mbox

[scarthgap,0/1] Pull request for CVE-2026-CVE-2026-123158

Message ID cover.1794323281.git.yoann.congal@smile.fr
State Not Applicable, archived
Headers show

Pull-request

https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-next

Message

Yoann Congal Nov. 10, 2026, 3:27 p.m. UTC 
This is an expedited Pull request to fix CVE-2026-123158 (aka
"sshhole").

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/5099
* qemux86-tc failed with 14259 – AB-INT: NFS mounting issue on qemu
  oe-selftest glibc.GlibcSelfTestSystemEmulated.test_glibc
  => retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/28/builds/4967
*  oe-selftest-armhost, oe-selftest-debian, oe-selftest-fedora failed on
   recipetool.RecipetoolCreateTests.test_recipetool_create_go
   | AssertionError: Items in the first set but not the second:
   | "${@go_src_uri('github.com/protocolbuffers/protobuf-go','v1.28.1',path='google.golang.org/protobuf')}"
   I think:
   * this is due to a recent change upstream[0], and
   * this is unrelated to this series (I reproduced the error locally without
     the CVE-2026-123158 fix.
   Given the expedited nature of this series, I think we should merge
   this CVE-2026-123158 fix and handle the selftest fix in the usual
   review cycle (most likely by backporting [1] from master to
   scarthgap)

[0]: https://github.com/protocolbuffers/protobuf-go/commit/b0087d0ecfdf237f44579eee415010405f329f17
[1]: https://git.openembedded.org/openembedded-core/commit/?id=d1256f8ff4a94d4f32b2b9ca855359dd2d691beb

The following changes since commit d40b840d5c7e7b0f9e94c2b434010fb63b306a72:

  util-linux: patch CVE-2026-53615 (2026-11-03 23:41:28 +0100)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-next
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-next

for you to fetch changes up to fc4316861becc9f0d41857b49f6438929ab4c291:

  openssh: fix CVE-2026-123158 (aka "sshhole") (2026-11-10 10:47:42 +0100)

----------------------------------------------------------------

Yoann Congal (1):
  openssh: fix CVE-2026-123158 (aka "sshhole")

 .../openssh/openssh/CVE-2026-123158.patch     | 191 ++++++++++++++++++
 .../openssh/openssh_9.6p1.bb                  |   1 +
 2 files changed, 192 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-123158.patch