new file mode 100644
@@ -0,0 +1,60 @@
+From 0472315404dc03d0e89eec4513eb80930f9b176e Mon Sep 17 00:00:00 2001
+From: PGZXB <420254146@qq.com>
+Date: Fri, 9 Oct 2026 02:52:55 +0800
+Subject: [PATCH] Fix StackOverflow when calling `H5Gget_info` (#6685)
+
+Verify B-tree node level when an expected level value is provided
+
+(cherry picked from commit 5933130b610c7bd6e66fe93c2798b97e3f3188c8)
+
+CVE: CVE-2026-120689
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/5933130b610c7bd6e66fe93c2798b97e3f3188c8]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ release_docs/CHANGELOG.md | 6 ++++++
+ src/H5B.c | 14 ++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/release_docs/CHANGELOG.md b/release_docs/CHANGELOG.md
+index c181f174bbb..b5c99cd4b16 100644
+--- a/release_docs/CHANGELOG.md
++++ b/release_docs/CHANGELOG.md
+@@ -778,6 +778,12 @@ Added Fortran wrapper `h5fdsubfiling_get_file_mapping_f()` for the subfiling fil
+
+ A malformed HDF5 file could have an attribute with a recorded name length of zero.This would lead to an overflow and an invalid memory access. An integrity check has been added to detect this case and safely stop file decoding.
+
++### Fixed a stack overflow when iterating a corrupted B-tree
++
++ `H5B__iterate_helper()` now verifies that a B-tree node it has just protected has the level the traversal expects, when the expected level is known. The equivalent check in `H5B__cache_deserialize()` only runs when a node is first loaded into the metadata cache, so a corrupted B-tree whose child pointer revisits a node that is already cached (for example, a node that points to itself) could bypass that check and recurse without bound until the stack was exhausted. Such a file is now rejected with an error instead of crashing. This was observed through `H5Gget_info()`.
++
++ Fixes GitHub issue #6403
++
+ ## Java Library
+
+ ### Renamed the Callbacks.java file to H5Callbacks.java
+diff --git a/src/H5B.c b/src/H5B.c
+index c9571708b73..4c6b1a55480 100644
+--- a/src/H5B.c
++++ b/src/H5B.c
+@@ -1140,6 +1140,20 @@ H5B__iterate_helper(H5F_t *f, const H5B_class_t *type, haddr_t addr, int exp_lev
+ if (NULL == (bt = (H5B_t *)H5AC_protect(f, H5AC_BT, addr, &cache_udata, H5AC__READ_ONLY_FLAG)))
+ HGOTO_ERROR(H5E_BTREE, H5E_CANTPROTECT, H5_ITER_ERROR, "unable to load B-tree node");
+
++ /* Check for a corrupted B-tree node. If the caller has told us what
++ * level to expect, verify that the node we just protected actually has
++ * that level. This check must be performed here rather than relying
++ * solely on the equivalent check in H5B__cache_deserialize, because
++ * that deserialize callback only runs when a node is first loaded into
++ * the metadata cache. A corrupted B-tree whose child pointer revisits
++ * a node that is already cached (e.g. a node that points to itself)
++ * bypasses the deserialize callback entirely, so without this check the
++ * recursion below would never terminate and would overflow the stack.
++ */
++ if (exp_level != H5B_UNKNOWN_NODELEVEL && bt->level != (unsigned)exp_level)
++ HGOTO_ERROR(H5E_BTREE, H5E_BADVALUE, H5_ITER_ERROR,
++ "B-tree node level is not as expected, possibly corrupted");
++
+ /* Iterate over node's children */
+ for (u = 0; u < bt->nchildren && ret_value == H5_ITER_CONT; u++) {
+ if (bt->level > 0)
@@ -24,6 +24,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://CVE-2026-19025.patch \
file://CVE-2026-19026-CVE-2026-19027-CVE-2026-19028.patch \
file://CVE-2026-19023-CVE-2026-19024.patch \
+ file://CVE-2026-120689.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"