new file mode 100644
@@ -0,0 +1,47 @@
+From 183c8aeb601a02a38dd6815bcb651a7317b1b647 Mon Sep 17 00:00:00 2001
+From: Glenn Song <43005495+glennsong09@users.noreply.github.com>
+Date: Thu, 9 Oct 2025 07:51:49 -0500
+Subject: [PATCH] Fix CVE-2025-2153 (#5795)
+
+This PR fixes #5329. Previously, the message flags field was able to be modified such that a message that is not sharable according to the share_flags field in H5O_msg_class_t could be treated as sharable. A check has been added to make sure messages that are not sharable can't be modified so that they indicate they can be shared.
+
+The bug was first reproduced using the fuzzer and the POC file from #5329. With this change, the heap based buffer overflow no longer occurs.
+
+CVE: CVE-2025-2153
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/38954615fc079538aa45d48097625a6d76aceef0]
+
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+---
+ src/H5Ocache.c | 4 ++--
+ src/H5Omessage.c | 3 +++
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/H5Ocache.c b/src/H5Ocache.c
+index 87f321c..12c30cf 100644
+--- a/src/H5Ocache.c
++++ b/src/H5Ocache.c
+@@ -1399,8 +1399,8 @@ H5O__chunk_deserialize(H5O_t *oh, haddr_t addr, size_t chunk_size, const uint8_t
+ else {
+ /* Check for message of unshareable class marked as "shareable"
+ */
+- if ((flags & H5O_MSG_FLAG_SHAREABLE) && H5O_msg_class_g[id] &&
+- !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
++ if (((flags & H5O_MSG_FLAG_SHARED) || (flags & H5O_MSG_FLAG_SHAREABLE)) &&
++ H5O_msg_class_g[id] && !(H5O_msg_class_g[id]->share_flags & H5O_SHARE_IS_SHARABLE))
+ HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, FAIL,
+ "message of unshareable class flagged as shareable");
+
+diff --git a/src/H5Omessage.c b/src/H5Omessage.c
+index 7190e46..fb9006c 100644
+--- a/src/H5Omessage.c
++++ b/src/H5Omessage.c
+@@ -354,6 +354,9 @@ H5O__msg_write_real(H5F_t *f, H5O_t *oh, const H5O_msg_class_t *type, unsigned m
+ */
+ assert(!(mesg_flags & H5O_MSG_FLAG_DONTSHARE));
+
++ /* Sanity check to see if the type is not sharable */
++ assert(type->share_flags & H5O_SHARE_IS_SHARABLE);
++
+ /* Remove the old message from the SOHM index */
+ /* (It would be more efficient to try to share the message first, then
+ * delete it (avoiding thrashing the index in the case the ref.
@@ -11,11 +11,11 @@ inherit cmake siteinfo qemu multilib_header multilib_script
DEPENDS += "qemu-native zlib"
-SRC_URI = " \
- https://support.hdfgroup.org/releases/hdf5/v1_14/v1_14_6/downloads/${BPN}-${PV}.tar.gz \
- file://0002-Remove-suffix-shared-from-shared-library-name.patch \
- file://0001-cmake-remove-build-flags.patch \
-"
+SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v1_14/v1_14_6/downloads/${BPN}-${PV}.tar.gz \
+ file://0002-Remove-suffix-shared-from-shared-library-name.patch \
+ file://0001-cmake-remove-build-flags.patch \
+ file://0001-Fix-CVE-2025-2153-5795.patch \
+ "
SRC_URI[sha256sum] = "e4defbac30f50d64e1556374aa49e574417c9e72c6b1de7a4ff88c4b1bea6e9b"
FILES:${PN} += "${libdir}/libhdf5.settings ${datadir}/*"
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2153 Pick the patch that resolved the issue from the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> --- .../files/0001-Fix-CVE-2025-2153-5795.patch | 47 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_1.14.6.bb | 10 ++-- 2 files changed, 52 insertions(+), 5 deletions(-) create mode 100644 meta-oe/recipes-support/hdf5/files/0001-Fix-CVE-2025-2153-5795.patch