026-73074 [wrynose,15/38] vim: Fix for CVE-2026-73076 [wrynose,16/38] vim: Fix for CVE-2026-73077 [wrynose,17/38] vim: Fix for CVE-2026-73078 [wrynose,18/38] improve_kernel_cve_report: fix backported-patch check [wrynose,19/38] p11-kit: upgrade 0.26.4 -> 0.26.5 [wrynose,20/38] python3-lxml: fix CVE-2026-41066 [wrynose,21/38] glibc: fix CVE-2026-19542 [wrynose,22/38] libxfont: Fix CVE-2026-56001 [wrynose,23/38] libxfont: Fix CVE-2026-56002 [wrynose,24/38] libxfont: Fix CVE-2026-56003 [wrynose,25/38] wget: fix CVE-2026-16599 [wrynose,26/38] libarchive: mark CVE-2026-14164 as fixed-version [wrynose,27/38] u-boot-tools: Ignore CVE-2026-29007 [wrynose,28/38] u-boot-tools: Ignore CVE-2026-29008 [wrynose,29/38] u-boot-tools: Ignore CVE-2026-29009 [wrynose,30/38] u-boot, u-boot-tools: Correct CVE-2026-46728 attribution for FIT fix [wrynose,31/38] wpa-supplicant: patch CVE-2026-58374 [wrynose,32/38] curl: patch CVE-2026-11352 [wrynose,33/38] curl: patch CVE-2026-11586 [wrynose,34/38] gnutls: fix CVE-2026-33845 [wrynose,35/38] perl: Fix CVE-2026-57433 [wrynose,36/38] wget: Fix CVE-2026-58470 [wrynose,37/38] python3-pip: Fix CVE-2026-8643 [wrynose,38/38] gawk: skip randtest in ptest suite

Commit Message

Yoann Congal Sept. 9, 2026, 7:29 a.m. UTC

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- NVD identifies the vulnerable code as net/tcp.c when
  CONFIG_PROT_TCP is enabled [1].
- tools-only_defconfig disables networking, so this code is not built
  into u-boot-tools [2].
- Hence ignoring the CVE for this recipe.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-29007
[2] https://github.com/u-boot/u-boot/blob/v2026.01/configs/tools-only_defconfig

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb | 2 ++
 1 file changed, 2 insertions(+)

diff mbox series

Patch

diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
index 7eaf721ca83..0e57bb88849 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
@@ -1,2 +1,4 @@ 
 require u-boot-common.inc
 require u-boot-tools.inc
+
+CVE_STATUS[CVE-2026-29007] = "not-applicable-config: tools-only_defconfig disables networking; net/tcp.c is not compiled into u-boot-tools."