From patchwork Tue Jul 21 14:23:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 93047 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA566C44529 for ; Tue, 21 Jul 2026 14:23:52 +0000 (UTC) Received: from DB3PR0202CU003.outbound.protection.outlook.com (DB3PR0202CU003.outbound.protection.outlook.com [52.101.84.62]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.24041.1784643828365687799 for ; Tue, 21 Jul 2026 07:23:48 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=ze0L5+gp; spf=pass (domain: est.tech, ip: 52.101.84.62, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=hnUo5v60W9WUb2qXOr0PkuTBWDjicWl8uGD0+h6ZRFf4KWtagFrJEcytwQWYc+8LHc3/f83QBufKFqNK4i0HvzizM3DQqId7SIYo0vYLPA373X7Aq3IAb4PtJcIn8BHV8tzP9VwuI6a9Md3v6TGI4skn99OvWLCRGaswdcjg0DKthRRI/2UWGnMTpjAF1mbmZ3T7c5UbR9AvcGY8b+JMZrEn9oSlkTnTblnlE/fpebfs+wS2/EIO6EyIgUuCz01ceQNDd44nrVjsmU8X5uxvmHRiGoXqJEC26Zt4v2atAqh11Lz5JU3QVYpwV70+zbWqfnDdVGmmlzal69FVbWalYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=J5q7N+Pi21W+hKtMHAny2CcktbYBN0nNt35gxSCc1/4=; b=YtHtGl6NhiXaoDChc1fgNmAjiw135FnXkpa732WyDFpolLw8F0AJAZUVV1fXO6NVWeXYGTLHZQKO6sNTGH3ARBqlNDjyswFWzXLV9kvtNU1jM0c2vw3RUTS2BLPZfOkq1326EY5QRaDzAZqFWoJQiUED8vUt+XQXrhhvpG4Ixo/GVU3aIvZXcits7m8/uE3Tw9q8qs0it2fiUFhm1hppZydcdwCCHsGvsfOPUyutj9NlquyrXiHGpJGDwUBGiBlC6gkv3rWaHUtINqkdkZD4ToSroeoNGzvNw+pDXjisHpSffWQR8XAZC3gKebm3BrtWB2IBGW9dROriwrUpXZZ9AA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=J5q7N+Pi21W+hKtMHAny2CcktbYBN0nNt35gxSCc1/4=; b=ze0L5+gpvQzz4/gNh5UXAM3/S6cH+vSMkCBXqBkdDASWTOGS+CL029k6LUa3/L3bnHVvrGPbGXykfxfjVk8sEIlTKfxTJTZtmyWAsrYxjPyrVOMavRA2YYZ3ueeH6Z88U3qwiGQf4Ovljm2GdA8BCS4DdAC3pj9sTorKqsLpcvne45nYVzO4Ey1q7Bdd047ewTU1pdvDIV/3uM81U/HXGxZouqSsFz74wYo+bfKrDvwvKOKXArP4UDi+u0ecK4Zl/bpZ6bOFGK7nb8B7xMKhE3E6Q/Ozk6aKEpHxfj2P0pTPuqCRyx1vSROuyFlhJnF2TCP0maumfIe7w1xCRty3sQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by AM7P189MB0850.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:173::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 14:23:45 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 14:23:45 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH v2 1/3] perl: fix CVE-2026-13221 Date: Tue, 21 Jul 2026 16:23:34 +0200 Message-ID: <20260721142336.21513-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260721142336.21513-1-jaipaul.cheernam@est.tech> References: <20260721134616.16538-1-jaipaul.cheernam@est.tech> <20260721142336.21513-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2PR04CA0179.eurprd04.prod.outlook.com (2603:10a6:10:2b0::34) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|AM7P189MB0850:EE_ X-MS-Office365-Filtering-Correlation-Id: 6829e7ec-59fc-4794-8710-08dee733ac86 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|11063799006|4143699003|12006099003|56012099006|10067099003|6133799003|22082099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: zLfExOLNXMa8Si+nHj+ZjOe5+VpiZolBISTSLdT+4MYLQ/lgkL3rq49iBFSNEwGWH5SgmgzbKdnCPZpltMcvVdgNsaCDd5TdG6/TVhwtl7y09xx2C2wS5Fn8DZNpaWQLhIZXQXCnCCiNXo/q9aPvSWopEI34NDJDJhUzdQWRk9RqbjmsOtf/nodj6RbLlE1nlNKt6FeCFSSajlJ9CrjtVbwiBGYBo4L64O72RYeFnRdu3oCTVD18oGGWGcL7kZCeTtfiBdoFmVYaS+KffYKKNhb4dzWi9jSY8fupbg9TxCNRGz5YaupSqy1/9yQvMDSbgmHbSP5AQbwpGsOctYrwsgYHbhwwSz5V93yxK0mQPFSU+O1rGh4Bk+jpEVmvPDBvh3G/alASny+kg0++8MS5hNXzD5L2LXFMaD9ixQDqg/g44BTFs71mR+s+bGaImcZhD8dsSCvO+PeMzhUAXUICRZjz8ZQ7YrqK//xbUCXL153dQYSt+g1vN6R+AU6qO1nE+wvyDDpRGw3QUiVWnChIdqq3//L4qSMGmibCeRNL/FSW+ES9/1JK6YYs0nLRPswEKbNhrfnPLsFxzUI6/Q+O1/MoUGN19hGn910lEBJfQdEpH4BMuMzPPd1LQZxs8NKK X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(11063799006)(4143699003)(12006099003)(56012099006)(10067099003)(6133799003)(22082099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 0wivt5hmkIo9Cz3x0vHBrn9baj5KijfUm1zm9IsnKwKTf36Ov51Rpl9FzaPE0oerMZNRV5/cCDHbs1BFx1S0ubWBxcOsJh5nRQzWcHglncTlYgcJd8ZeJlvXKsFbMB6SdiMbwAl7muWD6Cv3Gme92BPd+y2TenIJCRX0rhWJfpYSZSdOLI2PqqRFtq4WB1up90+La05HkhsAzOmw7T1tdEovesBR9SsI6wkLEHYrqhfZ4VyIMSJ9QCmz0hed530eRfuG+lGGTpfCkWNXzwF9FAjokM+pWcmExvz1yfB0iNF1r35++0k2cEBbHSrAcLec+ezhyVrEKjrWHmhyBxkMrvsdRAPGNH1HMF8X7abCzviEsqrSzJJxlv3wLkqIHqMUayNtYG9qaGfmkxLC7w8lIeNNxwsabLMNhL0JExg9zMqjKN3Ibz/tSXHQqC3CPbKTYYTila3hSMwxtDtESxSQY7u0+lhsr8fKbsddbSFzGi/r0ZViP2EwYEgjA8bIgOzcLnvB+5qKbPuvFAx8YR+z4veutk7dmtKdcjFPdAy8dacjKMsnaa4SsSUNQlNEz4TLk7TOD+Tv6N3S3afVgpHIUZ5wRYeuR6hy+y5a5XDl+Ir2bCCcmIBQha6tpgBNSSrFS9AWGcu1YV9G1lLV6VSqbryUvT50/G1GAmLoFD7vdJnsvQxrcKPXhxWCkJ5VYrhnWwtC4EkXUqDI4uEvStgye6Wiy3xVmHkk9SmM8EsNe20kVUUzcMyZLiGuEfteoSSwIAef7vWbcQMtGaDha8CXmmK1wuK/zlM6zzFA0UpZGINoYgReiIB/9Sc0ttmNnKHEXff8rNXU31lqHHgIqO3f/jmcPeGclpLeb/BcjzCerHKJ1OUMU4LAtHDStY2gKAaUZ0LqieL8eVzs5QdsOA6OlIbtiCKeAdiAh+ppIMaG09Pys2Zf0Z8X7yQ5FNbA2o1QY5+Lp6jRIRbMv36no+PblPmsgCGIFoi7aLkZBFi3zIkRR+dTwuxIrlYZ4wcaJyv+wSaKccyJQvYWQv78qSk7QR4ROQWrbxP7dySIuFmA35f8YuqizZfVRFmvsWdYCqzeSSuQLzxBcc0oBEiut1fWxgsWsmcKWFadsCd50yeJMMzVZPmHnMpsfqKwj1XOwEeBHrjvDxJm+idljuEGdebxXGk6LZFRVr3j2JnzjmGirdqvHwZyOoBQ23Kaf3dhC6gVvv1FWhZuARI9lNw5p+FA7L6tvox2Fru4mUGGRVedtMMlSS1nJ6LqNRUU6vL2JmYPYqItk7adS75MWhHmbvJDYPxFa1O184r4f6CUv+ByKbD1dAiQNK8nM0aYnL3y7F/VKmR1i0l7HRLChWSnxZy+0khYzTO+J3AjMw3mN3AEVV6Db7LyJbzrPh39Go36UKlzs1M2xUaJwkDFtLN2meUoLEEKAPUQ3IeLpetf98Da1c6ES518UZtnMuTKHSkWyGvnZ8YVK8DmqSQODltr2kTEewpFE7GfvbQ6Og9fhNvNrlRHOHx26ozsmN4qLUnXWR7TsIaeqRWK1txW5EusMqclsV4H54YuFXgumBQKMo08dYzT3CpUR3t1tLKcsAjb84281HKSzIpe+URNLoNWhgva07zKYMSk1Hy1AF+Fhp5dh9TrPOpNNRPBAwpG3RJT69u3pU20Kk+BXjBU4NcVaEC329HlaKvm6MrYoTEG9Voyw19xOVFDEwDN/gSk6xKEULb5OWzDRPSLi6yF5FbWjksQ5MLPrS1Jz0t4ynIcL1Np7ts= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 6829e7ec-59fc-4794-8710-08dee733ac86 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jul 2026 14:23:45.8299 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UQFHW7z5hT/zvaUAjJ6NPG7X6X3ABvIZgv6Ujo4E3obpwcP0DSiXdcR2ovMds7UphgxU7eG6SxNY45V9v+3LmeDTbXQEhXoe3dJ+z8mvk28= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7P189MB0850 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 21 Jul 2026 14:23:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241536 This patch applies the upstream fix as referenced in [1], using the commit shown in [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2026-13221 [2] https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Signed-off-by: Jaipaul Cheernam --- .../perl/files/CVE-2026-13221.patch | 75 +++++++++++++++++++ meta/recipes-devtools/perl/perl_5.38.4.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-13221.patch b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch new file mode 100644 index 0000000000..03396f3e43 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch @@ -0,0 +1,75 @@ +From 03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Mon Sep 17 00:00:00 2001 +From: Karl Williamson +Date: Thu, 26 Mar 2026 10:13:49 -0600 +Subject: [PATCH] regcomp_study: Don't create a trie that would overflow + +This addresses GH #23388 + +The design of the trie compiling code is to batch extra long tries into +smaller chunks that fit into whatever limitations there are. However, +this ticket shows that that isn't always being done. + +In this case, a bunch of branches that have TAIL operands can be +combined together, and the final TAIL is used. And the code requires +that the delta between the first branch and this final TAIL fit into a +16-bit field. That is the root cause of this bug. + +I'm not familiar enough with the trie construction code to easily +understand why the final tail needs to be used here. So this patch +simply doesn't optimize a sequence of branches into a trie that would +overflow. + +This could be revisited by someone who knows more about this than I, or +earlier in the development cycle. + +CVE: CVE-2026-13221 +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7] +Signed-off-by: Jaipaul Cheernam +--- + regcomp_study.c | 10 ++++++++++ + t/re/pat_advanced.t | 9 +++++++++ + 2 files changed, 19 insertions(+) + +diff --git a/regcomp_study.c b/regcomp_study.c +index db7ab3a409..a1b2c3d4e5 100644 +--- a/regcomp_study.c ++++ b/regcomp_study.c +@@ -1933,6 +1933,16 @@ Perl_study_chunk(pTHX_ + tail = regnext( tail ); + } + ++ /* The code below currently saves the difference from ++ * start to finish in a 16-bit field, causing ++ * GH #23388. This defeats the design of batching ++ * tries into chunks that each fit. khw thinks it is ++ * too late in the 5.44 cycle to relook at the design, ++ * so for now anyway, don't make a trie that would ++ * overflow */ ++ if (tail - startbranch >= U16_MAX) { ++ continue; ++ } + + DEBUG_TRIE_COMPILE_r({ + regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state); +diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t +index 398680838d..c9e389ecb3 100644 +--- a/t/re/pat_advanced.t ++++ b/t/re/pat_advanced.t +@@ -4898,6 +4898,15 @@ EOF_DEBUG_OUT + $x =~ s/^[\x{0301}\x{030C}]+//; + } + ++ { # GH #23388 ++ fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow"); ++ my $x = join "|", "aaa".."mzz"; ++ my $y = join "|", "naa".."zzz"; ++ use re 'Debug'; ++ "fnord" =~ m/(?:$x)|(?:$y)/; ++ PROG ++ } ++ + + # !!! NOTE that tests that aren't at all likely to crash perl should go + # a ways above, above these last ones. There's a comment there that, like +-- +2.43.0 diff --git a/meta/recipes-devtools/perl/perl_5.38.4.bb b/meta/recipes-devtools/perl/perl_5.38.4.bb index 9f4cc1c404..8dccd34499 100644 --- a/meta/recipes-devtools/perl/perl_5.38.4.bb +++ b/meta/recipes-devtools/perl/perl_5.38.4.bb @@ -20,6 +20,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://0001-Fix-intermittent-failure-of-test-t-op-sigsystem.t.patch \ file://CVE-2026-8376-01.patch \ file://CVE-2026-8376-02.patch \ + file://CVE-2026-13221.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \ From patchwork Tue Jul 21 14:23:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 93046 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE9D8C44533 for ; Tue, 21 Jul 2026 14:23:52 +0000 (UTC) Received: from DB3PR0202CU003.outbound.protection.outlook.com (DB3PR0202CU003.outbound.protection.outlook.com [52.101.84.62]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.24041.1784643828365687799 for ; Tue, 21 Jul 2026 07:23:49 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=WzpJVpg8; spf=pass (domain: est.tech, ip: 52.101.84.62, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=fvl06k4CxqYEld+dsIOITZ2zYAK8b99PYCdC5slPbiVtSgzpgLnc5KQ2IuOzhLnESGovuPmaC4IBR5blOwjB47SJPZQ9+c7FUN9CRS3C/t62xShOoB5yAsnKzW0A5glUKRdKNvTqJj3RkHo4NdDRqNSXusYduP45w1ukQ/gafhqDu3zBZMZJz+6LU5bLgzz7q9/Ge4BahMUcVU1Y1xj3MTQZXom/5jIO1jk5Jplh3T4Se9sEcMfS5jEpnQy5+thVmzrWXPWbRvW1MzkX6SvhSolOv0EqQYHEsx0UmlsPkjxApt2OIp20wpIcrIbUXtf7vtDKVodp6k78QxbyOrc0PQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+R7g7Lwh1tvYYBV7/f2oLBgIrCbyGQs6xO+zzPzO92s=; b=huy0loCdiRRODLYvOrmN46VoTan4E/z+auuuTs7XFp7c1GQPh5hOW3OzIXzFkyW7OdNf5dv2N1sSbW6hWdCOYqyYpobhSfVW+FwQEsa/8p1oriiHP8vhZ6SX5A7Wk/p0IGco2dyz9RLtObzHUgSQ5j0T1GPw0G/8S1F8Xa9ab7r1yCETZs0fadYo7QkVW5OD4u6G4HsFt1CaJTihaF+Y7eVjC77+Sufl5EA6DU9JIPFLVdBh7mLc+m3JMAMzdm/Gb1x320weVFlsbpddvXGz1t61fFTiD/9PLdC4vglsStRnG+FgMprVMPgAhQdyQ45lJmhzaxWG76K0Geh67NJ1nQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+R7g7Lwh1tvYYBV7/f2oLBgIrCbyGQs6xO+zzPzO92s=; b=WzpJVpg8D64szSyRaxqJbRiYtHfJw5iZye9m+/aF04C0IFS9k9Rbv88wRAI321hs8c4EZHtAv/e7vP4CeJv1m66YpNgPb19j1d+c9ZZAdfu5/qfITRZO+K8Gc3+wQcYLKyBMzvKWZOPztqdIGGbz8RCWbueynKQge2vuyOUAAS2FhlFiHLXLzfWYHhcViQ14P3/xfzmo+m+Ksz40VOYZdxHRc86WWEQ2o60yL+RLddNZBWQmEIGWCR4OhLk8CGqjdxM+NKaeeowDv+WdhDGtNWrNZ/o09bxt1G77oxuJdXep1bfbsoh7pOtTKEtB3uE5BD/LRXcfzf78guaY/ulh3w== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by AM7P189MB0850.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:173::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 14:23:48 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 14:23:48 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH v2 2/3] perl: fix CVE-2026-57432 Date: Tue, 21 Jul 2026 16:23:35 +0200 Message-ID: <20260721142336.21513-3-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260721142336.21513-1-jaipaul.cheernam@est.tech> References: <20260721134616.16538-1-jaipaul.cheernam@est.tech> <20260721142336.21513-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2PR04CA0155.eurprd04.prod.outlook.com (2603:10a6:10:2b0::10) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|AM7P189MB0850:EE_ X-MS-Office365-Filtering-Correlation-Id: d5adca0a-078b-40f1-c34a-08dee733adcb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|11063799006|4143699003|12006099003|56012099006|10067099003|6133799003|22082099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: 87mNV8Qd0Gk67q7VFvkNkJ5SmZ1zcD9h/GwSmC2NBhLBSH6f936jQ/9d52a5vqSsC/xCsHoSTGpL0iXsPc1Rf2WYRVABk41XmyL4cqZsKF/DWemjFZNrAqpzIVxBsLaqxLlCB9W8WDvuMfad+cziOEdqiiIGpXXX8h8lyKtvm+3264iFxC8fOnbTMUMSE50px+tDF0aGMSvnwTF76qHj4LOnC0SuSESYIK81vY0QYW5L+cDdvvvhIAEASm/6HjylDBvtqmss6vbZUj5ijojKqbqPjy3/juw+1Xp7dr9QbQS7QSJrORqerZjMpetGu3JfuHK2zjYhzrQYTZGwvBswurLA4VGsjXj7Rw+lTVx/yi3YgwgXuJ5GMu8LfBwAOQoK7G6leQ+a+T+ECamFm6gyMGeN1/d8mHrJiOXh6St5iOEO9cSYxAUYgKSxUfUikRo1hAnUTOq9flrEPeNTlNUIiVwkCpIoN5IC9FTYvg3wF1pC9U9AVIKDT8bIIIWkocqf+ERHGaJuJ6LCcy9JWDOXhCjrslVGCUBURWjHceLSekoOWTizY81o0vOOz3jzdfTxpC3DlFrKSKbsltMEYXQcBlHuLSqIk7XpjHdkg4e93EI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(11063799006)(4143699003)(12006099003)(56012099006)(10067099003)(6133799003)(22082099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: LNE/CmTsYQKyypV2E7LXDNo/UbhotVtl/GqVa44NARtZK0JfpD1gA/+yDKk8oFxy09ssVjkqM6xdk1/dRhvcQNzpm1aut+HN589TyMHVS+BVUEjgP/gbR1Tpx4tJMOjW2Y4hZssczT1tPArUVw3Mqo7DeheeJxrfinmWwbj/up5N2AIcIKO/S28KwxP72IF7UVQWzcPNzNrsQnJpTs9jMKNA82qjn/RI23ZljcOSoidgMaGkLiGAUpBmjS3z4cL3oZIXCcDNwVYeKC3N+Mx3Nls+IJpWdL5pPY8yh5hbsM1K7G/eQqYE6WKOyDqbi96nMEu8S1lTRZQ4bYJPdKiMY0+APUcMAghRNSLMPJPPgG03nhKHnshbW6eBstgf4/ErAYHaBscUdPXG5B5BylemCtkGNsG2LNbRm38jFl6v8aCL7NF+JG1QJRCVGieE6HX49UmlO/pNFnQuQxozcZyL3socg590RawXKJeV3gsKjR3PcOiH3mFlMSpcgLuNd9HoDEdANG6RONi7jefhunsCD5UAxATemipmNI87vZePUKp1gPt5ZX/wHSt9aTxDp7c6+n/6VRO46CXN8+1a3qeTYdOMmEy5m5nsiK2ZL/LVAiOHGM/OKpKs0JXsg98YEarKji/xTXfl2XpakDHgjm6j6AlxqE4439ud+iErNMHt1YoQmD9i6Jig7Rq/ubBIM0n8Xw/iNtr0QENdeUhT98HGcYwzLWvifSlcBk/jTxcCdKH1jJelUcOJt1u4AHrMylHrz6MJmfHFjMuJQX0kdxS7r3RHo9SFVDlsq0MYhSpt0GYdt7oNHAOWvoLJEiulEVhm2gJMeQO5DPJ1kivfmlqcckhKLS0YDwtikR5/xYnAaF/dG77W7CE8/QheGcg25kN11lRV2QjZmv15Sn36EK57+aHU1OKDBDSi7D/kK1lcmp7muee5v5hu6n7QzWeDpNTHwQx0xH2tsbBovrYK5AMJiSW/YFuWLQfwp9BnN+BkK3hgXsCgMQ/x1/epxtvFnzCNYYCaG/GzxlywyWQmNSpW3GnlIx3LZyetE9D5cjOcCPCsfuqtNJlFTMpMGXGRU38ebd0BRJkyr4s3V4J6q0LQ9IOm0Mj7zEaFJfAbMCIKz8ixjiDztcrA7H1kv7yA6ERn1TXZPxsYfb2bxeaauC/PL3PCMukLLT3w9k/XS/L3wAYt7d4my9drOc/zfeGZkUz/JlrxUbhPIYBnrfuRW6aMbMPdizSguq1fUhS40bcDIJ2rq/lBKLbGCkEioH+rY8UhnVXBTf1YpsTAVqVTML5oLkcthi59A+5l6z/LnBK58xWP36X+OFgBZdzjdigrqqE8Os+sVpIJIwIAvlj583Tdl5AKA1QIO5yawpRs/FvCay1w9mnaHhyVtVdofHnTv1wWCdadTppG1LHybA0x2UbThksWrnO94P9MuZp0K8KfrWNt+bhZKEtHnCqKn6huXMl84UU8bZI4wlDysIJ/3GvNXxQbRYNNR2rz1w6vN2uhmihjvh0Vwdq11q9hPw467k9WwWIfAiCsP4altTSE+F9Msm58Z0IqmZnXlgrQM4Cg1eC33k4x7HU4Vrx2i0rEdKWiX+VsYYZVjA+0m6HjWHXpm9oBt+5hBhA5VyEx/Whuj3w2uCowv7Kt5EV4qgaYnpi8uA1/yMJO8TRZMZAEDWf6esObpLXa44PmCtfLJldbCKUVq/iL4tTRFmHQ9eLwWbHSvwPd1TAE2CBWYMR3dISQKC4vrTLaOT2P/58w+h7AJgc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: d5adca0a-078b-40f1-c34a-08dee733adcb X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jul 2026 14:23:47.9992 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 8I1012eSIHNtSTtM0A6SaTJvuePx4Evw1DoYBBdpQiSYqUUQowmD+gUVRVkwYgOLW2HEAPk3BNx4SL6Jcb/5wS1vA6/ifxsH+OFmPglEpJA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7P189MB0850 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 21 Jul 2026 14:23:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241537 This patch applies the upstream fix as referenced in [1], using the commits shown in [2] and [3]. [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57432 [2] https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 [3] https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e Signed-off-by: Jaipaul Cheernam --- .../perl/files/CVE-2026-57432-01.patch | 52 +++++++++++++++++++ .../perl/files/CVE-2026-57432-02.patch | 34 ++++++++++++ meta/recipes-devtools/perl/perl_5.38.4.bb | 2 + 3 files changed, 88 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch b/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch new file mode 100644 index 0000000000..ef92b0d7b2 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch @@ -0,0 +1,52 @@ +From 5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 Mon Sep 17 00:00:00 2001 +From: "Paul \"LeoNerd\" Evans" +Date: Sat, 9 May 2026 17:18:43 +0100 +Subject: [PATCH] pp_pack.c: Avoid ssize_t overflow when calculating the size + of a structure + +If the user has requested a size that would overflow a SSize_t, then the +only sensible thing to do is throw an exception, because the structure +this implies couldn't possibly fit into memory anyway. + +CVE: CVE-2026-57432 +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55] +Signed-off-by: Jaipaul Cheernam +--- + pod/perldiag.pod | 6 ++++++ + pp_pack.c | 4 ++++ + 2 files changed, 10 insertions(+) + +diff --git a/pod/perldiag.pod b/pod/perldiag.pod +index 841e22d580..d9231077363d 100644 +--- a/pod/perldiag.pod ++++ b/pod/perldiag.pod +@@ -4880,6 +4880,12 @@ mixed-case attribute name, instead. See L. + (F) You can't specify a repeat count so large that it overflows your + signed integers. See L. + ++=item Pack template structure size is too large ++ ++(F) You called C or C to operate on a structure, whose ++computed size is too large to fit in memory. This usually happens as a ++result of embedding a large number as the repeat count for an item. ++ + =item page overflow + + (W io) A single call to write() produced more lines than can fit on a +diff --git a/pp_pack.c b/pp_pack.c +index b5c0b261ef..6075e83aac 100644 +--- a/pp_pack.c ++++ b/pp_pack.c +@@ -528,6 +528,10 @@ S_measure_struct(pTHX_ tempsym_t* symptr) + break; + } + } ++ if ((size > 0) && ++ ((len > SSize_t_MAX / size) || /* detect overflow of len * size */ ++ (len * size > SSize_t_MAX - total))) /* detect overflow of total + len * size */ ++ croak("Pack template structure size is too large"); + total += len * size; + } + return total; +-- +2.43.0 diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch b/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch new file mode 100644 index 0000000000..273a247a88 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch @@ -0,0 +1,34 @@ +From 40754edc72dd3e513d758153c0e2f0215897740e Mon Sep 17 00:00:00 2001 +From: "Paul \"LeoNerd\" Evans" +Date: Mon, 11 May 2026 12:25:33 +0100 +Subject: [PATCH] pp_pack.c: Avoid some other potential overflows when + calculating sizes + +CVE: CVE-2026-57432 +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e] +Signed-off-by: Jaipaul Cheernam +--- + pp_pack.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/pp_pack.c b/pp_pack.c +index 6075e83aac..b2019902203a 100644 +--- a/pp_pack.c ++++ b/pp_pack.c +@@ -515,12 +515,12 @@ S_measure_struct(pTHX_ tempsym_t* symptr) + break; + case 'B': + case 'b': +- len = (len + 7)/8; ++ len = (len / 8) + !!(len % 8); + size = 1; + break; + case 'H': + case 'h': +- len = (len + 1)/2; ++ len = (len / 2) + !!(len % 2); + size = 1; + break; + +-- +2.43.0 diff --git a/meta/recipes-devtools/perl/perl_5.38.4.bb b/meta/recipes-devtools/perl/perl_5.38.4.bb index 8dccd34499..b4927646d7 100644 --- a/meta/recipes-devtools/perl/perl_5.38.4.bb +++ b/meta/recipes-devtools/perl/perl_5.38.4.bb @@ -21,6 +21,8 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://CVE-2026-8376-01.patch \ file://CVE-2026-8376-02.patch \ file://CVE-2026-13221.patch \ + file://CVE-2026-57432-01.patch \ + file://CVE-2026-57432-02.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \ From patchwork Tue Jul 21 14:23:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 93048 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0AE4C44529 for ; Tue, 21 Jul 2026 14:24:02 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.31]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.24044.1784643836382679990 for ; Tue, 21 Jul 2026 07:23:56 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=H2/5uJ/H; spf=pass (domain: est.tech, ip: 40.107.162.31, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=nBoLa5iq/thHlcOJhE5VQm7gO+1OMj7qN75jVbVYwUi/AEBG6M4mEG87UB2lcnWRRNjcdiw54bE/0DEogMqfJ16E9TZbdtujWj6FX5H6Al7+O7Szkt9P91NT1H2vPBYaXlTjVgoDFN96+6UoStA9jiBq/rzaF14BC9yuj2A8/aBbiTo2s2LqpkqTrwae9GU8kEdpitleNenTd/SRs66bBxe5aSMfji675Vr8JtRAC5Wo9x0Ik6TPpBoUHK+YZlJ0wcLSp67JhgUIgWLOqfQqZyhuzgeDYOTN+oi/hbfBciymtZTkgqioHXxU6LFjghAvhuXJC5DQx2OJCSRztDjqoQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6QIme0Fg+uZTtWn9H8oTW4eOEugLYHN48ql9Jctj7TA=; b=XxtrXONTxFjOs0i26t2r2qit7kZt31lKBXBMMU85IPEJwfxsIq9n/hGhYNBN9SoHAcQOQZwSAynhc901hT6pNWKh4auNA8pqjGVqITgqqLxKy3CV1uXa9qhOEmvDno77/DeJez/Z8oK0mspiCJCE5iGDp56xTB+i6hrSNu4IkYSk870w+HSdCoYKA627vHr4SwVq3tTJz9Ti06UOLGKdU5b+mPffyJTvEMONXpLrI2v3gJrIrYmRqR4mtMXSqYBxYKr1ZXCxqUzhQ1I0qquSk4pC1YYqMWjT0Ky993R2F4YR6Q9sXorGKHSqv2nj1hWHGsgul9kV4p3YktlQaPgUoA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6QIme0Fg+uZTtWn9H8oTW4eOEugLYHN48ql9Jctj7TA=; b=H2/5uJ/H70qDkdKGw9+CZ44FldOs794HnR5fUI1Ct5wC3sUR2oHI/08Z+LaPynNOnfWS2TPWYgnuoEPbJ8WOpYf9C+T1vsUgTR9X3CXAWhss1gNuwdmT5HHUNP4E8JTrYtK+8ckhvqEIS2gfnDpaq6wgpBHzETM5LCWQqcxV1Q48vTYIMuxX4FkwRUgq4bzS7blZMUaiz8HBR0sdnLE6ZRQQWae7xJiVcsYcLrQerIoetNkfOKQp0ziBeJ96a25eFR9hQ1EKE/AnesI03xqA2l0xf/LwINphiXUajiIewY/b4o5aq7OZ1vylaWvoCRhqXEJcJRl4IZXt97Ek3o0mQg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by AM7P189MB0850.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:173::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 14:23:50 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 14:23:50 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH v2 3/3] perl: fix CVE-2025-40909 Date: Tue, 21 Jul 2026 16:23:36 +0200 Message-ID: <20260721142336.21513-4-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260721142336.21513-1-jaipaul.cheernam@est.tech> References: <20260721134616.16538-1-jaipaul.cheernam@est.tech> <20260721142336.21513-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2PR04CA0170.eurprd04.prod.outlook.com (2603:10a6:10:2b0::25) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|AM7P189MB0850:EE_ X-MS-Office365-Filtering-Correlation-Id: fd2e97e3-3123-4ffc-1eca-08dee733af66 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|11063799006|4143699003|12006099003|56012099006|10067099003|25016099003|6133799003|29003799003|22082099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: KR/reyn4pq4Iv2zjvOXFnrrpXv/I62MhSQyDPcFtiU4/klAxeNO0tPQhR0LTa/jRksEV6MhaemT3+j2tHEMBJFWKtTGt6TLvie0EloxXd0pP/r/Zj0hbUbAC/xC93GKJC+M2vGSQjaHc3042zMy4tCixyPsXEFHp0SzFmb0BE3Tsa5wq/neC9cwsDPvi+fE7jihgEuKPyneN0mjqo2UGjzzZNgB5NP+9h6BJWcFVsbc0PiEeFFiGQSFc+0C0xW0QdSf69CHXYrIP3wJY0U8tHp3ykDSQSiFxz+sYLAawMgUwUdShPRRd0Lxa9+w+KfLY+Z+FohdDYc6YDbIp0/Rq7GG7vR6lfUPqz7gkZg+Tniq09wxtiPrORi+9uQ5bdGjWPFV5rPDP4BQNkaRlrfnbmyCXjzoz8ri5C+0NO7XFeccQUOaAdng99YwoPla4jwhluZNSUUX0gBb1a6QiMbjTpK4wPzjq5Mrly0HhruYsFuySD3r8DCOfanCB8eNK55lFkQnt/vuSO63GdmDxsnohfl8Pro2wLAJPzraqUFYV9n7gi7bJWhWx20uEAmnHRhRthSolciX3+CfOCv4ta1+zqH/8nGVgvikiZvu0gNKLzaGr1zhkT7V6Ld5MG37GxSZ9 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(11063799006)(4143699003)(12006099003)(56012099006)(10067099003)(25016099003)(6133799003)(29003799003)(22082099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6MdFDbzTQPxL+qQYVx8K8Vin9TKYK8i10zJKChn2opkltJoux6VOjO76GowReNzbd2OZi+uFzbt5e85PRTY45NtjO1uo3JJ9rtkDkx9a18dpSzI6JtFvoyaSFu9PBSUBwkpdOviz8ExxK1RsHhThHjum9F7/NUsv1TpA5JNJLi7yBqQHb7T/aW9yFDi1m+/8KF0kIlP9lJxD3taQYp/quk3YzdivDWsIC/8rj9CRlhPdpDrISUjNVl9Xs/5+QmV/dhMYwiAk1Sec9ryw6jrsZats3Heoj+vJVvqafmiJM6babNGHtCEG4UfbUPGe/Vvrq6bmdM6WqC9Hk+FK5WbGH+JrsKjWY251wNXwDc0yh/KedlZ8reZ1ryN75r2jYpcSQsRNXGPw+847MqUM8ZpAzO5+ADOZfzXy4+DvbbuOmYFv8CfUTV7/jkgC6IgWkaNfjTwLf7Qi6iPsbKGA1zW9Dk3rMo0yJzK47DtzhW9HeFrRULYKTgrFapl7e5q8KM34B7+gLVZP00zCNvPLfInBYgJWusQE1KNF1bPc9DLmOY8cDTnAwt070lfY2P6DjTJ4rSx9us397MOAEKM4GywOMGqzhfYWRpVZBjYBKCgTvvolKTMXawSBVOp7HRNiq0r/IoqevUkry5myAwUY4id6je4G3J18zuA1spazrZwa5iXnSvI9/m15NfE0LTTB4PS9XGBzFfEFscEoWoQvJasZolyAFODOuNHvPeticbqOIni4eTNcIo3MXysky5yutHN3NqwDlARHHGRF9LX/4+YwZKvi4i7GfzJoVthfaroCFiK3C8k35L3bJMmnSzWaVCMRjU+i9A8u4RTUKIoJSXS26rTS/kfhkHMjyUWTvprecXDhPJqge7wn6c8iLSUDPoz33ojufE9O74Nj9gHz7tlHlRSJ15+1UB5aAkyZgOimNgPcYqnn4fLeuotKovMUkYBS+mAjlnD/6znTK3zxluHelprN84LfQ8uo7dhKd2rysFaWWJE+/je/W69s4jQOR44/pUuIwuQpRwspFJ9+batV8lZyRk1yoWrHgJAaVq8Rom5+9DeDcvTIZchNF843O9W3iw5Bc7caxv6aSgPsHsvGPaCElm/llXDXn3GJYmeuBAzmKdBlC5wunFPJ0C52WkR2WvRRwcoUBDXnhbCn6WQXv6ecY8xRoYsr5jvrgqXStOAM0Gnic2qjuHmID6VWxq9k9dpdIvx+LoEbM+jcq+n4rnYYygAd4FPIAAzL7/+nqyFmobNg/BGgRCgHDWFJ6LxUJKLChSsA2GH6Mhi3Y9valqbKDuczQ2PvcHcyj1JXyAy3xNwfpharx1Xw3YRoSJNZ06mq7Zz3OlE3IDd//cnSbAcsORr7YceoMzgNeqJL19WsXixzDg66/PaZ4G/kCgM3aAUDBL7F5VerPEaNfTm1SRLRh5T4oUNRnNLNDgqbsO8n8uVGujzFxy9IQ8/XKe/PailkmAz7zfNUEJKlDROtC2AnXQzjlXuIrLA5kXVTJgaHSgXGnHqXTwHHIL3STPW2w0rvUZ30gar3JdDKXJ7yLhQ7DfkRjCPY8u0vhfo3ocaMGGwzXdNZzTnpjIjQr1pdNW+j57yOcJYF9wSMnEIi2+ACTJaYm5vv4Ea2WCxoFoNqMw4qJDdh8FZ38iajfzOGKCxnBvIi6NLwtJo3vjnHUk6poAUO5f9V3V7gFbMJDIYsWzQC0DVp4fJjURh2NikVF7sXRRjHX0xGFKWcIMScbNlQ1V7nXKpY4WCvHCyd2tk= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: fd2e97e3-3123-4ffc-1eca-08dee733af66 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jul 2026 14:23:50.6625 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7ZRXx4WwH6H7QWrnP64KXazvMTTsuoMPJOHP2FV6W2nKyzhwW9FJtmUnFm5RHQtnBU9xgICHiiJlu3AY9HUIMXW5zbzENug3PgvBNtx+nqs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7P189MB0850 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 21 Jul 2026 14:24:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241538 This patch applies the upstream fix as referenced in [1], using the commit shown in [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-40909 [2] https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9 Signed-off-by: Jaipaul Cheernam --- .../perl-cross/files/CVE-2025-40909-dep.patch | 25 ++ .../perl-cross/perlcross_1.6.2.bb | 1 + .../perl/files/CVE-2025-40909.patch | 412 ++++++++++++++++++ meta/recipes-devtools/perl/perl_5.38.4.bb | 1 + 4 files changed, 439 insertions(+) create mode 100644 meta/recipes-devtools/perl-cross/files/CVE-2025-40909-dep.patch create mode 100644 meta/recipes-devtools/perl/files/CVE-2025-40909.patch diff --git a/meta/recipes-devtools/perl-cross/files/CVE-2025-40909-dep.patch b/meta/recipes-devtools/perl-cross/files/CVE-2025-40909-dep.patch new file mode 100644 index 0000000000..d5d4bf279d --- /dev/null +++ b/meta/recipes-devtools/perl-cross/files/CVE-2025-40909-dep.patch @@ -0,0 +1,25 @@ +From f702c387e6940fab3801d7562a668b974a2b3a8f Mon Sep 17 00:00:00 2001 +From: Audrey Dutcher +Date: Fri, 30 May 2025 12:29:54 -0700 +Subject: [PATCH] add d_fdopendir configuration + +Upstream-Status: Submitted [https://github.com/arsv/perl-cross/pull/159] +Signed-off-by: Jaipaul Cheernam +--- + cnf/configure_func.sh | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/cnf/configure_func.sh b/cnf/configure_func.sh +index 4c13e4c..b24fe03 100644 +--- a/cnf/configure_func.sh ++++ b/cnf/configure_func.sh +@@ -83,6 +83,7 @@ checkfunc d_fchmodat 'fchmodat' "0,NULL,0,0" 'unistd.h sys/stat.h' + checkfunc d_fchown 'fchown' "0,0,0" 'unistd.h' + checkfunc d_fcntl 'fcntl' "0,0" 'unistd.h fcntl.h' + checkfunc d_fdclose 'fdclose' "NULL,NULL" 'stdio.h' ++checkfunc d_fdopendir 'fdopendir' "0" 'dirent.h' + checkfunc d_ffs 'ffs' "0" 'strings.h' + checkfunc d_ffsl 'ffsl' "0" 'strings.h' + checkfunc d_fgetpos 'fgetpos' "NULL, 0" 'stdio.h' +-- +2.43.0 diff --git a/meta/recipes-devtools/perl-cross/perlcross_1.6.2.bb b/meta/recipes-devtools/perl-cross/perlcross_1.6.2.bb index e4bd90c572..1c5fc27d97 100644 --- a/meta/recipes-devtools/perl-cross/perlcross_1.6.2.bb +++ b/meta/recipes-devtools/perl-cross/perlcross_1.6.2.bb @@ -15,6 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/perl-cross-${PV}.tar.gz;name=perl-c file://0001-perl-cross-add-LDFLAGS-when-linking-libperl.patch \ file://determinism.patch \ file://0001-Makefile-check-the-file-if-patched-or-not.patch \ + file://CVE-2025-40909-dep.patch \ " GITHUB_BASE_URI = "https://github.com/arsv/perl-cross/releases/" diff --git a/meta/recipes-devtools/perl/files/CVE-2025-40909.patch b/meta/recipes-devtools/perl/files/CVE-2025-40909.patch new file mode 100644 index 0000000000..c9418a3574 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2025-40909.patch @@ -0,0 +1,412 @@ +From 918bfff86ca8d6d4e4ec5b30994451e0bd74aba9 Mon Sep 17 00:00:00 2001 +From: Leon Timmermans +Date: Fri, 23 May 2025 15:40:41 +0200 +Subject: [PATCH] CVE-2025-40909: Clone dirhandles without fchdir + +This uses fdopendir and dup to dirhandles. This means it won't change +working directory during thread cloning, which prevents race conditions +that can happen if a third thread is active at the same time. + +CVE: CVE-2025-40909 +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9] +Signed-off-by: Jaipaul Cheernam +--- + Configure | 6 ++ + Cross/config.sh-arm-linux | 1 + + Cross/config.sh-arm-linux-n770 | 1 + + Porting/Glossary | 5 ++ + Porting/config.sh | 1 + + config_h.SH | 6 ++ + configure.com | 1 + + plan9/config_sh.sample | 1 + + sv.c | 91 +---------------------------- + t/op/threads-dirh.t | 104 +-------------------------------- + win32/config.gc | 1 + + win32/config.vc | 1 + + 12 files changed, 28 insertions(+), 191 deletions(-) + +diff --git a/Configure b/Configure +index 44c12ced4014..7a13249caa96 100755 +--- a/Configure ++++ b/Configure +@@ -478,6 +478,7 @@ d_fd_set='' + d_fds_bits='' + d_fdclose='' + d_fdim='' ++d_fdopendir='' + d_fegetround='' + d_ffs='' + d_ffsl='' +@@ -13344,6 +13345,10 @@ esac + set i_fcntl + eval $setvar + ++: see if fdopendir exists ++set fdopendir d_fdopendir ++eval $inlibc ++ + : see if fork exists + set fork d_fork + eval $inlibc +@@ -25052,6 +25057,7 @@ d_flockproto='$d_flockproto' + d_fma='$d_fma' + d_fmax='$d_fmax' + d_fmin='$d_fmin' ++d_fdopendir='$d_fdopendir' + d_fork='$d_fork' + d_fp_class='$d_fp_class' + d_fp_classify='$d_fp_classify' +diff --git a/Cross/config.sh-arm-linux b/Cross/config.sh-arm-linux +index bfa0b00d5f0f..9e056539198b 100644 +--- a/Cross/config.sh-arm-linux ++++ b/Cross/config.sh-arm-linux +@@ -212,6 +212,7 @@ d_fd_macros='define' + d_fd_set='define' + d_fdclose='undef' + d_fdim='undef' ++d_fdopendir=undef + d_fds_bits='undef' + d_fegetround='define' + d_ffs='undef' +diff --git a/Cross/config.sh-arm-linux-n770 b/Cross/config.sh-arm-linux-n770 +index 47ad5c37e3fd..365e4c4f9671 100644 +--- a/Cross/config.sh-arm-linux-n770 ++++ b/Cross/config.sh-arm-linux-n770 +@@ -211,6 +211,7 @@ d_fd_macros='define' + d_fd_set='define' + d_fdclose='undef' + d_fdim='undef' ++d_fdopendir=undef + d_fds_bits='undef' + d_fegetround='define' + d_ffs='undef' +diff --git a/Porting/Glossary b/Porting/Glossary +index bb505c653b0b..8b2965ca99c6 100644 +--- a/Porting/Glossary ++++ b/Porting/Glossary +@@ -947,6 +947,11 @@ d_fmin (d_fmin.U): + This variable conditionally defines the HAS_FMIN symbol, which + indicates to the C program that the fmin() routine is available. + ++d_fdopendir (d_fdopendir.U): ++ This variable conditionally defines the HAS_FORK symbol, which ++ indicates that the fdopen routine is available to open a ++ directory descriptor. ++ + d_fork (d_fork.U): + This variable conditionally defines the HAS_FORK symbol, which + indicates to the C program that the fork() routine is available. +diff --git a/Porting/config.sh b/Porting/config.sh +index a921f7e1c79a..6231ea0f31ea 100644 +--- a/Porting/config.sh ++++ b/Porting/config.sh +@@ -223,6 +223,7 @@ d_fd_macros='define' + d_fd_set='define' + d_fdclose='undef' + d_fdim='define' ++d_fdopendir='define' + d_fds_bits='define' + d_fegetround='define' + d_ffs='define' +diff --git a/config_h.SH b/config_h.SH +index da0f2dbcd7b7..5a0f81cf2011 100755 +--- a/config_h.SH ++++ b/config_h.SH +@@ -142,6 +142,12 @@ sed <$CONFIG_H -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un + */ + #$d_fcntl HAS_FCNTL /**/ + ++/* HAS_FDOPENDIR: ++ * This symbol, if defined, indicates that the fdopen routine is ++ * available to open a directory descriptor. ++ */ ++#$d_fdopendir HAS_FDOPENDIR /**/ ++ + /* HAS_FGETPOS: + * This symbol, if defined, indicates that the fgetpos routine is + * available to get the file position indicator, similar to ftell(). +diff --git a/configure.com b/configure.com +index 99527c180bfc..7c38711bb85d 100644 +--- a/configure.com ++++ b/configure.com +@@ -6010,6 +6010,7 @@ $ WC "d_fd_set='" + d_fd_set + "'" + $ WC "d_fd_macros='define'" + $ WC "d_fdclose='undef'" + $ WC "d_fdim='" + d_fdim + "'" ++$ WC "d_fdopendir='undef'" + $ WC "d_fds_bits='define'" + $ WC "d_fegetround='undef'" + $ WC "d_ffs='undef'" +diff --git a/plan9/config_sh.sample b/plan9/config_sh.sample +index 636acbdf6db3..246bad954424 100644 +--- a/plan9/config_sh.sample ++++ b/plan9/config_sh.sample +@@ -212,6 +212,7 @@ d_fd_macros='undef' + d_fd_set='undef' + d_fdclose='undef' + d_fdim='undef' ++d_fdopendir=undef + d_fds_bits='undef' + d_fegetround='undef' + d_ffs='undef' +diff --git a/sv.c b/sv.c +index ae6d09dea28a..8a005b2d165b 100644 +--- a/sv.c ++++ b/sv.c +@@ -14096,15 +14096,6 @@ Perl_dirp_dup(pTHX_ DIR *const dp, CLONE_PARAMS *const param) + { + DIR *ret; + +-#if defined(HAS_FCHDIR) && defined(HAS_TELLDIR) && defined(HAS_SEEKDIR) +- DIR *pwd; +- const Direntry_t *dirent; +- char smallbuf[256]; /* XXX MAXPATHLEN, surely? */ +- char *name = NULL; +- STRLEN len = 0; +- long pos; +-#endif +- + PERL_UNUSED_CONTEXT; + PERL_ARGS_ASSERT_DIRP_DUP; + +@@ -14116,89 +14107,13 @@ Perl_dirp_dup(pTHX_ DIR *const dp, CLONE_PARAMS *const param) + if (ret) + return ret; + +-#if defined(HAS_FCHDIR) && defined(HAS_TELLDIR) && defined(HAS_SEEKDIR) ++#ifdef HAS_FDOPENDIR + + PERL_UNUSED_ARG(param); + +- /* create anew */ +- +- /* open the current directory (so we can switch back) */ +- if (!(pwd = PerlDir_open("."))) return (DIR *)NULL; +- +- /* chdir to our dir handle and open the present working directory */ +- if (fchdir(my_dirfd(dp)) < 0 || !(ret = PerlDir_open("."))) { +- PerlDir_close(pwd); +- return (DIR *)NULL; +- } +- /* Now we should have two dir handles pointing to the same dir. */ +- +- /* Be nice to the calling code and chdir back to where we were. */ +- /* XXX If this fails, then what? */ +- PERL_UNUSED_RESULT(fchdir(my_dirfd(pwd))); ++ ret = fdopendir(dup(my_dirfd(dp))); + +- /* We have no need of the pwd handle any more. */ +- PerlDir_close(pwd); +- +-#ifdef DIRNAMLEN +-# define d_namlen(d) (d)->d_namlen +-#else +-# define d_namlen(d) strlen((d)->d_name) +-#endif +- /* Iterate once through dp, to get the file name at the current posi- +- tion. Then step back. */ +- pos = PerlDir_tell(dp); +- if ((dirent = PerlDir_read(dp))) { +- len = d_namlen(dirent); +- if (len > sizeof(dirent->d_name) && sizeof(dirent->d_name) > PTRSIZE) { +- /* If the len is somehow magically longer than the +- * maximum length of the directory entry, even though +- * we could fit it in a buffer, we could not copy it +- * from the dirent. Bail out. */ +- PerlDir_close(ret); +- return (DIR*)NULL; +- } +- if (len <= sizeof smallbuf) name = smallbuf; +- else Newx(name, len, char); +- Move(dirent->d_name, name, len, char); +- } +- PerlDir_seek(dp, pos); +- +- /* Iterate through the new dir handle, till we find a file with the +- right name. */ +- if (!dirent) /* just before the end */ +- for(;;) { +- pos = PerlDir_tell(ret); +- if (PerlDir_read(ret)) continue; /* not there yet */ +- PerlDir_seek(ret, pos); /* step back */ +- break; +- } +- else { +- const long pos0 = PerlDir_tell(ret); +- for(;;) { +- pos = PerlDir_tell(ret); +- if ((dirent = PerlDir_read(ret))) { +- if (len == (STRLEN)d_namlen(dirent) +- && memEQ(name, dirent->d_name, len)) { +- /* found it */ +- PerlDir_seek(ret, pos); /* step back */ +- break; +- } +- /* else we are not there yet; keep iterating */ +- } +- else { /* This is not meant to happen. The best we can do is +- reset the iterator to the beginning. */ +- PerlDir_seek(ret, pos0); +- break; +- } +- } +- } +-#undef d_namlen +- +- if (name && name != smallbuf) +- Safefree(name); +-#endif +- +-#ifdef WIN32 ++#elif defined(WIN32) + ret = win32_dirp_dup(dp, param); + #endif + +diff --git a/t/op/threads-dirh.t b/t/op/threads-dirh.t +index bb4bcfc14184..14c399ca19cd 100644 +--- a/t/op/threads-dirh.t ++++ b/t/op/threads-dirh.t +@@ -13,16 +13,12 @@ BEGIN { + skip_all_if_miniperl("no dynamic loading on miniperl, no threads"); + skip_all("runs out of memory on some EBCDIC") if $ENV{PERL_SKIP_BIG_MEM_TESTS}; + +- plan(6); ++ plan(1); + } + + use strict; + use warnings; + use threads; +-use threads::shared; +-use File::Path; +-use File::Spec::Functions qw 'updir catdir'; +-use Cwd 'getcwd'; + + # Basic sanity check: make sure this does not crash + fresh_perl_is <<'# this is no comment', 'ok', {}, 'crash when duping dirh'; +@@ -31,101 +27,3 @@ fresh_perl_is <<'# this is no comment', 'ok', {}, 'crash when duping dirh'; + async{}->join for 1..2; + print "ok"; + # this is no comment +- +-my $dir; +-SKIP: { +- skip "telldir or seekdir not defined on this platform", 5 +- if !$Config::Config{d_telldir} || !$Config::Config{d_seekdir}; +- my $skip = sub { +- chdir($dir); +- chdir updir; +- skip $_[0], 5 +- }; +- +- if(!$Config::Config{d_fchdir} && $^O ne "MSWin32") { +- $::TODO = 'dir handle cloning currently requires fchdir on non-Windows platforms'; +- } +- +- my @w :shared; # warnings accumulator +- local $SIG{__WARN__} = sub { push @w, $_[0] }; +- +- $dir = catdir getcwd(), "thrext$$" . int rand() * 100000; +- +- rmtree($dir) if -d $dir; +- mkdir($dir); +- +- # Create a dir structure like this: +- # $dir +- # | +- # `- toberead +- # | +- # +---- thrit +- # | +- # +---- rile +- # | +- # `---- zor +- +- chdir($dir); +- mkdir 'toberead'; +- chdir 'toberead'; +- {open my $fh, ">thrit" or &$skip("Cannot create file thrit")} +- {open my $fh, ">rile" or &$skip("Cannot create file rile")} +- {open my $fh, ">zor" or &$skip("Cannot create file zor")} +- chdir updir; +- +- # Then test that dir iterators are cloned correctly. +- +- opendir my $toberead, 'toberead'; +- my $start_pos = telldir $toberead; +- my @first_2 = (scalar readdir $toberead, scalar readdir $toberead); +- my @from_thread = @{; async { [readdir $toberead ] } ->join }; +- my @from_main = readdir $toberead; +- is join('-', sort @from_thread), join('-', sort @from_main), +- 'dir iterator is copied from one thread to another'; +- like +- join('-', "", sort(@first_2, @from_thread), ""), +- qr/(?join, 'undef', +- 'cloned dir iterator that points to the end of the directory' +- ; +- } +- +- # Make sure the cloning code can handle file names longer than 255 chars +- SKIP: { +- chdir 'toberead'; +- open my $fh, +- ">floccipaucinihilopilification-" +- . "pneumonoultramicroscopicsilicovolcanoconiosis-" +- . "lopadotemachoselachogaleokranioleipsanodrimypotrimmatosilphiokarabo" +- . "melitokatakechymenokichlepikossyphophattoperisteralektryonoptokephal" +- . "liokinklopeleiolagoiosiraiobaphetraganopterygon" +- or +- chdir updir, +- skip("OS does not support long file names (and I mean *long*)", 1); +- chdir updir; +- opendir my $dirh, "toberead"; +- my $test_name +- = "dir iterators can be cloned when the next fn > 255 chars"; +- while() { +- my $pos = telldir $dirh; +- my $fn = readdir($dirh); +- if(!defined $fn) { fail($test_name); last SKIP; } +- if($fn =~ 'lagoio') { +- seekdir $dirh, $pos; +- last; +- } +- } +- is length async { scalar readdir $dirh } ->join, 258, $test_name; +- } +- +- is scalar @w, 0, 'no warnings during all that' or diag @w; +- chdir updir; +-} +-rmtree($dir); +diff --git a/win32/config.gc b/win32/config.gc +index f8776188c09c..34aa8de6ed75 100644 +--- a/win32/config.gc ++++ b/win32/config.gc +@@ -199,6 +199,7 @@ d_fd_macros='define' + d_fd_set='define' + d_fdclose='undef' + d_fdim='undef' ++d_fdopendir='undef' + d_fds_bits='define' + d_fegetround='undef' + d_ffs='undef' +diff --git a/win32/config.vc b/win32/config.vc +index 619979e22b53..536085fe94e0 100644 +--- a/win32/config.vc ++++ b/win32/config.vc +@@ -199,6 +199,7 @@ d_fd_macros='define' + d_fd_set='define' + d_fdclose='undef' + d_fdim='undef' ++d_fdopendir='undef' + d_fds_bits='define' + d_fegetround='undef' + d_ffs='undef' diff --git a/meta/recipes-devtools/perl/perl_5.38.4.bb b/meta/recipes-devtools/perl/perl_5.38.4.bb index b4927646d7..b86c58f540 100644 --- a/meta/recipes-devtools/perl/perl_5.38.4.bb +++ b/meta/recipes-devtools/perl/perl_5.38.4.bb @@ -23,6 +23,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://CVE-2026-13221.patch \ file://CVE-2026-57432-01.patch \ file://CVE-2026-57432-02.patch \ + file://CVE-2025-40909.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \