[scarthgap,00/31] Patch review

Please review this set of changes for scarthgap and have comments back by end of day Tuesday, July 28. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4287 The following changes since commit 3217490cc554069ae53aa54cf8ad7327ce85fa10: glibc-testsuite: Do not generate SPDX (2026-07-21 20:32:51 +0200) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut for you to fetch changes up to 762321beb0260b1411c7f98f13458ec99a118280: bzip2: fix 'bzip2 --version > /tmp/aaa 2>&1' hang (2026-07-25 23:57:45 +0200) ---------------------------------------------------------------- Bruce Ashfield (2): linux-yocto/6.6: update to v6.6.143 linux-yocto/6.6: update to v6.6.144 Darsh Kelaiya (1): gzip: Fix CVE-2026-41991 Deepak Rathore (13): cups: fix CVE-2026-27447 cups: fix CVE-2026-41079 cups: fix CVE-2026-34978 cups: fix CVE-2026-34980 cups: fix CVE-2026-34979 cups: fix CVE-2026-34990 cups: fix CVE-2026-39314 cups: fix CVE-2026-39316 glib-2.0: fix CVE-2026-58010 glib-2.0: fix CVE-2026-58011 glib-2.0: fix CVE-2026-58012 glib-2.0: fix CVE-2026-58013 glib-2.0: fix CVE-2026-58014 Devansh Patel (8): libxml2: Fix CVE-2026-11979 openssh: Fix CVE-2026-59999 openssh: Fix CVE-2026-59997 openssh: Fix CVE-2026-59996 openssh: Fix CVE-2026-59995 openssh: Fix CVE-2026-60001 openssh: Fix CVE-2026-60002 openssh: Fix CVE-2026-60000 Enoch Ng (1): libxpm: fix CVE-2026-4367 Hongxu Jia (1): bzip2: fix 'bzip2 --version > /tmp/aaa 2>&1' hang Sudhir Dumbhare (3): gnutls: set status for CVE-2026-3832 gnutls: fix CVE-2026-42009 libpng: Fix CVE-2026-34757 Yoann Congal (2): scripts/install-buildtools: Update to 5.0.19 linux-yocto/6.6: update CVE exclusions (6.6.144) .../openssh/openssh/CVE-2026-59995.patch | 42 + .../openssh/openssh/CVE-2026-59996.patch | 37 + .../openssh/openssh/CVE-2026-59997.patch | 58 + .../openssh/openssh/CVE-2026-59999.patch | 36 + .../openssh/openssh/CVE-2026-60000.patch | 140 ++ .../openssh/openssh/CVE-2026-60001.patch | 130 ++ .../openssh/openssh/CVE-2026-60002.patch | 226 +++ .../openssh/openssh_9.6p1.bb | 7 + .../glib-2.0/glib-2.0/CVE-2026-58010.patch | 113 ++ .../glib-2.0/glib-2.0/CVE-2026-58011.patch | 78 ++ .../glib-2.0/glib-2.0/CVE-2026-58012.patch | 228 ++++ .../glib-2.0/glib-2.0/CVE-2026-58013.patch | 140 ++ .../glib-2.0/glib-2.0/CVE-2026-58014.patch | 106 ++ meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 5 + .../libxml/libxml2/CVE-2026-11979.patch | 70 + meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + ...-fix-bzip2-version-tmp-aaa-will-hang.patch | 65 + meta/recipes-extended/bzip2/bzip2_1.0.8.bb | 1 + meta/recipes-extended/cups/cups.inc | 12 + .../cups/CVE-2026-27447-regression_p1.patch | 33 + .../cups/CVE-2026-27447-regression_p2.patch | 46 + .../cups/cups/CVE-2026-27447.patch | 108 ++ .../cups/cups/CVE-2026-34978.patch | 107 ++ .../cups/cups/CVE-2026-34979.patch | 61 + .../cups/CVE-2026-34980-regression_p1.patch | 31 + .../cups/CVE-2026-34980-regression_p2.patch | 75 + .../cups/cups/CVE-2026-34980.patch | 85 ++ .../cups/cups/CVE-2026-34990.patch | 351 +++++ .../cups/cups/CVE-2026-39314.patch | 45 + .../cups/cups/CVE-2026-39316.patch | 40 + .../cups/cups/CVE-2026-41079.patch | 71 + .../gzip/gzip-1.13/CVE-2026-41991.patch | 75 + meta/recipes-extended/gzip/gzip_1.13.bb | 1 + ...67-Out-of-bounds-read-in-xpmNextWord.patch | 140 ++ .../xorg-lib/libxpm_3.5.17.bb | 1 + .../linux/cve-exclusion_6.6.inc | 1216 ++++++++++++++--- .../linux/linux-yocto-rt_6.6.bb | 6 +- .../linux/linux-yocto-tiny_6.6.bb | 6 +- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +- .../libpng/files/CVE-2026-34757_p1.patch | 521 +++++++ .../libpng/files/CVE-2026-34757_p2.patch | 484 +++++++ .../libpng/libpng_1.6.42.bb | 4 +- .../gnutls/gnutls/CVE-2026-42009_p1.patch | 66 + .../gnutls/gnutls/CVE-2026-42009_p2.patch | 47 + meta/recipes-support/gnutls/gnutls_3.8.4.bb | 4 + scripts/install-buildtools | 4 +- 46 files changed, 4964 insertions(+), 187 deletions(-) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58010.patch create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58011.patch create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58012.patch create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58013.patch create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58014.patch create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-11979.patch create mode 100644 meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-27447-regression_p1.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-27447-regression_p2.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-27447.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-34978.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-34979.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-34980-regression_p1.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-34980-regression_p2.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-34980.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-34990.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-39314.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-39316.patch create mode 100644 meta/recipes-extended/cups/cups/CVE-2026-41079.patch create mode 100644 meta/recipes-extended/gzip/gzip-1.13/CVE-2026-41991.patch create mode 100644 meta/recipes-graphics/xorg-lib/libxpm/0001-Fix-CVE-2026-4367-Out-of-bounds-read-in-xpmNextWord.patch create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch

Message ID	cover.1785054429.git.yoann.congal@smile.fr
State	Not Applicable, archived
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 00/31] Patch review Date: Sun, 26 Jul 2026 10:29:24 +0200 Message-ID: <cover.1785054429.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit

[scarthgap,00/31] Patch review

Pull-request

Message