[scarthgap,00/37] Patch review

Please review this set of changes for scarthgap and have comments back by end of day Friday, August 21. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4516 * The 2 warnings about ptest-curl are under investigation The following changes since commit 1ba3cd7c884dc6c3d78c6bedc15e081f5000c8c9: ref-manual/variables.rst: document the QB_DEFAULT_BIOS variable (2026-08-13 12:33:22 +0100) are available in the Git repository at: https://git.yoctoproject.org/poky-contrib stable/scarthgap-nut https://git.yoctoproject.org/poky-contrib/log/?h=stable/scarthgap-nut for you to fetch changes up to 7bc6442a1f83593427a502bbb924a3f91b4a0456: linux-yocto/6.6: update to v6.6.147 (2026-08-19 13:48:46 +0200) ---------------------------------------------------------------- Adarsh Jagadish Kamini (1): gnutls: fix CVE-2026-3833 Alexander Kanavin (1): perf: drop newt from tui build requirements Amaury Couderc (1): python3: fix CVE-2026-7210 Bruce Ashfield (1): linux-yocto/6.6: update to v6.6.147 David Nyström (1): libssh2: Fix CVE-2025-15661 Deepak Rathore (15): expat: fix CVE-2026-56403 expat: fix CVE-2026-56408 expat: fix CVE-2026-56404 expat: fix CVE-2026-56405 expat: fix CVE-2026-56410 expat: fix CVE-2026-56406 expat: fix CVE-2026-56409 expat: fix CVE-2026-56411 expat: fix CVE-2026-56407 expat: fix CVE-2026-56132 curl: fix CVE-2026-5545 curl: fix CVE-2026-6253 curl: fix CVE-2026-6429 curl: fix CVE-2026-7168 curl: fix CVE-2026-4873 Himanshu Jadon (1): python3-pip: set CVE_PRODUCT Jaipaul Cheernam (4): libssh2: fix CVE-2026-66032 libssh2: fix CVE-2026-66033 libssh2: fix CVE-2026-66034 libssh2: fix CVE-2026-66035 Maik Otto (1): u-boot: Set CVE_PRODUCT Marta Rybczynska (1): flex: update CVE_PRODUCT Peter Marko (5): xserver-org: update CVE_PRODUCT shadow: set CVE_PRODUCT sudo: set CVE_PRODUCT busybox: patch CVE-2026-38754 libsndfile1: patch CVE-2026-37555 mark.yang (5): python3-pyopenssl: set CVE_PRODUCT python3-idna: set CVE_PRODUCT python3-certifi: set CVE_PRODUCT python3-xmltodict: set CVE_PRODUCT python3-pyyaml: set CVE_PRODUCT meta/recipes-bsp/u-boot/u-boot.inc | 2 + .../busybox/busybox/CVE-2026-38754.patch | 155 +++++++ meta/recipes-core/busybox/busybox_1.36.1.bb | 1 + .../expat/expat/CVE-2026-56132_p1.patch | 80 ++++ .../expat/expat/CVE-2026-56132_p2.patch | 60 +++ .../expat/expat/CVE-2026-56132_p3.patch | 74 +++ .../expat/expat/CVE-2026-56132_p4.patch | 60 +++ .../expat/expat/CVE-2026-56132_p5.patch | 56 +++ .../expat/expat/CVE-2026-56403_p1.patch | 81 ++++ .../expat/expat/CVE-2026-56403_p2.patch | 52 +++ .../expat/expat/CVE-2026-56404.patch | 45 ++ .../expat/expat/CVE-2026-56405.patch | 30 ++ .../expat/CVE-2026-56406-dependent.patch | 59 +++ .../expat/expat/CVE-2026-56406.patch | 34 ++ .../expat/expat/CVE-2026-56407.patch | 41 ++ .../expat/expat/CVE-2026-56408.patch | 29 ++ .../expat/expat/CVE-2026-56409.patch | 51 +++ .../expat/expat/CVE-2026-56410_p1.patch | 46 ++ .../expat/expat/CVE-2026-56410_p2.patch | 39 ++ .../expat/expat/CVE-2026-56411.patch | 50 +++ meta/recipes-core/expat/expat_2.6.4.bb | 17 + meta/recipes-devtools/flex/flex_2.6.4.bb | 2 +- .../python/python3-certifi_2024.2.2.bb | 2 + .../python/python3-idna_3.7.bb | 2 + .../python/python3-pip_24.0.bb | 2 + .../python/python3-pyopenssl_24.0.0.bb | 1 + .../python/python3-pyyaml_6.0.1.bb | 2 + .../python/python3-xmltodict_0.13.0.bb | 2 + .../python/python3/CVE-2026-7210.patch | 148 ++++++ .../python/python3_3.12.13.bb | 1 + meta/recipes-extended/shadow/shadow.inc | 2 + meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 + .../xorg-xserver/xserver-xorg.inc | 2 +- .../linux/linux-yocto-rt_6.6.bb | 6 +- .../linux/linux-yocto-tiny_6.6.bb | 6 +- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +- meta/recipes-kernel/perf/perf.bb | 5 +- .../libsndfile1/CVE-2026-37555.patch | 44 ++ .../libsndfile/libsndfile1_1.2.2.bb | 1 + .../curl/curl/CVE-2026-4873.patch | 58 +++ .../curl/curl/CVE-2026-5545.patch | 42 ++ .../curl/curl/CVE-2026-6253.patch | 392 ++++++++++++++++ .../curl/curl/CVE-2026-6429.patch | 367 +++++++++++++++ .../curl/curl/CVE-2026-7168.patch | 425 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 5 + .../gnutls/gnutls/CVE-2026-3833.patch | 90 ++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + .../libssh2/libssh2/CVE-2025-15661-1.patch | 45 ++ .../libssh2/libssh2/CVE-2025-15661-2.patch | 131 ++++++ .../libssh2/libssh2/CVE-2025-15661-3.patch | 57 +++ .../libssh2/libssh2/CVE-2026-66032.patch | 36 ++ .../libssh2/libssh2/CVE-2026-66033.patch | 45 ++ .../libssh2/libssh2/CVE-2026-66034.patch | 40 ++ .../libssh2/libssh2/CVE-2026-66035.patch | 56 +++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 7 + 55 files changed, 3091 insertions(+), 26 deletions(-) create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38754.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-7210.patch create mode 100644 meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-4873.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5545.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6253.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch

Message ID	cover.1787154074.git.fabien.thomas@smile.fr
State	Not Applicable, archived
Headers	show Return-Path: <fabien.thomas@smile.fr> ip: 209.85.221.41, mailfrom: fabien.thomas@smile.fr) From: Fabien Thomas <fabien.thomas@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 00/37] Patch review Date: Wed, 19 Aug 2026 17:56:31 +0200 Message-ID: <cover.1787154074.git.fabien.thomas@smile.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit

[scarthgap,00/37] Patch review

Pull-request

Message