[meta-oe,7/7] polkit: upgrade 127 -> 128

diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch
deleted file mode 100644
index 96548ca771..0000000000
--- a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-01.patch
+++ /dev/null
@@ -1,64 +0,0 @@ 
-From 7e122c8a5120c2aae2d9d44a26796dc18f5b677c Mon Sep 17 00:00:00 2001
-From: Jan Rybar <jrybar@redhat.com>
-Date: Fri, 27 Mar 2026 15:57:01 +0100
-Subject: [PATCH] CVE-2026-4897 - getline() string overflow
-
-Report and fix by Aisle.com
-Pavel Kohout, Aisle Research
-
-Signed-off-by: Jan Rybar jrybar@redhat.com
-
-CVE: CVE-2026-4897
-Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/7e122c8a5120c2aae2d9d44a26796dc18f5b677c]
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- src/polkitagent/polkitagenthelperprivate.c | 23 +++++++++++++---------
- 1 file changed, 14 insertions(+), 9 deletions(-)
-
-diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
-index 35bca85..7e4f94e 100644
---- a/src/polkitagent/polkitagenthelperprivate.c
-+++ b/src/polkitagent/polkitagenthelperprivate.c
-@@ -24,6 +24,7 @@
- #include <stdio.h>
- #include <string.h>
- #include <stdlib.h>
-+#include <errno.h>
- #include <unistd.h>
- 
- #ifndef HAVE_CLEARENV
-@@ -59,21 +60,25 @@ read_cookie (int argc, char **argv)
-     return strdup (argv[2]);
-   else
-     {
--      char *ret = NULL;
--      size_t n = 0;
--      ssize_t r = getline (&ret, &n, stdin);
--      if (r == -1)
-+      #define POLKIT_AGENT_MAX_COOKIE 4096
-+      char buf[POLKIT_AGENT_MAX_COOKIE + 2]; /* +1 for newline, +1 for NUL */
-+      if (fgets (buf, sizeof(buf), stdin) == NULL)
-         {
-           if (!feof (stdin))
--            perror ("getline");
--          free (ret);
-+            perror ("fgets");
-           return NULL;
-         }
--      else
-+      if (buf[strlen (buf) - 1] != '\n')
-         {
--          g_strchomp (ret);
--          return ret;
-+          /* Cookie too long - drain remaining input and reject */
-+          int c;
-+          while ((c = getchar ()) != '\n' && c != EOF)
-+            ;
-+          errno = EOVERFLOW;
-+          return NULL;
-         }
-+      g_strchomp (buf);
-+      return strdup (buf);
-     }
- }
- 
diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch
deleted file mode 100644
index c47eee2014..0000000000
--- a/meta-oe/recipes-extended/polkit/files/CVE-2026-4897-02.patch
+++ /dev/null
@@ -1,32 +0,0 @@ 
-From 39601309eb3e5e88a1c1fbda9a272ba8691f1bf3 Mon Sep 17 00:00:00 2001
-From: Jan Rybar <jrybar@redhat.com>
-Date: Wed, 13 May 2026 14:58:32 +0200
-Subject: [PATCH] Draining loop can keep polkit busy
-
-The draining loop is not really appropriate for pipe input, especially
-in a daemon.
-
-Co-authored-by: Frantisek Sumsal <fsumsal@redhat.com>
-
-CVE: CVE-2026-4897
-Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/39601309eb3e5e88a1c1fbda9a272ba8691f1bf3]
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- src/polkitagent/polkitagenthelperprivate.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
-index 7e4f94e..c0a9825 100644
---- a/src/polkitagent/polkitagenthelperprivate.c
-+++ b/src/polkitagent/polkitagenthelperprivate.c
-@@ -70,10 +70,6 @@ read_cookie (int argc, char **argv)
-         }
-       if (buf[strlen (buf) - 1] != '\n')
-         {
--          /* Cookie too long - drain remaining input and reject */
--          int c;
--          while ((c = getchar ()) != '\n' && c != EOF)
--            ;
-           errno = EOVERFLOW;
-           return NULL;
-         }
diff --git a/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch b/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch
deleted file mode 100644
index 891d9215c9..0000000000
--- a/meta-oe/recipes-extended/polkit/files/CVE-2026-85498.patch
+++ /dev/null
@@ -1,38 +0,0 @@ 
-From eea172967848bb4c5a407329f40c0e45de0d187e Mon Sep 17 00:00:00 2001
-From: Jan Rybar <jrybar@redhat.com>
-Date: Thu, 27 Aug 2026 15:02:45 +0200
-Subject: [PATCH] CVE-2026-85498: Unsanitized underflow in cookie input
-
-Credits for the report:
-Sunwoo Lee, Korea Institute of Energy Technology (KENTECH)
-Daeyoung Kang, Korea Institute of Energy Technology (KENTECH)
-Haeryong Park, Korea Internet & Security Agency (KISA)
-Hyuk Lim, Korea Institute of Energy Technology (KENTECH)
-Seunghyun Yoon, Korea Institute of Energy Technology (KENTECH)
-Juthawong Naisanguansee
-
-Co-authored-by: Jan Rybar <jrybar@redhat.com>
-
-CVE: CVE-2026-85498
-Upstream-Status: Backport [https://github.com/polkit-org/polkit/commit/eea172967848bb4c5a407329f40c0e45de0d187e]
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- src/polkitagent/polkitagenthelperprivate.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/polkitagent/polkitagenthelperprivate.c b/src/polkitagent/polkitagenthelperprivate.c
-index c0a9825..e2d2c9b 100644
---- a/src/polkitagent/polkitagenthelperprivate.c
-+++ b/src/polkitagent/polkitagenthelperprivate.c
-@@ -68,6 +68,11 @@ read_cookie (int argc, char **argv)
-             perror ("fgets");
-           return NULL;
-         }
-+      if (buf[0] == '\0')
-+        {
-+          errno = EINVAL;
-+          return NULL;
-+        }
-       if (buf[strlen (buf) - 1] != '\n')
-         {
-           errno = EOVERFLOW;
diff --git a/meta-oe/recipes-extended/polkit/polkit_127.bb b/meta-oe/recipes-extended/polkit/polkit_128.bb
similarity index 95%
rename from meta-oe/recipes-extended/polkit/polkit_127.bb
rename to meta-oe/recipes-extended/polkit/polkit_128.bb
index acd4386354..61dcdd0cb8 100644
--- a/meta-oe/recipes-extended/polkit/polkit_127.bb
+++ b/meta-oe/recipes-extended/polkit/polkit_128.bb
@@ -7,12 +7,9 @@  BUGTRACKER = "https://github.com/polkit-org/polkit/issues"
 
 SRC_URI = "\
     git://github.com/polkit-org/polkit.git;protocol=https;branch=main;tag=${PV} \
-    file://CVE-2026-4897-01.patch \
-    file://CVE-2026-4897-02.patch \
-    file://CVE-2026-85498.patch \
 "
 
-SRCREV = "9e4894c969eecf26a3ba762f4f7a268aa0fb3e51"
+SRCREV = "e6373dc19975d8583568c6cd7025d03e682ca956"
 
 DEPENDS = "expat glib-2.0 duktape"