new file mode 100644
@@ -0,0 +1,64 @@
+From d66aa48babddfa0dad0b391917c7bdd6f509ff41 Mon Sep 17 00:00:00 2001
+From: tbeu <tbeu@users.noreply.github.com>
+Date: Thu, 28 May 2026 17:26:57 +0200
+Subject: [PATCH] Validate VL datatype type during decode and check file
+ pointer in H5T_set_loc (#6395)
+
+H5O__dtype_decode_helper() reads vlen.type from the file without
+validation. With corrupted HDF5 files (e.g. from fuzzing), this field
+can have an invalid value that is neither H5T_VLEN_SEQUENCE nor
+H5T_VLEN_STRING, which later triggers assert(0) in H5T__vlen_set_loc()
+(debug builds) or a NULL pointer dereference / SEGV in release builds.
+
+Fix by:
+1. Adding a validation check in H5O__dtype_decode_helper() immediately
+ after reading the vlen.type field, returning an error if the value
+ is invalid.
+2. Adding a NULL file pointer check in H5T_set_loc() before calling
+ H5T__vlen_set_loc() when loc == H5T_LOC_DISK, so the low-level
+ assert(file) invariant is never violated.
+
+This fixes the root cause at the decode level where the bad value
+enters the system, as requested in review of #6378 and #6385.
+
+Found by OSS-Fuzz via the matio fuzzer (ClusterFuzz testcase
+5366895365914624).
+
+CVE: CVE-2026-17574
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc]
+
+(cherry picked from commit 3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/H5Odtype.c | 2 ++
+ src/H5T.c | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/src/H5Odtype.c b/src/H5Odtype.c
+index 085ce24cd0..5022f43d7c 100644
+--- a/src/H5Odtype.c
++++ b/src/H5Odtype.c
+@@ -760,6 +760,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
+ */
+ /* Set the type of VL information, either sequence or string */
+ dt->shared->u.vlen.type = (H5T_vlen_type_t)(flags & 0x0f);
++ if (dt->shared->u.vlen.type != H5T_VLEN_SEQUENCE && dt->shared->u.vlen.type != H5T_VLEN_STRING)
++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "invalid VL datatype type");
+ if (dt->shared->u.vlen.type == H5T_VLEN_STRING) {
+ dt->shared->u.vlen.pad = (H5T_str_t)((flags >> 4) & 0x0f);
+ dt->shared->u.vlen.cset = (H5T_cset_t)((flags >> 8) & 0x0f);
+diff --git a/src/H5T.c b/src/H5T.c
+index 1b4e182cce..f49b2b78cf 100644
+--- a/src/H5T.c
++++ b/src/H5T.c
+@@ -6362,5 +6362,10 @@ H5T_set_loc(H5T_t *dt, H5VL_object_t *file, H5T_loc_t loc)
+ ret_value = changed;
+ } /* end if */
++ /* Validate file pointer for disk-based VL types */
++ if (loc == H5T_LOC_DISK && NULL == file)
++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL,
++ "NULL file pointer for disk-based VL datatype");
++
+ /* Mark this VL sequence */
+ if ((changed = H5T__vlen_set_loc(dt, file, loc)) < 0)
+ HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "Unable to set VL location");
@@ -32,6 +32,7 @@ SRC_URI = " \
file://CVE-2025-6857.patch \
file://CVE-2026-17572.patch \
file://CVE-2026-17573.patch \
+ file://CVE-2026-17574.patch \
"
SRC_URI[sha256sum] = "019ac451d9e1cf89c0482ba2a06f07a46166caf23f60fea5ef3c37724a318e03"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc [2] https://nvd.nist.gov/vuln/detail/CVE-2026-17574 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../hdf5/files/CVE-2026-17574.patch | 64 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_1.14.4-3.bb | 1 + 2 files changed, 65 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch