From patchwork Wed Aug 19 15:56:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95785 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA7ABC5DF81 for ; Wed, 19 Aug 2026 15:57:40 +0000 (UTC) Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10313.1787155058010867537 for ; Wed, 19 Aug 2026 08:57:38 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=RRk/tpj7; spf=pass (domain: smile.fr, ip: 209.85.221.49, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-47f904e80eeso1090911f8f.1 for ; Wed, 19 Aug 2026 08:57:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155056; x=1787759856; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Q5wCc2XeA9HDNJnAnDeakmyWJQHX9iNXNjizQ2URTig=; b=RRk/tpj7fjXBqpBtpJ1qLMv9zouxBdu24DmUjiJAB4TSFd8367xItKy/zqO7mAhSD/ IFK0SZYCbNqmLARKOBm8vSsHp03piYRsMPkOLJrAoZoJ56SK27r5iV85M113b9kVK6sS Lgf8Kafey1Nj74lAXkg5171s4ypjB4PkM3G1A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155056; x=1787759856; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Q5wCc2XeA9HDNJnAnDeakmyWJQHX9iNXNjizQ2URTig=; b=hQiCZdm0sc5cpchYYNM+vtryPrfcNsMsNJlZL6X7ddBg15Y/9ZZTKchT6KphISDFMX b7QsBoeOHIoEUYGxUqg0PIhMBe1sDk3VTC4x1ssZDAI34x4fn5cFtdvZySKTTKMHXyPA pwZGEc5pcyeqiC2TlUae9/Ew51wBMYFwCTJYBHmKGu3wquPccpaDCNbSuzNm/QAXACei fwzOVrOExuHoR8n5SVsggOJ/Pp9bVHnn5sqeuppP8AnKPbv3NeWvsNAVXCOzVm146vB6 G61wW0VDrsfBQ842306ER2WILu1gl2dfNL/8+cqh1K3wBVvTPwxTYZG7OeTicy1N8Lyu uO6w== X-Gm-Message-State: AFuF++kUcauXt42zVYN8P93uJB7+zA8jEZO2C4OaKQM3wKyGUQSfZI/u gtF38vh2vXyCOrsq06uBnWy3vT88o0minbbE65LxLlvuhvWw3mNRWIWu9JOBzbsE/Gag+SixPLM tsgOOQw4= X-Gm-Gg: AR+sD12rdJoXxDvpfiAKIzMjOqTO+S0Yze0pO7OHjvV+Nc1ydQ868GRkKgIcAprlg/e JS+RSbVAbLBdY10x4NBInBMqas6nFgi3zq4tTsc47U11RNfVc+dUqtCQBzQNKm91y9dlVkSa8Te pLKY/O/PeiJrXhGxAICKhr+JwNONUks465YYUV97J3ZQZ/0YPaNpxEPz4oANv+TfGbhKf/Ad5Po 9A0Tb6CiyzO2r6J5kSta+kFAvLybF8diIRmMYOcbtLPzZ3PVKGWl3OhdhudT9h2y0BnDthzHys9 F/4hR9OhXX+goAzBAOgTY4Ma2ZmG0kBe34SDMZmE97F1VdSlnUYNtly98h28Mck4C5WUri8QAmf d4VmxzT143LvSYRWuCAJFE6yoJINFdbJfeBGO4csuHSfa2GKgnzyTooHRfwknQAgBggt5uK52Kc yp6HGKoMjpIgyd07FmSoQiqoYG9nE9u95glN/RJC5gGNSrKmTK9mo2o7SqVVE93fsW/ZKkIswkq CRwNoJ5OsOnVpBjqNJ3bk4Ma9lFNMmIqt9YRIHQnUgXdoOrUmCb36CFtwBo5sw3W12Gn4oznqzL Xg0wAAamjlBtu1i3axkIFkO7JkU5z5552sUmDOdB X-Received: by 2002:a05:6000:2881:b0:47f:97e9:fe60 with SMTP id ffacd0b85a97d-482b1fd9579mr10143245f8f.15.1787155056130; Wed, 19 Aug 2026 08:57:36 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:35 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 01/37] python3-pyopenssl: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:32 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243737 From: "mark.yang" The pypi class default python:pyopenssl matches nothing in the CVE databases, which have used four vendor spellings for pyOpenSSL over the years: * CVE-2013-4314 (jean-paul_calderone:pyopenssl) * CVE-2018-1000807 (pyopenssl:pyopenssl) * CVE-2018-1000808 (pyopenssl_project:pyopenssl) * CVE-2026-27448, CVE-2026-27459 (pyca:pyopenssl in the CNA records, pyopenssl:pyopenssl in the NVD CPEs) Set all four vendor:product pairs. For scarthgap, python3-pyopenssl is 24.0.0. CVE-2026-27448 and CVE-2026-27459 are fixed in 26.0.0, so this metadata change will expose those CVEs as applicable/unpatched. The fixes for these CVEs need to be handled separately. Note: Original commit was for python3-pyopenssl_26.0.0.bb. This is adjusted for scarthgap where recipe version is python3-pyopenssl_24.0.0.bb. (From OE-Core rev: f6cc7e0c0a4a906244fc8cd4b45706d42a931fce) Signed-off-by: mark.yang Signed-off-by: Richard Purdie (cherry picked from commit ba3d752e577004f871fe7f4235e2625410140a08) Signed-off-by: Himanshu Jadon Signed-off-by: Fabien Thomas --- meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb b/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb index 94a70aa17d1..ab00730b570 100644 --- a/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb +++ b/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb @@ -8,6 +8,7 @@ DEPENDS += "openssl python3-cryptography" SRC_URI[sha256sum] = "6aa33039a93fffa4563e655b61d11364d01264be8ccb49906101e02a334530bf" PYPI_PACKAGE = "pyOpenSSL" +CVE_PRODUCT = "jean-paul_calderone:pyopenssl pyca:pyopenssl pyopenssl:pyopenssl pyopenssl_project:pyopenssl" inherit pypi setuptools3 SRC_URI += " \ From patchwork Wed Aug 19 15:56:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95787 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5907C5DF88 for ; Wed, 19 Aug 2026 15:57:40 +0000 (UTC) Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10314.1787155058376775765 for ; Wed, 19 Aug 2026 08:57:38 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=zmXfISYu; spf=pass (domain: smile.fr, ip: 209.85.221.51, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-47fe377a217so720005f8f.1 for ; Wed, 19 Aug 2026 08:57:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155057; x=1787759857; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7CeprVtOXc5UWOTFD6RDtPwVyJNqq/tfmTsAQPYPtwY=; b=zmXfISYuypUj/cYG0aLpkBOcgWoRgJhMYFix5eYs8L0fkOWLX87/wKDzapGjj23mBQ H1g6x0rD41pQuq0yKgB1RYG3swBTRNTmx8F5nhhYtcCfyArULTYi/Icwh1ZC3ukGuP4d iH7MPYDjqFV0q+pVEH+pBKBxlQhn6uacEE/EM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155057; x=1787759857; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=7CeprVtOXc5UWOTFD6RDtPwVyJNqq/tfmTsAQPYPtwY=; b=SN48zy6RFlGnwFcMJqXtNyojM0Ivm5eKjClEP7n6DEYNJMEf/ULTTyR1p5A09m7PXl SDtUZm2A5Q/oIUsfLzIolqv9supWYny17nGJgS/M9+HTfu+lS03pmuf2oilVejWDXvuY asTOxT7IAhhZBVryT1jeYz9GqV9Bby8sHdZhn7+zosC8ijsRzNIlEuTjGtDTRKT8AhLU 1Bwb/k0l1iKBQFRtLp+VNtd+7rWm0VOkrbAi8t5SPkWYdZ+LO/Y+NVyPQBhXmslHd7Qe Xtpel7zMpo7RXICXntaJRIhveXm3MA0tFPqr/vMhnn8wJcyOwSUrVWpFWKWTnf3FL3EE F+pw== X-Gm-Message-State: AFuF++mAopZwWLwC4tvD+3jo/qyr7quPiJoaAMKlIPwi68EZqGeuDVdR CvZxF/Ofb0dbPBn2/+k+7QlsJhlbDOai9cWW6fE6A93wsSpfRwYpqv7AekTUcwZ6/U1lTknKIXl 7MAqX4jg= X-Gm-Gg: AR+sD120Q5a4Wxdh+pdSipd7V19Flety0K2YOmXv8JzYPOYRLe+RYnKpdSC5O3tphEE xcvO6jaSKywo6frXJZLj+WxjvBRZsYxwB89fzxkz9isq+irXrz/C0jtoNI1104ubqyohU0G3DU8 kzYq7aUlxPHVE4mz4m7DL9Hz3P4p4J5kDbEsDZMjst7uz2XheJBbteyCOFdXBnWd9e2jnv2z3VN svxrw7jZdH30q20SXFMO4v20CLN1IfdyMsqgYCp6WVM9z/NxLs2V4bci96b8tMCRJUn1iJP3vqM RuIc+D0+WZ8CVlxzC+JK14kR8ypuatPCmY1ANPPUUvnyWKqgC7sePVseXGZF/tIXmg3sxP7cQhs EEeJgaROOm5wg25JBay9dFtSjiF338aWkX/HWYVNAJM6ox3r+gYAB4QPH/T1rFOyWX18pv2Qg9w Z8fQPNduVOG3ORB/XwCQT5NcVkMlmvkHmZA/shXANP4o2Bdt0cZdf2Urxt+AWywQCDZW+BLM1rb d6sEqD69C3bADz/K91HM0tSU7SybRtC/vgNv1AkmOgN2vnNkJTcBRKIqse0JAWi4RWWaQEkM9vO vhVIzumRL2v1KccILFxj/DZ2QxUReZ/p0KCfZQix X-Received: by 2002:a05:6000:41fd:b0:47f:8ac0:282 with SMTP id ffacd0b85a97d-482b1fef313mr10721691f8f.17.1787155056671; Wed, 19 Aug 2026 08:57:36 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:36 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 02/37] python3-idna: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:33 +0200 Message-ID: <67cfd22208b69ee05756bea754f18726bb8d13da.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243738 From: "mark.yang" The pypi class default python:idna matches nothing in the CVE databases, which track the Python idna CVEs as: * CVE-2024-3651 (kjd:internationalized_domain_names_in_applications) [1] * CVE-2026-45409 (kjd:idna in the CNA record, same NVD CPE as above) Set both vendor:product pairs. For scarthgap, python3-idna is 3.7. CVE-2026-45409 affects idna versions before 3.15, so this metadata change will expose that CVE as applicable/unpatched. The fix for CVE-2026-45409 needs to be handled separately. The bare product name is not an option here: it would also match "servo:idna", the Rust idna crate (e.g. CVE-2024-12224). Note: Original commit was for python3-idna_3.11.bb. This is adjusted for scarthgap where recipe version is python3-idna_3.7.bb. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-3651 (From OE-Core rev: 70a1b17edf909715065c1d727f989fc07f8db8bf) Signed-off-by: mark.yang Signed-off-by: Richard Purdie (cherry picked from commit 48428c0fe22d8ecbfa53efffb28173d4d37539e6) Signed-off-by: Himanshu Jadon Signed-off-by: Fabien Thomas --- meta/recipes-devtools/python/python3-idna_3.7.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-idna_3.7.bb b/meta/recipes-devtools/python/python3-idna_3.7.bb index 729aff1c462..e4213be5dfc 100644 --- a/meta/recipes-devtools/python/python3-idna_3.7.bb +++ b/meta/recipes-devtools/python/python3-idna_3.7.bb @@ -5,6 +5,8 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=204c0612e40a4dd46012a78d02c80fb1" SRC_URI[sha256sum] = "028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc" +CVE_PRODUCT = "kjd:idna kjd:internationalized_domain_names_in_applications" + inherit pypi python_flit_core RDEPENDS:${PN}:class-target = "\ From patchwork Wed Aug 19 15:56:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95788 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18B06C5DF8A for ; Wed, 19 Aug 2026 15:57:41 +0000 (UTC) Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10315.1787155059110225752 for ; Wed, 19 Aug 2026 08:57:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=GfkP1V7K; spf=pass (domain: smile.fr, ip: 209.85.221.49, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-47fe377a217so720011f8f.1 for ; Wed, 19 Aug 2026 08:57:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155057; x=1787759857; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=a38oYNfAvgQasLLBAn/Q70M2hMSHxIKLPvr4j4NNWpk=; b=GfkP1V7KGsOm6h3NL3h+tTzw4vTgrv3DctMrmfJ9UEQSo3J3w1QRy7mWiTx1/dUG5p 0f9Y/DOsIgGaJiq8wdOU/+DIrT/GHRLFUQKHAwJojaz301CJWI335ZU1Dp6h6WsKTzHW Y0RiR3YljIdItnu6gpM5y8dCUZlbSpQCA9zZw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155057; x=1787759857; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=a38oYNfAvgQasLLBAn/Q70M2hMSHxIKLPvr4j4NNWpk=; b=iFNy9mS+atTBS2pb38jHbAbIgV04pZaM2SQ5VVWkbawsphUejvsYm8QmFMsqBcepAo sC1Ybs8G3IfnzXbRQm3e7wYKlfSIy2GW61YA1MFKyCDVvcWuYrcThyDvBvYh8/weYCrs UZcZgK1/l5kLUhaBH8gLFlxk5oj9vn/1rMWdXBuhx38wuMXdHuSGUfL8okOnCJj3HIFP g9+iQYazHdJ+RTUiUDegLihZ7FkGYgknlq2un2zKY3UQr8jsKZR13iZ1Uaj7swC3zWwU dJDzCBiNSh73JDAzuC1dxcnglkE4egU5NKCdS7yDawcV0UdznW9WXwt+yM9QH2/J9zDI y2sQ== X-Gm-Message-State: AFuF++kVpJ/8VUMDISd/HGl3YQM3cBZhKolk8HHyzhp3LipPO5xEEPRQ vt3QLpzAby/ASXvIhm6/yU6nscpcXMIBIuYVXWNpC/Ol2yjdY3znqN9cv7jS14RYR8LHyB4bCfI j8C3qmWQ= X-Gm-Gg: AR+sD12AsYv9t/gRq2yZtKAx5HSIgHGr9Gh+iQ+zZVZAmcZeCCYb2YA2FvIzHtuZImJ LJ9j5Quau8PsuVY23lFCY7sNlKIvx4HfsrzIkw4z6Dy9c09CtuhJhCA29JDbsqOtrGYoLRQLURc lp32B5nbWVibBX7WBi22NRqfuvlLtoRawlQudBVsMdW4GFp9+UToOA5T1mXi8RGNOjI4nDysiWh y6slaCgP5dpG4PMBl31rvm/XzleeoFQEIu2OY8mbHaEQqg/tiEuldR0Mz0u+rZqjX8+EDLigXHT AAAm5FoOAtj46mosqPoV09EL0mlscg1UrVtf9TvHJDQhTBFiHJYOU01WqKF6mTbTHJlV6drYsUW LdHNVEbh+ytiAFceCy65z31VWS9HGoEQjOSflcRfQKaTdRfAmpVSRL0NVyKU5VitoEHXA6sGWSP DMy75hSY+S5tIKoNT8EZ2UtfjRgSnUrhn+JwVRBYRrQ/iLHbP2NGOj///04tzBAKHns+1HZGY8o Itj39M7rf6KD1Bq0+3ZgwBsTOyKD2DTGxNn0Ytz2Bbn7zRd8DDczE3fOw6e70k32mzCYpDH3/wf zX3Fj4+e/u9uJIXhJLYqBax9bVIZLdpM92Ulu7i0 X-Received: by 2002:a05:6000:4029:b0:481:5003:c654 with SMTP id ffacd0b85a97d-482b1e95911mr9632390f8f.7.1787155057329; Wed, 19 Aug 2026 08:57:37 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:37 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 03/37] python3-certifi: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:34 +0200 Message-ID: <7fde1db72b213e6828f2e30ae8304ee506cdb649.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243739 From: "mark.yang" NVD tracks certifi as certifi:certifi, so the default python:certifi vendor prefix never matches and its CVEs are not evaluated at all. Use the exact vendor:product pair. For scarthgap, python3-certifi is 2024.2.2. CVE-2024-39689 affects certifi versions before 2024.7.4, but this recipe already carries CVE-2024-39689.patch. With this mapping, cve-check can evaluate that existing backport against the correct NVD product instead of missing the CVE mapping. Note: Original commit was for python3-certifi_2026.2.25.bb. This is adjusted for scarthgap where recipe version is python3-certifi_2024.2.2.bb. (From OE-Core rev: e6773f4c819544eae93f3efa7d2101b448db4ebb) Signed-off-by: mark.yang Signed-off-by: Richard Purdie (cherry picked from commit 26c49743ec431a3cc39803664eec8851be75756e) Signed-off-by: Himanshu Jadon Signed-off-by: Fabien Thomas --- meta/recipes-devtools/python/python3-certifi_2024.2.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb b/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb index 116add2079d..b3d6cf080cc 100644 --- a/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb +++ b/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb @@ -12,6 +12,8 @@ SRC_URI += "file://CVE-2024-39689.patch \ SRC_URI[sha256sum] = "0569859f95fc761b18b45ef421b1290a0f65f147e92a1e5eb3e635f9a5e4e66f" +CVE_PRODUCT = "certifi:certifi" + inherit pypi setuptools3 BBCLASSEXTEND = "native nativesdk" From patchwork Wed Aug 19 15:56:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95786 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD213C5B572 for ; Wed, 19 Aug 2026 15:57:40 +0000 (UTC) Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10402.1787155059732649845 for ; Wed, 19 Aug 2026 08:57:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=pBIOo5mN; spf=pass (domain: smile.fr, ip: 209.85.221.48, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-47fde295992so39934f8f.0 for ; Wed, 19 Aug 2026 08:57:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155058; x=1787759858; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=zvx85DhwSfih1LZc0Oug8j/wqyKIcLb981Z3xs2SuPs=; b=pBIOo5mN0kDSUWOxbvoc+plGRAInfGAEWTfrmsQDSVQ5WbVGKIcIST2szdtl4WLFC4 gCrFGFW7vbeOhhLUrSzYZvlTgY9BG/aaTeO01q2lfHj/4ffPrMwiZRACypVog/yVZzse S3Tu3crhrC6xtQUNqaDCVIk2+7lJtu0UrWcmM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155058; x=1787759858; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=zvx85DhwSfih1LZc0Oug8j/wqyKIcLb981Z3xs2SuPs=; b=nzpBXTb0fiuhSPFE1bchPliGfl6UWPhWLI8m8vaaV0RQdW7AuGahbFp9U2LEHW80bI gLZE4l3OornXIXF+j32E3M9aLLlzELaTS/Z+RUkzEl64nR/cNCnkiy9d1i212BFsWKI5 jU3QUCwuY/mio0cF87i1GfEoPVxGEPbatxJ/i4Uo9g84K3e2Yyts2HW3HACcx4KmKgwO P3/LuzyqKcArijy9ovNXBp/8p/OzOBkhIZsUxVv9hnnV8Z4zqELCPJNu0Z9kzLm1DFw9 mNGKsYXO9TtuWJW5HGlnRJDAFCgLjQ+xEIscc26+FsfAf8FdKko3CbaR0p+gP1jSCS1r LaMQ== X-Gm-Message-State: AFuF++kPBcBi15iPHyKRsrlau5gQc5l70bdpkxjLMXrsMi9FKIqGWLvv FjnEZvnGfLc84XSBt39F/ynNdAVMQ5IS/UA6iQHhdZ5n42IBDQ3LhND3U7jOYdzDQhc9Ervs6eM 3x0sjxgg= X-Gm-Gg: AR+sD10bUOBmunxNsskAm05V+yZY5YvlaotHOaQiUTQSmR/Uhdt8mwOfYq473USAN0m SPEDFmTekcTZy0s/EjrH7vRjcacBWIsx8ih9Vgigz70lkw6s4iwk+I26at+F9HKD7Osx/7kam3k TjQ2Xz8DtflrSKqTLfeV1KTDnmg+AJH7V3y0ZAoIHr8tcc4jGH+cb+7bKv7qVxRnGg/ZH7IrRpQ NRkggCw+8YTGks3OuJJp42MYGKPK8daZyiu/NsbCRKc0nPc3gwb76f9Phh//6f0IDtBIiO/PeGk 47d/uQilgRpV6McIJCMU43Wy+p13wePvVRlxVH7svVgfCCppOMpkEg7q8YflwoLZ3yQa2dRULBw LrGjs/E1Ewqifk0j4oQKFJx/hz8VgJZyWjwXax401nG10ogGDAUdCYmD5goKshd7rm1u2ajS0Sw O32qOMufqkZQTeGISJlief2Q8m6+G/xar3Rrz1CRYI3AB4Oo0Cke0oAlOXOFEySMmT+kzmXC1xM zbK6lYsIKJAMzkO/ExqFPs0eFbwzMtZNXaddhMk4MBrd9snBTRr440RNvzaom4pEAHgvBHrnp/V qmQECiXGEF9/HMZwHqM7JZqlhUZvSCDbyaCDbiIV X-Received: by 2002:a05:6000:643:b0:47f:ec53:1d2d with SMTP id ffacd0b85a97d-482b781c048mr277547f8f.7.1787155058007; Wed, 19 Aug 2026 08:57:38 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:37 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 04/37] python3-xmltodict: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:35 +0200 Message-ID: <5ab9b2a4aa3070945fc282d3ecabe632a614ce49.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243740 From: "mark.yang" The CVE databases track xmltodict as xmltodict:xmltodict, so the default python:xmltodict vendor prefix never matches and its CVEs are not evaluated at all. Use the exact vendor:product pair. Note: Original commit was for python3-xmltodict_1.0.4.bb. This is adjusted for scarthgap where recipe version is python3-xmltodict_0.13.0.bb. (From OE-Core rev: 918d1fd448ff96431197031e5adb1be658156bc2) Signed-off-by: mark.yang Signed-off-by: Richard Purdie (cherry picked from commit 2229426b729adf85780c23d38c85fc3cf090f6ba) Signed-off-by: Himanshu Jadon Signed-off-by: Fabien Thomas --- meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb b/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb index 9a308a29d2c..33bf49b1fcc 100644 --- a/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb +++ b/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb @@ -7,6 +7,8 @@ SRC_URI[sha256sum] = "341595a488e3e01a85a9d8911d8912fd922ede5fecc4dce437eb4b6c8d PYPI_PACKAGE = "xmltodict" +CVE_PRODUCT = "xmltodict:xmltodict" + BBCLASSEXTEND = "native nativesdk" inherit pypi setuptools3 ptest From patchwork Wed Aug 19 15:56:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95801 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 102C9C5DF91 for ; Wed, 19 Aug 2026 15:57:52 +0000 (UTC) Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10317.1787155061186008586 for ; Wed, 19 Aug 2026 08:57:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=JqGYuKCb; spf=pass (domain: smile.fr, ip: 209.85.221.45, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-480033bdcf4so681051f8f.2 for ; Wed, 19 Aug 2026 08:57:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155059; x=1787759859; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=uosIFzMWYexe0n2Wau+bY8mTWxvT8qf90N9qITSN4qA=; b=JqGYuKCbvi6EnJcmZoq2rYel3vl1Pqhf09dhSPySjkBNf351MTnen52mT9zSSV+b4W JtS/5iZ9wVesezgLIwdK6ukIAZvgyjqSGSH1W7wDwRHw8gpKGP93CzKAPFYhFQuyiWbO X0FsPsb0UDPIZZU15JutfVM7r3hxnIxWeNX0I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155059; x=1787759859; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=uosIFzMWYexe0n2Wau+bY8mTWxvT8qf90N9qITSN4qA=; b=LXUOE0xz/24REcBpd6qz1uSCxnb2JvmiahkJOMcFem5e5s2ZZYqo/7tz12c9PUYrw1 xE2s2Vl2J1MUs7Q+qD/pWk6lCzjkmJxISseJrHL5y1SeyJlkNtKidqPCel42iGyAnazj XH3fS/mdsEi5tW0Hg9WDWK1dtXAJb9vZ86MSuZ0q73JrOvTTJ3dv/56AOEmUiQaBDM/b btDw3SalODa+Jwfcos9lEUVDGEa7ufSJ0eUa2codtb90PToBjB+oBlBajRGM0Zx6Ye9k zVIth5tON5HksaF/+a6mojtR9AGPFQFNPIZxviEIZcD+h21px7YODson7SpDgIMXbAS+ wMJg== X-Gm-Message-State: AFuF++lZiFKjWEgP3xH9Kafwk0DGR4NZ1gNeFO5pSLVb0/Mv8Xz2s4ug EztkhuJCqSaA0qa49S1gC81zK611ttdqWLaGgsCVHVSCs3x07SIxDdCQVCGVDk7QcbLDOBlpvNl yPlbfC6M= X-Gm-Gg: AR+sD10+HsZKaTe8ghJp2/INXntNSO7Jevl98jt2BNgXCEcRebINE4RJ50CarfUZpSU GtTsLEBGMtlvx/2kpq24c1EgHmRs9+I+tUoCRHEuGMSUlsf+/1d6Aulyiktc8A68sUci5tqXfHU IoGggRw3iPKFovOrWzaw3huqCVPOGLJsFpZ9/XFXHfMwt3cWU/Vc8remQGImzjQDi68TrDmrgXk KZw/Me5cufV6scQPKexzjfZ5SCNMoJOPmybhJK9wrDfdLCLFfGPGFayJnui9a4wBTKmx759+CDh LJ7ELadqtAfdxxqmRjFXpyQNZ0/1zlu7T9JBGxYzGZ9JK91CH7SwB8dJkrk6cX+heQqycMf8YYe goDkPSTPnIfFF7x4JnIG0eg+EgZZ+5a5HFgxDuLSXATK72M7cmjkMcbwKiFjntvD3MCYp0f1Z5p cWAm3EG8O1gLhJhj1LBUZzChw/x73SNAx2nFYVcd9ctqSD1cw18Bo+gM4RaoFkqzHLj7r/jijjw JO07jUXd6Dvtk6rudlFNv651n0nl0yQ23vg/wv2jiO3gj4XdIF6EtAXbXa//g8OtJ5+IzY3co2N D7XD6nyfLaMsYnFiNfuAzY8+4dENX9HEOzk4nZTp X-Received: by 2002:a05:6000:4283:b0:482:a909:53d3 with SMTP id ffacd0b85a97d-482b1e877a0mr9440973f8f.2.1787155059351; Wed, 19 Aug 2026 08:57:39 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:38 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 05/37] python3-pyyaml: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:36 +0200 Message-ID: <23322d524f34571a378c752c1a9cf2cef621d0ec.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243741 From: "mark.yang" The pypi class default python:pyyaml vendor prefix matches nothing, so PyYAML CVEs are not evaluated at all. The databases use two vendor spellings: pyyaml in the NVD CPEs, and "Red Hat" (with a space, not expressible as a vendor:product pair) in CVE-2020-1747's CNA record. Use the bare product name to cover both. All four existing CVEs (CVE-2017-18342, CVE-2019-20477, CVE-2020-1747, CVE-2020-14343) are fixed by 5.4, so they resolve as not affected at 6.0.1. Note: Original commit was for python3-pyyaml_6.0.3.bb. This is adjusted for scarthgap where recipe version is python3-pyyaml_6.0.1.bb. (From OE-Core rev: 666e25c1fe1347da307726afd87554ffc080ed12) Signed-off-by: mark.yang Signed-off-by: Richard Purdie (cherry picked from commit 89a0ba3c2da2a7755bafb28afbf75dc7112e2549) Signed-off-by: Himanshu Jadon Signed-off-by: Fabien Thomas --- meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb b/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb index 33883125570..07bf851fce3 100644 --- a/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb +++ b/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb @@ -7,6 +7,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=6d8242660a8371add5fe547adf083079" PYPI_PACKAGE = "PyYAML" +CVE_PRODUCT = "pyyaml" + inherit pypi python_setuptools_build_meta SRC_URI += "file://0001-Fix-builds-with-Cython-3.patch" From patchwork Wed Aug 19 15:56:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95795 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86A9FC5DF8B for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10403.1787155062542026669 for ; Wed, 19 Aug 2026 08:57:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=aNcxEhYr; spf=pass (domain: smile.fr, ip: 209.85.221.48, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-47f3b39f2a1so989452f8f.2 for ; Wed, 19 Aug 2026 08:57:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155061; x=1787759861; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WBcWFjRaopoqKclo2aClG+cX18hNPxxy78GgmpsMBB4=; b=aNcxEhYr1pyVd2iFLJ8DmmBjNt3RS632bjGyvi9btIlVmZQ0ODjQghIUWCmwf56Vnw t/PMBQuxPeajULVonyS7J11obCb+x7mKgChRXRnxKCQdJ1J7jYwEzGxJDLnHNhyiMXLn QHpvql9JYBqZ/w2rh/rjXFkQ+v0A+ZkEHd9IU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155061; x=1787759861; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=WBcWFjRaopoqKclo2aClG+cX18hNPxxy78GgmpsMBB4=; b=CitHvPIaMCzxpb8ye9aPCSyL3lN2G7VnqAl8xTTbNkZZSiMry+37gru0EI363uIxPs R9McpW49ML9PkK+91NZrwi/rNyxAc19dRsRefKLWeEALAJKHz9rxLGQ4KGgC1ru/6LsS ey9nrrMSqw/sBVuLHb7GV3aZbuUr4DYmdDlifJCFDGYZvEHA2qqb+rUOK9mQ9du3CeWO Z0n7SwAon6d9yC3xqw2/+KoDNyabqJxL/ecxJ/iq+S94d5OQotxjucde1VN8G5FXQYLv oNvnh6rVR3JTxabb6qZS+zvafCX9/YMO2Poy4K8PuQyMl6HRQ/qc+k26jAzpoLxYa/xf eN3w== X-Gm-Message-State: AFuF++kwpNJ/6/dP0h2A255uini+H6ZXnlscntaR1x3nop75dVRzym/5 n7scHKFnUFpsgXfJ1xBhlZ4qEt5PiyyTbwromcY+mHeKRuMU0WEH2aFL6mgOkooex+GpebZ36p7 /SvgH+6E= X-Gm-Gg: AR+sD10GYHoCZGvHmG8gNpWVZjoQw1a9NYipSJL6tWQB0JS2o+HguK7zIWENrX6r45j XcmbKmEk2+DehWjnFqj1DJvZbY6MRXDfl9V9iXnfnLpocd5cDLwHBkYHRjggXaNvYKN3WFC9enB FOk+GuJdpL9VnJMgla380hNn7tUjmxSirZbzeREdMcXoZsMsySUj/roa659Sqfc35JmOtPdyZMh A/3BRK+HZIjURfViSxbdpWgnW0Zn/e8KW4ufy5Kv3Lk0m8IL72JDdxZFd2MNWjbTMkbeXFteOqC 7h3bon5yq1PUW2slrmSvdvIC8OsI2qoleOzuL1SYjfLYv2L8o2fWgOW8tJpSyNfh8bUifUx8l7o IdJ6tLVbGHCoeJvUElZyf9VcCw28ZjorWEU9B/B1f7B+Vw9BN+e6M+O1/lyjm6pX2E/K4MA6rto cAArJVk1FnsZkXDZ+tDW5PRlOh5tIZcmRsqKPmTd5h7iUMDAd3d2P4GO3p+HoQk+VaOHhGRykAh EI+wjsJUq68OsltT6SRtXf2d0sSf3gCJMebKN6rQBmNwyxZtSX5XnwdGFfe4XVKSNilfp5q36TO b83RJWSyHjVlqhX7SRiVS9FwrqXU+kLaxWMbG9lk X-Received: by 2002:a05:6000:2f84:b0:47f:c648:e265 with SMTP id ffacd0b85a97d-482b1feb260mr9772733f8f.17.1787155060689; Wed, 19 Aug 2026 08:57:40 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:39 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 06/37] gnutls: fix CVE-2026-3833 Date: Wed, 19 Aug 2026 17:56:37 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243742 From: Adarsh Jagadish Kamini Backport patch to fix CVE-2026-3833. References: https://nvd.nist.gov/vuln/detail/CVE-2026-3833 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5 Tested with ptest: Before: PASSED: 369, FAILED: 0, SKIPPED: 17 After: PASSED: 369, FAILED: 0, SKIPPED: 17 (From OE-Core rev: c4d9e204adc134b1d7d2b3b8ea9bbfd6fd33e5f5) Signed-off-by: Adarsh Jagadish Kamini Signed-off-by: Fabien Thomas --- .../gnutls/gnutls/CVE-2026-3833.patch | 90 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 91 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch new file mode 100644 index 00000000000..a92703bb26d --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch @@ -0,0 +1,90 @@ +From 47f495820c5c049933563e869e931a2180e0a428 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 16 Mar 2026 15:29:40 +0100 +Subject: [PATCH] x509/name-constraints: compare domain names case-insensitive + +RFC 5280 7.2: +> When comparing DNS names for equality, conforming implementations +> MUST perform a case-insensitive exact match on the entire DNS name. +> When evaluating name constraints, conforming implementations MUST +> perform a case-insensitive exact match on a label-by-label basis. + +Domain name comparison during name constraints processing +was case-sensitive. For excluded name constraints, this could lead to +incorrectly accepting domain names that should've been rejected. +The code for comparing domain names and domain name parts of emails +has been modified to perform case-insensitive comparison instead. + +Reported-by: Oleh Konko +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1223 +Fixes: #1803 +Fixes: #1852 +Fixes: CVE-2026-3833 +Fixes: GNUTLS-SA-2026-04-29-5 +CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-3833 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5] + +Signed-off-by: Adarsh Jagadish Kamini +--- + lib/x509/name_constraints.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +index 04722bdf4..dee045d25 100644 +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -35,6 +35,7 @@ + #include "x509_int.h" + #include "x509_ext_int.h" + #include ++#include "c-strcase.h" + + #include "ip.h" + #include "ip-in-cidr.h" +@@ -80,7 +81,7 @@ enum name_constraint_relation { + NC_SORTS_AFTER = 2 /* unrelated constraints */ + }; + +-/* A helper to compare just a pair of strings with this rich comparison */ ++/* Helpers to compare just a pair of strings with this rich comparison */ + static enum name_constraint_relation + compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len) + { +@@ -96,6 +97,22 @@ compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len) + return NC_EQUAL; + } + ++static enum name_constraint_relation ++compare_strings_case_insensitive(const void *n1, size_t n1_len, const void *n2, ++ size_t n2_len) ++{ ++ int r = c_strncasecmp(n1, n2, MIN(n1_len, n2_len)); ++ if (r < 0) ++ return NC_SORTS_BEFORE; ++ if (r > 0) ++ return NC_SORTS_AFTER; ++ if (n1_len < n2_len) ++ return NC_SORTS_BEFORE; ++ if (n1_len > n2_len) ++ return NC_SORTS_AFTER; ++ return NC_EQUAL; ++} ++ + /* Rich-compare DNS names. Example order/relationships: + * z.x.a INCLUDED_BY x.a BEFORE y.a INCLUDED_BY a BEFORE x.b BEFORE y.b */ + static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1, +@@ -121,8 +138,8 @@ static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1, + while (j && n2->data[j - 1] != '.') + j--; + +- rel = compare_strings(&n1->data[i], i_end - i, &n2->data[j], +- j_end - j); ++ rel = compare_strings_case_insensitive(&n1->data[i], i_end - i, ++ &n2->data[j], j_end - j); + if (rel == NC_SORTS_BEFORE) /* x.a BEFORE y.a */ + return NC_SORTS_BEFORE; + if (rel == NC_SORTS_AFTER) /* y.a AFTER x.a */ diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index d27d2cfa748..676c5c6f940 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -45,6 +45,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2025-14831-9.patch \ file://CVE-2026-42009_p1.patch \ file://CVE-2026-42009_p2.patch \ + file://CVE-2026-3833.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b" From patchwork Wed Aug 19 15:56:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95798 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AFE3AC5DF8F for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10318.1787155063138032327 for ; Wed, 19 Aug 2026 08:57:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=LTY/ZCb8; spf=pass (domain: smile.fr, ip: 209.85.221.53, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-47f84023916so1112654f8f.3 for ; Wed, 19 Aug 2026 08:57:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155061; x=1787759861; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Uq3UEkqr17QI1POwkuSPeF0sIY76CigrlVRmN5WHN/c=; b=LTY/ZCb8INQgYPO/2nJRdsFwHtTzZR1tMBQwhkOhzQMTaPE4WjMjUYdwbb3OH9WRK0 I92mqMihB7YPuTVuXSQlVKddnRXM1Gafwf6Gcs4B/sabLCSVZJG1eC1+CQOugLSPi0se YSk+tZ20mV3v4BUs7J7tvFpv2xI8xUEUkZF2c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155061; x=1787759861; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Uq3UEkqr17QI1POwkuSPeF0sIY76CigrlVRmN5WHN/c=; b=lKUy4gfYyLYqckP3vEDWFw6oU0Ll451W4pbMF/t63NUqRH0ClaKGvHcluZTqS0MV8W rELXyGFNq7kBGek7SecpBVGpNQvBpJ65Tnf8XW84ArlEW753n6JZeymDdsw1zrjLHTb6 V0R0DJCDWYdC716+Ebe7DCUujAKfsiHzefc9YKC7cyWyZLzlkPpPOSqyi6nKuUGvkE7T gjva1W87oMeIxcP3mbOsPh9M9ckiMFw5soQENHu8EJc7awKw+Du2bpdwAZBITppqMXfg KvDozyHjWMfRZJF9FOyQ7YnYrFpCLqXfcrcTv/Av1E/ob0/7QPEY8SaqhOEZ47OefYxR 9zsw== X-Gm-Message-State: AFuF++mzVqkeVHrMAwk4zgMKstQ2qAqfEqiJh157t9sbqTFSwefMkjv/ x9Ead470+mx1/li7QVSudCNs/pIoJfnV4mXPeU2l2rPLrQ/YHgcIHimrY0pwEKACMmbupp7sLPb VphYcjX0= X-Gm-Gg: AR+sD10622AC1K6UeCJ9FLPbL+spgHYEkTbYWO1xxtV5uV6dwg14TO+2jUwiUqjhr6W cje/NPWrjPOhFodzQk7TiXaltMMFdqyx6amYCAlqiRsA3mJ/QZJSOxF2JtDzDUjVcAZcydWzQjj cl5oRQobHhtqQKfHkQZUjSuGv/zBb4yvDYdrr+HvY1T2vL0FwFAZxImmKPgUyXrD1VMosEbMDoz 3UhJ7QQa0sPSb/df3pb79uEie8bCOKD3uCbrnid52tQyKN7x0k2HJ2CemrLRv+oOZ3fpx0mgCy3 /MUGZy58HrQk8lSJjMVKyCrx8de8x5Wvh9s6kK5YXmpuZ8CEHqzv4C4f7Ztd93mZg5lpN6IWh/8 lLpGFIPhyXv70J3SOEC7+6YRHZj3840cvMkd446OrcMCDZtSe3lZZzax1PASKKsaH+jE8F7hZY0 NOLggk6MEEMYmHivX3uYsrva1VNc6xl1b/29eXHhsphtW5ZXkumKWmRw0uZVHkqIFCXBAKDuuHV Kwhlz0bfrOM3YzuhznCL8Hf/C4D20jQWVAq/7J0Q0jq5gyXP1FhM24DHU2vVWHvCpl165WodKxv k756gM6Ox52ZYGiqzAuksczm9nU/FtboH8aliWJJ X-Received: by 2002:a05:6000:1846:b0:47f:7129:6e2d with SMTP id ffacd0b85a97d-482b1fe83d6mr10575603f8f.17.1787155061295; Wed, 19 Aug 2026 08:57:41 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:40 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 07/37] expat: fix CVE-2026-56403 Date: Wed, 19 Aug 2026 17:56:38 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243743 From: Deepak Rathore These patches apply the upstream fixes shown in [1] and [2], as referenced by [3]. [1] https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648 [2] https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-56403 (From OE-Core rev: a9e124fc7c48291392676a3cf26cde4acd660fa5) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56403_p1.patch | 81 +++++++++++++++++++ .../expat/expat/CVE-2026-56403_p2.patch | 52 ++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 2 + 3 files changed, 135 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch new file mode 100644 index 00000000000..8c9860c6e67 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch @@ -0,0 +1,81 @@ +From b689559597116ee75a633453e2f7177c8541b04e Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Wed, 20 May 2026 12:12:10 +0200 +Subject: [PATCH 01/17] lib: Protect function `storeAtts` from signed integer + overflow + +CVE: CVE-2026-56403 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648] + +Backport Changes: +- Adapt storeAtts to the Scarthgap 2.6.4 loop and URI allocation + logic while preserving the upstream overflow checks. + +(cherry picked from commit 12dc6d8d3d65f79471a94d8565f6bf1cf245f648) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 9bc67f38..df92a3ca 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -4226,26 +4226,32 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + return XML_ERROR_NONE; + prefixLen = 0; + if (parser->m_ns_triplets && binding->prefix->name) { +- for (; binding->prefix->name[prefixLen++];) +- ; /* prefixLen includes null terminator */ ++ size_t candidateLen = 0; ++ for (; binding->prefix->name[candidateLen++];) ++ ; /* candidateLen includes null terminator */ ++ /* Detect and prevent integer overflow */ ++ if (candidateLen > INT_MAX) ++ return XML_ERROR_NO_MEMORY; ++ prefixLen = (int)candidateLen; + } + tagNamePtr->localPart = localPart; + tagNamePtr->uriLen = binding->uriLen; + tagNamePtr->prefix = binding->prefix->name; + tagNamePtr->prefixLen = prefixLen; +- for (i = 0; localPart[i++];) +- ; /* i includes null terminator */ ++ ++ size_t localPartLen = 0; ++ for (; localPart[localPartLen++];) ++ ; /* localPartLen includes null terminator */ + + /* Detect and prevent integer overflow */ +- if (binding->uriLen > INT_MAX - prefixLen +- || i > INT_MAX - (binding->uriLen + prefixLen)) { ++ if (localPartLen > INT_MAX || binding->uriLen > INT_MAX - prefixLen ++ || localPartLen > (size_t)INT_MAX - (binding->uriLen + prefixLen)) { + return XML_ERROR_NO_MEMORY; + } + +- n = i + binding->uriLen + prefixLen; ++ n = (int)localPartLen + binding->uriLen + prefixLen; + if (n > binding->uriAlloc) { + TAG *p; +- + /* Detect and prevent integer overflow */ + if (n > INT_MAX - EXPAND_SPARE) { + return XML_ERROR_NO_MEMORY; +@@ -4273,10 +4279,14 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + } + /* if m_namespaceSeparator != '\0' then uri includes it already */ + uri = binding->uri + binding->uriLen; +- memcpy(uri, localPart, i * sizeof(XML_Char)); ++ /* Detect and prevent integer overflow */ ++ if (localPartLen > SIZE_MAX / sizeof(XML_Char)) { ++ return XML_ERROR_NO_MEMORY; ++ } ++ memcpy(uri, localPart, localPartLen * sizeof(XML_Char)); + /* we always have a namespace separator between localPart and prefix */ + if (prefixLen) { +- uri += i - 1; ++ uri += localPartLen - 1; + *uri = parser->m_namespaceSeparator; /* replace null terminator */ + memcpy(uri + 1, binding->prefix->name, prefixLen * sizeof(XML_Char)); + } diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch new file mode 100644 index 00000000000..88cb66c5469 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch @@ -0,0 +1,52 @@ +From 2855ce68a1ce9732267c06734427930364ab66c1 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Fri, 22 May 2026 00:43:52 +0200 +Subject: [PATCH 02/17] xmlwf: Protect function `xcsdup` from signed integer + overflow + +CVE: CVE-2026-56403 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15] + +Backport Changes: +- Add stdint.h and convert count and numBytes to size_t because + Scarthgap 2.6.4 lacks these upstream prerequisites. + +(cherry picked from commit 147c8f36d6277d5c6011c098370a8362aed47b15) +Signed-off-by: Deepak Rathore +--- + expat/xmlwf/xmlwf.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c +index fd4fc3f8..7bbdb303 100644 +--- a/expat/xmlwf/xmlwf.c ++++ b/expat/xmlwf/xmlwf.c +@@ -45,6 +45,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -304,13 +305,18 @@ processingInstruction(void *userData, const XML_Char *target, + static XML_Char * + xcsdup(const XML_Char *s) { + XML_Char *result; +- int count = 0; +- int numBytes; ++ size_t count = 0; ++ size_t numBytes; + + /* Get the length of the string, including terminator */ + while (s[count++] != 0) { + /* Do nothing */ + } ++ ++ // Detect and prevent integer overflow ++ if (count > SIZE_MAX / sizeof(XML_Char)) ++ return NULL; ++ + numBytes = count * sizeof(XML_Char); + result = malloc(numBytes); + if (result == NULL) diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index 3581d94fac4..de03bab4ab7 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -61,6 +61,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-45186-05.patch \ file://CVE-2026-45186-06.patch \ file://CVE-2026-45186-07.patch \ + file://CVE-2026-56403_p1.patch;striplevel=2 \ + file://CVE-2026-56403_p2.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95802 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C6FAC5DF93 for ; Wed, 19 Aug 2026 15:57:52 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10405.1787155063818149974 for ; Wed, 19 Aug 2026 08:57:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=gu/2Q87t; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4994c49f588so439555e9.0 for ; Wed, 19 Aug 2026 08:57:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155062; x=1787759862; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yh+qPsVg4DqIXUXqiiPidy9eWD5EQHmQbZn5iaTmAdY=; b=gu/2Q87th6Lf5GuRC/GHy5LPXo4ewGatCk1Tvgpy2smvJis0kOxThjzGFRWgpEXhmF TUOcr+3VttCfJCw3nN4q0duusLQlbVxlhAEg9iiy+2g3u/Y+Akcde3I6YKcduBndhG7r 6NTugqCjZn+/mz0CLmXvpcYfE9OflnlHIXZo8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155062; x=1787759862; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=yh+qPsVg4DqIXUXqiiPidy9eWD5EQHmQbZn5iaTmAdY=; b=m0BR6elMBX4cVanMrfc9zgDrsovRzfUkqyTRuJXtckttemrwZILcGGSE2inXxCOs3W sRuNeJGUgW+goa7sttditpwUBC2XHPc+Bie/cLTxpCpEUBSSA6GVHarxfogXnpsHgEm5 6fawU4S0hp6kUjljerzwXDSzk/Lznf1Jyr3wohEajPH8L9OBiEYLomTFMNhlH0zMzCuf KLJ0jjEGPFPTudRs5WZOAzSK3gD9+vaUSNbPx4cRYrKOS/Hz33xMHj5V92kBX335WL8o nzXucN3R5Aubv9ajVDhFL1ScJl0PQUXL0R3vI3voRCRIuS9CDtcoHmy8b9PH36msu+Hq 8TIA== X-Gm-Message-State: AOJu0YzFtYrTsXA2YcqILuKet+PR+zEDzCxKhi/VVLPE+Rc6vAEL95mX vs2uevXmlslVvaEGdR+cDRskk7u7dAHGbdysU6VzbFDpVYKg6f6/VpkZ8mxZL/7WAuIc9N3ZPPH 16/eeJEI= X-Gm-Gg: AR+sD12VVA29oopZ3t6emr4EBxYHMYqSkNWxkJtpm/o80eTIPkHAv5KWAjOOL0lUqyC pOcN/r7wE24N07B5hhJQzYFQKYmMF1sWS0Ejex+lcG9CMtkTFwQyk35/+2BuFcL3pem/ScTH5fE xclN/WqYa67xO6/5wq2YcAUclh1PnX2841nc7Q2dC70uWbMVeysskEa+pWkiOfH1xDdkzwLoCK3 EEZ7c0dyVU6QPq4nWsoIJu06IKhzLV2Kj4A9hMdL1CJnyDjxFRpHEV7q+ep5VkDdLT2gd7hZrCu Vj0c1YjFQpU/CiLoU9L8tuSL8yl9an5nA8xdj1j+0Z0G6+bZNwVCgdi/KV77WCarlRuRmxAjC/r 6WwBHDZKfWd7Npqy8YnrU6X4vyTY26SyBnahwBYb0STrGvhKy6K9MhYbwy2B7cW+idsO85S798W 1+NnpR97JqTr83APhQS7BEEqMiZ+Z4DSYJmyqQvN6dKdBMGn/rkpoUpiu9GrXU1K2QHSwZai9Bp GZyCgEAI7pGk1+i74yY2Af/5KlvQ1H4+Fgavhobr8cCfJJ5yTkTSlEPHBJ/Rw85Bh6a5h9s4I/Q 9ekvAj3/7EcFErToZqAZTQBesA+ZsNvogM7oSqLt X-Received: by 2002:a05:600c:4982:b0:498:1577:e11a with SMTP id 5b1f17b1804b1-499b06ea08cmr1709545e9.5.1787155062096; Wed, 19 Aug 2026 08:57:42 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:41 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 08/37] expat: fix CVE-2026-56408 Date: Wed, 19 Aug 2026 17:56:39 +0200 Message-ID: <51cd346218f5dcc5712e0ed7a3213673131ce819.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243744 From: Deepak Rathore This patch applies the upstream fix shown in [1] as referenced by [2]. The fix is adapted to the existing Scarthgap Expat 2.6.4 source. [1] https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56408 (From OE-Core rev: 7a0997b570488debe1ae1f2ab5a312150a96b940) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56408.patch | 29 +++++++++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 1 + 2 files changed, 30 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56408.patch b/meta/recipes-core/expat/expat/CVE-2026-56408.patch new file mode 100644 index 00000000000..8e066565ba2 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56408.patch @@ -0,0 +1,29 @@ +From c1ad5610cf060c6374d8f8d3b39163edd7053321 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Thu, 23 Apr 2026 10:31:45 +0200 +Subject: [PATCH 03/17] lib: Waterproof `copyString` from integer overflow + +CVE: CVE-2026-56408 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817] + +(cherry picked from commit 16e2efd867ea8567ffa012210b52ef5918e20817) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index df92a3ca..12bbe23e 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -8489,6 +8489,10 @@ copyString(const XML_Char *s, XML_Parser parser) { + /* Include the terminator */ + charsRequired++; + ++ /* Detect and prevent integer overflow */ ++ if (charsRequired > SIZE_MAX / sizeof(XML_Char)) ++ return NULL; ++ + /* Now allocate space for the copy */ + result = MALLOC(parser, charsRequired * sizeof(XML_Char)); + if (result == NULL) diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index de03bab4ab7..7fe81749095 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -63,6 +63,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-45186-07.patch \ file://CVE-2026-56403_p1.patch;striplevel=2 \ file://CVE-2026-56403_p2.patch;striplevel=2 \ + file://CVE-2026-56408.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95799 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD9FBC5DF90 for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10319.1787155064446924415 for ; Wed, 19 Aug 2026 08:57:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=CjoPAtMe; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-495590dde14so14678065e9.0 for ; Wed, 19 Aug 2026 08:57:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155063; x=1787759863; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RDnQKNGHozSTLpDSOkxqi2+vsOJzmJwcxxNnUS6cyFc=; b=CjoPAtMe60qq9dQEF/oLcIRorKwEc0UN5yc//5tZaiEP1auuGaER/clNds98n7PKVD cAu4/1x5anRXTKH5UC7o6DRelOxKVm5X9HQUM+zstl+jlf4UvRu8AJFN2BdNoELIkXKV UNxjQcNCnrlCV1RzTwtC8IrQHjnyhXLkRA+Do= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155063; x=1787759863; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RDnQKNGHozSTLpDSOkxqi2+vsOJzmJwcxxNnUS6cyFc=; b=QcnKm9pc+scZ5qrIlQkIQLjxKVzgqcpwbtNIP29yHwQvsf4IWQdztOeSAQ7z7yKtas Al7znoWu6UxoX/KNPvw5VZljA2H0bf7LExmc4Q+qij1hqj5U5Vw9lQOSKtKwqXhFDhs+ 7YhQzEmRwBWZM8WhXC1+S9NUUsZzc8g6qwb4T75slwOFNl5uRmp2gsa4h6KJua7P7UL7 e4XVsnk5DjzhQDipQhAkp+/8u5dNQZwgWinpV5s3pz5wsLzrZafFXAKWQpS7KDGL/aT6 SWrnLrRGw8UfGqmfBBzblsRSWRpVigXmGYxUTba53MwBzzg5oYO0TXhPbTmbLGyBQSB4 vuUA== X-Gm-Message-State: AOJu0YzL20mDOwXEN5z0PH4Wva6f6KMkzt2fjLvzlBnzodNntD6N/4T+ k4bSziNQYaVJkcBRodX75lnQFRCJbSivvAOR61Knfm3cU5AUyD8qpDEYEZO9YSllx2eQWK43oSc pR6Wtejo= X-Gm-Gg: AR+sD10q/dZRNuS7YxNVs0nokNHWOnyTB3ZunVmVbaGURcpZW8R1LlFfxAXRdSpIk5V qcO2RWx+2FO52jJCgkxQGOxQcitKz2lwRGOYqEzKP6YulQvTjZQ2F+UP7mZXacbHJ/o7XYroYN3 ySj4ryQ5IcreBWrDgK6B+IOmYQyET/JKz3Ak58GSFdStuO+Ay2PP/khaXd6q/a6F98u9IvvA98O PhmUKbd98htitQIKsAC7fbDLHyD6EyJHINz2VY2Oi9/0VFSU7lkOkNnoPDtFO24cPx+opQ1J7IS UHB3ZGTolX0pbLmAsEUCP1a//+oREN1+IwdhfMnpxk6epU7YJjDHpQZ+I1wRlXOarFrlMtksglK HACGiVV+H+flTp/9yNwETgaRhciVlME98M/R7520K8na7ZdtmapO1yBrZDwlKMFAPK5EmefXeuW lZ+pIHfIvconJmOl3Pw8BjW1ql+w+oZl4dPIKj+rGCnf/69XPJaQ+NDYkRgwkcLi8qz8K0m1QhY aHNszaoaS7uQ78lMKT5cpdVraprs2mu99Y8KC78dYaWD+YA1/PavJOLNf/OfSIo5abfGspvsQjb MjuBz5OleMMZcWfmabOWs2C6AUtNy40T9s7f9+igiYzdJA== X-Received: by 2002:a05:600c:4754:b0:499:7f38:d77 with SMTP id 5b1f17b1804b1-499aa1659edmr82514835e9.6.1787155062623; Wed, 19 Aug 2026 08:57:42 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:42 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 09/37] expat: fix CVE-2026-56404 Date: Wed, 19 Aug 2026 17:56:40 +0200 Message-ID: <2dd880612a13f4f56b181d903219184684797224.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243745 From: Deepak Rathore This patch applies the upstream fix shown in [1] as referenced by [2]. [1] https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56404 (From OE-Core rev: 5ac52606f2aae12323b29026e3d8af24a9c278bf) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56404.patch | 45 +++++++++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56404.patch b/meta/recipes-core/expat/expat/CVE-2026-56404.patch new file mode 100644 index 00000000000..bd5f99742b7 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56404.patch @@ -0,0 +1,45 @@ +From d8e09a54fa9214e64d8e73057ca6918d08857022 Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Thu, 28 May 2026 12:44:11 +0530 +Subject: [PATCH 04/17] lib: protect function addBinding from signed integer + overflow + +CVE: CVE-2026-56404 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164] + +(cherry picked from commit babfc48090977cbf7be24b2c48f6053dca75c164) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 12bbe23e..9d21e136 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -4456,6 +4456,10 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId, + } + + for (len = 0; uri[len]; len++) { ++ /* Detect and prevent signed integer overflow */ ++ if (len == INT_MAX) { ++ return XML_ERROR_NO_MEMORY; ++ } + if (isXML && (len > xmlLen || uri[len] != xmlNamespace[len])) + isXML = XML_FALSE; + +@@ -4496,8 +4500,13 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId, + if (isXMLNS) + return XML_ERROR_RESERVED_NAMESPACE_URI; + +- if (parser->m_namespaceSeparator) ++ if (parser->m_namespaceSeparator) { ++ /* Detect and prevent signed integer overflow */ ++ if (len == INT_MAX) { ++ return XML_ERROR_NO_MEMORY; ++ } + len++; ++ } + if (parser->m_freeBindingList) { + b = parser->m_freeBindingList; + if (len > b->uriAlloc) { diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index 7fe81749095..5e3aef3b7ea 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -64,6 +64,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56403_p1.patch;striplevel=2 \ file://CVE-2026-56403_p2.patch;striplevel=2 \ file://CVE-2026-56408.patch;striplevel=2 \ + file://CVE-2026-56404.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95803 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D54BC5DF94 for ; Wed, 19 Aug 2026 15:57:52 +0000 (UTC) Received: from mail-wr1-f42.google.com (mail-wr1-f42.google.com [209.85.221.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10320.1787155064916289361 for ; Wed, 19 Aug 2026 08:57:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=XfOXewgT; spf=pass (domain: smile.fr, ip: 209.85.221.42, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f42.google.com with SMTP id ffacd0b85a97d-481412f1828so471095f8f.1 for ; Wed, 19 Aug 2026 08:57:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155063; x=1787759863; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Zx42RgbCl9iyBE4q+oV7VPB0nQS6wQC9gJ0uHKqOrx4=; b=XfOXewgTrh3M/iMc1CpTeL5wKHYq6AMB/2DeZpFpoOhOXDPpySYjBhsgFWmnaHDQem QMtr/ZCNBDAjjkpt/TkFF4cE8HiwmH5VMxcrMX7Pg+NQNjGNuoLuza/40D3BUyQjYtUo 1wazi8O71AsIp8aUwWGT/i+ifLcF9LLupUi08= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155063; x=1787759863; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Zx42RgbCl9iyBE4q+oV7VPB0nQS6wQC9gJ0uHKqOrx4=; b=kyW9PO5L6Latow6oR0BvnoIcccvwr7ZYIf/7FTia2aYM4AcyAtSsQ3DfwGpx6WbXBD K/kf0BgiDGHvTlJKs3frV7Dreu8+86+aYAhF1SzRY9yXJbUGxUsfnCus84NTnvkjXceS zXeZutf1VahlItx086ebXzxx+pgBwxsg7zT38DEiuVVMcgj+3IJ8rDUt8fpqLuS4t9Ia j9HzG5hFghDKbJN6RO7dx9TvYh5fU/xRck8Kc3bOl7WZSX6U7CC1RJmJMTsshOmzgUXc l5JCW4W45JqzbhWMnFmD8hgbhGd2EANy34tX39LXbpm7dTxFEHsoa6RiVR6IqE36Qih9 NSpw== X-Gm-Message-State: AFuF++l4ZgNT0yPftzktRYd3p6fOSRJuH2UnFQrV3q3dMZ2qHEwDgwO0 C85W7RjTA7JLoWVj71f4+/x4cHsa0YlgQ1rO98RRKNUuo8NN1vuYemjzxdncDb5zibmDllLvbKI uk1IbSyA= X-Gm-Gg: AR+sD10IvDEKHgS9d+Ze/CvnVwgSdFixHxPlDQBNuGX8y2NC/keit+nvyM2ZLh27O8z ua27VkXyiK8UxqlwNmovc3wB26tJhHBCdIV49+tfhiIYLua1RmDtAQw/wtWVPycqLay6FRag+nE 3Rs4bMRsDalyf2gmwCrOWDTyDpwyt6pUZNSiRfK5jvW9PuQlYqPFCeRyuwMyntDrZvXuWC5hcyt +tm8xMAGyllKrJDtlMjIIna7RZ4r5hxK5OjgsjJy0a0sJBSNbB3sl+WiMRfgquBR+Z1kKoj1Q5w qNzs42pFmX2pxSRs+NGcqtf58zNPdRjfSVSrYWU23mHdqKjrYMDPy45yRgXm2BQqB9KmuOsX9fu UxcyqRiN+PJCoYDeW/XMIyqn1dKbusz96l8ORi6f27kjkjG54IlO27+nFaEFaEnfZH8Gy1uIGJH wdD2RAl18uHXEzcPnpa2ZW1jcUk4pYmOX5nJkPN3ujK/R4GNnOlyM864MVZRfpwi53BqO+cCsnX lOeXyewR/gkrW8uYX1xoxXDZFIZIZn1AVdjP/GtOqFrYnyR7LmUY3E0n1/k0yIFyDgNoHp7yIsd /KK9niB0LE5vwVpYXiP5sra2QeLmKda8Mk0yNJSk X-Received: by 2002:a05:6000:705:b0:47f:8d71:210a with SMTP id ffacd0b85a97d-482b1fd48c0mr11329390f8f.15.1787155063167; Wed, 19 Aug 2026 08:57:43 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:42 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 10/37] expat: fix CVE-2026-56405 Date: Wed, 19 Aug 2026 17:56:41 +0200 Message-ID: <2626a4fb7742ec4572285c2659b1981fa711443f.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243746 From: Deepak Rathore This patch applies the upstream fix shown in [1] as referenced by [2]. [1] https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56405 (From OE-Core rev: 7d9b2576a9dcb01184c0aa3bd54a6bdd20496bbe) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56405.patch | 30 +++++++++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56405.patch b/meta/recipes-core/expat/expat/CVE-2026-56405.patch new file mode 100644 index 00000000000..67595173414 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56405.patch @@ -0,0 +1,30 @@ +From 49ba5bdafa7aaee9b77a32ffaa798e625bd46e73 Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Fri, 29 May 2026 11:45:17 +0530 +Subject: [PATCH 05/17] lib: Protect function getAttributeId from signed + integer overflow + +CVE: CVE-2026-56405 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0] + +(cherry picked from commit 2c6c42d33689f6b266a5267b639e03cde17e53c0) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 9d21e136..80ad0811 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -7312,6 +7312,10 @@ getAttributeId(XML_Parser parser, const ENCODING *enc, const char *start, + } else { + int i; + for (i = 0; name[i]; i++) { ++ /* Detect and prevent signed integer overflow */ ++ if (i == INT_MAX) { ++ return NULL; ++ } + /* attributes without prefix are *not* in the default namespace */ + if (name[i] == XML_T(ASCII_COLON)) { + int j; diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index 5e3aef3b7ea..6d71393b2a5 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -65,6 +65,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56403_p2.patch;striplevel=2 \ file://CVE-2026-56408.patch;striplevel=2 \ file://CVE-2026-56404.patch;striplevel=2 \ + file://CVE-2026-56405.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95792 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 559EAC5DF8A for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10321.1787155065450343520 for ; Wed, 19 Aug 2026 08:57:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=fZqVvZiX; spf=pass (domain: smile.fr, ip: 209.85.221.50, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-481412f1828so471100f8f.1 for ; Wed, 19 Aug 2026 08:57:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155064; x=1787759864; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=EvyWTJXFkuwb4wpgbch+7qTOgJDi68Und1VkcYDre/U=; b=fZqVvZiXRWO8sTDTre3GqlAmco0f9gdMHkFh0vLPDDZdQSoIVdtPRyJQQVaJotnHv4 BVuMGE1RaqjGJAHN3Fw/YjxzuCP1bbarnyLBhp1wdiG+EYc5KUQXkd3uQmZfQsDmdm/I A7mXRUCGir6jXCgrWwhmMutVxkUdWlpAbmNSA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155064; x=1787759864; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=EvyWTJXFkuwb4wpgbch+7qTOgJDi68Und1VkcYDre/U=; b=o6MtNdjZCIRtlV57xnnTKZPUIkSmBsTxaKoJxJ3+AqiICKrzJf7W1QXTRYSDvCOwns 8OmVwHxnY2OkgLHUf9k5Vz29ssMFCeaatLnyE3ZVkVt+FeXoloaXQ2dyR1NMqzetN0mJ plYrlZNAN0hCnp9GFmed+vR+IrvlpDLfzA9RvVFMchPNGoNU03UfG9KKHobrA1L4xBx8 MkKvQuUqixcAfeT96wy2N8rS7Qu8VnfWBYVsTa0JStE/B1hVwKqs4WodICELKPnW5JFL 6RZrZ/4IdRw+RE7ppapyJzXoX/ldNA0xgcmgcig3aPXj3WwiOCaZB04+AHI0zqt+J9jP YOBQ== X-Gm-Message-State: AFuF++n22vCNaK4E8WXW5BK6+5q1OFmg6KvwrZ76tzNXCTtSm8VanKWD Bal2aQgp+8B0CpY8Hj0uvrDVJ3Gx633Bza5nb5TSTxhOHGVUhckkOxvTUb3URSg/JW9CQIs8O4R SmoBBA/A= X-Gm-Gg: AR+sD13eC750tAoSfrQ6zwMIau261HFNvbKQCH/rh3m3E5AuNwKjhFil+ut9FSU0Gig Huanl8ufxGq4H0GzD9z2tKkQ+iBb9alUqchYdQIMbdprg1PF9xQZo6P0UGksTzl3SRuzLisvCa3 ibZyOj0rfo+XY622UEts8cpcx+7qQi6gKNlZG5PyLK9kRlCPUVx8DPNXR00AwB9GKMiIJ/NUQ9W 12bbS2fuKgDDIxQa7Rnj7Il7RHsvMgFgppAkHrKjJVQgW9zEBRZEzFFuZ5tC3NlgnFQtpLyvPLz 8LN+sD7NNKRc8KJhLF9iYGDp4HP7oH8tXqp0+SO7jENgbWFCrDVDP7TvW50B7MowYuKGbb2FeY4 yKuPEj3Iw66Jt7rMm+U4nNpy0Gl/X6L/xiZEcbzhEnWBNpgvHHzRb3y6OlBWPZZboRkpwFkA4fl D4e3fgYryR6GWbipSI5Apm+udzLwfKEMCoFBEsDWHxwwyY6y3kq+2RALtvxIX+QXNDXpjf7jNNa HExhnDXhK/nmR4KfRU0ZRUsu1OycVLoi3djEpS2vkY6LhrPuEMYJwHmP2UNzY0c7wkDL88jTYUM EXI7JQhz6xoDVqyXB2rhPfGUAqeTE0//OZnjdC0eY9vSMaya5ow= X-Received: by 2002:a05:6000:382:b0:47f:6f6a:6a7f with SMTP id ffacd0b85a97d-482b1e91ccamr11092124f8f.8.1787155063704; Wed, 19 Aug 2026 08:57:43 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:43 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 11/37] expat: fix CVE-2026-56410 Date: Wed, 19 Aug 2026 17:56:42 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243747 From: Deepak Rathore These patches apply the upstream fixes shown in [1] and [2], as referenced by [3]. [1] https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347 [2] https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea [3] https://nvd.nist.gov/vuln/detail/CVE-2026-56410 (From OE-Core rev: 51d1871b3551deddd9f5fac85fdcd4b2793b94f0) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56410_p1.patch | 46 +++++++++++++++++++ .../expat/expat/CVE-2026-56410_p2.patch | 39 ++++++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 2 + 3 files changed, 87 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch new file mode 100644 index 00000000000..6f906e682d3 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch @@ -0,0 +1,46 @@ +From b454931c42290c9f0faf2a01f9634d82db636bac Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Fri, 29 May 2026 17:51:25 +0530 +Subject: [PATCH 06/17] xmlwf: protect resolveSystemId from integer overflow + +CVE: CVE-2026-56410 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347] + +Backport Changes: +- Adapt the allocation hunk to Scarthgap 2.6.4's explicit cast and + include stdint.h so SIZE_MAX is available. + +(cherry picked from commit deeb97f7c88d17a16b0ea2521a13733abc283347) +Signed-off-by: Deepak Rathore +--- + expat/xmlwf/xmlfile.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/expat/xmlwf/xmlfile.c b/expat/xmlwf/xmlfile.c +index 9c4f7f8d..ad691b12 100644 +--- a/expat/xmlwf/xmlfile.c ++++ b/expat/xmlwf/xmlfile.c +@@ -41,6 +41,7 @@ + #include "expat_config.h" + + #include ++#include + #include + #include + #include +@@ -130,8 +131,13 @@ resolveSystemId(const XML_Char *base, const XML_Char *systemId, + #endif + ) + return systemId; +- *toFree = (XML_Char *)malloc((tcslen(base) + tcslen(systemId) + 2) +- * sizeof(XML_Char)); ++ const size_t charsRequired = tcslen(base) + tcslen(systemId) + 2; ++ ++ /* Detect and prevent integer overflow */ ++ if (charsRequired > SIZE_MAX / sizeof(XML_Char)) ++ return systemId; ++ ++ *toFree = malloc(charsRequired * sizeof(XML_Char)); + if (! *toFree) + return systemId; + tcscpy(*toFree, base); diff --git a/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch new file mode 100644 index 00000000000..148592ba9bc --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch @@ -0,0 +1,39 @@ +From 7e6230212ddc4ea74115218fdbe5717e8e1c0f2b Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Sat, 30 May 2026 11:28:51 +0530 +Subject: [PATCH 07/17] xmlwf: guard each operator in resolveSystemId length + sum + +CVE: CVE-2026-56410 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea] + +(cherry picked from commit cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea) +Signed-off-by: Deepak Rathore +--- + expat/xmlwf/xmlfile.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/expat/xmlwf/xmlfile.c b/expat/xmlwf/xmlfile.c +index ad691b12..4d2e3220 100644 +--- a/expat/xmlwf/xmlfile.c ++++ b/expat/xmlwf/xmlfile.c +@@ -131,9 +131,17 @@ resolveSystemId(const XML_Char *base, const XML_Char *systemId, + #endif + ) + return systemId; +- const size_t charsRequired = tcslen(base) + tcslen(systemId) + 2; ++ const size_t baseLen = tcslen(base); ++ const size_t systemIdLen = tcslen(systemId); + +- /* Detect and prevent integer overflow */ ++ /* Detect and prevent integer overflow in the addition (without risking ++ underflow) */ ++ if (baseLen > SIZE_MAX - systemIdLen || baseLen > SIZE_MAX - systemIdLen - 2) ++ return systemId; ++ ++ const size_t charsRequired = baseLen + systemIdLen + 2; ++ ++ /* Detect and prevent integer overflow in the multiplication */ + if (charsRequired > SIZE_MAX / sizeof(XML_Char)) + return systemId; + diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index 6d71393b2a5..39e40befc44 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -66,6 +66,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56408.patch;striplevel=2 \ file://CVE-2026-56404.patch;striplevel=2 \ file://CVE-2026-56405.patch;striplevel=2 \ + file://CVE-2026-56410_p1.patch;striplevel=2 \ + file://CVE-2026-56410_p2.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95797 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A507C5DF8C for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10407.1787155066030289076 for ; Wed, 19 Aug 2026 08:57:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=obTlDLv/; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4954df200ddso9664085e9.0 for ; Wed, 19 Aug 2026 08:57:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155064; x=1787759864; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=W2hZe/lWTcUUSYydLVyYADD2RkSUQAu7YUJeK8l0RcI=; b=obTlDLv/DXNlFhI1coNjYcF5wjFZ/VLhp7ziwiZ07UulSUyaoNbtmzLHKoLDkFxbgP SCgzEEFLYhyGTDZmQO/nyPOipoxQGvuiFrB6iD+GmllZGXAZ3S8Ir7fJzCGv0hs2FbO9 /eYdPlrnQInhL/yynokUFvWR7IMtDF7TcWFKY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155064; x=1787759864; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=W2hZe/lWTcUUSYydLVyYADD2RkSUQAu7YUJeK8l0RcI=; b=CClUXmzh5+iDpPMr5YhX3WIRPUiKtqMsjAfR3KzaZrLsKhRb2hC0opAPsCCNks3QDJ QN4Gy5cpmMPXGR2s/G8io/fp6aCyghrYoKPKHHFzXQDn6WmGvImVMRJsMnTQQpDadUoa Q9Chao4jL6+doZcJ9g74HqDp9TaFfpRS5zvhdFN6W94uM7yvHsw0L1vLyJKUHGIHb2MI 65rJ/aWGiSVBi7te9KmrggsJeYnYKNMpAdxuRBLQJO7bhMKrD5MBth5gCLaYRAjVRgws QDcy+x7LYdwnqKVnBx9+ytM0Pg68tFm6eFvM/oa2MtjV1OXDk0iIlRD/swqimf3LOURh zoWA== X-Gm-Message-State: AOJu0YxXXz1bq7bVK96NqdhLsEqgaL4c5F40ZIfz11JjDpNqxynse6pi 5uj16/H9zTIE85TYTQbIUT03f1mTYKoJ/AJcwLrlAlJnE0kdLvPJYUJdNvqCXt+k39DZn4EUET3 oU8Mk4eg= X-Gm-Gg: AR+sD11zJDmkRzA2Ud1anYi02obaMKLKRq6byksNyhXY98N2EzgiyIhJhOpiBW+3G2s PxPGhr9tbr1vx6DAKYgX0e/leynGySOEWJP6DLNmvEs2yGAw1X1l/X3x8wdr2Ucf1xO0Moc89mS oaEU4zwh3Rbi6zuCUgnKe805GswMSVi1gjH1A7ugbhVR8lewAu8Dqemx7Ny2R5JUWCj55emRRTf qoOf6CuDMO+0fJnGRuICZuO2G1oRX6vq1NYnxZmmfiPxa6ZEMApmg7S8ONN1iMrxlIfDKjKE77P omRaLAfytcZ7H5LjoZJoRZwI7/QuaoCQ5yCKz0I0f08ry6RbEyAJKrBC7OFB/NvxnflrTpNzHfh xAOXkdF9U85eg4CN00aTQpakEzv8IlQtveKjFybug/WNV7oisSD+Ez/om/MAtE+tZPPdsKztJBS oprg3vd+rut4XkqkTpcphFsC1CmRXD8/gwlgR1DPI4Xit2RT8unKgVlKk2RcgbJkhu0n9PPgYjV neYX6VKy9lendLpsgw3d4Xvp1yy2p9Y2Bmj4/JPgyiN9422wdraJJVwswIO4SD1xo1Yi8hwKeB2 zx6OtW9v4OXAYFpxfGw3mnxUylicPTci/3m02tdo5zFHNfQIKOg= X-Received: by 2002:a05:600c:3f18:b0:498:1595:be7b with SMTP id 5b1f17b1804b1-499aa194df0mr118087535e9.4.1787155064245; Wed, 19 Aug 2026 08:57:44 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:43 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 12/37] expat: fix CVE-2026-56406 Date: Wed, 19 Aug 2026 17:56:43 +0200 Message-ID: <6c5b6659d16f0109fea8c1d6b31a8c3ea63bfa08.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243748 From: Deepak Rathore This patch applies the upstream fix shown in [1] as referenced by [3]. The prerequisite in [2] provides XML_INDEX_MAX for the Scarthgap Expat 2.6.4 backport. [1] https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d [2] https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd [3] https://nvd.nist.gov/vuln/detail/CVE-2026-56406 (From OE-Core rev: 6cbc3b17313df01c48e738a87f8d12bc8834fd59) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/CVE-2026-56406-dependent.patch | 59 +++++++++++++++++++ .../expat/expat/CVE-2026-56406.patch | 34 +++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 2 + 3 files changed, 95 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch b/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch new file mode 100644 index 00000000000..d749ef06089 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch @@ -0,0 +1,59 @@ +From 9aafa47798332618f08af046c3471de1f3a9e031 Mon Sep 17 00:00:00 2001 +From: Matthew Fernandez +Date: Wed, 27 May 2026 17:01:44 -0700 +Subject: [PATCH 08/17] lib: Make `XML_Index` overflow check more intuitive + +In fixing a bug, 7e5b71b748491b6e459e5c9a1d090820f94544d8 introduced a magic number `2` in this code that made it difficult to understand the rationale for this overflow check without reading the commit log. This change introduces some more readable constants to use in these situations. + +CVE: CVE-2026-56406 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd] + +Backport Changes: +- Adapt include context for Scarthgap 2.6.4 and expose SIZE_MAX in + the existing stdint.h comment. + +(cherry picked from commit 252ff1a307b1490ce0f430632791e7e52d7e43fd) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 80ad0811..5bf706b0 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -97,10 +97,10 @@ + #include + #include /* memset(), memcpy() */ + #include +-#include /* UINT_MAX */ ++#include /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */ + #include /* fprintf */ + #include /* getenv, rand_s */ +-#include /* uintptr_t */ ++#include /* SIZE_MAX, uintptr_t */ + #include /* isnan */ + + #ifdef _WIN32 +@@ -211,6 +211,12 @@ typedef char ICHAR; + + #endif + ++#ifdef XML_LARGE_SIZE ++# define XML_INDEX_MAX LLONG_MAX ++#else ++# define XML_INDEX_MAX LONG_MAX ++#endif ++ + /* Round up n to be a multiple of sz, where sz is a power of 2. */ + #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1)) + +@@ -2360,7 +2366,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) { + int nLeftOver; + enum XML_Status result; + /* Detect overflow (a+b > MAX <==> b > MAX-a) */ +- if ((XML_Size)len > ((XML_Size)-1) / 2 - parser->m_parseEndByteIndex) { ++ if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + parser->m_errorCode = XML_ERROR_NO_MEMORY; + parser->m_eventPtr = parser->m_eventEndPtr = NULL; + parser->m_processor = errorProcessor; diff --git a/meta/recipes-core/expat/expat/CVE-2026-56406.patch b/meta/recipes-core/expat/expat/CVE-2026-56406.patch new file mode 100644 index 00000000000..56de9e41249 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56406.patch @@ -0,0 +1,34 @@ +From 5db699faa6af1c66e96abec5dbd1908efd64ef70 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sun, 31 May 2026 15:18:58 +0200 +Subject: [PATCH 09/17] lib: Copy overflow check from `XML_Parse` to + `XML_ParseBuffer` + +CVE: CVE-2026-56406 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d] + +(cherry picked from commit 99d8454fdf900a6d00c2a52748e6c0eeb507574d) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 5bf706b0..9f07b860 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -2483,6 +2483,14 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { + parser->m_parsingStatus.parsing = XML_PARSING; + } + ++ // Detect and avoid integer overflow ++ if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { ++ parser->m_errorCode = XML_ERROR_NO_MEMORY; ++ parser->m_eventPtr = parser->m_eventEndPtr = NULL; ++ parser->m_processor = errorProcessor; ++ return XML_STATUS_ERROR; ++ } ++ + start = parser->m_bufferPtr; + parser->m_positionPtr = start; + parser->m_bufferEnd += len; diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index 39e40befc44..aa2a4f89669 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -68,6 +68,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56405.patch;striplevel=2 \ file://CVE-2026-56410_p1.patch;striplevel=2 \ file://CVE-2026-56410_p2.patch;striplevel=2 \ + file://CVE-2026-56406-dependent.patch;striplevel=2 \ + file://CVE-2026-56406.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95796 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A28D2C5DF8D for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10408.1787155066628572521 for ; Wed, 19 Aug 2026 08:57:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ugp5ptdL; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4995b0343c1so11266075e9.3 for ; Wed, 19 Aug 2026 08:57:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155065; x=1787759865; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Jyuors+EzkXc4Ti3jROEpx9MSQS8rLv9s0flzjz7mJk=; b=ugp5ptdLbYHuwQKLzCN6dcYS5GDeVZrt9Ns+2WLTiYUGEBY6j5/daunRpuu8hvfOF5 vyJ9XO9/kOTpjt/bVJoi7sDFc6iGKA4U5/n6VlFDEyz4tFsdHbdogg8IcQ8JVgbmAtvI 4kMUtCoiaHi45sqhT7w247O6lQcIKAQMF99w8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155065; x=1787759865; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Jyuors+EzkXc4Ti3jROEpx9MSQS8rLv9s0flzjz7mJk=; b=Y+1Yq/EroG5ps3LuGgGk1xHMypZJjTYb5tNcuZuJ2WrIOj1xYve2tZrOiPg9Xkt89d ecn9kRrjYuipO/kurEm7Fva5JjyB4NHKqlbRz400iPGGPcHeYK2DtzqBP7Su9qAsA6rq lqVZ3O+slYBLdEttlpKk39emB5/o0Fb1nF8VGQC9gAlnN/FPWvxo2v46rFnuol9X2ac5 MIhmr9D96dlNn0jvob1ziT4E2mbWjKuv+mTlm39C7HNSSX8lMdjXarh+YkHzmQcU693c CEXrn9xqPxOE53TotymtFJueJktpNM+XIEuWcU9SsCmwr0i+sbU9ehFBt9NlT0AnySc5 8Dow== X-Gm-Message-State: AOJu0YxXrT7BnI2NEhdh4BVbJhZH1TrQ6EJwy3cImpRUWULa7RkkhEB6 8HjKUmMumZkCZR2o4ldmwzKLeapCHDL+2T3kClZvMlsazZfGAkInleD/F2gckqFeDRUOUdJGfj4 3L14n/3Y= X-Gm-Gg: AR+sD10g0yJRiyvDj2BpNKLGctRgQdRyW1O+ixmkaGepJ477v72DflUbLmB5zRti+B1 qFtcLQZzeKiwq9C8ksdirYMfgSWjxqmjXzKtoTnb7C8Qu3S/8s0aklOwTrdR5BIREog8oBLkF+B OKnXSxUtlfcwG4C9zHBemXpafhQWsy340BzV72OYCO2vWyhsZJUlRbe73yDLqwReC19KEpYGNdv 2DWZPfjL7gmmczaXH4i0otbC25RK381MXk37kkH8yebmjPxbHbcdbXOGXXpAeEVdLP+9KdVmC/5 8YZvrOWUFYwIachvISUxgRyDFJIwNk1sKVABEjSqwWrtExKuQVYR3JrkzqWMRS63buZWdjDa2mq fNAYwWVGfhXc7a1eN9uNXk5xuGzvhB9s8Ad7Yg7s0ToxoKsmOrNbHHTOynHb8bYjwjnWnPwjAof iOg6e0mhh/7RSNh58QOPKvm3fFCzrifZFESzfjkG/81nlK841GavPcHubNE4YV+tu2QN15v1mt7 RnSLB42StwG2r4FgH8abVvJonaFHqvZL403IP0B+o2E3/douBe6BxihDX5jWnCDHkQoGP6uvi6p kd1TZEUp1tow+AgThZxqhXaZ5Wx2cn7CLcrjZLcN X-Received: by 2002:a05:600c:5294:b0:492:4e09:9fc1 with SMTP id 5b1f17b1804b1-499aa1f5413mr115937355e9.15.1787155064895; Wed, 19 Aug 2026 08:57:44 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:44 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 13/37] expat: fix CVE-2026-56409 Date: Wed, 19 Aug 2026 17:56:44 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243749 From: Deepak Rathore This patch applies the upstream fix shown in [1] as referenced by [2]. [1] https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56409 (From OE-Core rev: 6e0669fdbf661569083b7fe479bf829e6e476f72) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56409.patch | 51 +++++++++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 1 + 2 files changed, 52 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56409.patch b/meta/recipes-core/expat/expat/CVE-2026-56409.patch new file mode 100644 index 00000000000..b0aac260739 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56409.patch @@ -0,0 +1,51 @@ +From 174ce18f2a283be634d830a5259bd07142635fe8 Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Mon, 1 Jun 2026 11:53:19 +0530 +Subject: [PATCH 10/17] xmlwf: protect output path join from integer overflow + +CVE: CVE-2026-56409 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e] + +Backport Changes: +- Adapt the allocation hunk to the explicit XML_Char cast used by + Scarthgap 2.6.4; overflow checks are unchanged. + +(cherry picked from commit 61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e) +Signed-off-by: Deepak Rathore +--- + expat/xmlwf/xmlwf.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c +index 7bbdb303..bd5f68a4 100644 +--- a/expat/xmlwf/xmlwf.c ++++ b/expat/xmlwf/xmlwf.c +@@ -1240,8 +1240,26 @@ tmain(int argc, XML_Char **argv) { + } + #endif + } +- outName = (XML_Char *)malloc((tcslen(outputDir) + tcslen(file) + 2) +- * sizeof(XML_Char)); ++ const size_t outputDirLen = tcslen(outputDir); ++ const size_t fileLen = tcslen(file); ++ ++ /* Detect and prevent integer overflow in the addition (without ++ risking underflow) and the multiplication, mirroring the guards ++ in xcsdup() and resolveSystemId() */ ++ if (outputDirLen > SIZE_MAX - fileLen ++ || outputDirLen > SIZE_MAX - fileLen - 2) { ++ tperror(T("Could not allocate memory")); ++ exit(XMLWF_EXIT_INTERNAL_ERROR); ++ } ++ ++ const size_t charsRequired = outputDirLen + fileLen + 2; ++ ++ if (charsRequired > SIZE_MAX / sizeof(XML_Char)) { ++ tperror(T("Could not allocate memory")); ++ exit(XMLWF_EXIT_INTERNAL_ERROR); ++ } ++ ++ outName = malloc(charsRequired * sizeof(XML_Char)); + if (! outName) { + tperror(T("Could not allocate memory")); + exit(XMLWF_EXIT_INTERNAL_ERROR); diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index aa2a4f89669..0f996f882ba 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -70,6 +70,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56410_p2.patch;striplevel=2 \ file://CVE-2026-56406-dependent.patch;striplevel=2 \ file://CVE-2026-56406.patch;striplevel=2 \ + file://CVE-2026-56409.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95800 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0545C5DF8E for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10322.1787155067153390843 for ; Wed, 19 Aug 2026 08:57:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=jexpJWBz; spf=pass (domain: smile.fr, ip: 209.85.221.50, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-472326ca506so815804f8f.2 for ; Wed, 19 Aug 2026 08:57:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155065; x=1787759865; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=t+FItTlfqszOI5fvunzn9X6+BVvjmbJwc7e6X21RzAo=; b=jexpJWBzyzq0rG/FZ5Bqp/MTPyvUu9gBv2ko8wQO92XkHyxXwfcGRq1ji9bIX3zDud GsWMdYDexzD4Jhwc4Bc3sfCjVHBlGLVgODtxImoGKW4vaRtGWtfSiwX7Cy1FdWZVoWvr zj9d+Km/KuZ2vEE5HHHm0VregRXNlcMjA6iRA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155065; x=1787759865; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=t+FItTlfqszOI5fvunzn9X6+BVvjmbJwc7e6X21RzAo=; b=cbzV8E78rbzQ0/v5KgURgc0n9/B/Zrp7uNPPW93R3MKQ7lm6wTiXgonQm3yyGqhcbc tTqOqXbXxDVMe4M9Ph/hS2LSwNBIaWbkjnisDe4ApE9325XtE6j0beL4EgxWvmElIX3U bYdBRAYv5Ye4+cYL8L9HFji8Z9qQHhBXvXEhn+fG/6BEAqOMgOiOIByDuGlmUTgT4i7I oTQzlJN5qabtrPPjHrcyxb6icoy4cvXSkgVckmkH/qs1eQ3/jxQgT0ZpF2VpZ7RbumRp VUQSnwwmE9hUfkSCABfyhwSj5R7e5tO6wMsUMk9IYlwXftd/8V0cEI8ImYlx6gQgkq8g 91rw== X-Gm-Message-State: AFuF++ldp547gui2aoiYoUAoIOJiqiWI2QxnZyEa9mDP13SRvfn/dWvc yxEJ4sKKcnQSvKVEjLJ/p/zt3w0UcN1jDGDh0W4jqp2E20Qoo8ixcQimQn3Vn4Eu3qxLkZhFa0B ejcaX7Pg= X-Gm-Gg: AR+sD10KdKt5WqyrpQPytHxw3CdiCvqHn9AaryqZf/ZHgojQDuITOhGp8Wp6ibZz27Z tbNCoTe0tWd71UIyjlR3J4vj+QCJSWcIxbgVqj6FA3aZcSWt/eltNqhTk1fppq3jPxgJWVV+JxT LQG5vMHGCnqiRpyvKIwD5qT0nXH95bXJwgPUDIqbXmUzbTC6ZKOIRSp2VezxO4XB+BztsTwqKWB AwhMMP9mObQ4ZzXckaO8KnYiT3GnyRnVvhQ+uc6v0kKC4+q2FdB34mwJlF+NY99HV7jcJUCZemp JE1+gC/pfikobmFfE5Yz8oTO6PDqziBlSqQ7lUGEuzJGdSTaTfa1vKlMbBOuCWiErhUBVLYJ1CJ xRub+Euc//TcW85xukjSA4PkKamigWReGtxA4CJLdFBuVPqXa8V+TRsGH9KXiuMKEJc0FixnrA3 WhppZ5JEkVAIkayQhqAmEqJtxx4HQsSD7aT4dk8077CbTUL8IuwtuSDdHzpr5ZcDPM4eKCH0/PG BT6hCWhwTZZTtHXyvBKgrLKBk31uuZiVWShH+QxwNOo48gClnfOEzP5ItM4vupqINhVJxmnTi/L RY7xxWm2KjYZXuf1cR/gaJREZqd1tdwOyXDMPDFS X-Received: by 2002:a05:6000:4301:b0:47f:8f8f:e493 with SMTP id ffacd0b85a97d-482b1e86885mr8496019f8f.3.1787155065377; Wed, 19 Aug 2026 08:57:45 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:45 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 14/37] expat: fix CVE-2026-56411 Date: Wed, 19 Aug 2026 17:56:45 +0200 Message-ID: <98e969a60c4979e9d4d9d202360c27bd65718631.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243750 From: Deepak Rathore This patch applies the upstream fix shown in [1] as referenced by [2]. [1] https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56411 (From OE-Core rev: 61f895ea50fc7d6e3c1f3bac9e77f3a7ac96de6a) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56411.patch | 50 +++++++++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 1 + 2 files changed, 51 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56411.patch b/meta/recipes-core/expat/expat/CVE-2026-56411.patch new file mode 100644 index 00000000000..c6dd601f202 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56411.patch @@ -0,0 +1,50 @@ +From 5e696e78f8c4a709c4f774973b142e57090c4364 Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Tue, 2 Jun 2026 13:13:34 +0530 +Subject: [PATCH 11/17] xmlwf: protect notation list allocation from integer + overflow + +CVE: CVE-2026-56411 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5] + +Backport Changes: +- Use Scarthgap 2.6.4 freeNotations cleanup and return directly + because the newer shared cleanUp label is absent. + +(cherry picked from commit 528a4e5017e1bd3b48b689fd0c131df940ae3ea5) +Signed-off-by: Deepak Rathore +--- + expat/xmlwf/xmlwf.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c +index bd5f68a4..6a3d31b7 100644 +--- a/expat/xmlwf/xmlwf.c ++++ b/expat/xmlwf/xmlwf.c +@@ -387,9 +387,9 @@ static void XMLCALL + endDoctypeDecl(void *userData) { + XmlwfUserData *data = (XmlwfUserData *)userData; + NotationList **notations; +- int notationCount = 0; ++ size_t notationCount = 0; + NotationList *p; +- int i; ++ size_t i; + + /* How many notations do we have? */ + for (p = data->notationListHead; p != NULL; p = p->next) +@@ -401,6 +401,14 @@ endDoctypeDecl(void *userData) { + return; + } + ++ /* Detect and prevent integer overflow in the multiplication, mirroring ++ the guards in xcsdup() and resolveSystemId() */ ++ if (notationCount > SIZE_MAX / sizeof(NotationList *)) { ++ fprintf(stderr, "Unable to sort notations"); ++ freeNotations(data); ++ return; ++ } ++ + notations = malloc(notationCount * sizeof(NotationList *)); + if (notations == NULL) { + fprintf(stderr, "Unable to sort notations"); diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index 0f996f882ba..fb36108eafa 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -71,6 +71,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56406-dependent.patch;striplevel=2 \ file://CVE-2026-56406.patch;striplevel=2 \ file://CVE-2026-56409.patch;striplevel=2 \ + file://CVE-2026-56411.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95793 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E66DC5DF88 for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10323.1787155067757188962 for ; Wed, 19 Aug 2026 08:57:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=hHkx4EIh; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4921eed3fa2so11476075e9.0 for ; Wed, 19 Aug 2026 08:57:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155066; x=1787759866; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=vIe6pZi3fS9IHz9dvVIs0CW4+PMenaxJD5QtqiYbTLA=; b=hHkx4EIh+UvWEVXwAuPlPlZ6IjMJ7Gr4f+OjTbbWg/dRHR2SeBER1jqWx+AS1A+ETG P9ksR4OPCzNN7tIWlyXJSFETAC7QbZVhBQsKwTWXldN5nEui4QzZQsG7lfetzXnCwTL3 c6YGnq2ldtApGXXtFbQ1VD1c69SP071UpBreI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155066; x=1787759866; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=vIe6pZi3fS9IHz9dvVIs0CW4+PMenaxJD5QtqiYbTLA=; b=dlsBkDgTpZu5hkBzvcYruDbhxtoXE91318wVQanZFls9vKCwoLO5xHumcXpDmW/ka6 730NBBicSpooNVkE10mWHPm83mqNjT+TdSYC3PW086kO8eru2pck8ae45G9LOK/8lSkF xIDzZX1dMUi9fgpfWrV8wSsMEZp8vjIOBatVEoFgatHBJ9X4PYI7mwPyRRhqrwikPtLF uMRHVzJ7fgQKSiKXak6y4M2qigQT4e8tQpx+bUUHrjAgZkSEJa7B+c4RRYmwoxhq4qMQ LuOScjLzlpOvraiPRLCxWrl2Fb8v1RHTeGfSyIErea74PcwXutoq9FPYAnM09y5tydpu J0Cg== X-Gm-Message-State: AOJu0Yw+kSPAK9/vdnEtlwAvBFeGbZAIfKbOyI1KomD8D2XMI0yOvbuq E4B5i0JsEkEhslVS6Bxhd4A9JjZNgAnF+/TxoZ7FNAb57/2BZ3L895bsAhN6QpE6jhQKis4D48J H6jNtgYY= X-Gm-Gg: AR+sD137iwXZ0HpP2Q75QY56Wo+R/mvAT1MFOvbIoCR25E+I9EjKpKkREnnZ17hoR30 8waO3hxFWAEuO00iCBnGl5OwVyH5T9U8B+sYAK3ecmLGXUsZijCbuLFhwWD74Zvxg7hsYorh5RI EbSEffc8V8SUZV/Bbd6QTbgzlrGSnL+IgEs8gbRTc813hgZ+8VPyeJJSu5ermSFTtaJH8pmr1vV NiZZjbk506pCdgcQVFuOU3xatI6Mc/BEgLR/CQXLKq6VGbsB9juHjMIytTRW+bJrGgzi4FvP39/ mPx5oocPP5d/3F2vQc+R7nVzVdcY4Cb+oX22qJ19EuexDy38GUD7DCf5Bc+vpqxBIjvAtdSkcWY S5Ak03Msa1YqprczW0Hrd/MwHEyd08YC7AXauLjhtZrMpc+hXW5/DOg/5JU7bdjPTy0BQ9WI8qb Tt4hdQJilEuzzTKGvQ2gfc/EK02HEgIRh+hI+ORAccBDt/0SNcDxpu8BN8fc+qXxk7r9alyFZ/3 K0JAtg+QX9NAf10TYNZzr4qw61e2CqvMRUKoGxxl6DYwmXdiZQkArBZ2LMhYdvZqmv0aNWGsKvx UUQdxiy/a4TKBbVRAytRx2lLs02u1jtxPbg5LqLr X-Received: by 2002:a05:600c:468c:b0:495:6a50:3fb8 with SMTP id 5b1f17b1804b1-499aa180578mr93149625e9.1.1787155066057; Wed, 19 Aug 2026 08:57:46 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:45 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 15/37] expat: fix CVE-2026-56407 Date: Wed, 19 Aug 2026 17:56:46 +0200 Message-ID: <594ad6e8edf8185dbed03a5346ef34e9a012b88f.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243751 From: Deepak Rathore This patch applies the upstream fix shown in [1] as referenced by [2]. [1] https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-56407 (From OE-Core rev: 9e565187ad989856ed274feecb343744a4d0d290) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56407.patch | 41 +++++++++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56407.patch b/meta/recipes-core/expat/expat/CVE-2026-56407.patch new file mode 100644 index 00000000000..498f93d5b93 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56407.patch @@ -0,0 +1,41 @@ +From d1cd2bd7da8ed830e9432660616e9b4831df959a Mon Sep 17 00:00:00 2001 +From: netliomax25-code +Date: Tue, 2 Jun 2026 11:59:01 +0530 +Subject: [PATCH 12/17] cap entity textLen against signed integer overflow + +CVE: CVE-2026-56407 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13] + +(cherry picked from commit 30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 9f07b860..8439dc0e 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -5655,6 +5655,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + parser, enc, s + enc->minBytesPerChar, next - enc->minBytesPerChar, + XML_ACCOUNT_NONE); + if (parser->m_declEntity) { ++ /* Detect and prevent signed integer overflow */ ++ if ((size_t)poolLength(&dtd->entityValuePool) > (size_t)INT_MAX) { ++ return XML_ERROR_NO_MEMORY; ++ } + parser->m_declEntity->textPtr = poolStart(&dtd->entityValuePool); + parser->m_declEntity->textLen + = (int)(poolLength(&dtd->entityValuePool)); +@@ -7076,6 +7080,11 @@ storeSelfEntityValue(XML_Parser parser, ENTITY *entity) { + return XML_ERROR_NO_MEMORY; + } + ++ /* Detect and prevent signed integer overflow */ ++ if ((size_t)poolLength(pool) > (size_t)INT_MAX) { ++ poolDiscard(pool); ++ return XML_ERROR_NO_MEMORY; ++ } + entity->textPtr = poolStart(pool); + entity->textLen = (int)(poolLength(pool)); + poolFinish(pool); diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index fb36108eafa..2851c752977 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -72,6 +72,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56406.patch;striplevel=2 \ file://CVE-2026-56409.patch;striplevel=2 \ file://CVE-2026-56411.patch;striplevel=2 \ + file://CVE-2026-56407.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95805 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9730C5DF92 for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10409.1787155068532673056 for ; Wed, 19 Aug 2026 08:57:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=0z5jXIuJ; spf=pass (domain: smile.fr, ip: 209.85.221.48, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-47db714766aso34829f8f.0 for ; Wed, 19 Aug 2026 08:57:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155067; x=1787759867; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EfrAZiZvjBSo85I+h5nC4f/EAHncegU9SXoQWhM4xKY=; b=0z5jXIuJ0VIGClDZHl/5nZAUx3HiWVmMb2bK94bS6V9myJkzc91UJWmDnTqoT3t7bb 7VSVWbelwtfTkpxeMHF68z3VUGyEfx5ByPUR/4R77suth27d6qf9qEXqnuc8LOaT2R1p y7OLp9vlQzwUA2YcGwb3BghJWkRUIh8nvOqkA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155067; x=1787759867; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=EfrAZiZvjBSo85I+h5nC4f/EAHncegU9SXoQWhM4xKY=; b=VM9iDjHmo0O3hJGMRUjHFK3tWSZOdbY/usg0wQ3XAueYQjjEVda61e6SlLHd9Gc8D4 acRZeOaxHuvFVedQ78VckvZeI/psTjtyggmNQZ36tBbLxE9x1Rw1PDA506IP7iLvIEcW HBk7oxBLjVk2C1ZX7a+Z5WinADTKgmiuKjIPfTqb0xKciXkk0JG5teUye3+A5j/FVS8m l1+GZZzJAaiN0JXhhP21nNKPyL6m/UBLftbIDqHPP/86fqJvzxHBYveY9jMl/TYS7XRz ZcNSWAT26uS0WaG8Nq2yKJr6N+9kFT5W+0RU2P+wpa+2QzGwFTUDY3NPhcaPrAYfZ+WN R1kQ== X-Gm-Message-State: AFuF++ka1SSctrGgVIZj5WDtXEA+hk1fqpo+YrGY3SPH9f8Lx0p75gRD Q8kGhwmw/lAXz6aRSFcSOhOpVvKxKO4FHoDUbKqq+VAWZsPZUTGxkMkzK2cUVCwDDyxMFgvIgBZ t0YkhvWA= X-Gm-Gg: AR+sD13am06DP3jljQRKDtKficMi3ReQUB95hWXtibS0q7RgjU0uq8VaHuN9Lo07XxQ a/gLLEtpB/cn3PIoAzk1Zrpb4Wcdx7zs7C79yfiwyDjhC1N6iAn1tQei1u2MVW3jLS1d8MFBmCZ MXTEzE5GCRpnAfd/etCv7ey52+KMPizPcNkQjkPFJkIf4psEJYcgvmWd3QzefYDxCGOAZY/XF6w gq0P7Oqm7X6qdkRMpWqkgikKCM5ushDKKGRycjMyY4AIuPdJ0G7hgPUO14/aZczEOMUWADYrpvN s1oGJejcv6Slgcs0F52nnBmq6ce3+Cep0k9J8dwEWbePjvR5Q4Nxtep/XEDWFosi6dYr5njZC7Z +Xs0yUc8CbIXx4c8XwQhed33FmQAFv+tK8vbphej3f0LVX+KRl+dwvRQJB71wqAaADut6SU+h7/ ZgiVtpyZGmWL/xWGIP2XepYSv4wL3w3RgQIyb6gau+U5FKLT+OSJr2oT5qWgrVa15tNSzVqAJbU Q6LR+h6aN7kB4F2fx83pdkuNSuNei1qS86mV87wF5ohGFQYVN+fZC+i6Cz3H647byiq4a4ugc9x 79YhtucGwyA2jkzWtptcsb/nYb2TKMVrVAuOIdcAGY1SyQ== X-Received: by 2002:a5d:6f01:0:b0:46b:70db:2113 with SMTP id ffacd0b85a97d-482b74dc7a7mr448143f8f.0.1787155066632; Wed, 19 Aug 2026 08:57:46 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:46 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 16/37] expat: fix CVE-2026-56132 Date: Wed, 19 Aug 2026 17:56:47 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243752 From: Deepak Rathore These patches apply the upstream fix shown in [2], its prerequisite [1], the regression test in [3], and the follow-up cleanups in [4] and [5], as referenced by [6]. [1] https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3 [2] https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e [3] https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf [4] https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4 [5] https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5 [6] https://nvd.nist.gov/vuln/detail/CVE-2026-56132 (From OE-Core rev: 0cba8f866ffe5b96dd7f2a8fe7b4c52264d382c5) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../expat/expat/CVE-2026-56132_p1.patch | 80 +++++++++++++++++++ .../expat/expat/CVE-2026-56132_p2.patch | 60 ++++++++++++++ .../expat/expat/CVE-2026-56132_p3.patch | 74 +++++++++++++++++ .../expat/expat/CVE-2026-56132_p4.patch | 60 ++++++++++++++ .../expat/expat/CVE-2026-56132_p5.patch | 56 +++++++++++++ meta/recipes-core/expat/expat_2.6.4.bb | 5 ++ 6 files changed, 335 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch new file mode 100644 index 00000000000..fc5b5778787 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch @@ -0,0 +1,80 @@ +From 9d1c131840a501e6664c5770046153235467f574 Mon Sep 17 00:00:00 2001 +From: Matthew Fernandez +Date: Thu, 4 Jun 2026 17:01:02 -0700 +Subject: [PATCH 13/17] lib: Remove reuse of `m_groupSize` to count + `m_scaffIndex` allocation + +The sizes of the two arrays `m_groupConnector` and `scaffIndex` need to +vary independently. This change is a step towards allowing this. + +Anthropic: ANT-2026-00037 +Anthropic: ANT-2026-03621 +Anthropic: ANT-2026-03867 +Co-authored-by: Alessandro Gario + +CVE: CVE-2026-56132 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3] + +Backport Changes: +- Adapt scaffIndex sizing to Scarthgap 2.6.4, where m_groupSize is + not temporarily doubled before reallocation. + Keep the branch's equivalent size_t overflow check. + +(cherry picked from commit 3a4eaf47af8fd7abda38ea2c08308c91152061f3) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 8439dc0e..e9ad78df 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -423,6 +423,7 @@ typedef struct { + unsigned scaffCount; + int scaffLevel; + int *scaffIndex; ++ size_t scaffIndexSize; + } DTD; + + enum EntityType { +@@ -5975,6 +5976,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (new_scaff_index == NULL) + return XML_ERROR_NO_MEMORY; + dtd->scaffIndex = new_scaff_index; ++ dtd->scaffIndexSize = parser->m_groupSize; + } + } else { + parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32); +@@ -7575,6 +7577,7 @@ dtdCreate(XML_Parser parser) { + + p->in_eldecl = XML_FALSE; + p->scaffIndex = NULL; ++ p->scaffIndexSize = 0; + p->scaffold = NULL; + p->scaffLevel = 0; + p->scaffSize = 0; +@@ -7615,6 +7618,7 @@ dtdReset(DTD *p, XML_Parser parser) { + + FREE(parser, p->scaffIndex); + p->scaffIndex = NULL; ++ p->scaffIndexSize = 0; + FREE(parser, p->scaffold); + p->scaffold = NULL; + +@@ -7790,6 +7794,7 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd, + newDtd->scaffSize = oldDtd->scaffSize; + newDtd->scaffLevel = oldDtd->scaffLevel; + newDtd->scaffIndex = oldDtd->scaffIndex; ++ newDtd->scaffIndexSize = oldDtd->scaffIndexSize; + + return 1; + } /* End dtdCopy */ +@@ -8310,6 +8315,7 @@ nextScaffoldPart(XML_Parser parser) { + dtd->scaffIndex = MALLOC(parser, parser->m_groupSize * sizeof(int)); + if (! dtd->scaffIndex) + return -1; ++ dtd->scaffIndexSize = parser->m_groupSize; + dtd->scaffIndex[0] = 0; + } + diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch new file mode 100644 index 00000000000..c8a4971e839 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch @@ -0,0 +1,60 @@ +From a4c1b874dffcc80ee63ca3b4d6a1537c56da8dc1 Mon Sep 17 00:00:00 2001 +From: Matthew Fernandez +Date: Thu, 4 Jun 2026 17:01:02 -0700 +Subject: [PATCH 14/17] lib: doProlog: Fix out-of-bound scaffolding index store +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The scaffold backing array is reallocated using the caller parser’s +per-parser `m_groupSize`, but the DTD struct (which carries +`scaffIndex`) is shared between a parent parser and any external +parameter-entity sub-parser created via +`XML_ExternalEntityParserCreate(parent, NULL, …)`. A sub-parser whose +group nesting is shallower than the parent’s can `REALLOC` the shared +`scaffIndex` down to its own size; when the parent resumes and parses a +deeper element content model, its bounds check passes (its private +`m_groupSize` is still large enough), the doubling-grow path is skipped, +and the next write lands past the shrunken buffer. + +Anthropic: ANT-2026-00037 +Anthropic: ANT-2026-03621 +Anthropic: ANT-2026-03867 +Co-authored-by: Alessandro Gario +Reported-by: Trail of Bits, in collaboration with Anthropic + +CVE: CVE-2026-56132 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e] + +(cherry picked from commit 58400483d7c97be316d7a77739c0a6af5d55932e) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index e9ad78df..c46c17bc 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -5992,6 +5992,21 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + if (myindex < 0) + return XML_ERROR_NO_MEMORY; + assert(dtd->scaffIndex != NULL); ++ if ((size_t)dtd->scaffLevel >= dtd->scaffIndexSize) { ++ /* Detect and prevent integer overflow */ ++ if (dtd->scaffIndexSize > SIZE_MAX / 2 / sizeof(int)) { ++ return XML_ERROR_NO_MEMORY; ++ } ++ assert(dtd->scaffIndexSize > 0); ++ const size_t new_size = dtd->scaffIndexSize * 2; ++ int *const new_scaff_index ++ = REALLOC(parser, dtd->scaffIndex, new_size * sizeof(int)); ++ if (new_scaff_index == NULL) { ++ return XML_ERROR_NO_MEMORY; ++ } ++ dtd->scaffIndex = new_scaff_index; ++ dtd->scaffIndexSize = new_size; ++ } + dtd->scaffIndex[dtd->scaffLevel] = myindex; + dtd->scaffLevel++; + dtd->scaffold[myindex].type = XML_CTYPE_SEQ; diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch new file mode 100644 index 00000000000..1376e1d4c0c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch @@ -0,0 +1,74 @@ +From 5d4d0dab46e077b327f70a7c02a307287e8d1fe5 Mon Sep 17 00:00:00 2001 +From: Matthew Fernandez +Date: Thu, 4 Jun 2026 17:01:02 -0700 +Subject: [PATCH 15/17] tests: Add a test case for scaffolding array limits in + shared DTDs + +This test case provokes the bug fixed in the previous commit. + +Anthropic: ANT-2026-00037 +Anthropic: ANT-2026-03621 +Anthropic: ANT-2026-03867 +Co-authored-by: Alessandro Gario +Reported-by: Trail of Bits, in collaboration with Anthropic + +CVE: CVE-2026-56132 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf] + +(cherry picked from commit 353919b3b9f2174073a557ac7d517a5f3cd0cbbf) +Signed-off-by: Deepak Rathore +--- + expat/tests/basic_tests.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +diff --git a/expat/tests/basic_tests.c b/expat/tests/basic_tests.c +index 023d9ce4..d52dcf1c 100644 +--- a/expat/tests/basic_tests.c ++++ b/expat/tests/basic_tests.c +@@ -4044,6 +4044,37 @@ START_TEST(test_skipped_external_entity) { + } + END_TEST + ++START_TEST(test_scaff_index_shared_across_external_entity_parser) { ++ const char text[] ++ = "\n" ++ "\n" ++ "%e;\n" ++ "\n" ++ "]>\n" ++ ""; ++ ExtOption options[] ++ = {{XCS("ext"), ++ ""}, ++ {NULL, NULL}}; ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS); ++ XML_SetUserData(parser, options); ++ XML_SetExternalEntityRefHandler(parser, external_entity_optioner); ++ XML_SetElementDeclHandler(parser, dummy_element_decl_handler); ++ ++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE) ++ == XML_STATUS_ERROR) ++ xml_failure(parser); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + /* Test a different form of unknown external entity */ + START_TEST(test_skipped_null_loaded_ext_entity) { + const char *text = "\n" +@@ -6399,6 +6430,8 @@ make_basic_test_case(Suite *s) { + tcase_add_test(tc_basic, test_trailing_cr_in_att_value); + tcase_add_test(tc_basic, test_standalone_internal_entity); + tcase_add_test(tc_basic, test_skipped_external_entity); ++ tcase_add_test__ifdef_xml_dtd( ++ tc_basic, test_scaff_index_shared_across_external_entity_parser); + tcase_add_test(tc_basic, test_skipped_null_loaded_ext_entity); + tcase_add_test(tc_basic, test_skipped_unloaded_ext_entity); + tcase_add_test__ifdef_xml_dtd(tc_basic, test_param_entity_with_trailing_cr); diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch new file mode 100644 index 00000000000..74d0e33a9d9 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch @@ -0,0 +1,60 @@ +From a7d7ed5d6dbcc7231529357d64eb19ede3114868 Mon Sep 17 00:00:00 2001 +From: Matthew Fernandez +Date: Thu, 4 Jun 2026 17:01:02 -0700 +Subject: [PATCH 16/17] lib: Remove unnecessary `scaffIndex` expansion + +Following the previous changes, all locations that append entries to +`scaffIndex` handle expanding the array if it is not already large +enough. So this extra expansion code is no longer necessary. In some +cases such as processing siblings with alternating scaffolding counts, +this logic would actually _shrink_ the array only to then later +re-expand it. + +Anthropic: ANT-2026-00037 +Anthropic: ANT-2026-03621 +Anthropic: ANT-2026-03867 +Co-authored-by: Alessandro Gario + +CVE: CVE-2026-56132 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4] + +Backport Changes: +- Remove the Scarthgap 2.6.4 scaffIndex resize block because later + append paths already expand the array when required. + +(cherry picked from commit bca93b4ba9e15fd84425568d772b69baebf790e4) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 19 ------------------- + 1 file changed, 19 deletions(-) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index c46c17bc..3afe2884 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -5959,25 +5959,6 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + } + parser->m_groupConnector = new_connector; + } +- +- if (dtd->scaffIndex) { +- /* Detect and prevent integer overflow. +- * The preprocessor guard addresses the "always false" warning +- * from -Wtype-limits on platforms where +- * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */ +-#if UINT_MAX >= SIZE_MAX +- if (parser->m_groupSize > (size_t)(-1) / sizeof(int)) { +- return XML_ERROR_NO_MEMORY; +- } +-#endif +- +- int *const new_scaff_index = REALLOC( +- parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int)); +- if (new_scaff_index == NULL) +- return XML_ERROR_NO_MEMORY; +- dtd->scaffIndex = new_scaff_index; +- dtd->scaffIndexSize = parser->m_groupSize; +- } + } else { + parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32); + if (! parser->m_groupConnector) { diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch new file mode 100644 index 00000000000..59229f331ca --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch @@ -0,0 +1,56 @@ +From 778ba31c47f9930fe339194f4d97081e43893362 Mon Sep 17 00:00:00 2001 +From: Matthew Fernandez +Date: Thu, 4 Jun 2026 17:01:02 -0700 +Subject: [PATCH 17/17] lib: Remove indented scoping of `new_connector` local + +Following the previous change, the lifetime of `new_connector` as +constrained by this introduced scope was identical to the parent scope. + +CVE: CVE-2026-56132 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5] + +Backport Changes: +- Retain the Scarthgap 2.6.4 unsigned integer overflow guard while + removing only the redundant new_connector scope. + +(cherry picked from commit 08baa7ef9d168b99094249998fd78f8d190526e5) +Signed-off-by: Deepak Rathore +--- + expat/lib/xmlparse.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 3afe2884..df8331d5 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -5945,20 +5945,18 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end, + case XML_ROLE_GROUP_OPEN: + if (parser->m_prologState.level >= parser->m_groupSize) { + if (parser->m_groupSize) { +- { +- /* Detect and prevent integer overflow */ +- if (parser->m_groupSize > (unsigned int)(-1) / 2u) { +- return XML_ERROR_NO_MEMORY; +- } ++ /* Detect and prevent integer overflow */ ++ if (parser->m_groupSize > (unsigned int)(-1) / 2u) { ++ return XML_ERROR_NO_MEMORY; ++ } + +- char *const new_connector = REALLOC( +- parser, parser->m_groupConnector, parser->m_groupSize *= 2); +- if (new_connector == NULL) { +- parser->m_groupSize /= 2; +- return XML_ERROR_NO_MEMORY; +- } +- parser->m_groupConnector = new_connector; ++ char *const new_connector = REALLOC(parser, parser->m_groupConnector, ++ parser->m_groupSize *= 2); ++ if (new_connector == NULL) { ++ parser->m_groupSize /= 2; ++ return XML_ERROR_NO_MEMORY; + } ++ parser->m_groupConnector = new_connector; + } else { + parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32); + if (! parser->m_groupConnector) { diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb index 2851c752977..3387a7d7c1f 100644 --- a/meta/recipes-core/expat/expat_2.6.4.bb +++ b/meta/recipes-core/expat/expat_2.6.4.bb @@ -73,6 +73,11 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-56409.patch;striplevel=2 \ file://CVE-2026-56411.patch;striplevel=2 \ file://CVE-2026-56407.patch;striplevel=2 \ + file://CVE-2026-56132_p1.patch;striplevel=2 \ + file://CVE-2026-56132_p2.patch;striplevel=2 \ + file://CVE-2026-56132_p3.patch;striplevel=2 \ + file://CVE-2026-56132_p4.patch;striplevel=2 \ + file://CVE-2026-56132_p5.patch;striplevel=2 \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Wed Aug 19 15:56:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95794 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 487DFC5DF85 for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10324.1787155069346837434 for ; Wed, 19 Aug 2026 08:57:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=YKQecqxh; spf=pass (domain: smile.fr, ip: 209.85.221.50, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-4815bce4652so771663f8f.1 for ; Wed, 19 Aug 2026 08:57:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155068; x=1787759868; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=istQEhrxfvxKENC/LPuaNQX9ubPzRjIV0+lAg2keYvg=; b=YKQecqxh4tnaRqCUBkf9O9FIi+55OZxEi19ikipDHw3cU+FFJ1TZ+i0L9R1pFX/1PN LlVtxlw32q1P4I6kiQL0/qfrzrv89gd0/XBlvKzIZL7uZX5gKzkJDZdtm0TJRVyQPh+F hk63eM6yfl3FPtshXf29PxgkGdcZRsH7tpX6w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155068; x=1787759868; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=istQEhrxfvxKENC/LPuaNQX9ubPzRjIV0+lAg2keYvg=; b=jfqpkJKnsoCm9G1KQRPF/rgUGNq1KTGeo/xAdsJN/gJn1l94Zre5BLLGJB4F+EI6Kt 99uwJt2aWTYziSD6NE/GrwXGIrOX025L8l5anum2QNdvNsq9HRUyh3jS9d5i2QeJ9Z5B quMZ+bV9RBTO9b3ZKohWyWoqCo4Ucyg0hSG1ha09f/zwkzf6M3SgQjjQzpL7rs5cZ9K1 e88wQnSUqOnMlKJ++fHIFHA7YQtWIVz3lbwtxNM/2ZDYX77uZnRaUghD6eXT1si0eBGR F/0QoXr6DMGhdS3AwlgeOxThM4jDAwCPsfVDzjB6Xmwk7VnPN7cJzWQ4Q3BfPsB8o5BY Zsww== X-Gm-Message-State: AFuF++ml/9bi3U/xU2OIKt+icJiImaiUmyZ4rNAPNabClcE3xtYjV05T 1VPDNPHeTx2XydGtQEAbFeLpHgHBFvz3dDeAuGH/LImW6CVSyIyVbUP0cbCzI3ugybFuubiiOkU uX973jlA= X-Gm-Gg: AR+sD11XnaEcZkokLZxpeXlPDXUlHx1GwCH9CeclhaHJYBgwpy5OaUtCtZypouG0uSm z/Y6q96KKPouXFYLOwJpdyfIIJ7ecJ31Wf7714dsz5D6Q9KlXKRWo0IdcUMko1vznU0IsT7UQEx d26ZYYmrBKbjA0c/QgkNDguJql3shmgNYRPylQj1eiQcIE7eaJbyjIvsgiWiG0m/T5YZve8upf6 2AyUiHBJhCK+GCZd/t3EKgepzQ7y3mrPCI40+fYWoCG3+9ynL1I3sIid2rJKpMNSoYOYpqpOj1b CXBtDMFesywRpWloWdgd0Tv2m2n29zX1hXUZbQBKJlGRzbAGnggYIAtv+5Nu6p4OXXy1q/vzY6D Fo0/yZILXPtiw8jvJ2/amQijBSDLkST45nqT3LKRbje6GNBRV50isKjxVyXrEvJT4Zy9GUThaDW RkTUHYYOl4miF4So4AGKz57IWHwxAi+46wfoePDmvFdAfTLg20KxbuHioWOOl4tBl0mYFAcT2Pg ojHL+qyEpY6dzY2PtDuTTZs2hJ0yoMQBxUH/39pbY8vco/zB8L8HM2Ulh1JZZjr0JGHYm1L/rCF ScpNv2hIF5yQU4tR8CgBPyYYOLCmKSVd/Ix9XhVvMipBa00GJS0= X-Received: by 2002:a05:6000:4811:b0:47f:8fc8:a8b1 with SMTP id ffacd0b85a97d-482b1fd9d3dmr10694218f8f.14.1787155067508; Wed, 19 Aug 2026 08:57:47 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:46 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 17/37] python3: fix CVE-2026-7210 Date: Wed, 19 Aug 2026 17:56:48 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243753 From: Amaury Couderc CVE-2026-7210 is a hash-flooding denial-of-service vulnerability in Python's XML parsing modules (xml.parsers.expat, xml.etree.ElementTree). An attacker can craft XML input that forces O(n²) hash collisions in libexpat's internal name dictionary, causing excessive CPU consumption. The previous mitigation seeded libexpat's hash function with only 4 bytes of entropy, which is insufficient against a determined attacker. This patch upgrades to XML_SetHashSalt16Bytes (libexpat >= 2.8.0), providing a full 16-byte secret. Older expat versions fall back gracefully to the legacy XML_SetHashSalt via a runtime NULL check. Backport patch to fix CVE-2026-7210. https://nvd.nist.gov/vuln/detail/CVE-2026-7210 Upstream fix: https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4 -- Changes from Upstream -- Replace compile-time version checks with runtime detection of the XML_SetHashSalt16Bytes function using #pragma weak. This allows using backported security fixes from expat even when version macros haven't been bumped (in thus case expat 2.6.4 with CVE-2026-41080). - Add weak symbol declaration for XML_SetHashSalt16Bytes - Convert newxmlparseobject() version check to runtime NULL check - Convert pyexpat_exec() CAPI export check to runtime NULL check Tested with ptest: Before: PASSED: 40019, FAILED: 0, SKIPPED: 1882 After: PASSED: 40020, FAILED: 0, SKIPPED: 1882 CVE: CVE-2026-7210 (From OE-Core rev: d753c46085c9d31f3b68d59f863855c909a6f400) Signed-off-by: Amaury Couderc Signed-off-by: Fabien Thomas --- .../python/python3/CVE-2026-7210.patch | 148 ++++++++++++++++++ .../python/python3_3.12.13.bb | 1 + 2 files changed, 149 insertions(+) create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-7210.patch diff --git a/meta/recipes-devtools/python/python3/CVE-2026-7210.patch b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch new file mode 100644 index 00000000000..029eb713e42 --- /dev/null +++ b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch @@ -0,0 +1,148 @@ +From 2ed6138dea0bc94c726f879501e4525712e885d1 Mon Sep 17 00:00:00 2001 +From: Stan Ulbrych +Date: Sun, 10 May 2026 18:36:26 +0100 +Subject: [PATCH] gh-149018: Use `XML_SetHashSalt16Bytes` in + `pyexpat`/`_elementtree` when possible (#149023) + + +CVE: CVE-2026-7210 +Upstream-Status: Backport [https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4] + +[yocto: Use weak symbol detection for XML_SetHashSalt16Bytes instead of +XML_COMBINED_VERSION >= 20800, since our backported expat 2.6.4 provides +the function but does not bump the version macros.] + +Signed-off-by: Amaury Couderc +--- + Include/pyexpat.h | 3 +++ + Include/pyhash.h | 8 +++++--- + .../2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst | 3 +++ + Modules/_elementtree.c | 8 ++++++-- + Modules/pyexpat.c | 22 ++++++++++++++++------ + 5 files changed, 33 insertions(+), 11 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst + +diff --git a/Include/pyexpat.h b/Include/pyexpat.h +index 04548b7684a..d28d6828975 100644 +--- a/Include/pyexpat.h ++++ b/Include/pyexpat.h +@@ -57,6 +57,9 @@ struct PyExpat_CAPI + XML_Parser parser, unsigned long long activationThresholdBytes); + XML_Bool (*SetAllocTrackerMaximumAmplification)( + XML_Parser parser, float maxAmplificationFactor); ++ /* might be NULL for expat < 2.8.0 */ ++ XML_Bool (*SetHashSalt16Bytes)( ++ XML_Parser parser, const uint8_t entropy[16]); + /* always add new stuff to the end! */ + }; + +diff --git a/Include/pyhash.h b/Include/pyhash.h +index 182d223fab1..ec359bd2f35 100644 +--- a/Include/pyhash.h ++++ b/Include/pyhash.h +@@ -39,14 +39,14 @@ PyAPI_FUNC(Py_hash_t) _Py_HashBytes(const void*, Py_ssize_t); + * pppppppp ssssssss ........ fnv -- two Py_hash_t + * k0k0k0k0 k1k1k1k1 ........ siphash -- two uint64_t + * ........ ........ ssssssss djbx33a -- 16 bytes padding + one Py_hash_t +- * ........ ........ eeeeeeee pyexpat XML hash salt ++ * eeeeeeee eeeeeeee eeeeeeee pyexpat XML hash salt + * + * memory layout on 32 bit systems + * cccccccc cccccccc cccccccc uc + * ppppssss ........ ........ fnv -- two Py_hash_t + * k0k0k0k0 k1k1k1k1 ........ siphash -- two uint64_t (*) + * ........ ........ ssss.... djbx33a -- 16 bytes padding + one Py_hash_t +- * ........ ........ eeee.... pyexpat XML hash salt ++ * eeeeeeee eeeeeeee eeee.... pyexpat XML hash salt + * + * (*) The siphash member may not be available on 32 bit platforms without + * an unsigned int64 data type. +@@ -71,7 +71,9 @@ typedef union { + Py_hash_t suffix; + } djbx33a; + struct { +- unsigned char padding[16]; ++ /* 16 bytes for XML_SetHashSalt16Bytes */ ++ uint8_t hashsalt16[16]; ++ /* 4/8 bytes for legacy XML_SetHashSalt */ + Py_hash_t hashsalt; + } expat; + } _Py_HashSecret_t; +diff --git a/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst b/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst +new file mode 100644 +index 00000000000..d1b5b368684 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst +@@ -0,0 +1,3 @@ ++Improved protection against XML hash-flooding attacks in ++:mod:`xml.parsers.expat` and :mod:`xml.etree.ElementTree` when Python is ++compiled with libExpat 2.8.0 or later. +diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c +index 56d1508af13..941376613b0 100644 +--- a/Modules/_elementtree.c ++++ b/Modules/_elementtree.c +@@ -3657,8 +3657,12 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *target, + PyErr_NoMemory(); + return -1; + } +- /* expat < 2.1.0 has no XML_SetHashSalt() */ +- if (EXPAT(st, SetHashSalt) != NULL) { ++ // Prefer 16-byte entropy, only expat >= 2.8.0. See gh-149018 ++ if (EXPAT(st, SetHashSalt16Bytes) != NULL) { ++ EXPAT(st, SetHashSalt16Bytes)(self->parser, ++ _Py_HashSecret.expat.hashsalt16); ++ } ++ else if (EXPAT(st, SetHashSalt) != NULL) { + EXPAT(st, SetHashSalt)(self->parser, + (unsigned long)_Py_HashSecret.expat.hashsalt); + } +diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c +index 79492ca5c4f..47e3a1b2c00 100644 +--- a/Modules/pyexpat.c ++++ b/Modules/pyexpat.c +@@ -14,6 +14,11 @@ + + #include "pyexpat.h" + ++/* Use weak symbol to detect XML_SetHashSalt16Bytes at link time. ++ This allows using the backported function from expat even when the ++ version macros have not been bumped (e.g. expat 2.6.4 + CVE-2026-41080). */ ++#pragma weak XML_SetHashSalt16Bytes ++ + /* Do not emit Clinic output to a file as that wreaks havoc with conditionally + included methods. */ + /*[clinic input] +@@ -1388,10 +1393,16 @@ newxmlparseobject(pyexpat_state *state, const char *encoding, + Py_DECREF(self); + return NULL; + } +-#if XML_COMBINED_VERSION >= 20100 +- /* This feature was added upstream in libexpat 2.1.0. */ +- XML_SetHashSalt(self->itself, +- (unsigned long)_Py_HashSecret.expat.hashsalt); ++ /* Prefer 16-byte entropy (expat >= 2.8.0 or backported). */ ++ if (XML_SetHashSalt16Bytes != NULL) { ++ XML_SetHashSalt16Bytes(self->itself, _Py_HashSecret.expat.hashsalt16); ++ } ++#if XML_COMBINED_VERSION >= 20100 ++ else { ++ /* This feature was added upstream in libexpat 2.1.0. */ ++ XML_SetHashSalt(self->itself, ++ (unsigned long)_Py_HashSecret.expat.hashsalt); ++ } + #endif + XML_SetUserData(self->itself, (void *)self); + XML_SetUnknownEncodingHandler(self->itself, +@@ -2257,6 +2267,12 @@ pyexpat_exec(PyObject *mod) + #else + capi->SetHashSalt = NULL; + #endif ++ /* Detect at runtime via weak symbol */ ++ if (XML_SetHashSalt16Bytes != NULL) { ++ capi->SetHashSalt16Bytes = XML_SetHashSalt16Bytes; ++ } else { ++ capi->SetHashSalt16Bytes = NULL; ++ } + #if XML_COMBINED_VERSION >= 20600 + capi->SetReparseDeferralEnabled = XML_SetReparseDeferralEnabled; + #else diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb index de174f7bfdc..b6ceb0c6343 100644 --- a/meta/recipes-devtools/python/python3_3.12.13.bb +++ b/meta/recipes-devtools/python/python3_3.12.13.bb @@ -47,6 +47,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://CVE-2026-11940.patch \ file://CVE-2026-11972.patch \ file://CVE-2026-9669.patch \ + file://CVE-2026-7210.patch \ " SRC_URI:append:class-native = " \ From patchwork Wed Aug 19 15:56:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95790 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 396EBC5DF81 for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10325.1787155069860341628 for ; Wed, 19 Aug 2026 08:57:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=g60nf5W7; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4956869750eso7693905e9.2 for ; Wed, 19 Aug 2026 08:57:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155068; x=1787759868; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=g/XROzwA0KnlfgRiRO0LJH4gXp5ycKnvB0C7irdETWA=; b=g60nf5W7lOBrTREkgnTg69zXCCq/vNo9YMFMi5kSCQxrb+txdM6Pe562Zu1T9cdn6i 5p/hM75AX34ukhg4b3rzQwxxeT2Fuzq/AEt3Nae9hIyEEYPW+6QPOtuSpX1hJwbfdzg1 tO4sy1tHaC3MSlEsu8/U664to+/zMgfHTuJ6s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155068; x=1787759868; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=g/XROzwA0KnlfgRiRO0LJH4gXp5ycKnvB0C7irdETWA=; b=Cy0G+mJdNuf2MkjMPAGug1rcTHIm1YzrqLR/U2843bjZQcTgbLfjZg4OKKMzifcQr2 A3WudDrcuucuQLh5f/byNkD8wVY1j1OYh/Zh/CMUlzVcG0v/Ri3wPnSdJg/JV/U9DICl stGMcKGEIEas4iXIKFD1SddZ2QV+1zAtgPotd5+joOCX3pRtSiPRbENrlp5ajOqpzO62 by5fQoZVj7r3bPpkpLaPrkLjI3ov3Vm5P4lTuRr0Mhb2jPYIyah/VIAXgduGhS+ld0ca +1N/MuR9ZhFyCJWio/WwCEvkyTwTC5JpJBKYXdx8QvCl022Gr9NMVTibaLw39157JJSX DekA== X-Gm-Message-State: AOJu0YwvDXzJr5xP7P07b+EOEMwksjJduQ2oKrDGBBZczX8p7qUkplzB 9xLMjYaReQIFTpSOBUpRsP8htTui10pr8LAX72sAR/SEe7IBdkILYhxHurj9F+TGLmXUJsMWR+e LJ1CeYgU= X-Gm-Gg: AR+sD11UE8U2JgrxpBpeq2brdyzAExGFywoG1wyE+RQ7+DufWGQiITsGflKxp01YLBd II0ZFlyUEQBnf6sJYHnaF7Mo4I4+3Cp3L9YTRBfOYxH7veZnH3xa8Y08NQACvfgwGmdYNcAzKVN B7+nONZcMTojxtUeF2AriTblab5OSt2QeswKncfbDKeDF/mJ0oC8oPvYnSmbpUnOOvdfy7t31w6 KkYitRe5lF3l/eZ3npn5CCeHQcBA6cTRmdduiNrvEc0NtEwjgJ36l2KshGDo181f7fCoge4tiey 6+Y3kjebBqmG40jA/jPxOcIsdaFXYIKVvEYJvzFNo98md2ffzXL0KcprPREF4bKB0oTNj1h5vRD mPFwq0E7mD43z2quI5hDhEEatS6NiwLj2CBKCvbkJ+c/N/qWOLxiTR7I2nh7zgZQFp1LTTEU87Y 6420xAViIgqVXnt+pdcOVkBm7yNBRWeyaz2A5mM7v/LrnjK0vQ9txGf1ih6+gIvonn8xlcYl3x+ Aia+ULn/zvwk+8rei8QFE6OaoHlWZHoMrZGEATKlRznIk/6xawkyw7H6CYtBnHesIkQUxL0akox +De/Cf7s20pTUbcTvUKRyvg/0/KBFTItOdvhkATH X-Received: by 2002:a05:600c:8b35:b0:499:7ce1:d8a2 with SMTP id 5b1f17b1804b1-499aa1a54b2mr117987085e9.8.1787155068101; Wed, 19 Aug 2026 08:57:48 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:47 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 18/37] python3-pip: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:49 +0200 Message-ID: <85e02d942810674a7712e4ea1db32540c85e5096.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243754 From: Himanshu Jadon CVE_PRODUCT is not set for python3-pip, so cve-check can miss or misreport pip CVEs. CVE-2026-8643 is reported in NVD with pypa:pip. Add CVE_PRODUCT to match the NVD product name and report this CVE correctly. (From OE-Core rev: 3a24c9f77622148c3894c9228e061cabf79f169f) Signed-off-by: Himanshu Jadon Signed-off-by: Richard Purdie (cherry picked from commit a486abd4889ad03e1a8ddd5311595f3ece7d61b6) Signed-off-by: Himanshu Jadon Signed-off-by: Fabien Thomas --- meta/recipes-devtools/python/python3-pip_24.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb index cf123a5d230..51fff41e257 100644 --- a/meta/recipes-devtools/python/python3-pip_24.0.bb +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb @@ -41,6 +41,8 @@ do_install:append() { rm -f ${D}/${bindir}/pip } +CVE_PRODUCT = "pypa:pip" + do_install:append(){ # pip vendors distlib which ships Windows launcher templates (*.exe). # Keep them only when building for a Windows (mingw) host. From patchwork Wed Aug 19 15:56:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95791 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 202BCC5B572 for ; Wed, 19 Aug 2026 15:57:51 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10328.1787155070626611074 for ; Wed, 19 Aug 2026 08:57:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=F71upkJx; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-495437bb891so228345e9.1 for ; Wed, 19 Aug 2026 08:57:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155069; x=1787759869; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bF3zDteGfBvGgktFz2FrE2o990wZJKwvU51NKSCOBDM=; b=F71upkJx3L83Rqje232E5AkIASlOv/NwBQdY1gHjnsp24w1o8DOaL86QlDcw1LhsY/ j0x6iRpLE1V+ehZ5x6nuda6bF+Xiv6mnnNUKK8jk/3KqZhBAwVCFxFLVKn4+3pWvoa0g sN/niW8CNoMOleNUHTvkjqs8ch12pb+ZRKLEY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155069; x=1787759869; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bF3zDteGfBvGgktFz2FrE2o990wZJKwvU51NKSCOBDM=; b=Rfzr4GmYHiKGtf+pPflcFD+N95sOwFb0QC3gE7BNcEmv8lxHHi6xp3IEWEYbsEuN0p qa+r4x3LtX9Mq9KIKdUp/SBeIMKRmZO1/5a3PN64Nt72q3AfhPYkXUnhYtKyI6kZPP9w TOow3+PhE0NtPq6i3pEQfxT+1ReRZPZhFGmPTOfgkf14PwDJhtG36BEuhbgaSeSO2bNb us4p663IxbuPLcgQtrWS1T/oVepZLxmnlr0sw2f9OJt3noh9h4e0Q5zahoeBpCtetvyc GYGrKWy0wxQQCydxOyGSSzqOb8q3DrA/yRajSgx4TgeAuV3kzponkmmIeGLJ7uzptben wFjw== X-Gm-Message-State: AOJu0YxYPMMhNdqFcpywtIKOpHcnOlkg/Cau1PH/Lf8Mw2TF+2ZpnUsT FmfNeav4ILFT9b0hYaTtv+ROFUpK3IgD0a/M/s6JzPFcSlfqOFEsn7TJFJ9Xdxq+I4sBw6QXAli Fn+SuWIA= X-Gm-Gg: AR+sD1161/QAjCtY/bueGSRenzyPE2c82RbfHnJ3zMyZcKxkaxJlhIvIgBg6va7euFQ W4UrpJUd16u89hcWKEpX4y1Vo1WILJbqVwYCByn3FS0MJsTSxro5rBMx3o8zjJjCmkGoJJdGbg+ yO9bue5oitCNGwodVYeUv07NHT6l22HXm3NtisCzgja0H7cg3DJIED2Qj6BAsRMEvjoYr5wxWV8 GwP10NGXcOWukFTjN4mTTRfSK2351MUtCYxEdbifayO/yrQ8JZ/nzZSVyP7gKu8/Uf2j659E/UW 0qq/YS2IpN7miV9GL4tPPVVePk7FK2HeFg81SD0ZTraVwxvcz3qqTEmvmAFl1pMuAI9fX9x10q8 aTPLZH8lLV5Xl4fkDVT8bH3nfUwrdsLvu4LmRdhcpv4+TTKOZbm0mmyntCI0uyjUOIVzcLNuUUg WVC1+J/5AzFDrM/HDH8cCMtr4np6zHdvlgWjKRz9LUaKLy34napbKDOnqgRtmkIQ6ZGG07SPaLK tifGagziKAcGN3EC9RuTtVm2kLiHgSESrTTsnJsZuEjosmuEUWVPFq/x5AtpUD0rx6/biq3T29M KcSb0Ewr0yXCEkekM46rlU3busGQMN2Tk2PTFuHqhAHZoKhp6VE= X-Received: by 2002:a05:600c:8b63:b0:499:7f37:cb74 with SMTP id 5b1f17b1804b1-499b06a36dcmr3623195e9.1.1787155068730; Wed, 19 Aug 2026 08:57:48 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:48 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 19/37] libssh2: Fix CVE-2025-15661 Date: Wed, 19 Aug 2026 17:56:50 +0200 Message-ID: <5836a39c37be842e842599fd81abdd38acd82a53.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243755 From: David Nyström Fix CVE-2025-15661[1] similiar to debian[2], two first commits identical, third commit fixes a return code regression introduced by CVE fix commit. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-15661 [2] https://sources.debian.org/patches/libssh2/1.11.1-4/ (From OE-Core rev: bfe549a53dc12382745fc49d37f3d2709fc20bec) Signed-off-by: David Nyström Signed-off-by: Fabien Thomas --- .../libssh2/libssh2/CVE-2025-15661-1.patch | 45 ++++++ .../libssh2/libssh2/CVE-2025-15661-2.patch | 131 ++++++++++++++++++ .../libssh2/libssh2/CVE-2025-15661-3.patch | 57 ++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 3 + 4 files changed, 236 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch new file mode 100644 index 00000000000..93a9e6eb596 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch @@ -0,0 +1,45 @@ +From 95028b06d1875e07c99918145234a473e5e8521f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?David=20Nystr=C3=B6m?= +Date: Thu, 9 Jul 2026 12:36:24 +0000 +Subject: [PATCH 1/3] sftp: add LIBSSH2_UNCONST() macro needed by + CVE-2025-15661 fix +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Needed by the fix for CVE-2025-15661. + +Extracted from upstream commit 606c102e52f8447de2b745dd6c5ddf418defc519 +(build: enable -Wcast-qual, fix fallouts) by Viktor Szakats. +Only the LIBSSH2_UNCONST() macro definition in libssh2_priv.h is +included; the remainder of that commit is not applicable to this +stable branch. + +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/606c102e52f8447de2b745dd6c5ddf418defc519] +Signed-off-by: David Nyström +--- + src/libssh2_priv.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h +index 9b8866dc..bb1f8ad3 100644 +--- a/src/libssh2_priv.h ++++ b/src/libssh2_priv.h +@@ -117,6 +117,14 @@ + #define UINT32_MAX 0xffffffffU + #endif + ++#ifdef _WIN64 ++#define LIBSSH2_UNCONST(p) ((void *)(libssh2_uint64_t)(const void *)(p)) ++#elif defined(_MSC_VER) ++#define LIBSSH2_UNCONST(p) ((void *)(unsigned int)(const void *)(p)) ++#else ++#define LIBSSH2_UNCONST(p) ((void *)(uintptr_t)(const void *)(p)) ++#endif ++ + #if (defined(__GNUC__) || defined(__clang__)) && \ + defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \ + !defined(LIBSSH2_NO_FMT_CHECKS) +-- +2.43.0 + diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch new file mode 100644 index 00000000000..40096d3318d --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch @@ -0,0 +1,131 @@ +From 72e8f8dd812503e07fecd775e7f88183e005d9ae Mon Sep 17 00:00:00 2001 +From: Will Cosgrove +Date: Fri, 10 Oct 2025 08:26:20 -0700 +Subject: [PATCH 2/3] Update sftp_symlink to avoid out of bounds read on + malformed packet #1705 (#1717) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Use buffer struct to guard against out of bounds reads and invalid packets. + +Discovery Credit: +Joshua Rogers + +CVE: CVE-2025-15661 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d] +Signed-off-by: David Nyström +--- + src/sftp.c | 66 ++++++++++++++++++++++++++++++++++++++---------------- + 1 file changed, 47 insertions(+), 19 deletions(-) + +diff --git a/src/sftp.c b/src/sftp.c +index 6ede3111..43b6ff90 100644 +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -3795,15 +3795,19 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path, + { + LIBSSH2_CHANNEL *channel = sftp->channel; + LIBSSH2_SESSION *session = channel->session; +- size_t data_len = 0, link_len; ++ size_t data_len = 0, lk_len; + /* 13 = packet_len(4) + packet_type(1) + request_id(4) + path_len(4) */ + ssize_t packet_len = + path_len + 13 + + ((link_type == LIBSSH2_SFTP_SYMLINK) ? (4 + target_len) : 0); + unsigned char *s, *data = NULL; ++ struct string_buf buf; + static const unsigned char link_responses[2] = + { SSH_FXP_NAME, SSH_FXP_STATUS }; + int retcode; ++ unsigned char packet_type; ++ uint32_t tmp_u32; ++ unsigned char *lk_target; + + if(sftp->symlink_state == libssh2_NB_state_idle) { + sftp->last_errno = LIBSSH2_FX_OK; +@@ -3891,8 +3895,25 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path, + + sftp->symlink_state = libssh2_NB_state_idle; + +- if(data[0] == SSH_FXP_STATUS) { +- retcode = _libssh2_ntohu32(data + 5); ++ buf.data = (unsigned char *)LIBSSH2_UNCONST(data); ++ buf.dataptr = buf.data; ++ buf.len = data_len; ++ ++ if(_libssh2_get_byte(&buf, &packet_type)) { ++ LIBSSH2_FREE(session, data); ++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL, ++ "SFTP Protocol Error (type)"); ++ } ++ ++ if(packet_type == SSH_FXP_STATUS) { ++ if(_libssh2_get_u32(&buf, &tmp_u32)) { ++ LIBSSH2_FREE(session, data); ++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL, ++ "SFTP Protocol Error (code)"); ++ } ++ ++ retcode = (int)tmp_u32; ++ + LIBSSH2_FREE(session, data); + if(retcode == LIBSSH2_FX_OK) + return LIBSSH2_ERROR_NONE; +@@ -3903,30 +3924,37 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path, + } + } + +- if(_libssh2_ntohu32(data + 5) < 1) { ++ /* advance past id */ ++ if(_libssh2_get_u32(&buf, &tmp_u32)) { + LIBSSH2_FREE(session, data); + return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL, +- "Invalid READLINK/REALPATH response, " +- "no name entries"); ++ "SFTP Protocol Error (id)"); + } + +- if(data_len < 13) { +- if(data_len > 0) { +- LIBSSH2_FREE(session, data); +- } ++ /* look for at least one link */ ++ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) { ++ LIBSSH2_FREE(session, data); + return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL, +- "SFTP stat packet too short"); ++ "Invalid READLINK/REALPATH response, " ++ "no name entries"); + } + +- /* this reads a u32 and stores it into a signed 32bit value */ +- link_len = _libssh2_ntohu32(data + 9); +- if(link_len < target_len) { +- memcpy(target, data + 13, link_len); +- target[link_len] = 0; +- retcode = (int)link_len; ++ if(_libssh2_get_string(&buf, &lk_target, &lk_len) == LIBSSH2_ERROR_NONE) { ++ if(lk_len < target_len) { ++ memcpy(target, lk_target, lk_len); ++ target[lk_len] = '\0'; ++ retcode = (int)lk_len; ++ } ++ else { ++ retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL; ++ } + } +- else +- retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL; ++ else { ++ LIBSSH2_FREE(session, data); ++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL, ++ "SFTP Protocol Error (filename)"); ++ } ++ + LIBSSH2_FREE(session, data); + + return retcode; +-- +2.43.0 + diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch new file mode 100644 index 00000000000..f34a8778080 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch @@ -0,0 +1,57 @@ +From 09a4a795b051c8c39957a85b36abba5d8dbd7230 Mon Sep 17 00:00:00 2001 +From: Will Cosgrove +Date: Mon, 20 Oct 2025 14:04:52 -0700 +Subject: [PATCH 3/3] Fix sftp_symlink when getting SSH_FXP_STATUS response + (#1731) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Move advancing past packet ID before reading the FXP_STATUS response. + +Note: +Fixes return code regression introduced by: +"Update sftp_symlink to avoid out of bounds read on malformed packet #1705 (#1717)" + +CVE: CVE-2025-15661 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/4ed26f5740bdd409269ed9fb48a28bf8f565b681] +Signed-off-by: David Nyström +--- + src/sftp.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/src/sftp.c b/src/sftp.c +index 43b6ff90..0a6d15de 100644 +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -3905,6 +3905,13 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path, + "SFTP Protocol Error (type)"); + } + ++ /* advance past id */ ++ if(_libssh2_get_u32(&buf, &tmp_u32)) { ++ LIBSSH2_FREE(session, data); ++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL, ++ "SFTP Protocol Error (id)"); ++ } ++ + if(packet_type == SSH_FXP_STATUS) { + if(_libssh2_get_u32(&buf, &tmp_u32)) { + LIBSSH2_FREE(session, data); +@@ -3924,13 +3931,6 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path, + } + } + +- /* advance past id */ +- if(_libssh2_get_u32(&buf, &tmp_u32)) { +- LIBSSH2_FREE(session, data); +- return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL, +- "SFTP Protocol Error (id)"); +- } +- + /* look for at least one link */ + if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) { + LIBSSH2_FREE(session, data); +-- +2.43.0 + diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 960ff71df2f..1b281e62966 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -13,6 +13,9 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2026-7598.patch \ file://CVE-2026-55200.patch \ file://CVE-2026-55199.patch \ + file://CVE-2025-15661-1.patch \ + file://CVE-2025-15661-2.patch \ + file://CVE-2025-15661-3.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Wed Aug 19 15:56:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95804 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56399C5DF95 for ; Wed, 19 Aug 2026 15:57:52 +0000 (UTC) Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10329.1787155071443540064 for ; Wed, 19 Aug 2026 08:57:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=W2I7+WNl; spf=pass (domain: smile.fr, ip: 209.85.221.50, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-4813ea321cdso19359f8f.1 for ; Wed, 19 Aug 2026 08:57:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155070; x=1787759870; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=HyyKoonaDP7tJP3PaqYD+D9D9mScXyTcYB+TqrJBElQ=; b=W2I7+WNlRqgiRcLfavo4JUauLHP7YnBWg7+rTsRvOJIa52AeuP9zzpU+sPbuiY4k1F tSzkk2UeYpnMo/WZYKSIPiUExt9LF840lMJr2bI0VAnMAWLeeyZa+RA0E5JxTZfcB+Xo +2lQjjAXPZS4zuIb9M3DHKEqaUaNA9H6ERwWg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155070; x=1787759870; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=HyyKoonaDP7tJP3PaqYD+D9D9mScXyTcYB+TqrJBElQ=; b=s90zftDkWiaTSRXkFufD6f34WbPOdwvHhemESj721QvfiEWwYoS336RQ6tFI5vyUqs zCBVkgstdJFpA/tV6ClXomMCOrszhfhXOjN3d4jape+kK0VvbqjYTgTOfcZqJhNVntvN OxYWbIeAnLnLqcFudhwG+ANfst5bVrawz3bTb1DmJA4xoXYwfTybIGGxuZ0beGT7Zru+ 7j5zM9FT+fX5oTLAQFstBw2i/3FySj5QpEOEui8RgSDkdCXL5/TPgUkuBnLorjiXiVhC 49/QFgGf/0aNqZkZk7LAd2ijWe6YF7VLDXti1EbLsyjc7Bqu7+GTuCxnveA3cCsnrUmF ftsA== X-Gm-Message-State: AFuF++kIrE9H7xHqxyydi1usd2hvpoxrmaxq/Ln/4zhC+5y5NL5Qchg8 CRBlbrVrtI9avBPaFOEPLTz2fYBukcH+tqwV468M/qGe7YIBksSw/5GXaBrogGGZTsgRqSTtaN/ SlubKGws= X-Gm-Gg: AR+sD10YySGz+WwZgBtF1mHi89boGwSRUdoUmBtwrf9poHnpiengLWsSIhhdnri+j8T UCBoCGc2dV3SZqlya32RHSGnuO33afDzwKVswXa95bT5PZMfh/xOpp5AGdLqtbvplkCJfiTI4Mz 8QczfU9OaG6CgInQN1UNipMqY58+7A1QIU3k/tQLXIFBAD2tzyvwDyZNQsq7N3WNWGhmQnLdlJW S8Ve+c3/tdsDAsqytsjcIkNva3fz3OGQjTd2R/ThXRc/YWhTV+XDFjEWZx4v2lttpzqpS2VPUYx kD6p14FE5HuchDADxFlF3CjDiPl7a06M30+DKQ6DdLzU6A1uJcG6YJDGso3GYkPM6wyC2yEsfGo ZPBsYKu+3NeUHnyveZMmoDPhv/FcCTm0BQOn0IX/R/WtGjBFX0rV3nBt2BedHCeBSz4MI3cSd6m W5Q8C6Rblg8PVuOrWOzQbo02zforAjHllu6jVCZGw1TXc93uLOUcTsiiL8CBqDjLJTtLTFPjUUk VquTrPpvHS/k6p6CsBi+NarghEJKKhJ1wKa1ldvdHPtECLGMda/V76vpiNdGVYH0eWgrkXDFmS5 JbL0P+WV8/LB8igl43huGDB8zNrmvN29Fu60enB4 X-Received: by 2002:a5d:5f07:0:b0:47f:86af:8fd8 with SMTP id ffacd0b85a97d-482b7837553mr304906f8f.11.1787155069684; Wed, 19 Aug 2026 08:57:49 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:49 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 20/37] curl: fix CVE-2026-5545 Date: Wed, 19 Aug 2026 17:56:51 +0200 Message-ID: <476e5ee5af648083fbf642e3c8218c55bd79ce7b.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:57:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243756 From: Deepak Rathore This patch applies the upstream backport for CVE-2026-5545. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd [2] https://curl.se/docs/CVE-2026-5545.html (From OE-Core rev: dfb61bf303fc32257e32719df36344286b1a80e6) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../curl/curl/CVE-2026-5545.patch | 42 +++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5545.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-5545.patch b/meta/recipes-support/curl/curl/CVE-2026-5545.patch new file mode 100644 index 00000000000..d012f39b079 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-5545.patch @@ -0,0 +1,42 @@ +From ab96b09b1163659b83b0716abe42662d1e1630ea Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Fri, 5 Jun 2026 01:17:44 -0700 +Subject: [PATCH] url: improve connection reuse on negotiate + +Check state of negotiate to allow proper connection reuse. + +Closes #21203 + +CVE: CVE-2026-5545 +Upstream-Status: Backport [https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd] + +Backport Changes: +- curl-8.7.1 still performs the NTLM/Negotiate reuse logic inline in + ConnectionExists(), so the upstream guard was adapted there. + +(cherry picked from commit 33e43985b8f3b9e66691d06e70be0395849856cd) +Signed-off-by: Deepak Rathore +--- + lib/url.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/lib/url.c b/lib/url.c +index 30f215fd48..1d6e3309f5 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -1219,8 +1219,14 @@ ConnectionExists(struct Curl_easy *data, + Curl_timestrcmp(needle->passwd, check->passwd)) { + + /* we prefer a credential match, but this is at least a connection +- that can be reused and "upgraded" to NTLM */ ++ that can be reused and "upgraded" to NTLM if it does ++ not have any auth ongoing. */ ++#ifdef USE_SPNEGO ++ if((check->http_ntlm_state == NTLMSTATE_NONE) && ++ (check->http_negotiate_state == GSS_AUTHNONE)) ++#else + if(check->http_ntlm_state == NTLMSTATE_NONE) ++#endif + chosen = check; + continue; + } diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 3e48c58fa78..7ea5723de07 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -38,6 +38,7 @@ SRC_URI = " \ file://CVE-2026-3784.patch \ file://CVE-2026-5773.patch \ file://CVE-2026-6276.patch \ + file://CVE-2026-5545.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Aug 19 15:56:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95821 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2ABFEC5DF94 for ; Wed, 19 Aug 2026 15:58:03 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10410.1787155072460576737 for ; Wed, 19 Aug 2026 08:57:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=iJdbesxy; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4998590d392so11241835e9.0 for ; Wed, 19 Aug 2026 08:57:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155071; x=1787759871; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=z6Ho0g60tTJwMWTe6sUvMgPnzSayI0FUmb1OwzRLBUk=; b=iJdbesxy4bhIaurPbP2ck7HeC8+H0rZh0bPcP9eM2EN+jqDOTVuhQvDHE+ga1SzAE4 huIxgSe0M/1V54hGG3iPS2Mun2bAbIY59Qn909ACH2HBNpS7pWJznsNe4/SXiYUbxKAw HcsWd+HCX6n6MvGyaubSMwbBSBO3bT3bmBmgY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155071; x=1787759871; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=z6Ho0g60tTJwMWTe6sUvMgPnzSayI0FUmb1OwzRLBUk=; b=jhiS0ScchHirXz4IxPNbCTtueOvWy3IEh+zxtiCc420HqxdECYvWEoLmU9+Z4oStzm hZzDuWXYUv1WECvyvOWk2b3Msk7TM/DsKVd475lMDDv8+0D6XjTZ6z6znr1Rc15qUAFm engmxCANIIEr9uBQqAB4cDjfZlS1OcGsTjNRauOpiHthPc9sJpInZVDlq6qDWf/6iYu4 qr/3OJJx4B6EST+fi8AolYlkif5pO9oz9kxUPHJRMpaDnzzY8gT1oTui4q2v6f9Mx8Vm l6Qfh3KYQqVq6gCYoBPcBXfXPt5uEbhlvZkfPdZB26dmNNlmyyj8HLlwBSSlT9/lNv92 sVfw== X-Gm-Message-State: AOJu0YwZP4Lz/ymi/RilugZO5n8sgC27EzGYFnrPhFto3enCSJ3xvWwk 8kWCIXCkIdX12AVNLLKImTGnFIyUEuLceSaZ9pI+ucQiqaTySqBM39pzPHoS+lrzJSgZa55c7Gw +AGcFn1k= X-Gm-Gg: AR+sD12iITIoP1gqikvJ9B6BXFja1PM39TVxfqimU4Inf+9GKUvB/sPNpuIeq/gkVSj K3RpXtD2qAJWufLYSYynFg2f12+RSWHxCfIEbKSY2bS8nH0X7+g1Xh45EDOl5YBE9vDX9rFwBif wyr62HeVOsWmGwW6AsRLVmGOTmnBHYDE4mHVHNaaAomqmmN4FPFojDOkXlWz32RajBr5zYTSeK6 NcXQ13RKjFcmo3Ggqvn4yQZj1lAPfeQJTmTcX+/ofJqzPWkc8+QUOljrn96RInnpRTyn5E6CHnU 9idL6d+UZGSV596jcXiLWIhXfx+/EE/Ajfbxe1arZi+miLrhvDPyN4aTzZC0y7QcWUbNr+IBnm6 nYIVzOtepWeMXcFOOmnhuUDdX+Uw5CBi0xnt1ZmZJfz71FMcIRJGEDej3WgWhvAGs5PPowzfBqy mClDsUPAKbHVE5rZZBS0Ee6HryS7y+J3H8IaDTN3JmnKgL1v641aQWXdhr7NtJLIhdLuemu7jV2 BoNceEfRxXB+VkqnUB66wgH97NkdUIJ+ejl8l9TwYqbwpl8zwzsV60rViGp5LFu1B+xE8R8Px26 o/2dj2/kZGtK4282WgUfvmalIs8B3xN/GKgDaA1q X-Received: by 2002:a05:600c:a412:b0:499:ae94:be05 with SMTP id 5b1f17b1804b1-499ae94be48mr64724575e9.0.1787155070710; Wed, 19 Aug 2026 08:57:50 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:50 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 21/37] curl: fix CVE-2026-6253 Date: Wed, 19 Aug 2026 17:56:52 +0200 Message-ID: <976f0097172ff5b04b4a72dc8488e6b75ff2ef9c.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243757 From: Deepak Rathore This patch applies the upstream backport for CVE-2026-6253. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f [2] https://curl.se/docs/CVE-2026-6253.html (From OE-Core rev: 21a929291fddb4f7c874609f6d5293477fb74ad9) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../curl/curl/CVE-2026-6253.patch | 392 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 393 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6253.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-6253.patch b/meta/recipes-support/curl/curl/CVE-2026-6253.patch new file mode 100644 index 00000000000..956beac27bb --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-6253.patch @@ -0,0 +1,392 @@ +From eb175878ffa07392d6654127f3d4637d4d335c78 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Fri, 5 Jun 2026 01:18:43 -0700 +Subject: [PATCH] http: clear the proxy credentials as well on port or scheme + change + +Add tests 2009-2011 to verify switching between proxies with credentials +when the switch is driven by a redirect + +Reported-by: Dwij Mehta + +Closes #21304 + +CVE: CVE-2026-6253 +Upstream-Status: Backport [https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f] + +Backport Changes: +- The upstream lib/http.c hunk adds the credential resets to + Curl_http_follow(). curl-8.7.1 predates that protocol-specific redirect + handler and carries the equivalent logic in lib/transfer.c via + Curl_follow(), so the full upstream lib/http.c hunk was adapted there. +- The upstream Curl_reset_proxypwd() helper includes a CURL_DISABLE_PROXY + fallback. In curl-8.7.1, the proxy credential fields and string slots are + unconditional and the pre-existing code accesses them without that guard, + so this backport retains the target-version behavior instead. +- curl-8.7.1 uses tests/data/Makefile.inc instead of the upstream + tests/data/Makefile.am list. + +(cherry picked from commit 188c2f166a20fa97c2325b2da7d0e5cecc13725f) +Signed-off-by: Deepak Rathore +--- + lib/transfer.c | 56 ++++++++++++++++++++++++-------- + lib/transfer.h | 2 ++ + tests/data/Makefile.inc | 1 + + tests/data/test2009 | 70 ++++++++++++++++++++++++++++++++++++++++ + tests/data/test2010 | 71 +++++++++++++++++++++++++++++++++++++++++ + tests/data/test2011 | 70 ++++++++++++++++++++++++++++++++++++++++ + 6 files changed, 257 insertions(+), 13 deletions(-) + create mode 100644 tests/data/test2009 + create mode 100644 tests/data/test2010 + create mode 100644 tests/data/test2011 + +diff --git a/lib/transfer.c b/lib/transfer.c +index ccd042b80d..a73462928d 100644 +--- a/lib/transfer.c ++++ b/lib/transfer.c +@@ -553,6 +553,35 @@ void Curl_init_CONNECT(struct Curl_easy *data) + data->state.upload = (data->state.httpreq == HTTPREQ_PUT); + } + ++/* ++ * Restore the user credentials to those set in options. ++ */ ++CURLcode Curl_reset_userpwd(struct Curl_easy *data) ++{ ++ CURLcode result; ++ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD]) ++ data->state.creds_from = CREDS_OPTION; ++ result = Curl_setstropt(&data->state.aptr.user, ++ data->set.str[STRING_USERNAME]); ++ if(!result) ++ result = Curl_setstropt(&data->state.aptr.passwd, ++ data->set.str[STRING_PASSWORD]); ++ return result; ++} ++ ++/* ++ * Restore the proxy credentials to those set in options. ++ */ ++CURLcode Curl_reset_proxypwd(struct Curl_easy *data) ++{ ++ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser, ++ data->set.str[STRING_PROXYUSERNAME]); ++ if(!result) ++ result = Curl_setstropt(&data->state.aptr.proxypasswd, ++ data->set.str[STRING_PROXYPASSWORD]); ++ return result; ++} ++ + /* + * Curl_pretransfer() is called immediately before a transfer starts, and only + * once for one transfer no matter if it has redirects or do multi-pass +@@ -700,21 +729,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data) + return CURLE_OUT_OF_MEMORY; + } + +- if(data->set.str[STRING_USERNAME] || +- data->set.str[STRING_PASSWORD]) +- data->state.creds_from = CREDS_OPTION; +- if(!result) +- result = Curl_setstropt(&data->state.aptr.user, +- data->set.str[STRING_USERNAME]); +- if(!result) +- result = Curl_setstropt(&data->state.aptr.passwd, +- data->set.str[STRING_PASSWORD]); + if(!result) +- result = Curl_setstropt(&data->state.aptr.proxyuser, +- data->set.str[STRING_PROXYUSERNAME]); ++ result = Curl_reset_userpwd(data); + if(!result) +- result = Curl_setstropt(&data->state.aptr.proxypasswd, +- data->set.str[STRING_PROXYPASSWORD]); ++ result = Curl_reset_proxypwd(data); + + data->req.headerbytecount = 0; + Curl_headers_cleanup(data); +@@ -759,6 +777,7 @@ CURLcode Curl_follow(struct Curl_easy *data, + bool disallowport = FALSE; + bool reachedmax = FALSE; + CURLUcode uc; ++ CURLcode result; + + DEBUGASSERT(type != FOLLOW_NONE); + +@@ -889,12 +908,23 @@ CURLcode Curl_follow(struct Curl_easy *data, + free(scheme); + } + if(clear) { ++ result = Curl_reset_userpwd(data); ++ if(result) { ++ free(newurl); ++ return result; ++ } + Curl_safefree(data->state.aptr.user); + Curl_safefree(data->state.aptr.passwd); + } + } + } + ++ result = Curl_reset_proxypwd(data); ++ if(result) { ++ free(newurl); ++ return result; ++ } ++ + if(type == FOLLOW_FAKE) { + /* we're only figuring out the new url if we would've followed locations + but now we're done so we can get out! */ +diff --git a/lib/transfer.h b/lib/transfer.h +index e65b2b1472..f1a791f1cf 100644 +--- a/lib/transfer.h ++++ b/lib/transfer.h +@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data, + + void Curl_init_CONNECT(struct Curl_easy *data); + ++CURLcode Curl_reset_userpwd(struct Curl_easy *data); ++CURLcode Curl_reset_proxypwd(struct Curl_easy *data); + CURLcode Curl_pretransfer(struct Curl_easy *data); + CURLcode Curl_posttransfer(struct Curl_easy *data); + +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index 9fb92742ee..aafd309a9d 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -231,6 +231,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \ + test1970 test1971 test1972 test1973 test1974 test1975 \ + \ + test2000 test2001 test2002 test2003 test2004 test2005 test2006 \ ++test2009 test2010 test2011 \ + \ + test2023 \ + test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \ +diff --git a/tests/data/test2009 b/tests/data/test2009 +new file mode 100644 +index 0000000000..d2fd79e0d6 +--- /dev/null ++++ b/tests/data/test2009 +@@ -0,0 +1,70 @@ ++ ++ ++ ++ ++HTTP ++HTTP proxy ++http_proxy ++ ++ ++# Server-side ++ ++ ++HTTP/1.1 407 Denied ++ ++ ++ ++HTTP/1.1 301 redirect ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Server: test-server/fake ++Content-Length: 4 ++Content-Type: text/html ++Location: https://another.example/%TESTNUMBER0002 ++ ++boo ++ ++ ++ ++# Client-side ++ ++ ++proxy ++ ++ ++http ++https ++ ++ ++proxy credentials via env variables, redirect from http to https ++ ++ ++ ++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT ++https_proxy=https://%HOSTIP:%HTTPSPORT/ ++ ++ ++http://somewhere.example/ --follow --proxy-insecure ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET http://somewhere.example/ HTTP/1.1 ++Host: somewhere.example ++Proxy-Authorization: Basic %b64[user:secret]b64% ++User-Agent: curl/%VERSION ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++CONNECT another.example:443 HTTP/1.1 ++Host: another.example:443 ++User-Agent: curl/%VERSION ++Proxy-Connection: Keep-Alive ++ ++ ++ ++7 ++ ++ ++ +diff --git a/tests/data/test2010 b/tests/data/test2010 +new file mode 100644 +index 0000000000..443ae9d2f9 +--- /dev/null ++++ b/tests/data/test2010 +@@ -0,0 +1,71 @@ ++ ++ ++ ++ ++HTTP ++HTTP proxy ++http_proxy ++ ++ ++# Server-side ++ ++ ++HTTP/1.1 407 Denied ++ ++ ++ ++HTTP/1.1 301 redirect ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Server: test-server/fake ++Content-Length: 4 ++Content-Type: text/html ++Location: https://another.example/%TESTNUMBER0002 ++ ++boo ++ ++ ++ ++# Client-side ++ ++ ++proxy ++ ++ ++http ++https ++ ++ ++proxy credentials via options for two proxies, redirect from http to https ++ ++ ++ ++http_proxy=http://%HOSTIP:%HTTPPORT ++https_proxy=https://%HOSTIP:%HTTPSPORT/ ++ ++ ++--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET http://somewhere.example/ HTTP/1.1 ++Host: somewhere.example ++Proxy-Authorization: Basic %b64[batman:robin]b64% ++User-Agent: curl/%VERSION ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++CONNECT another.example:443 HTTP/1.1 ++Host: another.example:443 ++Proxy-Authorization: Basic %b64[batman:robin]b64% ++User-Agent: curl/%VERSION ++Proxy-Connection: Keep-Alive ++ ++ ++ ++7 ++ ++ ++ +diff --git a/tests/data/test2011 b/tests/data/test2011 +new file mode 100644 +index 0000000000..dd4e534248 +--- /dev/null ++++ b/tests/data/test2011 +@@ -0,0 +1,70 @@ ++ ++ ++ ++ ++HTTP ++HTTP proxy ++http_proxy ++ ++ ++# Server-side ++ ++ ++HTTP/1.1 407 Denied ++ ++ ++ ++HTTP/1.1 301 redirect ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Server: test-server/fake ++Content-Length: 4 ++Content-Type: text/html ++Location: https://another.example/%TESTNUMBER0002 ++ ++boo ++ ++ ++ ++# Client-side ++ ++ ++proxy ++ ++ ++http ++https ++ ++ ++proxy creds via env, cross-scheme redirect, --location-trusted ++ ++ ++ ++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT ++https_proxy=https://%HOSTIP:%HTTPSPORT/ ++ ++ ++http://somewhere.example/ --location-trusted --proxy-insecure ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET http://somewhere.example/ HTTP/1.1 ++Host: somewhere.example ++Proxy-Authorization: Basic %b64[user:secret]b64% ++User-Agent: curl/%VERSION ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++CONNECT another.example:443 HTTP/1.1 ++Host: another.example:443 ++User-Agent: curl/%VERSION ++Proxy-Connection: Keep-Alive ++ ++ ++ ++7 ++ ++ ++ diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 7ea5723de07..2b988654c41 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -39,6 +39,7 @@ SRC_URI = " \ file://CVE-2026-5773.patch \ file://CVE-2026-6276.patch \ file://CVE-2026-5545.patch \ + file://CVE-2026-6253.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Aug 19 15:56:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95812 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3819C5DF8B for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10411.1787155073264644767 for ; Wed, 19 Aug 2026 08:57:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=WixiPMUb; spf=pass (domain: smile.fr, ip: 209.85.221.43, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-47362928f65so1096015f8f.2 for ; Wed, 19 Aug 2026 08:57:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155071; x=1787759871; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=hd6MCsFibaoLQSIU7ZNJx1qcPwJuNl3WjNl09dDfOw0=; b=WixiPMUbL9OH0kf2D2al6KyzjdeDLp4OcdAUYx+mawOx0l2dDLACKnX8+K7fkUTGPY 209qECmNWHaeBIDmcvQvGwmUypFShbnkW++QKX5ncpJ5fCbZpqJLjnOsOVBvSMFVpkQ5 /BoQ5Vqdzu62oEzxW8yw5hSr/kTZT81wkzNOE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155071; x=1787759871; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=hd6MCsFibaoLQSIU7ZNJx1qcPwJuNl3WjNl09dDfOw0=; b=MZqe5vWEHzLoWVHMjb3TZKnC+V7z4sqjh7wur52yA+Xt1jYSBwV0zgbJq1NGSoCT2b GZbreOmHvc4Wq+o+IdZersVyWREVaOjiwpq1AxtQBSNnm4xiS8HyRoNcSgVgheZM7b1Y mt63CpFuVinhN7fAIpAof3bMQ70fcI9gZ/Va74kQIs6eV/DNPa3SzVSpo0fCjVpnmFVQ 0ljX52ORf2Uus+50GhIlQDWep7ez1bwlUqIMKfpz9PXy7DdBVeBev+DGCP89wyLIugrv CXJzgHZk/zZ0QlzJShdSzjmiH7W/M39heRx6PI+Zd8+09ihQLeCILxcvO6vI6X0Rbiah w8aw== X-Gm-Message-State: AFuF++kdRxZjAImBFfcCSVbFvHH1eOrJVhHrNdXOhTMNtxPV6NQFAZwR B0ULyIdWFlYoLgh7XzlZFdISVIknSTlZsHW+B4u7FC/+d6MJHLnV3g1oKd2N9g2moYdXT/qjcwe ogwVEJZ4= X-Gm-Gg: AR+sD11Qo9KUNcPmPQ0hvx2XAegPWoebbRIcr6RIaCk3QWzY5WwBhQawOAca7l89x0/ ZoNLmPrh6f8a5eDp/6KHiWuiaSjA5/0RvaCxxiUA4303GMetT42lma6s+oUDnuyz2zgEeRdej1v QlpcovGdo5CPtBs1cI8fU6bjSfShkZfAVazyVbjox7fsIoTFdXCMaK92gfuvn7LTP2RGSAGe2D0 LYSbXQHvWRfJl+T43Bk/6OxOdGke3f4sfm4ASZe3Gfs7vJRJMYnbVBQcqghwGhN07Ri/F2+ultf hD5R16Z0jgkWVVIL63v3Vq3nti6y+06BxzYQp3Z7RE2ARAHm+QCfjQAId50ZqwjfhxgjS3R1rih ojT/bJcBloeGFu5uB4mbTPsT/lnugq6Zbj0abNdpSzF9CGoE0q98Z19KSx70krsdKviVfPuuuWi 88tKJqMbF64hZYy3xzIP5WFdOUtYEBlSGPs6Dt7bWcdLK6wmTPYU/HWKIU2/8qzVB7a5180vcSx xDEL1FGoGliv/8jmJPCrBUwzsZ5vwN6Zhi2RObIMVbTGDpoku+uCa8LAw5BQVNWoeTOHhnTNJgJ quyCvlMjKf4G/enPCItS+w/S7dul+WOhSsmwZY9J X-Received: by 2002:a05:6000:4008:b0:47f:8f8f:db74 with SMTP id ffacd0b85a97d-482b1fd9704mr9006417f8f.12.1787155071250; Wed, 19 Aug 2026 08:57:51 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:50 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429 Date: Wed, 19 Aug 2026 17:56:53 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243758 From: Deepak Rathore This patch applies the upstream backport for CVE-2026-6429. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306 [2] https://curl.se/docs/CVE-2026-6429.html [3] https://nvd.nist.gov/vuln/detail/CVE-2026-6429 (From OE-Core rev: 0cbfae83eebf9076f7b22d07b48cb5cef1536989) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../curl/curl/CVE-2026-6429.patch | 367 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 368 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429.patch b/meta/recipes-support/curl/curl/CVE-2026-6429.patch new file mode 100644 index 00000000000..f4df441aa2b --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-6429.patch @@ -0,0 +1,367 @@ +From 8191fd6d5677c30579c09a8d0988b47bbf33f65f Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Fri, 5 Jun 2026 01:20:50 -0700 +Subject: [PATCH] http: clear credentials better on redirect + +Verify with test 2506: netrc with redirect using proxy + +Updated test 998 which was wrong. + +Reported-by: Muhamad Arga Reksapati + +Closes #21345 + +CVE: CVE-2026-6429 +Upstream-Status: Backport [https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306] + +Backport Changes: +- The upstream lib/http.c hunk adds the same-origin credential clearing to + Curl_http_follow(). curl-8.7.1 predates that protocol-specific redirect + handler and carries the equivalent redirect logic in lib/transfer.c via + Curl_follow(), so the full upstream lib/http.c hunk was adapted there. +- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc + instead of the upstream tests/data/Makefile.am and + tests/libtest/Makefile.am lists. +- curl-8.7.1 does not contain test2504/lib2504, so the new + test2506/lib2506 entries were registered after the nearest existing + test2503/lib2502 entries in the target-version test lists. +- curl-8.7.1 uses the older libtest harness, so first.h, + test_lib2506(), and CURLcode result handling were adapted to test.h, + test(), and int res. +- Scarthgap curl-8.7.1 keeps the same incorrect redirected-request + Authorization expectation in tests/data/test998, so this backport removes + that expectation with an equivalent target-version hunk. + +(cherry picked from commit b4024bf808bd558026fdc6096e8457f199ace306) +Signed-off-by: Deepak Rathore +--- + lib/transfer.c | 103 +++++++++++++++++++++---------------- + tests/data/Makefile.inc | 2 +- + tests/data/test2506 | 64 +++++++++++++++++++++++ + tests/data/test998 | 1 - + tests/libtest/Makefile.inc | 5 +- + tests/libtest/lib2506.c | 71 +++++++++++++++++++++++++ + 6 files changed, 198 insertions(+), 48 deletions(-) + create mode 100644 tests/data/test2506 + create mode 100644 tests/libtest/lib2506.c + +diff --git a/lib/transfer.c b/lib/transfer.c +index a73462928d..0f5bd8ce59 100644 +--- a/lib/transfer.c ++++ b/lib/transfer.c +@@ -865,49 +865,62 @@ CURLcode Curl_follow(struct Curl_easy *data, + if(uc) + return Curl_uc_to_curlcode(uc); + +- /* Clear auth if this redirects to a different port number or protocol, +- unless permitted */ +- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) { +- char *portnum; +- int port; +- bool clear = FALSE; +- +- if(data->set.use_port && data->state.allow_port) +- /* a custom port is used */ +- port = (int)data->set.use_port; +- else { +- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum, +- CURLU_DEFAULT_PORT); +- if(uc) { +- free(newurl); +- return Curl_uc_to_curlcode(uc); +- } +- port = atoi(portnum); +- free(portnum); +- } +- if(port != data->info.conn_remote_port) { +- infof(data, "Clear auth, redirects to port from %u to %u", +- data->info.conn_remote_port, port); +- clear = TRUE; ++ { ++ bool same_origin; ++ CURLU *u; ++ char *oldscheme = NULL; ++ char *oldhost = NULL; ++ char *oldport = NULL; ++ char *newscheme = NULL; ++ char *newhost = NULL; ++ char *newport = NULL; ++ ++ u = curl_url(); ++ if(!u) { ++ free(newurl); ++ return CURLE_OUT_OF_MEMORY; + } +- else { +- char *scheme; +- const struct Curl_handler *p; +- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0); +- if(uc) { +- free(newurl); +- return Curl_uc_to_curlcode(uc); +- } + +- p = Curl_get_scheme_handler(scheme); +- if(p && (p->protocol != data->info.conn_protocol)) { +- infof(data, "Clear auth, redirects scheme from %s to %s", +- data->info.conn_scheme, scheme); +- clear = TRUE; +- } +- free(scheme); ++ uc = curl_url_set(u, CURLUPART_URL, data->state.url, 0); ++ if(!uc) ++ uc = curl_url_get(u, CURLUPART_SCHEME, &oldscheme, 0); ++ if(!uc) ++ uc = curl_url_get(u, CURLUPART_HOST, &oldhost, 0); ++ if(!uc) ++ uc = curl_url_get(u, CURLUPART_PORT, &oldport, CURLU_DEFAULT_PORT); ++ if(!uc) ++ uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &newscheme, 0); ++ if(!uc) ++ uc = curl_url_get(data->state.uh, CURLUPART_HOST, &newhost, 0); ++ if(!uc) ++ uc = curl_url_get(data->state.uh, CURLUPART_PORT, &newport, ++ CURLU_DEFAULT_PORT); ++ if(uc) { ++ curl_url_cleanup(u); ++ free(oldscheme); ++ free(oldhost); ++ free(oldport); ++ free(newscheme); ++ free(newhost); ++ free(newport); ++ free(newurl); ++ return Curl_uc_to_curlcode(uc); + } +- if(clear) { ++ ++ same_origin = strcasecompare(oldscheme, newscheme) && ++ strcasecompare(oldhost, newhost) && ++ !strcmp(oldport, newport); ++ ++ curl_url_cleanup(u); ++ free(oldscheme); ++ free(oldhost); ++ free(oldport); ++ free(newscheme); ++ free(newhost); ++ free(newport); ++ ++ if((!same_origin && !data->set.allow_auth_to_other_hosts) || ++ !data->set.str[STRING_USERNAME]) { + result = Curl_reset_userpwd(data); + if(result) { + free(newurl); +@@ -917,12 +930,12 @@ CURLcode Curl_follow(struct Curl_easy *data, + Curl_safefree(data->state.aptr.passwd); + } + } +- } + +- result = Curl_reset_proxypwd(data); +- if(result) { +- free(newurl); +- return result; ++ result = Curl_reset_proxypwd(data); ++ if(result) { ++ free(newurl); ++ return result; ++ } + } + + if(type == FOLLOW_FAKE) { +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index aafd309a9d..f673f86384 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -251,7 +251,7 @@ test2300 test2301 test2302 test2303 test2304 test2305 test2306 test2307 \ + \ + test2400 test2401 test2402 test2403 test2404 \ + \ +-test2500 test2501 test2502 test2503 \ ++test2500 test2501 test2502 test2503 test2506 \ + \ + test2600 test2601 test2602 test2603 \ + \ +diff --git a/tests/data/test2506 b/tests/data/test2506 +new file mode 100644 +index 0000000000..9c65002496 +--- /dev/null ++++ b/tests/data/test2506 +@@ -0,0 +1,64 @@ ++ ++ ++ ++ ++HTTP ++cookies ++ ++ ++ ++ ++ ++HTTP/1.1 301 redirect ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Content-Length: 3 ++Location: http://numbertwo.example/%TESTNUMBER0002 ++ ++ok ++ ++ ++HTTP/1.1 200 OK ++Date: Tue, 09 Nov 2010 14:49:00 GMT ++Content-Length: 4 ++ ++yes ++ ++ ++ ++ ++ ++http ++ ++ ++proxy ++ ++ ++lib%TESTNUMBER ++ ++ ++netrc with redirect using proxy ++ ++ ++machine site.example login batman password robin ++ ++ ++http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506 ++ ++ ++ ++ ++ ++GET http://site.example/ HTTP/1.1 ++Host: site.example ++Authorization: Basic %b64[batman:robin]b64% ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://numbertwo.example/25060002 HTTP/1.1 ++Host: numbertwo.example ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++ ++ ++ +diff --git a/tests/data/test998 b/tests/data/test998 +index 0969d4704b..17c0a0e150 100644 +--- a/tests/data/test998 ++++ b/tests/data/test998 +@@ -82,7 +82,6 @@ Proxy-Connection: Keep-Alive + + GET http://somewhere.else.example/a/path/9980002 HTTP/1.1 + Host: somewhere.else.example +- Authorization: Basic YWxiZXJ0bzplaW5zdGVpbg== + User-Agent: curl/%VERSION + Accept: */* + Proxy-Connection: Keep-Alive +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 9f7cec6027..9d3356aaf5 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -75,7 +75,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \ + lib1970 lib1971 lib1972 lib1973 lib1974 lib1975 \ + lib2301 lib2302 lib2304 lib2305 lib2306 \ + lib2402 lib2404 \ +- lib2502 \ ++ lib2502 lib2506 \ + lib3010 lib3025 lib3026 lib3027 \ + lib3100 lib3101 lib3102 lib3103 + +@@ -684,6 +684,9 @@ lib2404_LDADD = $(TESTUTIL_LIBS) + lib2502_SOURCES = lib2502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib2502_LDADD = $(TESTUTIL_LIBS) + ++lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib2506_LDADD = $(TESTUTIL_LIBS) ++ + lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib3010_LDADD = $(TESTUTIL_LIBS) + +diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c +new file mode 100644 +index 0000000000..e6dde18507 +--- /dev/null ++++ b/tests/libtest/lib2506.c +@@ -0,0 +1,71 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Linus Nielsen Feltzing ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++#include "test.h" ++ ++#include "testtrace.h" ++ ++static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud) ++{ ++ (void)ptr; ++ (void)ud; ++ return size * nmemb; ++} ++ ++int test(char *URL) ++{ ++ CURL *curl; ++ int res = CURLE_OUT_OF_MEMORY; ++ ++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { ++ curl_mfprintf(stderr, "curl_global_init() failed\n"); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ curl = curl_easy_init(); ++ if(!curl) { ++ curl_mfprintf(stderr, "curl_easy_init() failed\n"); ++ curl_global_cleanup(); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506); ++ test_setopt(curl, CURLOPT_PROXY, URL); ++ test_setopt(curl, CURLOPT_URL, libtest_arg2); ++ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL); ++ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3); ++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); ++ test_setopt(curl, CURLOPT_VERBOSE, 1L); ++ ++ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the ++ credentials come from netrc */ ++ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L); ++ ++ res = curl_easy_perform(curl); ++ ++test_cleanup: ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ ++ return res; ++} diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 2b988654c41..8e39d821626 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -40,6 +40,7 @@ SRC_URI = " \ file://CVE-2026-6276.patch \ file://CVE-2026-5545.patch \ file://CVE-2026-6253.patch \ + file://CVE-2026-6429.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Aug 19 15:56:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95815 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1979C5DF8F for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10412.1787155073742438233 for ; Wed, 19 Aug 2026 08:57:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=FTjLz4q9; spf=pass (domain: smile.fr, ip: 209.85.221.52, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-47fe89fb333so619406f8f.3 for ; Wed, 19 Aug 2026 08:57:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155072; x=1787759872; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=IUi7xedz6Sy0vy6k9aowfiL50N3x2irxqLxThSxJ2tk=; b=FTjLz4q93SVmzfMx68VZymzcrZG87mN2XUFS5l6clAzlhg8xf/skP6V2aR6yGJeOzb oyZMfl1wNuPJFu9jcYv2IbYnp34CbU4ah15hUkq0MkV4UZR64gyy1YeB66PON6PtscNE 1tiPTUNJuYMBzfhn3x8CKYIJob4uR1eeDqyO0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155072; x=1787759872; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=IUi7xedz6Sy0vy6k9aowfiL50N3x2irxqLxThSxJ2tk=; b=kfh9mfwW9MfgENujBKJ1Tyb+GL2afjsyn61WA5Rco/bj0kzHNS3TLdAsibBGyilGON wozmT9Q8sIOlTYGaSCtxWp/SOjL+6wuqeJ1xfJvnvbXup4SkFxBo+OVM20XD1LFEy5Oi ezFSF8OBM/7T+r7sO/8d3tzI+5KuI73lmywRYD9G2wALN0dWYo/Ea5/YaheTspSdDOnE xX4I1novyjFfE/vdmFtLKxuqAh5XgzHoJbwTYAdE7CRqC5SIlwWoXkN8FyrSqLXnkeVY IkNPnL51iNc1kyC1XxQzURcleoG8FTl50ZaQlrgbFznzIBZ9Xypyu7PXCtMxlP24Ov94 j2+g== X-Gm-Message-State: AFuF++mnKrDH3Su6fd8M91jtbu2mVCbczjlwO+/BLoWNqOtixssSGqJa JE08Xw41dcZDPPK/UyO6ZdbPWO+eC1+ORZBvjp71TNK+XfGCAN6sMKXNinhVIVgANp8GTcPCyOL pS0ZcVPQ= X-Gm-Gg: AR+sD13qMBR5aGmjER2nK66dwxXriYVcBU1lYO0Uw/bjjK1xeFCB1spwg3FdlTjIJ9n Pwnae7wkSGnCNa+QM0nNKvOWGKCn+Hjy8K8Cofah2xqbSHZWJ5LNK2rN3PSJHiTPoBEnJVlqD6f z8XMD3LLC30YkzFFwWmdU9XGU3Ke1qo42bz6loKTj3ak5QFhOY6YmaT1k4pc2/UZ5SMbQ4spuFF OLLDhRD1+0XqooTMgKqsDwpi4XhnG2yuYn2pgTzMZSRFinaUxK9VUpu0tFGWgQhCrfNdZZZX9A2 mOWaSRs8sq/z+ZmRg7QIHNidwVZyHSxAFKzWqNSt5Sh1iO3ZumnuvV+4cfOnfp8eF9hllrFKF/R kSYnwqz+7QL8vXMpuEtdcWG/gl/MY9pdp1XHQaxwZuPpUc7hOWTHQDAkIsL/iWRj1b0aiTMS/AB mtFSoEA9Tn8ZPBYO6RadcizU8jdDtZYhu+/U7VeTCQrliE7K6KveIvkjDYdAsYfn8/XJZlAdqgB JP1qkEOW+0hXrX1ycfzo3rQBu0tCmdP1eCUcqIqw8Iz4SPRmJRZ0DxLm+jgVMJFDJscE3+dGd+x Yh5JZJepZx3L/3X6PMnjhYsLJBDjFOsOT6i4JuQmqWiVuuh+5Hs= X-Received: by 2002:a05:6000:2884:b0:481:5b58:c589 with SMTP id ffacd0b85a97d-482b1e9f1f2mr8534129f8f.10.1787155071887; Wed, 19 Aug 2026 08:57:51 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:51 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168 Date: Wed, 19 Aug 2026 17:56:54 +0200 Message-ID: <12acba5a26f3e91eb642ad27c5f7e651f6ad1fd5.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243759 From: Deepak Rathore This patch applies the upstream backport for CVE-2026-7168. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 [2] https://curl.se/docs/CVE-2026-7168.html (From OE-Core rev: 2fa295fe7473c6df94175de36528736bf32f1e9a) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../curl/curl/CVE-2026-7168.patch | 425 ++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 426 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch new file mode 100644 index 00000000000..0669be6546d --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch @@ -0,0 +1,425 @@ +From 0f0bb5efbd1e4f2199eeb98e6c62a7a67242cad2 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Fri, 5 Jun 2026 01:22:37 -0700 +Subject: [PATCH] setopt: clear proxy auth properties when switching + +Verify with test 1588 + +Closes #21453 + +CVE: CVE-2026-7168 +Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507] + +Backport Changes: +- The upstream lib/setopt.c hunk reuses Curl_auth_digest_cleanup() from the + newer tree. curl-8.7.1 does not expose that helper to setopt.c in the same + way, so this backport adds the vauth/vauth.h include before applying the + upstream setproxy() cleanup logic. +- The upstream tree already provides a CURL_DISABLE_DIGEST_AUTH fallback for + Curl_auth_digest_cleanup(). curl-8.7.1 does not, so this backport adds the + equivalent no-op macro in lib/vauth/vauth.h. +- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc + instead of the upstream tests/data/Makefile.am and + tests/libtest/Makefile.am lists. +- curl-8.7.1 uses the older libtest harness, so first.h, + test_lib1588(), libtest_arg4, and CURLcode result handling were adapted to + test.h, test(), test_argv[4], and int res. +- curl-8.7.1 does not define the newer digest test feature in runtests.pl. + This backport defines the target harness feature as digest-auth, matching + tests/server/disabled.c, and makes test 1588 require digest-auth. +- The curl-8.7.1 server harness does not handle crlf="headers" correctly on + response data sections for this test, so those attributes were removed from + the two server response blocks and datacheck. The protocol block keeps + crlf="headers" because runtests.pl normalizes protocol verification when any + crlf attribute is present. + +(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507) +Signed-off-by: Deepak Rathore +--- + lib/setopt.c | 18 ++++- + lib/vauth/vauth.h | 2 + + tests/data/Makefile.inc | 1 + + tests/data/test1588 | 106 ++++++++++++++++++++++++++ + tests/libtest/Makefile.inc | 5 +- + tests/libtest/lib1588.c | 152 +++++++++++++++++++++++++++++++++++++ + tests/runtests.pl | 2 + + 7 files changed, 283 insertions(+), 3 deletions(-) + create mode 100644 tests/data/test1588 + create mode 100644 tests/libtest/lib1588.c + +diff --git a/lib/setopt.c b/lib/setopt.c +index 8a5a5d7..7eaf309 100644 +--- a/lib/setopt.c ++++ b/lib/setopt.c +@@ -51,6 +51,7 @@ + #include "altsvc.h" + #include "hsts.h" + #include "tftp.h" ++#include "vauth/vauth.h" + #include "strdup.h" + /* The last 3 #include files should be in this order */ + #include "curl_printf.h" +@@ -76,6 +77,20 @@ CURLcode Curl_setstropt(char **charp, const char *s) + return CURLE_OK; + } + ++#ifndef CURL_DISABLE_PROXY ++static CURLcode setproxy(struct Curl_easy *data, const char *proxy) ++{ ++ if((data->set.str[STRING_PROXY] && proxy) && ++ /* there was one set, is this a new one? */ ++ !strcmp(data->set.str[STRING_PROXY], proxy)) ++ return CURLE_OK; /* same one as before */ ++ ++ Curl_auth_digest_cleanup(&data->state.proxydigest); ++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy)); ++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy); ++} ++#endif ++ + CURLcode Curl_setblobopt(struct curl_blob **blobp, + const struct curl_blob *blob) + { +@@ -1139,8 +1154,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param) + * Setting it to NULL, means no proxy but allows the environment variables + * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL). + */ +- result = Curl_setstropt(&data->set.str[STRING_PROXY], +- va_arg(param, char *)); ++ result = setproxy(data, va_arg(param, char *)); + break; + + case CURLOPT_PRE_PROXY: +diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h +index 9da0540..bf5c7a3 100644 +--- a/lib/vauth/vauth.h ++++ b/lib/vauth/vauth.h +@@ -119,6 +119,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data, + + /* This is used to clean up the digest specific data */ + void Curl_auth_digest_cleanup(struct digestdata *digest); ++#else ++#define Curl_auth_digest_cleanup(x) + #endif /* !CURL_DISABLE_DIGEST_AUTH */ + + #ifdef USE_GSASL +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc +index f673f86..461eb37 100644 +--- a/tests/data/Makefile.inc ++++ b/tests/data/Makefile.inc +@@ -200,6 +200,7 @@ test1540 test1541 test1542 test1543 test1544 test1545 \ + test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \ + test1558 test1559 test1560 test1561 test1562 test1563 test1564 test1565 \ + test1566 test1567 test1568 test1569 test1570 \ ++test1588 \ + \ + test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \ + test1598 \ +diff --git a/tests/data/test1588 b/tests/data/test1588 +new file mode 100644 +index 0000000..8a3bf81 +--- /dev/null ++++ b/tests/data/test1588 +@@ -0,0 +1,106 @@ ++ ++ ++ ++ ++HTTP ++HTTP GET ++HTTP proxy ++HTTP proxy Digest auth ++multi ++ ++ ++ ++# Server-side ++ ++ ++# this is returned first since we get no proxy-auth ++ ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++And you should ignore this data. ++ ++ ++# then this is returned when we get proxy-auth ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++ ++ ++ ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++ ++ ++ ++# Client-side ++ ++ ++http ++ ++# tool is what to use instead of 'curl' ++ ++lib%TESTNUMBER ++ ++ ++!SSPI ++crypto ++proxy ++digest-auth ++ ++ ++HTTP proxy auth Digest, then change proxy and do it again ++ ++ ++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/1588 HTTP/1.1 ++Host: test.remote.example.com ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a" ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++ ++ ++ +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 9d3356a..4c42d34 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -62,7 +62,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \ + lib1540 lib1541 lib1542 lib1543 lib1545 \ + lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \ + lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \ +- lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ ++ lib1588 lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ + \ + lib1662 \ + \ +@@ -687,6 +687,9 @@ lib2502_LDADD = $(TESTUTIL_LIBS) + lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib2506_LDADD = $(TESTUTIL_LIBS) + ++lib1588_SOURCES = lib1588.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1588_LDADD = $(TESTUTIL_LIBS) ++ + lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib3010_LDADD = $(TESTUTIL_LIBS) + +diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c +new file mode 100644 +index 0000000..00c6b35 +--- /dev/null ++++ b/tests/libtest/lib1588.c +@@ -0,0 +1,152 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Daniel Stenberg, , et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++/* ++ * argv1 = URL ++ * argv2 = proxy host ++ * argv3 = proxy port ++ * argv4 = proxyuser:password ++ */ ++ ++#include "test.h" ++#include "testutil.h" ++ ++static CURLcode init1588(CURL *curl, const char *url, ++ const char *userpwd, const char *proxy) ++{ ++ int res = CURLE_OK; ++ ++ res_easy_setopt(curl, CURLOPT_URL, url); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXY, proxy); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); ++ if(res) ++ goto init_failed; ++#if 0 ++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L); ++ if(res) ++ goto init_failed; ++#endif ++ ++ res_easy_setopt(curl, CURLOPT_HEADER, 1L); ++ if(res) ++ goto init_failed; ++ ++ return CURLE_OK; /* success */ ++ ++init_failed: ++ return (CURLcode)res; /* failure */ ++} ++ ++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd, ++ const char *proxy) ++{ ++ CURLcode res = CURLE_OK; ++ ++ res = init1588(curl, url, userpwd, proxy); ++ if(res) ++ return res; ++ ++ return curl_easy_perform(curl); ++} ++ ++int test(char *URL) ++{ ++ int res = CURLE_OK; ++ CURL *curl = NULL; ++ const char *proxyuserpws; ++ struct curl_slist *host = NULL; ++ struct curl_slist *host2 = NULL; ++ char proxy1_resolve[128]; ++ char proxy2_resolve[128]; ++ char proxy1_connect[128]; ++ char proxy2_connect[128]; ++ ++ if(test_argc < 5) ++ return TEST_ERR_MAJOR_BAD; ++ proxyuserpws = test_argv[4]; ++ ++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve), ++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2); ++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve), ++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2); ++ ++ /* we connect to the fake host name but the right port number */ ++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect), ++ "firstproxy:%s", libtest_arg3); ++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect), ++ "secondproxy:%s", libtest_arg3); ++ ++ res_global_init(CURL_GLOBAL_ALL); ++ if(res) ++ return res; ++ ++ curl = curl_easy_init(); ++ if(!curl) { ++ curl_mfprintf(stderr, "curl_easy_init() failed\n"); ++ curl_global_cleanup(); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ host = curl_slist_append(NULL, proxy1_resolve); ++ if(!host) ++ goto test_cleanup; ++ host2 = curl_slist_append(host, proxy2_resolve); ++ if(!host2) ++ goto test_cleanup; ++ host = host2; ++ ++ start_test_timing(); ++ ++ easy_setopt(curl, CURLOPT_RESOLVE, host); ++ ++ res = run1588(curl, URL, proxyuserpws, proxy1_connect); ++ if(res) ++ goto test_cleanup; ++ ++ curl_mfprintf(stderr, "lib1588: now we do the request again\n"); ++ ++ res = run1588(curl, URL, proxyuserpws, proxy2_connect); ++ ++test_cleanup: ++ ++ /* proper cleanup sequence - type PB */ ++ ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ curl_slist_free_all(host); ++ return res; ++} +diff --git a/tests/runtests.pl b/tests/runtests.pl +index ddfab20..b40df55 100755 +--- a/tests/runtests.pl ++++ b/tests/runtests.pl +@@ -637,6 +637,8 @@ sub checksystemfeatures { + $feature{"Kerberos"} = $feat =~ /Kerberos/i; + # SPNEGO enabled + $feature{"SPNEGO"} = $feat =~ /SPNEGO/i; ++ # Digest auth enabled unless disabled by build ++ $feature{"digest-auth"} = 1; + # CharConv enabled + $feature{"CharConv"} = $feat =~ /CharConv/i; + # TLS-SRP enabled +-- +2.35.6 diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 8e39d821626..7d55f72b03f 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -41,6 +41,7 @@ SRC_URI = " \ file://CVE-2026-5545.patch \ file://CVE-2026-6253.patch \ file://CVE-2026-6429.patch \ + file://CVE-2026-7168.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Aug 19 15:56:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95816 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 29E55C5DF91 for ; Wed, 19 Aug 2026 15:58:03 +0000 (UTC) Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10413.1787155074245744888 for ; Wed, 19 Aug 2026 08:57:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=wXVuS83p; spf=pass (domain: smile.fr, ip: 209.85.221.53, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-47f71156e1aso546669f8f.3 for ; Wed, 19 Aug 2026 08:57:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155072; x=1787759872; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RD+mraslbg4Ke6XBizr0gN8MmPUjpQIFoDbagKW9BQM=; b=wXVuS83pPJuWcj7bvX0QkVGe2JBILNcebh09heFG/XWkOq7FbExOytkvdr76crufLz rn1W03eog+VtLftsZyZhhMDasKsnsNiZCZIw2GTJMPbPJKtGtLk0XZZsvGMo9pzbAKYk gYpR7mnsnLmAKbncUepeJCYl91cZkS/0GGD3c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155072; x=1787759872; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RD+mraslbg4Ke6XBizr0gN8MmPUjpQIFoDbagKW9BQM=; b=r4qyqGFBxsI1jN252jWmY7WwvmkJuCSX03X6nFgV6owSyHhJp4wbuY21ZdqVC52IwT dpKriB6e1SYRapZZ3xrnRpyluj3xC1AJVeCqIVS0QOuopogUZe/3KKyf0tarlVUFr0Yv QGjfBmOhjLa+wl0SismRMaLOzuJpCTX/0+lvZDh9eGBkDngJt3sDU5rmw1BcjwZ4CCAU WYQSv56YEkDTIyDSy/8CJE2tsS9a0THz3UwBhlBQRhVXT54wELvzpXY9D2K/mWEvu9g4 7cKXJOG+64Txyau4+JHqLCVEgA7C+TTdaEklwJtWWAn5vXxICleiIl4rByDVCRWgd1VQ Dz6g== X-Gm-Message-State: AFuF++nbuxbz9GxwA5FUDZ9k2kIBRDFdUgCvj2SCXYziZN1H6ceYbnG3 CYBH+obD+ns5FFqUDDN99iVVk4B6GdpLlQuTJCcQmi7s2zohrLGa59miKcck/MZnz7mjAyKt7GC i2FBFLVQ= X-Gm-Gg: AR+sD12n2M0UE2BmNSveios5wcrpVrqLxxK2KpXKWtRfIlfSc5AxhHo9pknD4YryOLh Zz7xZIkNviO9+CcBJXyFMGJV09Y5TwQR8NV1buHrnhZgse+2Sh4VMUczpk07nP9da0HkkeUOAuu aOze76PqdNP8TVue5pjRXoGacrRdCc9A1DtF77SOGZOAGpWc74ynkwc6ZELGbNKDax7ujPQAMFG YMr5RwZ46RhdUs6fXix1TiQQvXaJ6LXVCJFDFcmzuWgRBO2yKt2PVT2VsyZFUJ7KSrWVhD3946X lqgrSHJUB8NHSb1XHlpvrOAy0cdHNIYj+Fgw2LNOCK03dWddO0lvAVIFyj4G6snskuWQzSGZTAa l1n4eTk+wKYxcONN59Oc9VKkXm+u7Hgwl7k36osNDD+1HI79FCnRS7D+cWHNaP5U3/9TuCvDpr2 zpM1ZOmPH1nClIHyJBVp4dfdK7aQiHHD4oUmbyLo2mgPTVGTwD/RMV0Q5dPy+xdwtUr6eU0VKLY hlm6PkGrqdfIj1zndwSpyiUzy7D621VblycSt7EiFSUVZDm3XGnLCDRr3FRKc/EIh90OgwWNKK5 uABrX/Qz1s5HPa1xQG0SUOekwQfsFBlgApgMviYyA4b0aMfEBwM= X-Received: by 2002:a05:6000:3c1:b0:47f:83ee:e56f with SMTP id ffacd0b85a97d-482b1fe2924mr11604755f8f.18.1787155072431; Wed, 19 Aug 2026 08:57:52 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:52 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 24/37] u-boot: Set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:55 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243760 From: Maik Otto The CPE vendor is "denx" and the CPE product is "u-boot". Set CVE_PRODUCT for properly matching in the NVD database. (From OE-Core rev: f4c9c7930bda530f60248a5db8e45c89f2c66f50) Signed-off-by: Maik Otto Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit d2e5d427de13b33694a1d802f5ac833b2c04ced6) Signed-off-by: Devansh Patel Signed-off-by: Fabien Thomas --- meta/recipes-bsp/u-boot/u-boot.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc index 7935f2b4aa4..00dda93b4ac 100644 --- a/meta/recipes-bsp/u-boot/u-boot.inc +++ b/meta/recipes-bsp/u-boot/u-boot.inc @@ -19,6 +19,8 @@ PACKAGECONFIG ??= "openssl" # a host build dependency. PACKAGECONFIG[openssl] = ",,openssl-native" +CVE_PRODUCT = "denx:u-boot" + # Allow setting an additional version string that will be picked up by the # u-boot build system and appended to the u-boot version. If the .scmversion # file already exists it will not be overwritten. From patchwork Wed Aug 19 15:56:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95814 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 019ACC5DF90 for ; Wed, 19 Aug 2026 15:58:03 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10414.1787155074812124912 for ; Wed, 19 Aug 2026 08:57:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=tpv6oaBP; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: fabien.thomas@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-499ae1c6471so5167815e9.3 for ; Wed, 19 Aug 2026 08:57:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155073; x=1787759873; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=JjvnlLkpdzifuFz4eyiRIp3KKbY0/lVsSzU2WWXZUV0=; b=tpv6oaBP/q8MaZWso9hCjqBPZ6oY79TxHB/1x59Zgxg3AcWDURG83u2LnSei1TUTET 3nVAX+dXA4ZIokcI+BdkDFamV1Az7xB5Ye4e0M3Q9OoASV2Ti0ZUNoK6iPORdRVbG4qs ZaJCzWEFwAVj7RfXLJInDIxenp8bGOYXmK//E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155073; x=1787759873; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=JjvnlLkpdzifuFz4eyiRIp3KKbY0/lVsSzU2WWXZUV0=; b=G+IFSz5KFo24T0thgv7PC0RggjQYYmDKEAjFi63hEvyR2a2LcD2sJTkVScW62FT/ts 51oE+AYfuKC/25EcLUNjgEIOcRjZoPIYfP66Z3S+irkh+gT2wLK5qcpbhJd+xL6WTQS7 Ri9A0ohLgxgAMw+b0mBNRl8rkqF6e8rqSUzUQZ1WASS0RfYBuaDYwmAtyVwfrqRCh78k xecHsLkLq3kkKA06cotlBd/x+J9aWtrBz0S+m7cT9hVaTxGQcZM8vtaN4Bq5zEWzavFT mZWz4l5VPE9gOuSWUu9ekRlnNpuJCT/cRXGAcTi7ZUKX7/ARptNr2cWJxoHI6Mx5Ip74 4Rxw== X-Gm-Message-State: AOJu0YwWQxazEtUVVYT3IrESc2INCeJZWTeqfFdGDi8oct91rqIIjSYU oh0Iy1CpNyHvWo+lX3RBCV3u051NdX6sv6e4XdRmcAZW1jzB72HUMqfSP667KppmCrn/Z9pgAdv LHsqqls0= X-Gm-Gg: AR+sD10O9ukDoJuyJ9ZSP6Epzt4lIzpzpOgyfSgxLcXb0v8DNp2dypDZw6Ac8RCbdKM bPt5gvzaQIXkvSqXukYfRidIYqZdLRhEPeWrdEpPKpyvnQUB2TkVsuls8nR8P3fpWW4wXKyn9XN JXT7NcMPLB5dj6gOEYUtQ3ALHbH9GxDukVjCTwrIkkaQDwm4Gj3CQRJ0SCYfMFoOPpqit1AJCBU tRxZGurm270E+zW/RB/EdR3C5xabdtFDE1BBKwzlNXGqov1hy5Ny0KW28rUBaaQL9Kpz25CRYB5 nQh0GI96FA5+vLtCzRviBom3wYB6f2xbJ51R79cZrVKu9nf3+2N+nZuqD6fZxZ78x/IM14va0GT CrpnePMq7w5ZIjDdTV8XUcxJ/hhGNQqJDCnnUCB3hxiNghye6bkheNElmJkxTrNpGJ4/fjd0fzH u2njEeTGAWv4pmKz6hYpI+yDLOj13UiXXdF9lSJ86R660QOX+D4LpAIFNmsLcFm3eeHfo8WUE8J 1uDrijoXPmod/Q6pTkUp6Ldb7C5p+sVBV594dmsqEmtIP+PifPEXT3EvcLvr9+Ukas9vazl5CR+ 5Tp6LlSFiNvGXp32fnpzRKvJBqPX0+qzMoZ7UVwOiq5/EchzD9U= X-Received: by 2002:a05:600c:1f94:b0:499:8807:345f with SMTP id 5b1f17b1804b1-499aa1b6994mr93856195e9.13.1787155072960; Wed, 19 Aug 2026 08:57:52 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:52 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 25/37] xserver-org: update CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:56 +0200 Message-ID: <1847e619f756eb0bba2bf7597a21b964cf626427.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243761 From: Peter Marko In cvelistV5, CVE-2024-21886 uses CPE xorg:xserver ([1]). Detected because this CVE is shown for xwayland recipe. [1] https://github.com/CVEProject/cvelistV5/blob/cve_2026-04-12_1800Z/cves/2024/21xxx/CVE-2024-21886.json#L646 (From OE-Core rev: c3cbb4003424f8b1e1faa06857096f4b1e609fea) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 5311f2a08842612b74472c843be2ae0d47cff6f5) Signed-off-by: Devansh Patel Signed-off-by: Fabien Thomas --- meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc index 815be6a4986..9bf5137de1e 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc @@ -19,7 +19,7 @@ SRC_URI = "${XORG_MIRROR}/individual/xserver/${XORG_PN}-${PV}.tar.xz" UPSTREAM_CHECK_REGEX = "xorg-server-(?P\d+(\.(?!99)\d+)+)\.tar" -CVE_PRODUCT = "xorg-server x_server" +CVE_PRODUCT = "xorg-server x_server xorg:xserver" CVE_STATUS[CVE-2011-4613] = "not-applicable-platform: This is specific to Debian's xserver-wrapper.c" CVE_STATUS[CVE-2020-25697] = "upstream-wontfix: \ From patchwork Wed Aug 19 15:56:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95820 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4574BC5DF93 for ; Wed, 19 Aug 2026 15:58:03 +0000 (UTC) Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10333.1787155075395690789 for ; Wed, 19 Aug 2026 08:57:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=DfU3uw+f; spf=pass (domain: smile.fr, ip: 209.85.221.49, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-4799b3f7c83so775676f8f.2 for ; Wed, 19 Aug 2026 08:57:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155074; x=1787759874; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=SUsXieTz5SoVoPyY7e0F6nNiAjeTALF89ilokDTn9n0=; b=DfU3uw+fqJgFT4RYI+FQ0PEiPGiKk1RrId8/Y2qw9oICpH+/AdMj8HKtIs673ca/cs CoJAZaWKPTJvPNA8UuWv5+S+6Wijg0VvgYslUJrKg3bZ5gGGiYziRI37rw29CFD2z8AW 81dCI1EhyUxPZhbSguP2n/kE2TKVwGd8OZU7k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155074; x=1787759874; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=SUsXieTz5SoVoPyY7e0F6nNiAjeTALF89ilokDTn9n0=; b=WYaEGC1PojFL++IneWJacRdTXwLGx8iwG2Htj1QBDTMOYGEr778HaE4+S3tN6oXv29 XnnN6YTDi4BNYc/vT1i2eNS6Wa30g5Uiw8dTZc2WGi+imMJlUBGhHYWJeUigfAZc5s32 nOX0SBS+nhA3GSyzbzXD11qwj84SCkqQJmyBbZ6VcFD6qwci1nCTF0V4jSVhojCL1FYc lZPDn9sGERvlHNs92UUkPlTIO6bAKvI1MvGhMQgV/+3go/5QyjZKbtZoSTYhqoX9H5U7 Exig6TrMMETBOEFxKOGVTRcwzjtXQLMMVBcILGsoR70+eTt/yDjle0cdnjvkZzy58c0n dH1Q== X-Gm-Message-State: AFuF++l1RUs6bV4/7JZaDc4En/pAMagn0CX4vHnlRRSQz0wqvnUA7z1t VCGZXOmgggJ9zQtw31MqU/guHtaQyS30fnMFsjJ2rnHHVRN8Ssh5eIKNviPyMu5RbzryteVg8Tq TTxomUgk= X-Gm-Gg: AR+sD104TTscpzQuABvn89+UQINjBMqDZLUYJu6cfSAKiQ3A0q++xWi1zfbzGUfE1WI 35Zg+mYouIKvxIS51BwhAJWrOXVtd5rpXAGw6Y/HGvzzmj6kxdUnSv3HZI1ykREWl/PMUZCfuUw 3GrvVmQobFjdqmfJByOS6LNwUH3H04F6ha0p1vRBl2WcAYzkxRiPwvfz3fr1Ip6AqGmixS196GO nVogfS8TiZirMtzmU7A74tugIi4sxWAxcSIM5SwVUtVmZFztbaagM8E7FpeSG+vsr8afZL9Szin A55Bc6by5+yzePrk/D87Ftx6ts3Jzl6Iq6SB8446feJytw1dASgyvf2RVsFbJyDVRIoZfjK6qQf jdnDnFDh8cbjWNfObWGzN6N18aS+cVzsXWmYGISXIpiBJiLQ8/TXh9R844otEbWYcDZBzV2gd6C 7aDl600jX/uaNh0E28mpgmeaDy1hbjtgrpu8tbQgAySHDNA8W7SBhzjYc1LXsZ7KtxO9wHtuOmM BVYTAjz/YmQCIs0fnmDpr3ta+46d67fAT8M2RUGzQAtiBLVGbU9DILu12FtIowVL7l4B5c3D9wu D+SJSUpp2mMfq38TB4LQDQxemOENpWsHc8Jl9LEC X-Received: by 2002:a05:6000:2311:b0:47f:ddc0:602a with SMTP id ffacd0b85a97d-482b1fde11bmr9727079f8f.18.1787155073573; Wed, 19 Aug 2026 08:57:53 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:53 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 26/37] shadow: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:57 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243762 From: Peter Marko This will remove CVE-2016-15024 from open cve reports. This CVE for is for "doomsider:shadow" [1]. It will also remove * CVE-2018-16588 (suse:shadow, [2]) * CVE-2019-16110 (blade-group:shadow [3]) which can be verified that they don't affect Yocto shadow. [1] https://security-tracker.debian.org/tracker/CVE-2016-15024 [2] https://security-tracker.debian.org/tracker/CVE-2018-16588 [3] https://security-tracker.debian.org/tracker/CVE-2019-16110 (From OE-Core rev: 2a4ade3b03b92e4dd1d57ac4074a9147b2fbb220) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 2946e238d2a3947c1a51c4ac1c86c8284f68e4cf) Signed-off-by: Devansh Patel Signed-off-by: Fabien Thomas --- meta/recipes-extended/shadow/shadow.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc index 40e6ab0b30e..a308ea00d24 100644 --- a/meta/recipes-extended/shadow/shadow.inc +++ b/meta/recipes-extended/shadow/shadow.inc @@ -36,6 +36,8 @@ PAM_SRC_URI = "file://pam.d/chfn \ file://pam.d/passwd \ file://pam.d/su" +CVE_PRODUCT = "debian:shadow shadow_project:shadow" + inherit autotools gettext github-releases pkgconfig export CONFIG_SHELL="/bin/sh" From patchwork Wed Aug 19 15:56:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95808 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7244DC5DF8A for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10415.1787155075964962457 for ; Wed, 19 Aug 2026 08:57:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=pggjDasX; spf=pass (domain: smile.fr, ip: 209.85.221.43, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-47c2b362ee2so949194f8f.1 for ; Wed, 19 Aug 2026 08:57:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155074; x=1787759874; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Un7AFWwkfD3uHgfQNJNU1JqBF33xYlC0BuNAJ1xv21w=; b=pggjDasXKUrQFGsO9sT9GBJlYThGwJ3L6KrR8NphYhaeuIQ0Is+MW0TBRnkNHgcBBQ 7I2qQ8xLKhlC56HvUg3wiPfkW2GN3X+RfajcHnYjRhNHrRonkzEdXq/G2hodwq7JBh5p yHO/Zt6ab8pfeKi+aaOCnxETWAwVEabpq8umQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155074; x=1787759874; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Un7AFWwkfD3uHgfQNJNU1JqBF33xYlC0BuNAJ1xv21w=; b=D9e9QV0HybkF+hUt1MB0iY1kGiikYX9RY7KPVgGbcRMzwY8Q9aKk7ygVVqWEgoxrfu PcA/QedaNOTHcE2OKi33xN2eYYIcdZnMC7r5N4g2y0MdQN+3glW1bN2bE5nVL/H3yul2 F8ftjZBUmZ04kabdy58WbGgz7IOAl085U7997oTy4sZSeqE+7IsVwNiK/2Aq7Sdv3fAE fehED2NjL9DhleS6aR5Ysa1D6Z9kCKXx1BRIrC8oMqfpF+rZnwtQGMit2Q3J/wei2Ym2 Ym557uJxPxyMc/M92itCS5dXVS3ob7NZNcVe7AdmcYEBJ+xTWI7KlJE6c/eZKx2U9Vbh Mm8Q== X-Gm-Message-State: AFuF++l3l1E+liIYVUNhZXF3AW17b6DGN8ip3iwPR/yL3UdvCvqSd9Wh 92zFCNHuD/DAYBo+epwGs0mrVqtKCQf1Uj/vjOfqeh3sK/GkgjYEsfpvE8nCY+2/hOhBKWt0cTu M1Be+1cM= X-Gm-Gg: AR+sD117qbbWaojzCM4dOr3wTCcmwYc1rj6JTJQOInPolgBBStZg1WXpPFJg+1k3gpz mVtDGykqQ+POFk47LszHR610s9K/tplHKVc3/lLb5QhUrsXjp8LF/M3jqIApVs2SCaDVvoJtpJ3 U094LoiPhlvBnC7fyWFiTnySOnJfaJ+kaJRzGAloyYMHdCd+QJ3iwhVVi0OAqnLlH6kJBZJ9/PN 6WXgzLo9svCELbMVGAyGgJbOQwMW3iXIAX/53Uq2a0FUJFgh8njyM7Ze4KcSkDBu3/UwQh1E5yM SIOJeoSyq5e+1E3LuWVSdWOOV9P6DiELdOKWX98NJixd0oxynOm662ouVvtS4FdoXpKl4YuUnEq HOxMIZjiA+Z3GAMZMiNdKx5yukmRO4nwXWCWBF978xUp2Nqvo+ijOBHi71bKchRMgeWdrpvus4r EcR6aJDFJWhZQ+5vZiabeVnrKkGoPMAJ63+gpzEUKB+Fkf42bMjh/xeHhuwvlHTCnJA/dP0HBDK DPJW5xMO8NmNcjnrWA0bxGmmyjUqSwNNa4aJw01Iv0PbXy7ilxVNF/fCfU1fE3Iq34BClJpnA1F d5wbrpIQ/8PZqOyXI6yfqyENGdZOs2hWmzUHXnRT X-Received: by 2002:a05:6000:4b0a:b0:481:5f3c:39d4 with SMTP id ffacd0b85a97d-482b1e84439mr11461399f8f.1.1787155074155; Wed, 19 Aug 2026 08:57:54 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:53 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 27/37] flex: update CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:58 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243763 From: Marta Rybczynska NVD uses westes:flex for recent CVEs in flex, based on the GitHub repo (From OE-Core rev: 711e2864b17db92ee1f6b9cfaaa16c7a20ec8331) Signed-off-by: Marta Rybczynska Signed-off-by: Richard Purdie (cherry picked from commit 8bb6aa4b4acb16c59b66aa55b33053e3e8749e72) Signed-off-by: Devansh Patel Signed-off-by: Fabien Thomas --- meta/recipes-devtools/flex/flex_2.6.4.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-devtools/flex/flex_2.6.4.bb b/meta/recipes-devtools/flex/flex_2.6.4.bb index 52543b6e021..e424aa58e8f 100644 --- a/meta/recipes-devtools/flex/flex_2.6.4.bb +++ b/meta/recipes-devtools/flex/flex_2.6.4.bb @@ -83,4 +83,4 @@ do_install_ptest() { do_install_ptest[vardepsexclude] += "UNINATIVE_LOADER" # Not Apache Flex, or Adobe Flex, or IBM Flex. -CVE_PRODUCT = "flex_project:flex" +CVE_PRODUCT = "flex_project:flex westes:flex" From patchwork Wed Aug 19 15:56:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95810 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0F7FC5DF8C for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10416.1787155076851396055 for ; Wed, 19 Aug 2026 08:57:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=kvsFwtJ8; spf=pass (domain: smile.fr, ip: 209.85.221.52, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-47fe2d179e2so743517f8f.1 for ; Wed, 19 Aug 2026 08:57:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155075; x=1787759875; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=1nasIIslVor5G1xtUaSAT1GOHXVScZtOsNvDwXa+MYw=; b=kvsFwtJ8KgD2eI06zuh00f6FRqji9lt8PXerOSYdKgCgMvN6+bm9E/QZQZkY/E/vhi iI/bCNMa6INAuX6QJo2mJfpJcsXR9om0WQrLp+z3nF2KOFwdkYvr5oscWs40lBQt3/nT EKFNB/AY6sUkffB/R/zjFenumgzO/ZquIs2z0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155075; x=1787759875; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=1nasIIslVor5G1xtUaSAT1GOHXVScZtOsNvDwXa+MYw=; b=bAj90bAknScyySSWO5rprM/kI9x1J0KTBAdGfqAnpE0Ybab3NWcp7fwCL4ogwKQqMc f82bwnhvrM5ZlKCk+Rc1OZrpxztWt4u54HHmCzjC+7mv7bntY/cXyn+NpZkI6ANwV60V ON1krneo7b7GggAEUZ7FB+/YD1h0CHG3ud5QacxfHhzGLTHO/0D/8vo5p8tbw6Y9QU3X 015OTyoZZhYn4HGwo8xiXlF1+S5gApUrSSf/zF3VY4FNqI0ofScluQmlokzIMJmRelHT oYqr3dBt+7QADZP+abU33WXwZteeTc2NzvqlBOJREK7RovIZYGpoASjNFQrSuATZb4B5 f86Q== X-Gm-Message-State: AFuF++mkSGaeVpUbZu1U1UNDgKpmxLPISsBH9YemsXQCBy59XRgH5eMW qZHL7OqOe8F5FpQZkaxGUjbaTdoysWFmV5Lfu/+Hx8vz2c4V7RppDpqtS8GVW4fMOA4Km7/9m9d HWe6kEB4= X-Gm-Gg: AR+sD12CIB8dWAyWCV2W3c09qkB4xfsd6U2yda8xCsBqD5uc+aSPuJERe0ANyK3hDG+ cZZYFM9lW1EPkAUHlYdWsrrY2ChCyv5HdEre+DTrwPZAxisOYPgY1QZisREStaI+j26cIMMfXnW HQOhFPFreLetSVYD8VLPdBIJw5/z4eQPx8FaeSmKW6B6oUIFCYjQIp3mKcAvVcxGT7KAMMVF4TJ aJXLhD153H/W+kGuKdyhjXclz9mqjyrzrVR0VuK8HoLafNAHOssFQSe6FLUFAZ5YEn7MackuuOg dawYnXJOntWr6mrGSStkG0XlqtBg251KVURMBgS7QaxDoDfr427k4Lg4276BqsJOtWIrLB00l/P oFXn1Md2J8ZcLzDVUU4hpFSzru5WCnqHZ1tREZhT4brhC/ptbaIGuLS6J+YH9DplbgzmTavhyTJ H00aX1WSNrlsEZsyLTMRJx9pvnw0OAf09AXNQ7BwTvE1TnlhwJ/1H0nRltiBOR5FyEmPwTGPRka VCgTf9ltcUpiD89o3wYvAZTQTmWOovWlvmZO28/I7HaMoRJYpMbqvGy8es4Eqg9E34qkJj1kwsb bjKexgLigoh4M8xt30iKSjPlTxwysqo5bewm+OQf X-Received: by 2002:a05:6000:2902:b0:47f:90cb:630c with SMTP id ffacd0b85a97d-482b1e977c9mr9793608f8f.8.1787155075083; Wed, 19 Aug 2026 08:57:55 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:54 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 28/37] sudo: set CVE_PRODUCT Date: Wed, 19 Aug 2026 17:56:59 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243764 From: Peter Marko This change removes currently open CVE-2025-64170 and CVE-2025-64517 from reports which are for "trifectatech:sudo-rs". It also removes following "patched" ones: * CVE-2023-42456 (memorysafety:sudo) * CVE-2025-46717 (trifectatech:sudo) * CVE-2025-46718 (trifectatech:sudo) All these are also for "sudo-rs". (From OE-Core rev: 00c2ea8cd0c1e1a1f841b8af0bacc6b9c179973a) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 0459398d31f74e9653cb55a57d8d0f6bfbdfa2ad) Signed-off-by: Devansh Patel Signed-off-by: Fabien Thomas --- meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb index 90672ed7afd..69bd654d08f 100644 --- a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb +++ b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb @@ -10,6 +10,8 @@ PAM_SRC_URI = "file://sudo.pam" SRC_URI[sha256sum] = "4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb" +CVE_PRODUCT = "gratisoft:sudo sudo:sudo sudo_project:sudo todd_miller:sudo" + DEPENDS += " virtual/crypt ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" RDEPENDS:${PN} += " ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-limits pam-plugin-keyinit', '', d)}" From patchwork Wed Aug 19 15:57:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95813 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C54ACC5DF8D for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10419.1787155077556251588 for ; Wed, 19 Aug 2026 08:57:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=hznhUBMj; spf=pass (domain: smile.fr, ip: 209.85.221.46, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-4799b3f7c83so775705f8f.2 for ; Wed, 19 Aug 2026 08:57:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155076; x=1787759876; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=FQBSjT3UfPZYzd9GSETT8WOCf9LYB8xINzjQypcO3z0=; b=hznhUBMjfLqayPcwJrR60jIDl3azU6YnkpVS9GyE/MhP7TF491Gd5W4thpI8u849yB kueaTNW1Nn/LTGHO5D8G9uN/HLV5NASf3A8yPTTMDYwhVEhHlXeU2OvAsJT9PNlmlviZ NbX1Sn6Y1aN8zdKikn+Eg6roOXqECQ3dVuuiU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155076; x=1787759876; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=FQBSjT3UfPZYzd9GSETT8WOCf9LYB8xINzjQypcO3z0=; b=K18YRQmN/plO540xXWzx/vt22woNClCuLvpqwPuBO2PGry0yPipjvUM4TFsnFCYwoM A12bbV0oZByuSkH5Qe3FvRt+laQRlFUIYjophGrXiApdpS6ORAYhZ6OZBAlItvcvLCyf 4DoZXZJ+2RngAqdWihxqKtYD4wXOax6l8OqzzPbgkWzI0ti5EJCdTLgDuCxQ5WRjOUrT ddHlDlQLNOpWNrKNDsMr3CHzMG9H2e2r/TvPVp38JQtow/f3wrnB4CbCCf800EXMEROS YnUO8CpKcnNsHbVGpDFpp40GfO9DGLb3jbbChRkfvdj8jqonbg/ljWt+aoTE1IeJimye QTLA== X-Gm-Message-State: AFuF++nKA9Z3/SqKj0vG6DxAjSKpyCFAhV0LicPdb0uYbeqch/PHdgyb glqYyzYoef5ShLSLY6fgXHifdq41GVyn9xz6bh0EUGpgmBwZlrAU1ihCgS7hh3hdqceOpAIcnuh fy/A+VIE= X-Gm-Gg: AR+sD12b62z0gs8Kb4GvnJZ58Q1yKxHlRIrw7UhKCJlUQns/uUuV9be21/x4c1Phfb+ liNfBSePAH16KthmHdGmJuGQmgCcaQXUtsmqK6n9DSoAYAlGJc3xosL4nSzFb5OWQTUKnrBYoLo ZrhbtI+znCLdguP/WV85gisxeBsXOG7nHnDeVUFUCuNE1MfVAFFRyw6OYwTeY2rVXjZ3etQk8ca wOOR0NYQeZ+BgePYFBss1Ft0yT2uh1+R1lKWMpPXHpScP5PuME+Zz6xI9XPDvIb1YmHsmitOHSD LzKFKDzSPuozOw1p820K7D6P4nkrBxZFMjwcO51Qil46bnQtm5zsAKqOKxlht3exnCCldPYXrJD bFDs0wEsUr7ZNmnG47ehs2a4laBIn8kMT7vXSE6BsVCTe/AOs20judxByDd/CsDsi+N7nwmOpZu SBmD5f/Do9NrskPSnD5FAYM9/xUCPaZDtzjslC3cctXE5SZoUUX4b8vLsC4ZlMUWM15ZP+geOKr COY/O6lHkebHEkk8Xjx8cbc9GD4raNsCalnxUHKFUseVbOubGUWqs3td3P5PWu0Ek29MNJRmMjo 6uIXVx2JgMe5FX2A8SZmvdnnUULjP+0g7wFUS97W X-Received: by 2002:adf:e19c:0:b0:47f:eb4b:75f4 with SMTP id ffacd0b85a97d-482b1fed35amr10588722f8f.21.1787155075639; Wed, 19 Aug 2026 08:57:55 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:55 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 29/37] perf: drop newt from tui build requirements Date: Wed, 19 Aug 2026 17:57:00 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243765 From: Alexander Kanavin As the comment says this was used by very old kernels (pre 3.10), and slang has been the only option for a long time. Also, correct the option to disable slang TUI. (From OE-Core rev: 9a9d894ddcb619a86d63b25cf7d3f4cb2cf3a5a8) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit a36a84490b943e6f0638c0430ad1eac7740e9be3) Signed-off-by: Shinu Chandran Signed-off-by: Fabien Thomas --- meta/recipes-kernel/perf/perf.bb | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/meta/recipes-kernel/perf/perf.bb b/meta/recipes-kernel/perf/perf.bb index 2d432f3f40f..a4bc3c1319f 100644 --- a/meta/recipes-kernel/perf/perf.bb +++ b/meta/recipes-kernel/perf/perf.bb @@ -14,10 +14,7 @@ PACKAGECONFIG ??= "python tui libunwind libtraceevent" PACKAGECONFIG[dwarf] = ",NO_DWARF=1" PACKAGECONFIG[perl] = ",NO_LIBPERL=1,perl" PACKAGECONFIG[python] = ",NO_LIBPYTHON=1,python3 python3-setuptools-native" -# gui support was added with kernel 3.6.35 -# since 3.10 libnewt was replaced by slang -# to cover a wide range of kernel we add both dependencies -PACKAGECONFIG[tui] = ",NO_NEWT=1,libnewt slang" +PACKAGECONFIG[tui] = ",NO_SLANG=1,slang" PACKAGECONFIG[libunwind] = ",NO_LIBUNWIND=1 NO_LIBDW_DWARF_UNWIND=1,libunwind" PACKAGECONFIG[libnuma] = ",NO_LIBNUMA=1" PACKAGECONFIG[bfd] = ",NO_LIBBFD=1" From patchwork Wed Aug 19 15:57:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95818 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DEC79C5DF8E for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10420.1787155078203004376 for ; Wed, 19 Aug 2026 08:57:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=BXleB6Lb; spf=pass (domain: smile.fr, ip: 209.85.221.46, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-47f84023916so1112878f8f.3 for ; Wed, 19 Aug 2026 08:57:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155076; x=1787759876; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Hqbh0iIuU7sAkAVoIISf8faeVCGLgeDwl7/FAumSiVw=; b=BXleB6LbJFVvjEPuFVK3m5mRHZnSiDuwMGgdCsAEuEKUUaC2V81+Q/1BaYGABdpNEp Znx3356VVpkO8dSfGK4MMr8YMCLyfE3q2uWY3nme14BmDRoLsSdXVpmAyfw1kP3Jnqlc IF3xFc7D21O8HWWHRcczoFQee73EHhnIZwKo4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155076; x=1787759876; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Hqbh0iIuU7sAkAVoIISf8faeVCGLgeDwl7/FAumSiVw=; b=hLVtsxC2TmteBtV8L/ltK80a6MqElCu6Hf2QI3uUISXPFf+mdHnaocxEnqAyEkW47I bC6NfigDBE/irn0fflQf7qg58J1AlUTLX3Z7eDrvsfM9YKj9d7yiC2Lklpb5kB9Scp3y lmGx2Tz6Sx9qdCOsU+P2s7gVJKz8/pEN5DVEC1RCrrFN3J1Rx6K9vtg0ezQkP5H1YOHv SSPswWOdR8672tO/y3kkvPxPJcBpHqteHN7irvLrcy2KcR9ZzklPh1igSYjM0YvjX/S1 DT6NKQYZX4lqK10WLoxunmRS8aJVwCMcTPUZXeho2nzY1NbfDUxG9/e6a5dP4FD9/bU3 NG/A== X-Gm-Message-State: AFuF++leTz0z4Ib8ungmQhyuIInMH3wJO463pkN/aW0KxbXqRF1GRAYr qz6Dt3PBlF5c/Vh+veP34VgtYeZifCHKCcHm21FE5AskDH9+YVbEkPU+MHwK1O6/M3pdlCAUMzF SL7nr6Kg= X-Gm-Gg: AR+sD10BTo7JBsQk81tVRBfbEXaValpho8ytMMzqtJbmC8cG8z3F0O3coxZgaQV3E/9 dPNvnLdLrhc9FP2QMane9IL2uvA2QIUxqHRi3t0UtnbsYMefj/dl64MHK0lPLNIUThQ7NigmS4H NRtsmT4C/I4+ehFZ79MF/fvtoYHscyW+LjyeNy7pZBT4u4+UHuhWOSA1xUMQwzAysjtDRgYGiDy WWYKTamJ/JPPOmonusHk/VKXsUz6QYwHkvl8rt30EsJrzR277OZcwpDRx1PJIJ1BEYnMg7/l+vk TGkeCx3n51CF1kZx3ZfxsnkbA6uMt5rZrXUefk7k5r07Uz/4JGYH7vZSMlYoQu7/l2ZoYaswuQp WvUeRksM3HlY/GMXBVyir1BpMMxG5Ub4OzXhUFolHwI45Az0M44rnntgd0kFJqg7VnsalKYD3KK 5kdKRylK+dzZAl268ec2/tYOMjH1boZR3HnoDi4v5nc5C8C/PoUFD493FEyKHBeNnA2kb3hXEuu ad86Tsta7goEVobzQ2xwRtiXg6Yh7E/EI40gl+4txDYzH5hnrzzBlNRREHbvC0m2gwbN7ByL47l Ww97OwjK0F70RfJCCbBo/thxotXJkVR8Yw1TfuEK X-Received: by 2002:a05:6000:2881:b0:47f:97e9:fe60 with SMTP id ffacd0b85a97d-482b1fd9579mr10146618f8f.15.1787155076277; Wed, 19 Aug 2026 08:57:56 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:55 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 30/37] busybox: patch CVE-2026-38754 Date: Wed, 19 Aug 2026 17:57:01 +0200 Message-ID: <4ee0e9afaf64cfe2db1fe4ccbd344493974ea65e.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243766 From: Peter Marko Pick patch which fixes this CVE as discussed in [1]. [1] https://lists.busybox.net/pipermail/busybox/2026-July/092392.html (From OE-Core rev: 052fef5679987d726e40c8a87f0bf019f3833149) Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas --- .../busybox/busybox/CVE-2026-38754.patch | 155 ++++++++++++++++++ meta/recipes-core/busybox/busybox_1.36.1.bb | 1 + 2 files changed, 156 insertions(+) create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38754.patch diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38754.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38754.patch new file mode 100644 index 00000000000..d263d72d9f3 --- /dev/null +++ b/meta/recipes-core/busybox/busybox/CVE-2026-38754.patch @@ -0,0 +1,155 @@ +From a448b6d5b21e5b21249391389b6f0551d9bea136 Mon Sep 17 00:00:00 2001 +From: Sanghyun Park +Date: Thu, 18 Jun 2026 17:04:20 +0900 +Subject: [PATCH] ash: fix out-of-bounds read in ifsbreakup() + +ifsfree() does not only release allocated ifsregion nodes; it also clears +the global IFS region state used by ifsbreakup(). If argstr() raises an +error while expanding an argument, ash longjmps out of expandarg() before +that cleanup runs, leaving stale IFS split offsets behind. + +A later expansion can reuse the stack for a shorter string. ifsbreakup() +then sees the stale IFS state, trusts the old offsets, and can walk past +the current stack block before dereferencing p. + +Follow dash's root-cause fix: when an expansion-related handler catches +EXERROR and continues, restore the handler and call ifsfree(). Apply +the cleanup to redirectsafe(), expandstr(), and evaltree(). + +Upstream commit: + + Date: Mon Dec 5 23:02:01 2022 +0800 + expand: Add ifsfree to expand to fix a logic error that causes a buffer over-read + + On Mon, Jun 20, 2022 at 02:27:10PM -0400, Alex Gorinson wrote: + > Due to a logic error in the ifsbreakup function in expand.c if a + > heredoc and normal command is run one after the other by means of a + > semi-colon, when the second command drops into ifsbreakup the command + > will be evaluated with the ifslastp/ifsfirst struct that was set when + > the here doc was evaluated. This results in a buffer over-read that + > can leak the program's heap, stack, and arena addresses which can be + > used to beat ASLR. + > + > Steps to Reproduce: + > First bug: + > cmd args: ~/exampleDir/example> dash + > $ M='AAAAAAAAAAAAAAAAA' + > $ q00(){ + > $ <<000;echo + > $ ${D?$M$M$M$M$M$M} + > $ 000 + > $ } + > $ q00 should be echo'd out; this works with ash, busybox ash, and dash and + > with all option args.> + > + > Patch: + > Adding the following to expand.c will fix both bugs in one go. + > (Thank you to Harald van Dijk and Michael Greenberg for doing the + > heavy lifting for this patch!) + > ========================== + > --- a/src/expand.c + > +++ b/src/expand.c + > @@ -859,6 +859,7 @@ + > if (discard) + > return -1; + > + > +ifsfree(); + > sh_error("Bad substitution"); + > } + > + > @@ -1739,6 +1740,7 @@ + > } else + > msg = umsg; + > } + > +ifsfree(); + > sh_error("%.*s: %s%s", end - var - 1, var, msg, tail); + > } + > ========================== + + Thanks for the report! + + I think it's better to add the ifsfree() call to the exception + handling path as other sh_error calls may trigger this too. + +function old new delta +restore_handler_expandarg - 33 +33 +evaltree 725 711 -14 +static.redirectsafe 141 124 -17 +expandstr 262 242 -20 +------------------------------------------------------------------------------ +(add/remove: 1/0 grow/shrink: 0/3 up/down: 36/-45) Total: -18 bytes + +Signed-off-by: Sanghyun Park +Signed-off-by: Denys Vlasenko + +CVE: CVE-2026-38754 +Upstream-Status: Backport [https://github.com/vda-linux/busybox_mirror/commit/a448b6d5b21e5b21249391389b6f0551d9bea136] +Signed-off-by: Peter Marko +--- + shell/ash.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +diff --git a/shell/ash.c b/shell/ash.c +index fb887f31b..b8ff67b16 100644 +--- a/shell/ash.c ++++ b/shell/ash.c +@@ -5480,6 +5480,7 @@ stoppedjobs(void) + */ + /* openhere needs this forward reference */ + static void expandhere(union node *arg); ++static void ifsfree(void); + static int + openhere(union node *redir) + { +@@ -5909,6 +5910,17 @@ redirect(union node *redir, int flags) + // preverrout_fd = copied_fd2; + } + ++static void ++restore_handler_expandarg(struct jmploc *savehandler, int err) ++{ ++ exception_handler = savehandler; ++ if (err) { ++ if (exception_type != EXERROR) ++ longjmp(exception_handler->loc, 1); ++ ifsfree(); ++ } ++} ++ + static int + redirectsafe(union node *redir, int flags) + { +@@ -5924,9 +5936,7 @@ redirectsafe(union node *redir, int flags) + exception_handler = &jmploc; + redirect(redir, flags); + } +- exception_handler = savehandler; +- if (err && exception_type != EXERROR) +- longjmp(exception_handler->loc, 1); ++ restore_handler_expandarg(savehandler, err); + RESTORE_INT(saveint); + return err; + } +@@ -9435,9 +9445,7 @@ evaltree(union node *n, int flags) + trap_depth--; + in_trap_ERR = 0; + +- exception_handler = savehandler; +- if (err && exception_type != EXERROR) +- longjmp(exception_handler->loc, 1); ++ restore_handler_expandarg(savehandler, err); + + exitstatus = savestatus; + } +@@ -13444,9 +13452,7 @@ expandstr(const char *ps, int syntax_type) + result = stackblock(); + + out: +- exception_handler = savehandler; +- if (err && exception_type != EXERROR) +- longjmp(exception_handler->loc, 1); ++ restore_handler_expandarg(savehandler, err); + + doprompt = saveprompt; + /* Try: PS1='`xxx(`' */ diff --git a/meta/recipes-core/busybox/busybox_1.36.1.bb b/meta/recipes-core/busybox/busybox_1.36.1.bb index 7929d396c85..60796de9ce2 100644 --- a/meta/recipes-core/busybox/busybox_1.36.1.bb +++ b/meta/recipes-core/busybox/busybox_1.36.1.bb @@ -66,6 +66,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ file://CVE-2026-26157-CVE-2026-26158-02.patch \ file://CVE-2026-29004-01.patch \ file://CVE-2026-29004-02.patch \ + file://CVE-2026-38754.patch \ " SRC_URI:append:libc-musl = " file://musl.cfg " # TODO http://lists.busybox.net/pipermail/busybox/2023-January/090078.html From patchwork Wed Aug 19 15:57:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95809 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A529C5DF88 for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10421.1787155078770020733 for ; Wed, 19 Aug 2026 08:57:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=skEWhBae; spf=pass (domain: smile.fr, ip: 209.85.221.54, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-47f6609c657so566847f8f.2 for ; Wed, 19 Aug 2026 08:57:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155077; x=1787759877; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KlN0UGFNmi0ipXilab14FMWkIkJ6HF1XLrLB19fdFYc=; b=skEWhBaeSlMTf+8mTydio19KzTD3utui+XpltjhL1LTBb1wQw1Igf8wx++wuv3WE3j ESj2bW9Nb9HI5XEHirtNi+0yP8MSl9ZAFTzHfpXpN/APRwJaqm2+NdEu7+8HLESgDHe5 +4zVrLco/erxnl3wFwmCa8rKSnHAVI+3Jgu9k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155077; x=1787759877; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KlN0UGFNmi0ipXilab14FMWkIkJ6HF1XLrLB19fdFYc=; b=lyclddmxFJOePHyNHZI5hkfI+8FYUkiNGwr4V/E53bCViyxqALTQ5Oakf6k0Q4rdSE wO4rc6sSPQoqo3JTwtfU9qxd7KU3rDAIeugwdgnffttYEz1yKF+P/42JpG0NlnlDnuVD /BHfBujUam3t75CXG8L6bAOFB/rmrgRql++cQFMcCeUprD84oCumkFmVB8nH/HhWs9ap g4HdKntcjP7xTyg+CyjTZPCZE/v3IxsyxaYcOJjNMPXt/yO/7T8h0q9psPnN1Wn4jDXK MNLahazd/JJSqceTfN1obGRCuiXMG81C+Ir49rwMJxDxs/wFADksIA+TTXo6nGXYCag7 WuRg== X-Gm-Message-State: AFuF++luJc9mXAuxJJYvlkmZcvS09B8ADYkV/CXM6hAvcCX+RLamMkCv jOSwvkM3kCCI4m1GjASOCQJiuHmEcUnh6cNVMmMRFQI4YHYxiH1LFuRmHOoEGrUL5h+RVu8pE9G 8+8YTB48= X-Gm-Gg: AR+sD13y7nj2sAgWkjBV1IiBAWWV8d9JQTv1rEMcOARekq+8jvFBjilFKFSxK9oPAI5 ayPE2yZ/JGSdNLa8Nw1bGCkdfU1b43lOEfVLEsAx7qU6tO0OJ2YSD/0wxNNPSZkkHjaVM4NSaaU Wu8r80nOhkbWJGs2pULTdgxvjTIo728no1719oAkbAgALVqKMYgN+b8qDdsFoVl7ljASkJLz6tY UwGZwY5Ka/vmpbx+WXVV9OZBDyIxXZ4znXw35jaeDeEb+uMhmk0ajtNk5H4nS/9HDcymamawMov 2IYZt09g6c1HQv0haUimj42q1t/5Mxnk/yfPOTHWPQ/kLNCgKb81/IrK6a5llgsAiNnkpNcVtdV xPeLa6HCVtX6wOrB8jpGTluaIiY+A8D8H0XDP1l5R5h9YzV7Zqb3b1/BPcmZ/UV8H/Mb553oaGx vt0RnuxtxeMfEz8JTr9MLwbnc5n6VK8ClUcJBeTdg4VfwWc1wo+kV5TWomCiPNv0XvjDOgN6rRz Topfud+xnGJB2Q2+30r+xWTGg1E10U5PPgkVo1EQIPFA8yVGbbBUwTM2Q0fvlHjhsb1hZoh79Iu d+yYpmenpa6y5j1w2oO21VEHLTrT/V+tO+4ntOySsyU3OY8N09k= X-Received: by 2002:a5d:59a7:0:b0:481:44e5:160c with SMTP id ffacd0b85a97d-482b1e8632emr11535302f8f.2.1787155076827; Wed, 19 Aug 2026 08:57:56 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:56 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 31/37] curl: fix CVE-2026-4873 Date: Wed, 19 Aug 2026 17:57:02 +0200 Message-ID: <7262ee606d93105b8062d8b945f6f2087e45c678.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243767 From: Deepak Rathore This patch applies the upstream backport for CVE-2026-4873. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865 [2] https://curl.se/docs/CVE-2026-4873.html (From OE-Core rev: 2dadf65eab0db85eed6bc250753baa0d5ab78660) Signed-off-by: Deepak Rathore Signed-off-by: Fabien Thomas --- .../curl/curl/CVE-2026-4873.patch | 58 +++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 59 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-4873.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-4873.patch b/meta/recipes-support/curl/curl/CVE-2026-4873.patch new file mode 100644 index 00000000000..bc6268da7d0 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-4873.patch @@ -0,0 +1,58 @@ +From a7e6dd14ee3900226066819a0334defb58c52486 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Tue, 28 Jul 2026 04:35:55 -0700 +Subject: [PATCH] url: do not reuse a non-tls starttls connection if new + requires TLS + +Reported-by: Arkadi Vainbrand + +Closes #21082 + +CVE: CVE-2026-4873 +Upstream-Status: Backport [https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865] + +Backport Changes: +- Upstream adds req_tls to struct url_conn_match, sets match.req_tls in + url_attach_existing(), and enforces it in url_match_ssl_use() when a + clear-text requested scheme is matched with a candidate connection + that is not actually using TLS. +- Scarthgap curl 8.7.1 does not have struct url_conn_match or the + url_attach_existing()/url_match_ssl_use() split. The equivalent reuse + matching still happens directly in ConnectionExists(), so this backport + keeps the same state in a local req_tls variable derived from + data->set.use_ssl. +- The rejection check is placed after the general SSL compatibility + check and uses Curl_conn_is_ssl(check, FIRSTSOCKET). This preserves + valid implicit-TLS IMAPS/POP3S/SMTPS reuse while still rejecting a + clear-text STARTTLS-capable cached connection for a request that + requires TLS. + +(cherry picked from commit 507e7be573b0a76fca597b75ff7cb27a66e7d865) +Signed-off-by: Deepak Rathore +--- + lib/url.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/lib/url.c b/lib/url.c +index 30f215f..c4c5982 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -935,6 +935,7 @@ ConnectionExists(struct Curl_easy *data, + /* plain HTTP with upgrade */ + bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) && + (needle->handler->protocol & CURLPROTO_HTTP); ++ bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; + + *usethis = NULL; + *force_reuse = FALSE; +@@ -1052,6 +1053,10 @@ ConnectionExists(struct Curl_easy *data, + /* except protocols that have been upgraded via TLS */ + continue; + ++ if(!(needle->handler->flags & PROTOPT_SSL) && ++ req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET)) ++ continue; ++ + if(needle->bits.conn_to_host != check->bits.conn_to_host) + /* don't mix connections that use the "connect to host" feature and + * connections that don't use this feature */ diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 7d55f72b03f..c0e5e8f2725 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -42,6 +42,7 @@ SRC_URI = " \ file://CVE-2026-6253.patch \ file://CVE-2026-6429.patch \ file://CVE-2026-7168.patch \ + file://CVE-2026-4873.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Wed Aug 19 15:57:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95817 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E169C5DF92 for ; Wed, 19 Aug 2026 15:58:03 +0000 (UTC) Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10422.1787155079558586557 for ; Wed, 19 Aug 2026 08:57:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=j6UuMMmT; spf=pass (domain: smile.fr, ip: 209.85.221.51, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-472326ca506so815973f8f.2 for ; Wed, 19 Aug 2026 08:57:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155078; x=1787759878; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=j7l81iDrTnHNiIUXaQdYKKwnMpu7rJdAzdWQtq4wp+s=; b=j6UuMMmTZnmAVIvql+a2g/SE66J8VKnQMgVQxk6yb8ulA4KQ3QbCgzOT47O1qbZNJR I/O827vIIJ1gMLXhMXkbEH2O2tGFlBWVYlY2sAszyd/P/p5Xr+rq8YOg6oyK36XEfHYz V1qZ3dyBkJCnYJ1mSUGr0fU15rnQGw/ClQwK4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155078; x=1787759878; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=j7l81iDrTnHNiIUXaQdYKKwnMpu7rJdAzdWQtq4wp+s=; b=HW60auk558VU2UwnU+XvDxro//YNXItSOeqxEzrxq8jRS6uDyoM40uBMA1l6nG/Rkh YUTX8pdkANtCSOFuYpOnIsl8JvivykF1cWYwOiQlRovQcyOqOHLpFycZvDy419Bq5yrG V3GqlGXDrhITkHRIfbJHtGDtNk8GlShCl4uQP/jGax0t1dm4eyNcXX+8VYL5pEdK2t/F fQe5R46vFLThd7WduSjyT+qvyext5eHBSmscAxDCiYtk8X4i95D60ARUPMVXI3ztW2W5 H6Dw9YYKvEXWv2lf5Y6wxiggCglxUdOikhTYCBlr9FbFf/Ouxa3qVhR1wcxz25plGPso 2jdw== X-Gm-Message-State: AFuF++kMJPut4ajH7NPGrYUD/QmLcCN4+2IuR4/CM3KHvrCHOnlXocd7 3spVvWPxTpVxW/hF8rk9vI0mYrKg0MrdL8+ucMUJCm1fkR6dFNEKFNrmyi/EmJHs6Q7/mh6CUHR QVqNQTlE= X-Gm-Gg: AR+sD12uhu1IPV2BiSRCDAYhR1jXDKOUJIwahKkP7x7YcDM7PH8o1t11yqSx+WfkcMm KsOESIGZDdts217fU5iqkMxzfcHM8UhpIK2BEAGkOEEpfPMzJDTw/ePgVB2vWxvZ1sMFyAUPJUu LUWQ0++8CUHAHkmSqbKuSwzH7s4SI9Kql0zx3qWQVUw+Wdyabf3IYqRG1D4Z/LemKAqormBx7SF E1sEs/A9/scSaJcefX346zFpBDZFbOUlS6+0w+xIUbzcpxkWtptiFVYXnIRmasoSHGY/NgOTyhE JXlj28NKqQtuR04aBgcXnThF/EG8Orp2LKna53VYmrVi9ATQrX2Rh7mmDkITYASO7ZEKM+XXeMk KRzFmQAq99uzKhLZmQffi7n442CcD+SESnfY9Fu7YiN3exr7XB3B91r4e0wxDhqpJSWF4NmF/+s qBhxhKG0Ly1xlaRZp8wAJuibwrudWOJNRSXkwhWDlJTXkPqYFl1rQHjqqpXLKEnWGCe2SfWbMqv LciAWFPlpVdY7YydflvA0lfAmpbYLdSsjqpXF/mkhW9sMgduJxzGF7UhUj1Wchp+iOXST3Wl4we JM+FcK/XaJ0nBLiIqt+gcTSb3EwUtYabogBLzZwk X-Received: by 2002:a05:6000:715:b0:47f:86d5:d1d7 with SMTP id ffacd0b85a97d-482b1e957b9mr11787851f8f.6.1787155077700; Wed, 19 Aug 2026 08:57:57 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:57 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 32/37] libssh2: fix CVE-2026-66032 Date: Wed, 19 Aug 2026 17:57:03 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243768 From: Jaipaul Cheernam Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66032 https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 (From OE-Core rev: 19f03bde8988ecff900d2c6f12fb93db84a6d48c) Signed-off-by: Jaipaul Cheernam Signed-off-by: Fabien Thomas --- .../libssh2/libssh2/CVE-2026-66032.patch | 36 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch new file mode 100644 index 00000000000..15a52664853 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch @@ -0,0 +1,36 @@ +From 352341aaebcf91ab16e7fcff158fef4a3b8c32f6 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Tue, 4 Aug 2026 12:32:31 +0000 +Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180) + +Set data to NULL after freeing it to avoid dangling pointer. fixes +GHSA-px3w-7g75-hg7w. + +Credit: VladimirEliTokarev + +CVE: CVE-2026-66032 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0] + +Backport adaptations: +- The upstream fix uses SSH2_FREE() which was renamed from + LIBSSH2_FREE() in newer libssh2. Context adjusted to match + the 1.11.1 codebase (different line numbers and surrounding + function/macro names). + +Signed-off-by: Jaipaul Cheernam +--- + src/sftp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/sftp.c b/src/sftp.c +index 6ede3111..793f267c 100644 +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -1279,6 +1279,7 @@ sftp_open(LIBSSH2_SFTP *sftp, const char *filename, + "got HANDLE FXOK")); + + LIBSSH2_FREE(session, data); ++ data = NULL; + + /* silly situation, but check for a HANDLE */ + rc = sftp_packet_require(sftp, SSH_FXP_HANDLE, diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 1b281e62966..260f06204df 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -16,6 +16,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-1.patch \ file://CVE-2025-15661-2.patch \ file://CVE-2025-15661-3.patch \ + file://CVE-2026-66032.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Wed Aug 19 15:57:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95811 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D2E8C5DF85 for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10335.1787155080154606378 for ; Wed, 19 Aug 2026 08:58:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=q0JDe1j9; spf=pass (domain: smile.fr, ip: 209.85.221.48, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-47362928f65so1096134f8f.2 for ; Wed, 19 Aug 2026 08:57:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155078; x=1787759878; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=wbe39KXP8JULG5EJIN8EbJ6sJkKciwCIES1gbYQQuXA=; b=q0JDe1j9500BBe/Rumlw/20WYamUS9FsLtOB15bzFS8jircYQ5lwDeANfspqTqr2Ye AwYtrid69Vsjy+gdNvXtPB4LDAZTaY3L260yUh97cfCVpa88ITyB4WIGG8i7ND4CdiRJ yBeMPWx4gjAbtdJxog4RGDE6yxy74qEsnrFes= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155078; x=1787759878; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=wbe39KXP8JULG5EJIN8EbJ6sJkKciwCIES1gbYQQuXA=; b=aBszUGwcjlQVL1bZrzqA8fi1OiQnKZP9Xwlfs5HXqdmv0TKth0Co1gPNOilMLlTaxO Zr9RC47Xxuzj/5nx1u/yinqFmNAneQ0nzQMaVaijctiludoq0D2VUV9Yil80iqwPWZNZ xjl0mzBw0pdQTMJlgTqC4hDo5U5i39L5QXQx+RkdzZdUpHnnDX8E4Y13YJ0jPkr8fiym iawSy+kvyQehsof1wJXvfmib4NMYRWSbUxxeYe0SlWq6mAz7HqcoCQRFuDM13TXNj+bF ZS4Gw58Huow6cgiD8MMJQ8MZ6gpSs5B6tUGgntdCfgU9uwja5QWUhrbyrVybJcoX7UP/ AiDg== X-Gm-Message-State: AFuF++mJJ3tUOIOmrQJsmljXMQkKJaoSLN2K73IUl0T6BJod1VsH/Pc+ 8V+qhHE/28gLfNrMFYJBBeX9fPe5dHnD4adQuxIrpkVhF/l7Pexjk42E3NB7IXQujPU3IDQYC7L ZAjOLUkA= X-Gm-Gg: AR+sD11v8LTl264IeVIxh5GovZ7HrVA9aEUeQ1uqfBJB9ygTt2qJvHLaxgK9YqeNo3o cgRsIruOsoTG+eMJy+8AvTwmXWmcqfjTXWas/6s88PEfwuEXjGKwyPRaEN33W6YRVLnkxOafGEz DvLMOo3wfy5QEccDjSRzvxXJfOHx8svLsRfKICpor7Nh32t/LlrBqSmg+h8+vWRx0QEeLQL63Yg ODgJsiaHOT2xXby5gAY2JkVxqBoC5eRCFzNPj7l4rrjkEPMCU1jwe3H/P0HYRB3/oJyGkswz2LJ 3RKUkp89MEPEyx5TFBjoBfrmk/8Fs97oQCVMIDm34ht5a6cl8j4NNYq1v4sWO1rFRI1YRJ20nJ/ RHVVT/MXNBqcHRUMe+9q0v3nHC05VXJbe25UEgFxp7JChRfntghaq9UKqxAz7JYnZGapRjZkcrW 1nyohZA/iYuO2IKNW1106KdS6styytu689oBF+xWMczwIp1cMG/XLu2cm0N3x65a8j/Z89LtQEx R75gmslErGgFu0tRNCK0vJBa33IwEbIU2iGjVAUzcXkyKKn77AaNg3P6a2LNNYnr08aAChSDF1f 96sobVYvL6v3/tXKOWhNYuxEXnhquhkHLhW0VJnFwvkS58pJTFs= X-Received: by 2002:adf:e19e:0:b0:47f:9254:d453 with SMTP id ffacd0b85a97d-482b1e9828dmr11439543f8f.8.1787155078447; Wed, 19 Aug 2026 08:57:58 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:58 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 33/37] libssh2: fix CVE-2026-66033 Date: Wed, 19 Aug 2026 17:57:04 +0200 Message-ID: <097dde8d577a42b5bff43985eddbbc5c994aef84.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243769 From: Jaipaul Cheernam Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66033 https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 (From OE-Core rev: 172d606e76f116377df822d94ffb0f9064e57b17) Signed-off-by: Jaipaul Cheernam Signed-off-by: Fabien Thomas --- .../libssh2/libssh2/CVE-2026-66033.patch | 45 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch new file mode 100644 index 00000000000..bb046a6eae2 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch @@ -0,0 +1,45 @@ +From d1b6996c3b31ce6b60d5a820ecc33880e61ef0ae Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Thu, 23 Jul 2026 10:32:04 +0200 +Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in + `ssh2_cipher_crypt()` + +By applying two bounds checks to non-debug builds. + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-c4f7-cvfc-33j7 +Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 + +Closes #2401 + +CVE: CVE-2026-66033 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6] +Signed-off-by: Jaipaul Cheernam +--- + src/openssl.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/src/openssl.c b/src/openssl.c +index eba05031..28ae1cc0 100644 +--- a/src/openssl.c ++++ b/src/openssl.c +@@ -1042,13 +1042,15 @@ _libssh2_cipher_crypt(_libssh2_cipher_ctx * ctx, + const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0; + /* size of AT, if present */ + const int authenticationtag = IS_LAST(firstlast) ? authlen : 0; +- /* length to encrypt */ +- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; ++ unsigned int cryptlen; /* length to encrypt */ + + (void)algo; + +- assert(blocksize <= sizeof(buf)); +- assert(cryptlen >= 0); ++ if(blocksize > sizeof(buf) || ++ blocksize < (size_t)(aadlen + authenticationtag)) ++ return 1; ++ ++ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; + + #if LIBSSH2_AES_GCM + /* First block */ diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 260f06204df..5633d3bae4b 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -17,6 +17,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-2.patch \ file://CVE-2025-15661-3.patch \ file://CVE-2026-66032.patch \ + file://CVE-2026-66033.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Wed Aug 19 15:57:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95807 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D45CC5DF81 for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10424.1787155080949190839 for ; Wed, 19 Aug 2026 08:58:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=R40M5SyD; spf=pass (domain: smile.fr, ip: 209.85.221.49, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-4798bea72f9so673787f8f.1 for ; Wed, 19 Aug 2026 08:58:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155079; x=1787759879; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WX4j30XiJIMWSnCzxhYuNhBuY1qu+uX3ny26CVEhzms=; b=R40M5SyDv1KL2Pu0vuDJdwHIjcOmXB8TI+VNJS6hobqZ1xNaFF+32rPQcrrOmXd9YX +Lm8JYzIOkH2AP1mA6l6FIaoC70Ba1MYnD2f28vYYQGtxJJg7djEaTw9Emgwgmt/LTHw ZeFfXauDi2VYJFuq5u2pzREpMx0ayMFTjLkCc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155079; x=1787759879; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=WX4j30XiJIMWSnCzxhYuNhBuY1qu+uX3ny26CVEhzms=; b=L3qGrkCdpw8gc8DKNHHqOMLH2eXLXg9nuK6CK4sSprI9g1v6qU2vetA8IKJQO/JnzO rmyPoQsPXx9D17Rqd1qgUbnUUNe+Ev21o7vZ3FNemku04NFJMllNu5MDH/F740L3TFK+ 0L8vCYn9P5j96tFG5QSaQQP7z/jgoN7isgd6giyn86aUgaluwurYqdSBwz/F3EAW4dyI t8VhrQ82m45AJc+0EsvnAY2++ljB8jsfqrdY3a8o1TCHn2pHue0Lra8cdRCEuX80Ayq5 4mtvyR5zw4gF3sJQnQaiubnyKIgNkx5AEYmnRiSWeTwT1+B4eYPTVmsFz3bLZwnx8Oxg 68RQ== X-Gm-Message-State: AFuF++kAyxyDBUxAd0t/Wmy835dSFzXQ2tWz0/WNtNY3ObFi6tjZa5/w 5gB+nriwp+Z2qelA7C0mAQjOpGztvqhPEaLBoQdXjiAhsymRow8ig6VlLj6LFZuquNF5BU62NS9 KmQnteiU= X-Gm-Gg: AR+sD11G53FXQASagSVUxVWJMZqqTa1Qs5RXK3p6rylVPch83At73IQcMuragQYkLSO HKnjLSUW3rj7KG2/GNAM+FPkmqb+3kQJXEPO+e8YbLfwrALbBVPcgvrpBXBhGX8Cphr2O33AT6p hOTYGzHDSFp5rT/bowTiOEUEk3d75wdQEdD0+l6uSJot8fgNf9nyR34pGbs5+GwaT2yaec7BCwa PpsCbt3DMm+Whfi4eu2FjF4X2+ijCz5hTHoIccUR623Nuzuu3lELVdXYr7kKJD9Qwxkdd663GdG kZL+UaVkATTY8rlxfqF6AFq9BMSdClNItDP4BqWwnuM2P5qdILFl5uNlWPih9Zk8A+UzhKpsPTy q+wJJUs+waypzzfs5VbSy1XCGwUz8vlDMIK1dghr3dQr/9s5zKy9caHRASxsJ/zpvxYLxfA26tg dbJt2BHs1StVw/TB9+iXHXOd52u6kC+5nRLmUHgjmPrE1UgQ6mZk7S271zPtRPvk/9DsaERq6z4 oO1VOh0TIJLL24sLo3fU/w7tYhaCGUz1pR7u0EXA5TMmot510AwmaBAB7eZ+uErSgnmMA3qf13Z 5xAklpacmFyTkla66JYtT8w1s/uoWFfIu8JPZ/9+ X-Received: by 2002:a5d:5f09:0:b0:482:9a18:d757 with SMTP id ffacd0b85a97d-482b1e9620dmr12246305f8f.9.1787155079147; Wed, 19 Aug 2026 08:57:59 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:58 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 34/37] libssh2: fix CVE-2026-66034 Date: Wed, 19 Aug 2026 17:57:05 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243770 From: Jaipaul Cheernam Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66034 https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 (From OE-Core rev: a19d6c5bbc4e2b4ab4803397e78c70370243a553) Signed-off-by: Jaipaul Cheernam Signed-off-by: Fabien Thomas --- .../libssh2/libssh2/CVE-2026-66034.patch | 40 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch new file mode 100644 index 00000000000..906356baf28 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch @@ -0,0 +1,40 @@ +From 16720054e0b3f02e36f31dd04add534d73d4a18d Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Sat, 4 Jul 2026 11:19:49 +0200 +Subject: [PATCH] publickey: fix potential OOB read in + `libssh2_publickey_list_fetch()` + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-w6g9-cpfp-22gc + +Closes #2202 + +Backport adaptations: +- The upstream fix uses ssh2_err() which is not available in libssh2 + 1.11.1. Replace with the equivalent _libssh2_error() call. + +CVE: CVE-2026-66034 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9] +Signed-off-by: Jaipaul Cheernam +--- + src/publickey.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/publickey.c b/src/publickey.c +index 9c9fa618..f3776d2d 100644 +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -988,6 +988,13 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys, + } + + if(comment_len) { ++ if(pkey->listFetch_s + comment_len > ++ pkey->listFetch_data + pkey->listFetch_data_len) { ++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "ListFetch data too short"); ++ goto err_exit; ++ } ++ + list[keys].num_attrs = 1; + list[keys].attrs = + LIBSSH2_ALLOC(session, diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 5633d3bae4b..e2872c335b0 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -18,6 +18,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-3.patch \ file://CVE-2026-66032.patch \ file://CVE-2026-66033.patch \ + file://CVE-2026-66034.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Wed Aug 19 15:57:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95806 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 452F4C5B572 for ; Wed, 19 Aug 2026 15:58:02 +0000 (UTC) Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.10337.1787155081512064175 for ; Wed, 19 Aug 2026 08:58:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=wgMTMFa5; spf=pass (domain: smile.fr, ip: 209.85.221.54, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-47f703a9d05so798165f8f.0 for ; Wed, 19 Aug 2026 08:58:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155080; x=1787759880; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=cSPM3zMNtmHiVLFAleq6A173W/P76aQQ4V89Rtt1Cm0=; b=wgMTMFa5EADdpHbuDCgAe8SAO6nQpsPXMn77GbrK4Oz8GgDZ/y18ANoBhg8AsxGHwH QRh++Yj9AJJuWs4iMIwyuHA0iy7KNc5ymDHAfWRF+6irrDn67dCPhOvXnic8GK18QH4+ mfTDxyiWjdGmbTOM6ad/OcIIv7XNYzzuJ9WR0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155080; x=1787759880; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=cSPM3zMNtmHiVLFAleq6A173W/P76aQQ4V89Rtt1Cm0=; b=ffTqyWiXjnAhaxGdXAHIjHDBZ6T1gLUBebugFHU5pWipx1Lj9ywrHU/ZJFnHpKgkGq CCWKTXXOl3ivBsyEQNeG/CdNEfppmvLvxTvO0p8DwTpu49k2OC8EnOtUcD6o071k6evD IRi+xrd5zwh1unACNMYbimduZlreiDP2gZ75Zh2ErO9hwxwYcYeL23nlfVvGvuhLF8CE V9+LXBteNV4JZAQQynL8j9ih8CoGExXy8NiupV1T1rqcO3TGGtyA4rkTJJHwgA604y/B 9Ttbg5gRGPVt5Jfv0Y5d3e219yNIf+sclL0X1RqQdczSKSXlKU8k923mrnvmHtNNk/y6 rfEQ== X-Gm-Message-State: AFuF++mYB8pUpNWCmd8bViNdtA9XeVUC9+bicNqS+VYoiUkUymLCeOO+ epY/FwMj3L7n6qnpQLVr3XhoGknmK5NsxTLJz74Qs+dSDoMXf96CAwRaUZvY2x9XSUyxbybAc9i 5jA71xmo= X-Gm-Gg: AR+sD12Dyk+DgHYj6AV53l9RIwq91/N/LLPz53iekV5E/ZSiRMroMA3HTqeHDOh+KSt 1wxz6CWWUSX6DCn8G5GxF8vcOc6Uu+Lo07GIWvzfiGEInT1u0+aV/PpYGgL+plffW6cfFPyQ63T E/376vBIoTPvVyIjB0qp7Auz4QGjvPNM37HJC41kse4hCgDkH6kkD9B59sHo6uG2SeBkdEzIEAK GzSFGSSnk3ZGReFi4jxGiA06CK2rTQw0c1dkmkv7gbgICCkITTHtze4NpEE0O39re4zTcmjyyAT TWoK/+sU71vbDT9ALgsN4qunTvNvnkHFiwVwiDktI4OXwo/3Rcv+laLGQ1yujYQjuoFNCqopLK+ FKse2D+JYWN1AvJWukm7t3kd+a+hModLNWTIFYQCMxkTq9/l1z3mxzulYeaFSiLS/rusQ4OfeSu 4N956+Mc/b7XaFF2nEZ8pSwXDg+7TiLT1OaB2tanUMcXQ64yTuZ8njhw1qkXLmi7AUR8/2+3p0S XcJnTYhmPyPNVD9LbrKt5HG+o1ERzDSO389QvbaKH/c10u6KK2YaenJS0HPzHwZwFFOaHJ2TkCz mpn06XCXJF/btH3HGQdEWZeHadTb65SR/JdrY/HT1g== X-Received: by 2002:a5d:64e4:0:b0:47f:8b2c:3d98 with SMTP id ffacd0b85a97d-482b1e867b5mr9333913f8f.4.1787155079730; Wed, 19 Aug 2026 08:57:59 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:57:59 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 35/37] libssh2: fix CVE-2026-66035 Date: Wed, 19 Aug 2026 17:57:06 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243771 From: Jaipaul Cheernam Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66035 https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 (From OE-Core rev: 6bfaa957e88c866c9e8257adb165150a2fd6c8d3) Signed-off-by: Jaipaul Cheernam Signed-off-by: Fabien Thomas --- .../libssh2/libssh2/CVE-2026-66035.patch | 56 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch new file mode 100644 index 00000000000..7c15f92fb6d --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch @@ -0,0 +1,56 @@ +From 6671019836476649792eea12868a370133be1abe Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Fri, 3 Jul 2026 18:22:55 +0200 +Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-6c79-444r-wx26 + +Closes #2198 + +Backport adaptations: +- The upstream fix uses SSH2_SAFEFREE() to safely release allocated + memory and reset the pointer. Since SSH2_SAFEFREE() is not available + in libssh2 1.11.1, replace its usage with the equivalent NULL check, + LIBSSH2_FREE(), and pointer reset sequence. +- The upstream fix renames decrypt() to transport_decrypt(). Since this + rename is not present in libssh2 1.11.1, retain the original + decrypt() function name. + +CVE: CVE-2026-66035 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4] +Signed-off-by: Jaipaul Cheernam +--- + src/transport.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/transport.c b/src/transport.c +index d147505b..9f386e75 100644 +--- a/src/transport.c ++++ b/src/transport.c +@@ -242,6 +242,17 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + unsigned char *decrypt_buffer; + int blocksize = session->remote.crypt->blocksize; + ++ if(p->total_num < mac_len + 4 + (size_t)blocksize) { ++ if(p->payload) { ++ LIBSSH2_FREE(session, p->payload); ++ p->payload = NULL; ++ } ++ return LIBSSH2_ERROR_DECRYPT; ++ } ++ decrypt_size = (ssize_t)(p->total_num - mac_len - 4); ++ ++ first_block[0] = 0; ++ + rc = decrypt(session, p->payload + 4, + first_block, blocksize, FIRST_BLOCK); + if(rc) { +@@ -249,7 +260,6 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + } + + /* we need buffer for decrypt */ +- decrypt_size = p->total_num - mac_len - 4; + decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size); + if(!decrypt_buffer) { + return LIBSSH2_ERROR_ALLOC; diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index e2872c335b0..d14a27f3dc3 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -19,6 +19,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2026-66032.patch \ file://CVE-2026-66033.patch \ file://CVE-2026-66034.patch \ + file://CVE-2026-66035.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Wed Aug 19 15:57:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95819 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61AA7C5DF95 for ; Wed, 19 Aug 2026 15:58:03 +0000 (UTC) Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10425.1787155082258957657 for ; Wed, 19 Aug 2026 08:58:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=RuRX1I1I; spf=pass (domain: smile.fr, ip: 209.85.221.51, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-47fd4531020so713548f8f.3 for ; Wed, 19 Aug 2026 08:58:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155080; x=1787759880; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=IosZslMiOULuM9yAtZfjLYH2sr6yoVTinwM5xa8XCis=; b=RuRX1I1INOP1iWq8lR3Dql/g8xS+tDrUAHiuZONBGLd+FX6IQLlB8xIFH5NubRGEfh 33K35gadxkobrkmznluZkC5tdu5wVpWnNktVT4MwV+yE8VPvpvHHjZsCD4Zwhlgehwuo MKijXFqmVWbq42zrno8j06fwiZf1Ci7m7yVh4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155080; x=1787759880; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=IosZslMiOULuM9yAtZfjLYH2sr6yoVTinwM5xa8XCis=; b=P/6ADjr6AzmP/sC1sSVERpPhmUZmKSja6ZOnZM+LGHweo3p5GdltUfpQLI+rQ1BirQ MRcGZrKiaV2QJKM+mCNa/NxQW/aGaIRrJVIQhSkzR2ikWuwK3txIW727gO3Yddc/YIgx sWqD8bXqUjdNAO24kGfzlugRq1si1zzDAgsTfmKu0gc9PG3bmoL5yiHwyKRt5xztb8Rd hRFNI0MMUZG6qwuVJBNtwIvHfiNFpI9cRIPvQNDgUC1SVV67jDNR8C8s6jkDhVFeJrlI 4yWAKuSrTC2diE4l+UwhjzT9lx/6oRARXwXm0aUyqOoABlRShhyy6cuITxA01pEKSMjE pItA== X-Gm-Message-State: AFuF++nrns9ZTLdIh1uNOFxTes/GclqL0F7eDw8xpLowBTa0B8klRisy 6c8W4tN2VQtpYzsOQd93GcOATyrblrYUDnG2BnPVEeEIXcAxBoVJMW5qIcKjAgT3ag+49E6xbR7 mZ/z1RTQ= X-Gm-Gg: AR+sD10Z+pMLG+zJYzKfhnHw7VcM3gcoqiHKxgaN6kFaKMUkOQXJfFdulj/e7Jrzy+t RksO5xKfSefFq69mlBYt5IVRbl4iuGFto3M9d243mStsGww+GJTSgxRBIfC+jTdAfudu0C/ZH8b yJplIFcryeSpemW8mCPhZ3AFKIR/7Wt18eoQtgaABzSfAK8HFxSA5xx+Y3mrbK55FGTap4R+iUM NjcQqmFoizjTcbeJCWG+CFIBWWTevpK6BYv09mQVG31TsYZrCGom6kDJbNWyM4XmU2ElbLiQb9b hZ97gfghdisBbsX+FW579NfTN5LHVKpyMyVWMii/lFzuzh6ptLlPngwu70jsyfBkyobRYVaYHNM iy6S0HSQuA/xl6Y3kc8gma7L3X8iROfBRSzJANTqOQbC9w6cG4WXeOl62RNr+ZI0KzccP/DRZml /P5y46V5tFyd5vq/ZpCENckDGorfbocz1xBYm9Y8cK/mvNwCwH1mXR83yje8Q8YWERtJxiwvF66 m3VyCrdidlsHcR+jkRAikJUwXlxIrf/o9HNNdSZtPpm86eyqepEigazPHBjwDHHYi7b/4QbMy2x Y2Qbc6FcNYfKihKtstB9z/IGP9Ryduw1Qj2rMztK X-Received: by 2002:a05:6000:490c:b0:481:56ec:b422 with SMTP id ffacd0b85a97d-482b1eaa195mr11072039f8f.9.1787155080486; Wed, 19 Aug 2026 08:58:00 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.57.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:58:00 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 36/37] libsndfile1: patch CVE-2026-37555 Date: Wed, 19 Aug 2026 17:57:07 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243772 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-37555 (From OE-Core rev: bdf36cd3a438b0d52de4c8971c19268ff1fc427f) Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas --- .../libsndfile1/CVE-2026-37555.patch | 44 +++++++++++++++++++ .../libsndfile/libsndfile1_1.2.2.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch new file mode 100644 index 00000000000..bac8476ee8c --- /dev/null +++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch @@ -0,0 +1,44 @@ +From c32c090ff9bb45e1dae637957c9c9b47b3967623 Mon Sep 17 00:00:00 2001 +From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com> +Date: Sat, 27 Jun 2026 14:34:16 +0200 +Subject: [PATCH] sds: avoid divide-by-zero in sds_byterate for zero-frame + files + +sds_read_header() sets psf->sf.frames directly from the file's 3-byte +data-length field without a lower bound, so a crafted .sds file can +leave psf->sf.frames == 0. SDS never sets psf->bytewidth, so +sf_current_byterate() falls through to psf->byterate (sds_byterate), +which computes + + (psf->datalength * psf->sf.samplerate) / psf->sf.frames + +dividing by zero -> SIGFPE crash (denial of service) when an +application calls the public sf_current_byterate() on such a file. + +Guard the division with psf->sf.frames > 0, returning -1 (the same +'unknown' value already used for the write path) otherwise. + +Reproduced with a 21-byte crafted .sds (data-length field = 0) under +AddressSanitizer: 'FPE ... in sds_byterate src/sds.c:761' before the +fix; returns -1 cleanly after. + +CVE: CVE-2026-37555 +Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/commit/c32c090ff9bb45e1dae637957c9c9b47b3967623] +Signed-off-by: Peter Marko +--- + src/sds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/sds.c b/src/sds.c +index 2a0f164c..1070e653 100644 +--- a/src/sds.c ++++ b/src/sds.c +@@ -757,7 +757,7 @@ sds_seek (SF_PRIVATE *psf, int mode, sf_count_t seek_from_start) + static int + sds_byterate (SF_PRIVATE * psf) + { +- if (psf->file.mode == SFM_READ) ++ if (psf->file.mode == SFM_READ && psf->sf.frames > 0) + return (psf->datalength * psf->sf.samplerate) / psf->sf.frames ; + + return -1 ; diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb b/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb index 4cf42375739..5d2a2c256b0 100644 --- a/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb +++ b/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb @@ -13,6 +13,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/libsndfile-${PV}.tar.xz \ file://CVE-2024-50612.patch \ file://CVE-2025-56226-01.patch \ file://CVE-2025-56226-02.patch \ + file://CVE-2026-37555.patch \ " GITHUB_BASE_URI = "https://github.com/libsndfile/libsndfile/releases/" From patchwork Wed Aug 19 15:57:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Fabien Thomas X-Patchwork-Id: 95822 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AE3EC5B572 for ; Wed, 19 Aug 2026 15:58:13 +0000 (UTC) Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10427.1787155084907382368 for ; Wed, 19 Aug 2026 08:58:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ykyDYhVY; spf=pass (domain: smile.fr, ip: 209.85.221.52, mailfrom: fabien.thomas@smile.fr) Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-47c2b362ee2so949338f8f.1 for ; Wed, 19 Aug 2026 08:58:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1787155083; x=1787759883; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mXyfXtsYqgJlmcFe9w2Ce0UihXNxPPgDtd7iQ+Tu+gk=; b=ykyDYhVYmGhnOlv8O4IkfWVBxC4O1nGxJfKWO9PmNOWqKCPO9JpEhNy9kviKapIymA u9G+T6cc+G7y3G6e9R1edK9rJE9+HmySL01mczMfpkhmNl7tJnxtBoSNgKcAJtY2hdZ7 9PHWh3Dom6e0rPk9ziStiu6pPrI8V9k/f6Mtw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787155083; x=1787759883; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=mXyfXtsYqgJlmcFe9w2Ce0UihXNxPPgDtd7iQ+Tu+gk=; b=qsSgSt2EvEjiAGWsQN35GRaDIbY5OQa59W9Q4ixjPhb6YJ39nZZ7Sw4dLIVTScoivy raMXUgY3FeSWC/zBI/fPk6oGizJvem3NumB8WmyPTgRsY3XB8iWDF1Bkvb3uX3Nv7487 RpgXDkM1dV/13lRPZ4lRcbjdxGPTV7k/D++DRDw6jzz0vEo8gzyjS84P+dCsSt3SjJlA hmfDOIlfWUn/HD1zGrzg8XyzOqHIOej/sA3JZHYByJPNSOCVWAPoFUWtnTYU8y4OAD0U NvPXo2hvyVpOBbbNfk84bWKyzbOmnmy+3HTJLTSNLZ1hKV5WxobfpnZElCF7raRVTNtG EyIw== X-Gm-Message-State: AFuF++nsw2uh2/IZ3JGMeRByuImz1dO8t5O2lzL4L38FQhRYPSfbXEAZ 1ets3paGPMqjnAa7r6mNQ37fYuJhZRMU7YsNKO5Gagsqn8/HMPJ5DgnM7Q7XQXpKPNyGVNGrCuS QTAg9py0= X-Gm-Gg: AR+sD11mnfb0hvdYQt8BhpKxuRIzEARD7MW02asU7oCJsPxvumkBefgMQ3XxlIaEn3v JYkluJWCi/pJoo0SMTIMdSektjy/oDpCdogI+rluu4DK0c2KS/tJZsvInPqoMQttbBWg3KZA3Ma Ijz1Tms0QUWaAuh9N+y3Fwk1iKVsXIe1sBMG3TH63Se+5UUolsgaObUx/s8i0cjtMZR5/npO+M/ idUbINMhDmaS/XbJaaNOSOdOa76mVLWN/j5M+7j84ZBImKx0Vpto56+R8eV5vSh1UetGgjM56s4 eZ3lie3jZwrL4RVualhElMRFJxHbr0acicMq18GoymP3OpGiQ4ukhzbm/P8NAbXeTHSbKEa72V9 qgN/c8nGPwpN87T2S+B6TJYTLRLIs3aEfYbnmERhGgD/MOyyhXBSRQbXwOCFTUTgQdEiarY8L/L yTMGYsSZoMKcw4kL51ppCSMCahB5tw6MJAxsDpCmpGADVjly2RhS4eXZ6rxudyYkRxYnt/wYTbO uV3EkxgBRmM+vRTRm4o0+aFCKYhYjXRrJLjQnRg6dNwsw9zh0K7KRu8JpqIWlNU1Ywenz+IGj8/ ZeTdXxFS6aTZwRueWgSEMgXG+ScmXSjAIq6Ck8KC X-Received: by 2002:a05:6000:41f6:b0:47d:eedb:ee62 with SMTP id ffacd0b85a97d-482b1fd3b69mr11586505f8f.14.1787155081575; Wed, 19 Aug 2026 08:58:01 -0700 (PDT) Received: from FRSMI25-GIGUE (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b14d05a6sm7215698f8f.35.2026.08.19.08.58.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 08:58:01 -0700 (PDT) From: Fabien Thomas To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 37/37] linux-yocto/6.6: update to v6.6.147 Date: Wed, 19 Aug 2026 17:57:08 +0200 Message-ID: <7bc6442a1f83593427a502bbb924a3f91b4a0456.1787154074.git.fabien.thomas@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 19 Aug 2026 15:58:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243773 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: a1153c0deb44f Linux 6.6.147 12a891c773aeb posix-cpu-timers: Prevent UAF caused by non-leader exec() race ae068b6761967 Linux 6.6.146 d8a1f7420d2d5 mm: refactor mm_access() to not return NULL c5596480c50e0 Linux 6.6.145 bd37e81cb475c selftests/bpf: Add simple strscpy() implementation 8fa926d33f082 tools/testing: add linux/args.h header and fix radix, VMA tests 2f48e29ce9dca driver core: Guard deferred probe timeout extension with delayed_work_pending() d329ff4039abd driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout() 8cd66ea50f3b1 jiffies: Cast to unsigned long in secs_to_jiffies() conversion a48236b8889e8 jiffies: Define secs_to_jiffies() df9757a9f5213 writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount() 19ec404b079be writeback: Fix use after free in inode_switch_wbs_work_fn() 96ae4c663f127 xfs: fix stupid compiler warning 2ec1d9d1cd538 Bluetooth: btmtk: remove #ifdef around declarations 88a04d42aa6c0 Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder 9f53402757671 selftests/hid: ensure CKI can compile our new tests on old kernels 4893deede7bbc Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev 6d012b730fd22 Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle 3d65aa0fd012e Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state fcd446bbe7446 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd faa3ff1dd933c seqlock: fix scoped_seqlock_read kernel-doc 90d35d2b8e47a KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers 83b22d7f7c384 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() e51042ddc0b20 Bluetooth: hci_sync: annotate data-races around hdev->req_status 436b54dfa0fb7 Bluetooth: separate CIS_LINK and BIS_LINK link types 3053a0be28cfa Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO 097b159d43407 btrfs: fix incorrect buffered IO fallback for append direct writes 7236d59f58f39 btrfs: fix false IO failure after falling back to buffered write d0bf0a7d75bb0 exfat: preserve benign secondary entries during rename and move 1058a40273237 exfat: move exfat_chain_set() out of __exfat_resolve_path() 2e22bced8e7e7 exfat: add exfat_get_dentry_set_by_ei() helper e603c5487f365 exfat: rename argument name for exfat_move_file and exfat_rename_file 04fe6ca144141 exfat: remove unnecessary read entry in __exfat_rename() fa0d1c1ff406b exfat: move free cluster out of exfat_init_ext_entry() 744b23aa430d5 mm: do file ownership checks with the proper mount idmap e2baf8ea13fb4 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() 7c90aa5cae6f5 regulator: scmi: Simplify with scoped for each OF child loop 1526f3c9884c4 audit: fix potential integer overflow in audit_log_n_hex() fc7e17d2f742c audit: add audit_log_nf_skb helper function 3ba204896c144 crypto: qat - fix restarting state leak on allocation failure 08f1388e09886 btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC e2e4042d86664 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile 80cd28b56ab62 nvmet-auth: validate reply message payload bounds against transfer length 824425c42253a nvmet: return DHCHAP status codes from nvmet_setup_auth() 981ccee1414ba nvmet: remove superfluous initialization d5631081be07f usb: gadget: f_fs: initialize reset_work at allocation time 7b20686bf065b crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A 9379d998f86d5 crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 f37d00b9d28d5 usb: typec: tcpm: Fix VDM type for Enter Mode commands f2a6abc670104 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() 6be54e2c8ea48 usb: iowarrior: remove inherent race with minor number ec662a8b2cde0 bpf: Allow LPM map access from sleepable BPF programs 85f16dd3f4872 bpf: Consistently use bpf_rcu_lock_held() everywhere b6a481642ea19 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length d6be467a9eb23 hfs/hfsplus: prevent getting negative values of offset/length 587afb06a5d1d serial: 8250_mid: Disable DMA for selected platforms 184579feec824 serial: 8250_mid: Remove 8250_pci usage 05e3decc55d1d HID: appleir: fix UAF on pending key_up_timer in remove() 120306ea29e99 treewide: Switch/rename to timer_delete[_sync]() 7456ae990a973 proc: protect ptrace_may_access() with exec_update_lock (part 1) 42417d36cf084 seqlock: Change do_task_stat() to use scoped_seqlock_read() 7d9295e319ec7 seqlock: Introduce scoped_seqlock_read() 6256899c3a346 mm/slab: do not limit zeroing to orig_size when only red zoning is enabled a6d5ce2e1a2d7 HID: multitouch: fix out-of-bounds bit access on mt_io_flags 7c29bc073a1f7 HID: add haptics page defines a018a7c37d5ae perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box() 5c3265f3252b2 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() ac7b2c21f2269 writeback: Avoid contention on wb->list_lock when switching inodes 138c692d2b2d6 proc: protect ptrace_may_access() with exec_update_lock (FD links) 5e7fc3518a48d proc: rename proc_setattr to proc_nochmod_setattr ea5c9bf99f626 ksmbd: track the connection owning a byte-range lock 875f1fde874f3 ksmbd: centralize ksmbd_conn final release to plug transport leak 1e112c47ec5dd ksmbd: use opener credentials for FSCTL mutations aa3c0cab4b28c smb: client: resolve SWN tcon from live registrations 5bb65ae76d055 smb: client: Improve unlocking of a mutex in cifs_get_swn_reg() 8c37e4338c801 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() 080a5a42810a4 Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister 8daaf7f73fe99 Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock 9e6c5169db423 netfilter: ebtables: zero chainstack array 101358689d262 netfilter: ebtables: Use vmalloc_array() to improve code d22fb719654bf media: nxp: imx8-isi: Fix use-after-free on remove 8b8358c7ce216 media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code e522a5ec70b88 media: nxp: imx8-isi: Convert to platform remove callback returning void 7a550256d68bb gpio: sch: use raw_spinlock_t in the irq startup path c23a7bbb0277f coresight: etb10: restore atomic_t for shared reading state e441cbfbd0eaa mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() 1455793885772 mm: shrinker: remove redundant shrinker_rwsem in debugfs operations 91047a4396a8b Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref f344a369d0380 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() b27ecba3196f6 staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() 425e1db64b5a6 staging: rtl8723bs: fix spaces around binary operators e2d5e8e8f758f staging: rtl8723bs: core: move constants to right side in comparison 7d41a98a0d22e PCI: Skip Resizable BAR restore on read error 51b254181df29 PCI: Move Resizable BAR code to rebar.c fd0e8911770f5 PCI: Add kerneldoc for pci_resize_resource() 0b52ed5ec3deb PCI: Fix restoring BARs on BAR resize rollback path 56f89adc050b6 PCI: Free saved list without holding pci_bus_sem c3e11419a630c PCI: Prevent resource tree corruption when BAR resize fails fe8c701a53c28 PCI: mediatek: Fix IRQ domain leak when port fails to enable 87129460aacb8 PCI: mediatek: Use generic MACRO for TPVPERL delay 5bbdcf407209d PCI: mediatek: Convert bool to single quirks entry and bitmap 81842201d74a9 PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() 4860120380916 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling f1db80a67da92 vfio/mlx5: Fix racy bitfields and tighten struct layout a25bfa2a6665a PCI: altera: Fix resource leaks on probe failure 2ee9c46fd2dcd ALSA: aoa: check snd_ctl_new1() return value f2315b1675bd3 iio: common: st_sensors: honour channel endianness in read_axis_data 668e305b743fa bitops: make BYTES_TO_BITS() treewide-available 5022f4ed5aae9 iio: pressure: mpl115: fix runtime PM leak on read error f88ae94a69ce7 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading 4700ad28cfdd3 iio: imu: inv_icm42600: stabilized timestamp in interrupt e56fac319bb99 iio: invensense: fix timestamp glitches when switching frequency 3822181f61903 iio: invensense: remove redundant initialization of variable period a5df36432d8cc iio: hid-sensor-rotation: Fix stale or zero output when reading raw values bd3c53b25b241 iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ 8e63297ca0af2 ACPI: NFIT: core: Fix possible deadlock and missing notifications 5dfed5a90e2ca ACPI: NFIT: core: Use devm_acpi_install_notify_handler() c5570ebe8ec65 ACPI: bus: Introduce devm_acpi_install_notify_handler() f1e12d81f9cd2 ACPI: driver: Check ACPI_COMPANION() against NULL during probe c127dbd832bd4 ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup ac44b4a3d6137 perf/x86/amd/brs: Fix kernel address leakage bd4a622786f92 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout f51f5acaeee65 mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout f3da9bc7c8c2d mtd: rawnand: fsl_ifc: return errors for failed page reads 7ee7a77ec2f44 mmc: vub300: defer reset until cmd_mutex is unlocked 7c0a3a73dccc9 mtd: mchp23k256: use SPI match data for chip caps 35568121adfc5 mtd: onenand: samsung: report DMA completion timeouts deb5f0ae384f1 wifi: mwifiex: fix permanently busy scans after multiple roam iterations 5d9f700511a52 wifi: mac80211: free ack status frame on TX header build failure d97a8f3668949 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() 6dc0c8cd9c8a8 reset: sunxi: fix memory region leak on ioremap failure ac6ac3d35bfc0 ipvs: reload ip header after head reallocation a3f0d5b605cd5 ipvs: fix more places with wrong ipv6 transport offsets d5db3439ee8d1 memstick: ms_block: reject a card that reports too many blocks 9735bc3aacc28 macsec: fix promiscuity refcount leak in macsec_dev_open() 75866e80e31e9 llc: fix SAP refcount leak when creating incoming sockets 68c5a2a19987c Bluetooth: btrtl: validate firmware patch bounds d573250d22840 net: openvswitch: reject oversized nested action attrs e1f485f5ea8cd regulator: ltc3676: Fix incorrect IRQSTAT bit offsets a02b52fe54f7b wifi: mac80211: fix memory leak in ieee80211_register_hw() eb7474d0253bb wifi: rt2x00: avoid full teardown before work setup in probe 8bf359e2547e8 powerpc/pseries: fix memory leak on krealloc failure in papr_init 87af3ebc112fb pmdomain: imx: Fix i.MX8MP VC8000E power up sequence 5c5d58fff3401 pmdomain: imx: Fix i.MX8MP power notifier 02f67c4f88be8 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed 3c693635bb7b3 tracing/osnoise: Call synchronize_rcu() when unregistering b5f92cc4e24a2 riscv: Prevent NULL pointer dereference in machine_kexec_prepare() f16866c626568 drbd: reject data replies with an out-of-range payload size f21fa533a3ed1 macsec: don't read an unset MAC header in macsec_encrypt() 9e36602cbec55 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new 9cb5ac594ca76 ipvs: use parsed transport offset in SCTP state lookup c7881b6088276 llc: fix SAP refcount leak in llc_ui_autobind() b91e5248dd7af mac802154: remove interfaces with RCU list deletion 036bc56610607 s390/monwriter: Reject buffer reuse with different data length 5da5cf48a432e riscv: probes: save original sp in rethook trampoline 76392d35c8df4 hwmon: (asus_atk0110) Check package count before accessing element 2b822df8e498a net: wwan: iosm: bound device offsets in the MUX downlink decoder 566d5bf1e27c8 ata: pata_pxa: Fix DMA channel leak on probe error 07c05601a9a8e orangefs: keep the readdir entry size 64-bit in fill_from_part() 1b7687fc56c9b tracing/probes: Fix double addition of offset for @+FOFFSET 6ee5a7665a908 net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked 86a61e46a1919 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked 6523daa6852b1 net: lan743x: Initialize eth_syslock spinlock before use ffb13fe1947bc fsl/fman: Free init resources on KeyGen failure in fman_init() e7fd81e9fb1fe hwmon: (occ) unregister sysfs devices outside occ lock b74f293e5f380 net: liquidio: fix BAR resource leak on PF number failure 22f864f7471a5 hwmon: (w83793) remove vrm sysfs file on probe failure 43d49fa630edf hwmon: (w83627hf) remove VID sysfs files on error and remove 22fa00dac08c7 rtc: mpfs: fix counter upload completion condition 5576ee19a6a4a bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() 54d73f18f8919 espintcp: use sk_msg_free_partial to fix partial send e8a916579e427 LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect() f2423da55976e batman-adv: clean untagged VLAN on netdev registration failure e6640923afee6 batman-adv: ensure minimal ethernet header on TX f19259395b44a batman-adv: retrieve ethhdr after potential skb realloc on RX 29dbd6e27d0f8 net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants 1fe2643d0b24c ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit b9071dc7889be ieee802154: ca8210: fix cas_ctl leak on spi_async failure 66f3053070c0b ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation 5abe94a205539 ieee802154: admin-gate legacy LLSEC dump operations 1d4d8ee002083 net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink 983cc4aa7e6f6 net: ipip: require CAP_NET_ADMIN in the device netns for changelink 33fd93961557e net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink c64b9ae7eb97e net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink f2ff634d95f8a net: ena: clean up XDP TX queues when regular TX setup fails 2400c4b05d588 net/sched: act_ct: preserve tc_skb_cb across defragmentation fd0b939ebd1ee net: ixp4xx_hss: fix duplicate HDLC netdev allocation fd01247bde1ad net: wwan: t7xx: destroy DMA pool on CLDMA late init failure 388ccffbd2e7e net: sit: require CAP_NET_ADMIN in the device netns for changelink f916210f9d64e gpios: palmas: add .get_direction() op 0ea41686d72f6 gpio-f7188x: Add support for NCT6126D version B 998f66e9ce320 cpu: hotplug: Bound hotplug states sysfs output 7a68257b90d8a cpu: hotplug: Preserve per instance callback errors cff8281bacd28 posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() 218cc15a4c907 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete 08bf4b6ee2898 Input: ims-pcu - fix type confusion in CDC union descriptor parsing 129187ec3f868 Input: ims-pcu - fix race condition in reset_device sysfs callback e3f93d63dcd48 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing 3fd7c0ace2453 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging 477149c848d40 Input: ims-pcu - fix DMA mapping violation in line setup f7f5afeed31ba Input: ims-pcu - add response length checks aa1885f87e60c Input: ims-pcu - validate control endpoint type ae05b7a600c07 Input: ims-pcu - release data interface on disconnect 6a6c373e6a82e Input: ims-pcu - fix use-after-free and double-free in disconnect 8c689a8f22922 scsi: elx: efct: Fix I/O leak on unsupported additional CDB 62cf39a9770a6 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() a040004846f1f scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE 6ca5de8782e67 scsi: target: Bound PR-OUT TransportID parsing to the received buffer fa588f2840110 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it 18d4f86816592 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path 5594ee5a2653b scsi: sg: Report request-table problems when any status is set c3f4e40766154 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() a61de4d7e22a9 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path 29b8d12278d20 dm-verity: increase sprintf buffer size 1f04b390add2e dm-verity: fix a possible NULL pointer dereference cf9feed8c131e dm-integrity: don't increment hash_offset twice 259ce9e3fc3a3 dm_early_create: fix freeing used table on dm_resume failure 9964ae466c589 dm-stats: fix merge accounting 04ca47b6768d8 dm-stats: fix dm_jiffies_to_msec64 d05e0edfecf52 dm-log: fix a bitset_size overflow on 32bit machines 29536a9ff146d dm-ioctl: fix a possible overflow in list_version_get_info ae7fac9cb5bb0 dm-bufio: fix wrong count calculation in dm_bufio_issue_discard 7e1822f83c5a1 dm era: fix out-of-bounds memory access for non-zero start sector 3dc9ae1029320 dm thin metadata: fix metadata snapshot consistency on commit failure a887bf1f0de8e dm thin metadata: fix superblock refcount leak on snapshot shadow failure cf419c869e0d0 net: sparx5: unregister blocking notifier on init failure 8b719cef5ac30 bpf: Add missing access_ok call to copy_user_syms c3fd6f28c7ce1 bpf,fork: wipe ->bpf_storage before bailouts that access it f53bdab85e64e can: bcm: add missing rcu list annotations and operations 0f6f9f95294b4 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure 4177762f70646 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF 6280eda96e070 can: isotp: use unconditional synchronize_rcu() in isotp_release() a02e1d8f19132 can: esd_usb: kill anchored URBs before freeing netdevs 7c96581169c9d nvmet-rdma: handle inline data with a nonzero offset a257b41ddfe9e sctp: validate STALE_COOKIE cause length before reading staleness 49f6705d80b5e spi: uniphier: Fix completion initialization order before devm_request_irq() 64b4197d013bf time: Fix off-by-one in compat settimeofday() usec validation 9c513dabd4540 tpm: Make the TPM character devices non-seekable 0084fd985fe28 tpm: fix event_size output in tpm1_binary_bios_measurements_show e9c90756f10da xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink 9257c256efa27 xfrm: use compat translator only for u64 alignment mismatch 311011f8cc206 xen/gntdev: fix error handling in ioctl c3f2f080b21f8 ice: fix ice_init_link() error return preventing probe 5290a52533e09 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() 6239860c5581f i2c: mediatek: fix WRRD for SoCs without auto_restart option 1f45a48035bdb hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig b1d16cecefbcd ksmbd: fix integer overflow in set_file_allocation_info() ecf3107bfa717 smb: client: use kvzalloc() for megabyte buffer in simple fallocate 9a14297744686 platform/x86/amd/pmc: Add delay_suspend module parameter b977cfb193aad platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops 1ec0f176f793e platform/x86/amd/pmc: Check for intermediate wakeup in function 3ee0f478bb29b dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK 8f0f5de109111 dmaengine: tegra: Fix burst size calculation 6b068a97958aa tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() 424130169dc03 irqchip/crossbar: Use correct index in crossbar_domain_free() 44c6abf5d823d mtd: maps: vmu-flash: fix NULL pointer dereference in initialization dc341272cf8e1 mtd: spi-nor: swp: Improve locking user experience 0d3766fecd9b2 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() 2b3b4e5ff5a58 net: thunderbolt: Fix frags[] overflow by bounding frame_count 7a563dbb3d8d5 bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path b2f6220e929b2 fpga: dfl: add bounds check in dfh_get_param_size() 38c1ef7ce50eb ocfs2: reject non-inline dinodes with i_size and zero i_clusters b363e2c77de8e ocfs2: reject dinodes whose i_rdev disagrees with the file type a5b555bcabbb0 ocfs2: reject dinodes with non-canonical i_mode type 7da7e4ac21895 ocfs2: add journal NULL check in ocfs2_checkpoint_inode() f14aaaa130356 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits e281d892ce587 ocfs2: avoid moving extents to occupied clusters 3da4eb15c7b42 mtd: rawnand: fix condition in 'nand_select_target()' f62a1f245a716 net/9p: fix infinite loop in p9_client_rpc on fatal signal afddc64840351 mtd: rawnand: pl353: fix probe resource allocation 6ab9356517c7b ocfs2: use kzalloc for quota recovery bitmap allocation 17400e4d9dd57 scsi: sas: Skip opt_sectors when DMA reports no real optimization hint e1919423f1b92 scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() a5a682b016ef5 9p: skip nlink update in cacheless mode to fix WARN_ON 200b8bc5b6065 mtd: slram: remove failed entries from the device list 511a60e71aec3 mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE 31bfda8ca7745 proc: only bump parent nlink when registering directories 50a753171d255 mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error a8c0592a80e95 mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs() 51afb7da697b6 riscv: cacheinfo: Fix node reference leak in populate_cache_leaves 3446ffb5d03c3 mips: sched: Fix CPUMASK_OFFSTACK memory corruption e44ad91e9f75f power: supply: charger-manager: fix refcount leak in is_full_charged() bd77afca2ae9b ntfs3: fix out-of-bounds read in decompress_lznt b232eb5c9fe11 ntfs3: validate split-point offset in indx_insert_into_buffer 53c5f3b2da377 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head 7ac4c86915c24 ntfs3: cap RESTART_TABLE free-chain walker at rt->used 429d653ca641d fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} 96fb64f9da86f fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow 57c071e2c4f30 fs/ntfs3: validate lcns_follow in log_replay conversion 546518468e6c9 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off 9b7c28d8c61bd fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass 4c8aac931c1cd fs/ntfs3: bound DeleteIndexEntryAllocation memmove length af08e689ec260 fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename c31067bf5c8dc mm/damon/core: make charge_addr_from aware of end-address exclusivity 700c225d829a1 power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak 27857db30c985 MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() fadd0af657f35 MIPS: ip22-gio: fix device reference leak in probe 22c4c06006721 MIPS: ip22-gio: fix kfree() of static object 9d19995c61977 MIPS: ip22-gio: fix gio device memory leak 65104d6eb43f0 remoteproc: qcom: Fix leak when custom dump_segments addition fails 4a1148f2739d5 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing 7ce4c23e783e7 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure ddfbd816273b4 lockd: Plug nlm_file leak when nlm_do_fopen() fails 0d8ceb3988414 sunrpc: wait for in-flight TLS handshake callback when cancel loses race f3b55945dd99f sunrpc: pin svc_xprt across the asynchronous TLS handshake callback 0b0d9404951aa nvdimm/btt: Free arena sub-allocations on discover_arenas() error path 5804e6a6912b5 nvdimm/btt: Free arenas on btt_init() error paths fb9b49618ed72 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() d141d9b769bcd Bluetooth: SCO: hold sk properly in sco_conn_ready 44a203afaedb4 Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready 6df7b63afb666 HID: playstation: validate num_touch_reports in DualShock 4 reports 614b6c5ad99c6 mfd: tps6586x: Fix OF node refcount 9015475f766b3 cifs: invalidate cfid on unlink/rename/rmdir 604bd5042fbcd batman-adv: tt: prevent TVLV OOB check overflow d2148aeee9319 batman-adv: frag: fix primary_if leak on failed linearization 740542f11bf8c batman-adv: frag: free unfragmentable packet 5ae95378caa59 batman-adv: fix VLAN priority offset 067e413eec2e6 batman-adv: tt: avoid request storms during pending request ddfea9b5089c7 batman-adv: dat: fix tie-break for candidate selection 3c62694c31f04 batman-adv: dat: ensure accessible eth_hdr proto field ab2bac47a0263 batman-adv: bla: reacquire gw address after skb realloc 3404be97b940a batman-adv: dat: acquire ARP hw source only after skb realloc ed90eb5c68420 batman-adv: access unicast_ttvn skb->data only after skb realloc afac8096bde49 batman-adv: gw: acquire ethernet header only after skb realloc 27206bb57c47b s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() 5be478c1e0898 perf/x86/amd/lbr: Fix kernel address leakage 7ab30a12b88bf x86/boot: Reject too long acpi_rsdp= values 9a77a7639dfdc x86/boot: Validate console=uart8250 baud rate to fix early boot hang db938eb9a3c13 tools/power/x86/intel-speed-select: Harden daemon pidfile open a3e340d506c10 mfd: sm501: Fix reference leak on failed device registration 8bf529571cca6 leds: uleds: Fix potential buffer overread 30500acfc43ef selinux: fix incorrect execmem checks on overlayfs e507633bf76bc selinux: check connect-related permissions on TCP Fast Open bb29a484dee0b soc: fsl: qe: panic on ioremap() failure in qe_reset() f747a76004dac soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy edc7267b59a46 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path c141f69d0a0fb netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() a842dab87cab2 netfilter: xt_nat: reject unsupported target families bca4bfb9cc5c5 netfilter: ecache: fix inverted time_after() check 7bdc3c0985ecf netfilter: nf_conncount: fix zone comparison in tuple dedup cd0d7bbc027b4 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag 57e4e29644ec0 netfilter: nf_nat_sip: reload possible stale data pointer 3f03a2d225c66 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst fac2fdac3baad netfilter: xt_cluster: reject template conntracks in hash match 893319e9950d0 netfilter: nfnl_cthelper: apply per-class values when updating policies 2b70f61f569bb netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read ec369eac0795c ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback 48b6c39883637 ASoC: mediatek: mt8183: Release reserved memory on cleanup 989cbe8cc86f4 ASoC: mediatek: mt8192: Release reserved memory on cleanup ee781058cd4d7 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control 1adde1941bba7 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get 8d16e5bc78478 fbdev: tridentfb: fix potential memory leak in trident_pci_probe() 6ca48f23ce61a fbdev: nvidia: fix potential memory leak in nvidiafb_probe() 124df55c7201d fbdev: vesafb: fix memory leak in vesafb_probe() d21e6747f3f68 fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() dfbb1a695d889 fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() c53fdf7ee65af fbdev: uvesafb: fix potential memory leak in uvesafb_probe() 0d0fa8425b296 fbdev: s3fb: fix potential memory leak in s3_pci_probe() e1ecbaeec5fbf fbdev: i740fb: fix potential memory leak in i740fb_probe() f4dacbfd885f3 fbdev: radeon: fix potential memory leak in radeonfb_pci_register() 200375909216b fbdev: sm712: Fix operator precedence in big_swap macro 2952767e399e2 fbdev: hecubafb: fix potential memory leak in hecubafb_probe() 4ce94f9e3bfb3 fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() 01708cf3dca2f fbdev: metronomefb: fix potential memory leak in metronomefb_probe() 8e9f7a95279bf KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs 3ef3190e30601 KVM: s390: pci: Fix handling of AIF enable without AISB 654be81c4c637 KVM: arm64: vgic: Check the interrupt is still ours before migrating it 6e69317cd44a2 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure 1237c24ea3ceb arm64: dts: qcom: sdm630: describe adsp_mem region properly cedcabcd3c826 arm64: fpsimd: Fix type mismatch in sve_{save,load}_state() 9433578bff9c1 net: ife: require ETH_HLEN to be pullable in ife_decode() 513f820b3f0cf net: atm: reject out-of-range traffic classes in QoS validation d0597074e9973 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() 7c6d2d2baeb1e ASoC: SOF: topology: validate vendor array size before parsing 0dce240145f47 ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get 89a2309a9eec8 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc 266f936db83ae ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put d7e7c813834c6 vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter 220d41bdce41f mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() 8b3350eacd9df mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() 160045fc943f6 smb: client: fix overflow in passthrough ioctl bounds check 212c59e5e4168 octeontx2-af: fix VF bringup affecting PF promiscuous state 6c97f394bb15f net/mlx5: Fix L3 tunnel entropy refcount leak 75a59698886cc selftests/net: fix EVP_MD_CTX leak in tcp_mmap 29a7953e9adea regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK 889374b8e4a60 dm era: fix NULL pointer dereference in metadata_open() 79cd550f8c884 SUNRPC: pin upper rpc_clnt across the TLS connect_worker ce4d29a99878c SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED d64b6be5740ce cifs: validate DFS referral string offsets 25e7c0fc304bd s390/zcrypt: Remove the empty file 9bc9b95aee2b2 ipvs: ensure inner headers in ICMP errors are in headroom accee8e53a760 ipvs: fix PMTU for GUE/GRE tunnel ICMP errors d45f73c274435 ipvs: use parsed transport offset in TCP state lookup 946e09454b1a0 ipvs: pass parsed transport offset to state handlers 9815e834f5ff8 ipv6: mcast: Fix potential UAF in MLD delayed work 8374a462c74ec ipv6: mcast: Replace locking comments with lockdep annotations. 40a1e998cb266 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() 75a7e03ad7336 octeontx2-pf: check DMAC extraction support before filtering 336c1e414fc0e net/sched: cake: reject overhead values that underflow length ff431529d3773 net: usb: lan78xx: disable VLAN filter in promiscuous mode 0e75abbc36ed1 net: usb: lan78xx: move functions to avoid forward definitions 0867b0f2513eb net/tls: Consume empty data records in tls_sw_read_sock() dbcb8635b1eb7 ring-buffer: Fix event length with forced 8-byte alignment f80b4afe893df Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() 85f5e3a9885a3 Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length 5aabbd01ac315 Bluetooth: MGMT: Fix adv monitor add failure cleanup ba1f1ef6522e6 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control dd54267a70e32 amt: fix size calculation in amt_get_size() 647b19e5cc145 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket 0d8532a5e972a net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload 3868c3244369a net: qualcomm: rmnet: validate MAP frame length before ingress parsing 0bf78df2d3ecb qede: fix off-by-one in BD ring consumption on build_skb failure 786456d0a244b net: microchip: vcap: fix races on the shared Super VCAP block 24c77044cdfcf net/mlx5e: Fix HV VHCA stats agent registration race 5b927dcec5f10 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation 8ace320ac4416 netfilter: xt_connmark: reject invalid shift parameters 2fd89a50a9783 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop 5da915fc159c6 netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() 0a8b7a6d76377 netfilter: xt_u32: reject invalid shift counts 2a99224c12082 gue: validate REMCSUM private option length 685e92934f11d net: usb: net1080: validate packet_len before pad-byte access in rx_fixup 6a3e06f1d1185 selftests/hid: Cover hid_bpf_get_data() size overflow 56558ef8eb2f8 selftests/hid: convert the hid_bpf selftests with struct_ops 4dee51c96e870 selftests/hid: force using our compiled libbpf headers b52c523eb8fc9 selftests/hid: do not manually call headers_install 75e9e9f1bc6ca selftests/hid: ensure we can compile the tests on kernels pre-6.3 6a10e76a56f81 arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() 33833e83cf552 arm64/mm: convert ptep_clear() to ptep_get_and_clear() 3be7e80fc59b2 arm64/mm: convert set_pte_at() to set_ptes(..., 1) 3ea68f5ec9bfe arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep) c973d53bcd420 HID: core: Fix OOB read in hid_get_report for numbered reports a02d5d7ad7ae5 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() 9eae03f0df96b ata: sata_gemini: unwind clocks on IDE pinctrl errors a11ebaab50d27 minix: avoid overflow in bitmap block count calculation 598f8ba4e8818 afs: Fix unchecked-length string display in debug statement 1607075220cf5 afs: Fix the volume AFS_VOLUME_RM_TREE is set on bef5514f6b6cb afs: Fix vllist leak 5a39b145a8fb4 afs: Fix callback service message parsers to pass through -EAGAIN ac428553b5a3d afs: use kvfree() to free memory allocated by kvcalloc() 9ad9016e3333c afs: Fix error code in afs_extract_vl_addrs() bac8fb0d60254 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid d3b5adfa2f008 net/sched: hhf: clear heavy-hitter state on reset fb64c5a232808 pinctrl: meson: restore non-sleeping GPIO access 1bc19683c8bbb gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe fb978d7205270 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check 515195c5e508c smb: move some duplicate definitions to common/cifsglob.h 16fb65ec15fe7 ksmbd: reject undersized DACLs before parsing ACEs 17efa598efd94 net/sched: act_bpf: use rcu_dereference_bh() to read the filter d04abfe08e4f8 cxgb4: Fix decode strings dump for T6 adapters 97cc510eafb6e virtio_net: disable cb when NAPI is busy-polled e6b674dc341c6 irqchip/ts4800: Fix missing chained handler cleanup on remove 57a48d17a789c irqchip/gic-v3-its: Fix OF node reference leak 284928533c7ed tracing: eprobe: read the complete FILTER_PTR_STRING pointer 63d5fd8f5e2db tracing/events: Fix to check the simple_tsk_fn creation 4c40eec06eeac bridge: stp: Fix a potential use-after-free when deleting a bridge 735567bde7401 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF e8c714acf5573 net: gianfar: dispose irq mappings on probe failure and device removal d2c37f26d1a37 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy 573418f7ea8f8 usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() 2106bf4056858 hwmon: (pmbus) Fix passing events to regulator core 39a581bd64a0e hwmon: adm1275: Prevent reading uninitialized stack 8c693f988ce1b MIPS: DEC: Ensure RTC platform device deregistration upon failure dcb0940c3df1e sctp: fix SCTP_RESET_STREAMS stream list length limit f55276160ffad net: enetc: check the number of BDs needed for xdp_frame e30af53dca803 qede: fix out-of-bounds check for cqe->len_list[] 804bb969f194c seg6: validate SRH length before reading fixed fields a05c848a94bbc gpio: htc-egpio: use managed gpiochip registration f0320c623f4d4 gpio: mvebu: fail probe if gpiochip registration fails 0567b5bcbd793 spi: sh-msiof: abort transfers when reset times out edce0203a4fc0 tracing: probes: fix typo in a log message cde84429e0fae dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback d805c95580b23 ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count 1596d8ecb6680 net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove a63eaf7605d15 net: sungem: fix probe error cleanup be626ac1faadd net: mvneta: re-enable percpu interrupt on resume aa6e2b431070b rtc: cmos: unregister HPET IRQ handler on probe failure ebe5ad5937dbc rtc: ds1307: Fix off-by-one issue with wday for rx8130 0d6d5194d9bba smb/client: preserve errors from smb2_set_sparse() ea8e946b09baf ipv6: fix error handling in disable_policy sysctl 2474255868717 ipv6: fix error handling in forwarding sysctl 7469cebbd8107 ipv6: fix error handling in ignore_routes_with_linkdown sysctl bcf9266fc3cd1 ipv6: fix error handling in disable_ipv6 sysctl 447d493034a9c net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle 83090f5e7b547 veth: fix NAPI leak in XDP enable error path fc62bfd30d30a net: dsa: sja1105: round up PTP perout pin duration 3876318ea54e8 net, bpf: check master for NULL in xdp_master_redirect() bd9e5220ffb15 alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs 4de5ff924c0a8 alpha/PCI: Add security_locked_down() check to pci_mmap_resource() 4e5ed2a7dda54 NTB: epf: Fix doorbell bitmask and IRQ vector handling 3fb009699812a NTB: epf: Report 0-based doorbell vector via ntb_db_event() ba1a84de32848 NTB: epf: Make db_valid_mask cover only real doorbell bits efc17b9240d82 netfilter: nft_compat: ebtables emulation must reject non-bridge targets 1655ca28c5b6d netfilter: nft_synproxy: stop bypassing the priv->info snapshot abef7f817217f netfilter: nf_conncount: prevent connlimit drops for early confirmed ct 87f7a720de254 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() 6b44c6660aa1c bpf: Disable xfrm_decode_session hook attachment b3b4719429d5c bpf, lsm: Add disabled BPF LSM hook list 49eaf14032013 ipv4: fib: Don't ignore error route in local/main tables. 302d57ed78728 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). 7470511d085af ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE 52c73b6992b46 rtc: msc313: fix NULL deref in shared IRQ handler at probe 3186a301d65d5 i40e: Fix i40e_debug() to use struct i40e_hw argument d662269211c49 ice: fix AQ error code comparison in ice_set_pauseparam() 335c2dd21ad9d ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() 2465d1bdf84e0 PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0 014dd1c8617ba PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0 bfa05d89dc3ca drm/edid: fix OOB read in drm_parse_tiled_block() 525e408c27ae7 bpf: Fix effective prog array index with BPF_F_PREORDER 9fe373020cc9d bpf: zero-initialize the fib lookup flow struct 475405593de2b bpf: Fix stack slot index in nospec checks 48c16ed988790 rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 429025d25ac24 rtc: abx80x: fix the RTC_VL_CLR clearing all status flags e88b1ff95f2ed octeontx2-pf: mcs: Fix mcs resources free on PF shutdown ab9c0b007c7fd octeontx2-pf: Clear stats of all resources when freeing resources 9ab0fb5758cbb octeontx2-af: mcs: Fix unsupported secy stats read 754dfaddde3a1 net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths 5e215bf1c47fd tipc: fix use-after-free of the discoverer in tipc_disc_rcv() a07f77e995a63 net: marvell: prestera: initialize err in prestera_port_sfp_bind c6edb7532c8e7 selftests/mm: fix exclusive_cow test fork() handling 75ec9461a4623 selftests/mm: allow PUD-level entries in compound testcase of hmm tests 04dfc21465992 selftests/mm: clarify alternate unmapping in compaction_test b508e7542d683 irqchip/crossbar: Fix parent domain resource leak f73b7de5338fc netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak 76d1bc5498c72 netfilter: nf_reject: skip iphdr options when looking for icmp header d01b4b471f0fc netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() 6329d3a9afe71 netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types 28642b1420f27 netfilter: ipset: annotate "pos" for concurrent readers/writers bead63993e05e netfilter: ipset: Fix data race between add and dump in all hash types c66ed3e6371f5 md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry 71b5add66c51d ieee802154: fix kernel-infoleak in dgram_recvmsg() ded58bfebcb32 ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() e74488982ecfd ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone() e3987bc539630 ACPI: resource: Amend kernel-doc style e432404e63edd thermal: intel: Fix dangling resources on thermal_throttle_online() failure 79417b08f747d arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS bcdd5a7363bdd ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints 9a65860959db5 flow_dissector: check device type before reading ETH_ADDRS f104794507099 devlink: Fix parent ref leak in devl_rate_node_create() 0ce4f958ddeb8 dpaa2-switch: fix VLAN upper check not rejecting bridge join 38e94d63e29f4 virtio-net: fix len check in receive_big() 154e29d0c6a23 spi: rpc-if: Use correct device for hardware reinitialization on resume e58aef585d173 PCI: iproc: Restore .map_irq() for the platform bus driver 722576aba0a6d sctp: hold socket lock when dumping endpoints in sctp_diag befe1ebe7fc2c net: psample: fix info leak in PSAMPLE_ATTR_DATA 19d2d36e193c3 octeontx2-pf: Fix leak of SQ timestamp buffer on teardown cfbffc8091f51 drm/amdgpu: initialize irq.lock spinlock earlier 506e635aed05d drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm 283e77af49fda drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free a6d0abb35052c ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode efa9e3b9f3dea xfrm: validate selector family and prefixlen during match a1c6d68ddee37 xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[] be8cdef5c93d5 xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path 22d554d9ba241 xfrm: Use the XFRM_GRO to indicate a GRO call on input cb4f93bdade99 spi: dw: fix wrong BAUDR setting after resume 6564da2814a79 gpio: mlxbf3: fail probe if gpiochip registration fails e1a215900d2ed sparc: led: avoid trimming a newline from empty writes 5feaaa1d34b29 apparmor: fix label can not be immediately before a declaration b8e89081a97b6 i3c: master: Prevent reuse of dynamic address on device add failure 07fea242a8942 apparmor: put secmark label after secid lookup 58817bf37ccc4 apparmor: aa_getprocattr free procattr leak on format failure 5cba148eae6e8 apparmor: fix potential UAF in aa_replace_profiles 5acb878db4132 apparmor: grab ns lock and refresh when looking up changehat child profiles 6a26de6c05542 apparmor: fix rawdata_f_data implicit flex array cc2192899d502 apparmor: aa_label_alloc use aa_label_free on alloc failure b7c45c05a396a apparmor: check label build before no_new_privs test 79d80d70b03d1 security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref() 6848ca381edff Revert "PCI/MSI: Unmap MSI-X region on error" 2e605bef29e09 PCI: mediatek: Use actual physical address instead of virt_to_phys() 26b30daf73ae8 PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() b3c60e4f962dd tools lib api: Fix mount_overload() snprintf truncation and toupper range bd0a73192c3a9 tools lib api: Fix filename__write_int() writing uninitialized stack data 20a17dd8a0c7e tools lib api: Fix missing null termination in filename__read_int/ull() 05457b1241d74 xprtrdma: Return sendctx slot after Send preparation failure 4322fd9645ee7 xprtrdma: Repost Receive buffers for malformed replies 4163424214017 xprtrdma: Sanitize the reply credit grant after parsing 88b5346284a18 xprtrdma: Fix bcall rep leak and unbounded peek e967e82e372f4 xprtrdma: Resize reply buffers before reposting receives 2b84ff4da343b xprtrdma: Document and assert reply-handler invariants dd798b76a3481 xprtrdma: Check frwr_wp_create() during connect 65a04db641fdb PCI: rcar-host: Remove unused LIST_HEAD(res) 2097a2537d9d1 fs/ntfs3: resize log->one_page_buf when adopting on-disk page size 018359b048c4c PCI: meson: Propagate devm_add_action_or_reset() failure b0c5bc5068f8c PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro 4bc7e5c789b62 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write 502b282f2f452 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors c31ce9fd8b349 nfs: keep PG_UPTODATE clear after read errors in page groups 02e00663846b2 NFSv4/pnfs: defer return_range callbacks until after inode unlock 9f3d9b68c1c6c xprtrdma: Decouple req recycling from RPC completion d006a5fb63b92 xprtrdma: Use sendctx DMA state for Send signaling d1b159356a358 xprtrdma: Post receive buffers after RPC completion 9d17e2618037d xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot b7070614baeba xprtrdma: Avoid 250 ms delay on backlog wakeup e253e1a0b360e xprtrdma: Remove temp allocation of rpcrdma_rep objects b6c4002122573 pNFS/filelayout: fix cheking if a layout is striped a64d70d5e33f8 clk: qcom: a53: Corrected frequency multiplier for 1152MHz 5876f38b67a30 dmaengine: Fix possible use after free 98cc38b541014 dmaengine: qcom: gpi: set DMA_PRIVATE capability ba8b410c7c4f6 perf: Fix off-by-one stack buffer overflow in kallsyms__parse() b67a3bcc1cb49 dmaengine: imx-sdma: Refine spba bus searching in probe bca364c4c7579 drm/amd/display: Add missing kdoc for ALLM parameters 914a77aa7a24e fs/ntfs3: fix mount failure on 64K page-size kernels 8afc24a884aff fs/ntfs3: add bounds check to run_get_highest_vcn() 6c63a4ed26927 HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter eda31b3b90f15 clk: at91: keep securam node alive while mapping it 8ac30431ca7e4 iio: tcs3472: power down chip on probe failure eed69f8a10b82 iio: accel: mma8452: handle I2C read error(s) in mma8452_read() 94d158985b6ea iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling 8cf3460745333 iio: magnetometer: ak8975: fix potential kernel stack memory leak 922e9be5c41a2 iio: light: si1133: prevent race condition on timeout 4799162324a84 iio: light: si1133: reset counter to prevent race condition 764723bd67a6c char: tlclk: fix use-after-free in tlclk_cleanup() 2bb0cfa1392c3 usb: host: max3421: Reject hub port requests for non-existent ports d512bdefd241b usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() 4928096212b78 staging: most: video: avoid double free on video register failure e519c1d8c5efb mailbox: mtk-adsp: fix UAF during device teardown 9c55eb9a0f6f4 phy: phy-can-transceiver: Check driver match and driver data against NULL 4d6628c106697 bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker() 78a0d1fa5d7a3 PCI: loongson: Do not ignore downstream devices on external bridges f67b187af7493 platform/x86: xo15-ebook: Fix wakeup source and GPE handling 37b43903ef0f0 x86/platform/olpc: xo15: Drop wakeup source on driver removal 4997873e3abba PCI: Check ROM header and data structure addr before accessing 01b03bc88bd8d PCI: Introduce named defines for PCI ROM a397bf58445ff PCI/ASPM: Don't reconfigure ASPM entering low-power state d887844028cd6 coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore 66433aca6e806 coresight: cti: Fix DT filter signals silently ignored 08626fcfe1230 staging: nvec: fix use-after-free in nvec_rx_completed() 8aadc136d8e8d net/9p: fix race condition on rdma->state in trans_rdma.c 49b34bd3ad696 ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write 2ce02059ceb63 mfd: cs42l43: Sanity check firmware size 7c3264d273d52 ksmbd: fix use-after-free in same_client_has_lease() 179966099aa10 ionic: Fix check in ionic_get_link_ext_stats 572fff10819df tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) 50ff092633b06 tipc: fix UAF in tipc_l2_send_msg() 00cd01ea0cf53 KEYS: Use acquire when reading state in keyring search 55d0edf94c19c powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus 7c75878359bd2 powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down 5397142d60aa2 powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del ac7385af1dca8 MIPS: mm: Fix out-of-bounds write in maar_res_walk() c05a0ec1cdced bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check 888706a76286c bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() 5c5fccbcf3e1c bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket 98219ce3e1c96 selftests/bpf: Initialize operation name before use 6fb80feea3099 smb/client: always return a value for FS_IOC_GETFLAGS 4465ebe67d893 cifs: remove all cifs files before kill super 3ff31b83aacf2 ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() 68d0415c16e5e netfilter: nf_conncount: callers must hold rcu read lock b8c90823cdfb5 kcm: use WRITE_ONCE() when changing lower socket callbacks 498a667dc9542 net: bcmgenet: Use weighted round-robin TX DMA arbitration 7edd4db82f942 net: wwan: t7xx: check skb_clone in control TX 8d654fa6ebf45 net/mlx5: Check max_macs devlink param value against max capability b6dced2150081 bpf: Run generic devmap egress prog on private skb 637639118ef33 net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check 8e52a247d9aa9 net: mana: initialize gdma queue id to INVALID_QUEUE_ID e8c6dbadf139c net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen acc08a0c7f37e net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen 25fb53e43ec00 handshake: Require admin permission for DONE command 23a29ee1d9de3 power: supply: core: fix supplied_from allocations 820a87639e9aa ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO dfab0d4698a64 spi: xilinx: use FIFO occupancy register to determine buffer size cbc2fcf580882 crypto: rng - Free default RNG on module exit 8afd1007ef798 crypto: cavium/cpt - fix DMA cleanup using wrong loop index ed374dbc70c10 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index 66bdbb8e6c5c8 cxl/test: Add check after kzalloc() memory in alloc_mock_res() f1715d92ee309 tipc: reject inverted service ranges from peer bindings 47ed873e4ceda tipc: prevent snt_unacked underflow on CONN_ACK 9b937de4b3ded tipc: require net admin for TIPCv2 netlink mutators b2a017bfcf565 net/sched: sch_hfsc: Don't make class passive twice 85f54cf589163 sctp: validate embedded address parameter length 53788b134519e bridge: cfm: reject invalid CCM interval at configuration time a7ef30753353b net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). 3d05400186027 net/sched: cls_flow: Dont expose folded kernel pointers 4bcb23635d505 ASoC: tegra: tegra210_ahub: Validate written enum value 0b10c6203e62d ASoC: fsl: fsl_audmix: Validate written enum values 8cbf24714d6b3 ASoC: codecs: hdac_hdmi: Validate written enum value aabfc845838ef RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one 6fc874fdfb366 RDMA/mlx5: Fix undefined shift of user RQ WQE size 87262e60adfe1 RDMA/mlx5: Remove raw RSS QP restrack tracking 60fa67263a772 fs: efs: remove unneeded debug prints 41d3e5526fcd6 Bluetooth: vhci: validate devcoredump state before side effects 290b36f9d1eb9 Bluetooth: hci: validate codec capability element length 809230cc25dde Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device b43dee28b7c81 s390/process: Fix kernel thread function pointer type eb73056ce2a6f bpf: Tighten cgroup storage cookie checks for prog arrays b0dbe5f70ee8d of: cpu: add check in __of_find_n_match_cpu_property() 7f10e0f35ac1d cxl/test: Zero out LSA backing memory to avoid leaking to user 0101d4000a124 cxl/test: Fix integer overflow in mock LSA bounds checks 2a0ee19de6e89 selftests/bpf: Fix bpf_iter/task_vma test 260830a9a706f ext4: fix kernel BUG in ext4_write_inline_data_end 015e32e264a9b bonding: 3ad: fix mux port state on oper down 3c75cd8e68f1f ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails b72d5d2d8fe76 ASoC: cs35l56: Fix missing calls to wm_adsp2_remove() 67fb36b508ce7 tools/virtio: check mmap return value in vringh_test 6445b945024f4 vhost/net: complete zerocopy ubufs only once f8e1f130689a2 vduse: Requeue failed read to send_list head 2b3f79b90b231 vhost/vdpa: validate virtqueue index in mmap and fault paths 93ed4692f2299 vduse: hold vduse_lock across IDR lookup in open path dbc63fe645f09 ASoC: codecs: aw88261: fix incorrect masks for boost regs a28ad91dc5d80 spi: meson-spifc: fix runtime PM leak on remove 407472df02dba IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified fcce8a44dfa39 btrfs: zoned: don't account data relocation space-info in statfs free space 5a15f8d87a007 hwmon: (it87) Clamp negative values to zero in set_fan() b2ff450f7f5cf fbdev: sm501fb: Fix buffer errors in OF binding code 015dc4a1e0c2c btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() 06010aab6ec04 wifi: mt76: mt7921: fix potential tx_retries underflow d42f6f25211a4 wifi: mt76: mt7915: fix potential tx_retries underflow e93b18ddc18a2 wifi: mt76: fix argument to ieee80211_is_first_frag() 66f21eecda2a2 sched/fair: Fix cpu_util runnable_avg arithmetic 6abaa8ec1b986 hwspinlock: qcom: avoid uninitialized struct members af71c2b88ccae vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() 310958030dc02 pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39 9f56b6dbefa85 pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 8c888a062c6de scsi: target: Remove tcm_loop target reset handling 0165403da5086 scsi: target: Fix hexadecimal CHAP_I handling 89184909634e5 watchdog: unregister PM notifier on watchdog unregister 9e57e2863872e configfs: fix lockless traversals of ->s_children 38149b57427c7 firmware_loader: Fix recursive lock in device_cache_fw_images() 43c9646d98a04 spi: ep93xx: fix double-free of zeropage on DMA setup failure 94f7e50eb6b2c IB/mlx5: Properly support implicit ODP rereg_mr 52d0e6527716f IB/mlx5: Don't take the rereg_mr fallback without a new translation 2bc08fe88e578 cpufreq: Documentation: fix conservative governor freq_step description e67b984f8c142 ACPI: IPMI: Fix message kref handling on dead device e0c3edd864145 ALSA: seq: Clear variable event pointer on read dba54c80f86eb riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe 32b482fbda6b5 ALSA: seq: Fix partial userptr event expansion c07aa0534d503 wifi: wcn36xx: fix OOB read from short trigger BA firmware response 64228dfc4247a wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication cfc67aee0c83e wifi: wcn36xx: fix heap overflow from oversized firmware HAL response 5e630134d11d4 bpf: Update transport_header when encapsulating UDP tunnel in lwt 1bfabe51760db bpf: Check tail zero of bpf_prog_info f8ab1c1bf42ee arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well 3982121730f91 RDMA/irdma: Initialize iwmr->access during MR registration ad360a31092a8 RDMA/irdma: Fix OOB read during CQ MR registration 9b82054dfe69a IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path() c121473586603 netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp 6bba4846f196d netfilter: conntrack: revert ct extension genid infrastructure 8d86b4041d219 netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock cc5d7dadb6d87 netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures f38fb17c8758e ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() aa7883b6a3c76 ocfs2/dlm: require a ref for locking_state debugfs open 346314bb0cc2f ocfs2: reject FITRIM ranges shorter than a cluster ecb3f9386f435 ocfs2: fix buffer head management in ocfs2_read_blocks() 6b38a5b8ee951 ocfs2: rebase copied fsdlm LVB pointers in locking_state a97a5f842c68f perf/x86/amd/core: Always use the NMI latency mitigation c35dce681145f bpftool: Use libbpf error code for flow dissector query 71323880be792 drm/amdgpu: set sub_block_index for mca ras sub-blocks eee07d769da5a configfs_lookup(): don't leave ->s_dentry dangling on failure b0799d03b709f lib/test_meminit: use && for bools e8bbcc00760df sched: restore timer_slack_ns when resetting RT policy on fork 8990dbb7065b0 ext2: fix ignored return value of generic_write_sync() 4af4f0b04964a mm/fake-numa: fix under-allocation detection in uniform split c70d0f9114c3c bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs 10e05b5ff05ce scsi: ufs: Fix wrong value printed in unexpected UPIU response case 4f944acca6379 scsi: pm8001: Fix error code in non_fatal_log_show() da4853eb4616f scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" 73e35c1bdfa16 nvdimm/btt: Handle preemption in BTT lane acquisition c225bb49c697f ARM: imx31: Fix IIM mapping leak in revision check ddab66c9a90d6 ata: libata: Fix ata_exec_internal() 21b8e6afbd1bb HID: wiimote: Fix table layout and whitespace errors 7eb7c42ec4930 ARM: imx3: Fix CCM node reference leak 93bc5642fbda3 ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble 70b1c71b1fdfb ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback ce3030e92f143 md/raid10: reset read_slot when reusing r10bio for discard 964a44a990d61 rpmsg: use generic driver_override infrastructure 04c18c43d250e media: qcom: venus: relax encoder frame/blur step size on v6 061a2f302fc50 media: qcom: venus: relax encoder frame/blur dimension steps on v4 c4f0846d1d246 media: qcom: venus: drop extra padding in NV12 raw size calculation fc72fd61cc8b2 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path cd19a6345e372 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe 0c16d7c01284a EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info 01623d834b5e8 drm/msm/dp: Fix the ISR_* enum values fee0e0eefcd41 drm/msm/dp: fix HPD state status bit shift value 86145b5c5a7c2 crypto: hisilicon/qm - disable error report before flr cc7d67197c51a ocfs2: kill osb->system_file_mutex lock b460f8d01a120 ocfs2: don't BUG_ON an invalid journal dinode acd54f42abbbd rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() d47b0b8a69a13 dax/kmem: account for partial discontiguous resource upon removal ca06e163e5181 libbpf: Fix UAF in strset__add_str() fb203d0e21dc0 libbpf: Harden parse_vma_segs() path parsing 9980c66ad2d4f drm/nouveau/bios: specify correct display fuse register for Ampere and Ada 13d9e73955c91 drm/tegra: Fix iommu_map_sgtable() return value check 3ac173e46ef6f gpu: host1x: Fix iommu_map_sgtable() return value check 3d211fb43a04e drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() 71c017b3f83ff gpu: host1x: Allow entries in BO caches to be freed 4b731af227c69 drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove 6e22d5ad61cfa drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered 4a76953c3ed04 net/sched: cls_bpf: prevent unbounded recursion in offload rollback 1e3db30a88815 ipv6: guard against possible NULL deref in __in6_dev_stats_get() ec2644cc69e14 workqueue: drop spurious '*' from print_worker_info() fn declaration 9ffdd11bd6c96 nvme-multipath: fix flex array size in struct nvme_ns_head 2f7c245d4601d pinctrl: cs42l43: Fix polarity on debounce 936641af564c3 ALSA: seq: midi: Serialize output teardown with event_input 82d6a87de7843 mtd: spi-nor: Drop duplicate Kconfig dependency 5b36ed8cc78f5 mips: n64: add __iomem for writel call 9291ea4dc7b05 mips: ralink: mt7621: add missing __iomem 17f5de95069b8 MIPS: DEC: Remove do_IRQ() call indirection f3d1b0c22466f MIPS: Fix big-endian stack argument fetching in o32 wrapper 59096e2aa0f66 PM: sleep: Use complete() in device_pm_sleep_init() a22346dc47b02 RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup a075a7acd155f RDMA/hns: Fix warning in poll cq direct mode 1035807ed1aba IB/mlx4: Fix refcount leak in add_port() error path 665fb7d22a700 RDMA/rxe: Fix a use-after-free problem in rxe_mmap 9f8f0d2099e3d RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs b0c4c1d8d42f4 bus: sunxi-rsb: Always check register address validity 5ff037ec8b5e9 pwm: imx27: Fix variable truncation in .apply() 7a832f4070be1 cpufreq: conservative: Simplify frequency limit handling de8f81c0e7d3e cpufreq: Documentation: fix sampling_down_factor range 9f1de8e384012 Revert "treewide: Fix probing of devices in DT overlays" 73323db56aae6 driver core: Use mod_delayed_work to prevent lost deferred probe work 08739321420f0 device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() 0c584c27f6649 tracing: Bound synthetic-field strings with seq_buf 0a1d6bbba52ae arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node 30aa348494531 firmware: arm_scmi: Fix OOB in scmi_power_name_get() 8972d8f38373e media: rockchip: rga: fix too small buffer size ed4e2f9f7e54b net/sched: sch_drr: annotate data-races around cl->deficit 8bfe280576b2a regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions e05e423fff76c bitops: use common function parameter names 969203772e515 sysfs: clamp show() return value in sysfs_kf_read() 457136c9719af firmware: arm_scmi: Read sensor config as 32-bit value f8c7669f57056 media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() dcf7a986f377c RDMA/srpt: fix integer overflow in immediate data length check 1025dc2f7ba29 RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference 0ccf70ea84330 RDMA/hns: Fix arithmetic overflow in calc_hem_config() 2c3b2667dad69 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier 8ed0ce9ea58d6 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD 1134ff0c8228f net/sched: sch_htb: annotate data-races (I) dc56c30c50cee net/sched: sch_htb: do not change sch->flags in htb_dump() e9c1d78836cef spi: hisi-kunpeng: Use dev_err_probe() for host registration failure 50c3c7df4f26d crypto: ccp - Treat zero-length cert chain as query for blob lengths 5543dd4d8eb58 net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() 1029bb377700e clk: scpi: Unregister child clock providers on remove 345675e960ab4 thermal: hwmon: Fix critical temperature attribute removal a36cbfb85f26e evm: terminate and bound the evm_xattrs read buffer 31f5ad37509d6 drm/hisilicon/hibmc: use clock to look up the PLL value 08bb9f3fdd4e6 drm/hisilicon/hibmc: move display contrl config to hibmc_probe() cca79a18f6275 arm64: dts: qcom: sm8450: Fix ICE reg size 79784c80d570e clk: scmi: Fix clock rate rounding c10d7a84e5a1a arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host 747a1775c4ee1 iommu/amd: Fix a stale comment about which legacy mode is user visible ac3d1a11397a4 nilfs2: fix backing_dev_info reference leak ae9e534e502a0 dlm: fix add msg handle in send_queue ordered 627938383761f crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents 32e50358edf05 crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve e833e865e4944 crypto: atmel-sha204a - fix blocking and non-blocking rng logic f79c80f173fda vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). 95b9fff4036e3 arm64: dts: imx8x-colibri: Correct SODIMM PAD settings 118930f6c9dcf arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc c399e66507af1 pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path 42fbc613682f5 media: v4l2-common: Add YUV24 format info d011267be9a3f media: cedrus: Fix failure to clean up hardware on probe failure 0b22f0181250b watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure 72b77aa04b50a watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5 886c7101db617 watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH ee346dcb5ebcd ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint 46ca1451f61b5 wifi: ath9k: fix OOB access from firmware tx status queue ID 3e135495c1657 kconfig: fix potential NULL pointer dereference in conf_askvalue 6a3c384393d3f wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer 966fbed4b4463 wifi: rtw89: Correct data type for scan index to avoid infinite loop 5e79e0180515b driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() 89a75e3349c4f drm/amdkfd: Validate CRIU-restored IDs before idr_alloc d2ebe124d3633 dt-bindings: pinctrl: nvidia,tegra234: Add missing required block da4a14062bbcb arm64: tegra: Fix Tegra234 MGBE PTP clock dbb66f78931b1 wifi: cfg80211: fix grammar in MLO group key error message 2ed6b94441cf6 arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning 6d7ef14197b71 arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S b6f6a8b8c3f92 Documentation: proc: fix section numbering in table of contents 126549251ce38 libbpf: Report error when a negative kprobe offset is specified 1c9ba32308c02 drm/radeon: fix memory leak in radeon_ring_restore() on lock failure b7b44937c548c drm/radeon: fix integer overflow in radeon_align_pitch() a5d13544cacb3 drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch() a0a24f75f8420 drm/tidss: Drop extra drm_mode_config_reset() call c0d5266a945a4 drm/rockchip: Test for imported buffers with drm_gem_is_imported() e3e69cfb053e6 clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive() 9b783b7e03dc7 fbcon: fix NULL pointer dereference for a console without vc_data f34fa27d4ac18 afs: Fix further netns teardown to cancel the preallocation charger 867b3ea146a04 afs: fix NULL pointer dereference in afs_get_tree() 85d5fb80fe4f0 afs: Fix netns teardown to cancel the preallocation charger 86eff3140c9d4 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK) 8bbede0afced3 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc c004ef925faf0 serial: 8250_omap: clear rx_running on zero-length DMA completes abc1926c88c18 serial: msm: Disable DMA for kernel console UART 6c9ac3417de7b dt-bindings: power: imx93: Add MIPI PHY power domain 3a9c0bee69e68 dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties 47ca0107e6a65 media: uvcvideo: Fix sequence number when no EOF e1052f8406019 media: uvcvideo: Fix buffer sequence in frame gaps 3351da80ca645 media: uvcvideo: Avoid partial metadata buffers 116f0e0890896 bpf: Prefer dirty packs for eBPF allocations 8d65c431e1037 bpf: Prefer packs that won't trigger an IBPB flush on allocation 1f232626a42b6 bpf: Skip redundant IBPB in pack allocator 3b3b23c80202c bpf: Restrict JIT predictor flush to cBPF cb27f3bf915cc x86/bugs: Enable IBPB flush on BPF JIT allocation 6e52c240c43a6 bpf: Support for hardening against JIT spraying 9badc789a500a crypto: hisi-trng - Remove crypto_rng interface 9a0e68b66e7ce crypto: crypto4xx - Remove insecure and unused rng_alg 05b7812164cee crypto: crypto4xx - Remove ahash-related code b2dbc71fe33b4 x86/mm: Fix check/use ordering in switch_mm_irqs_off() 306ded31bfa00 crypto: sun4i-ss - Remove insecure and unused rng_alg e091ff83d962f nvmet-tcp: Fix potential UAF when ddgst mismatch e602c93b25bda nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path 477145860dba4 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU 2c5e72b9fbf83 KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU 7b91e51d0eb7c crypto: algif_skcipher - force synchronous processing on trees without ctx->state 5a3218fbdeacb sched/fair: Only update stats for allowed CPUs when looking for dst group d6998ddd507c8 block: skip sync_blockdev() on surprise removal in bdev_mark_dead() c2e252e04fdcc smb/server: do not require delete access for non-replacing links 50f0012da1040 xfs: resample the data fork mapping after cycling ILOCK d0ae7ec3aa61d xfs: fail recovery on a committed log item with no regions 36bfa52459e45 smb: client: reject overlapping data areas in SMB2 responses 0e4a5a000123d fuse: re-lock request before returning from fuse_ref_folio() 018e33d403946 fuse: fix device node leak in cuse_process_init_reply() b2e26c955f8dd RDMA/siw: bound Read Response placement to the RREAD length 2912f3d40355d RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg 04781ba93e362 Input: maplecontrol - set driver data before registering input device 985cb452c2d10 Input: maplemouse - set driver data before registering input device 330f7b37f838c Input: maple_keyb - set driver data before registering input device d89daead87d9b Input: mms114 - fix multi-touch slot corruption a72f944864b45 Input: maplemouse - fix NULL pointer dereference in open() 5d2ea15ba03bf Input: mms114 - reject an oversized device packet size 431ad239f2924 Input: touchwin - reset the packet index on every complete packet 112666835071d Input: mms114 - fix touch indexing for MMS134S and MMS136 c21295616a8a5 Input: iforce - bound the device-reported force-feedback effect index 719d1a2c83a46 Input: goodix - clamp the device-reported contact count 8c1db3418a419 Input: elan_i2c - prevent division by zero and arithmetic underflow 26c895928d711 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count ba57f43032853 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count 5bd64ed8dd76f Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure 8f9b0cb58a10f i2c: stm32f7: truncate clock period instead of rounding it 0c36f72fc4d94 i2c: mpc: Fix timeout calculations 9882a9bd74db0 i2c: core: fix adapter deregistration race 051be2ed4d073 udmabuf: fix DMA direction mismatch in release_udmabuf() ffaaff82336db KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode 8192763d0ad78 KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs 503fdfdcac243 NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr() ce4736c1e6c4c exfat: bound uniname advance in exfat_find_dir_entry() afcc0515bbdd2 module: decompress: check return value of module_extend_max_pages() 22c1fd1355ad4 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC 35ae19764eabf tracing: Prevent out-of-bounds read in glob matching 0cab02d06307c watchdog: apple: Add "apple,t8103-wdt" compatible caf08fd5ed742 EDAC/i10nm: Don't fail probing if ADXL is missing e65505d91fa03 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path bf69ee9355c26 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() 51ffc1f5d8981 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state() 7953af378a19f crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation 0fae6fb13c49e crypto: talitos/hash - remove useless wrapper c9a65ad48bd24 crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request d1731c1798f8f crypto: talitos/hash - drop workqueue mechanism for SEC1 44174532b459a crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue 49ca4ff6d6432 crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor 9c68f257f9b29 crypto: talitos - move code in current_desc_hdr() into a standalone function a9ba45af2788f crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function 03ab5ac0dc382 crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function c25be6c4e4bef crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1 3d1d94445ab01 crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header 500319830d769 crypto: qat - validate RSA CRT component lengths e3155eb0ea98f crypto: drbg - Fix the fips_enabled priority boost d955e2127c34c crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels cc42fb40171c2 crypto: drbg - Fix returning success on failure in CTR_DRBG 82789a44415e3 crypto: pcrypt - restore callback for non-parallel fallback 677450e5ef850 crypto: ecc - Fix carry overflow in vli multiplication c8cfe11e48b2a crypto: caam - use print_hex_dump_devel to guard key hex dumps again ebd37eef6e4f4 crypto: caam - use print_hex_dump_devel to guard key hex dumps 425d2001df58c crypto: af_alg - Remove zero-copy support from skcipher and aead b736b12108fd1 isofs: bound Rock Ridge symlink components to the SL record fd94a779020f2 partitions: aix: bound the pp_count scan to the ppe array 9c894159c5b8a btrfs: do not trim a device which is not writeable be5e5553b1e2a nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks ee4465a245c14 dm-ioctl: report an error if a device has no table 93dfe94d55676 hwrng: jh7110 - fix refcount leak in starfive_trng_read() 7285276aa50d2 udf: validate sparing table length as an entry count, not a byte count bb0d384c1f42a udf: validate VAT header length against the VAT inode size fb49099206c5c udf: validate free block extents against the partition length 7f91201b1e486 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining edcbc218c39f6 iio: temperature: ltc2983: Fix n_wires default bypassing rotation check 97a5da403566c usb: typec: ucsi: cancel pending work on system suspend c32df11147822 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove af040c5b300c0 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode 0195c30c77e3a usb: typec: ucsi: Invert DisplayPort role assignment 012406f89abc5 usb: typec: tcpm: Validate SVID index in svdm_consume_modes() a82450bcb7ae4 usb: typec: class: drop PD lookup reference 58b26ba693008 usb: typec: anx7411: use devm_pm_runtime_enable() d0ebf9cc7c2dd usbip: vudc: fix NULL deref in vep_dequeue() 5bd3654a778bd usbip: tools: support SuperSpeedPlus devices 0b0651f8ed4f0 USB: usb-storage: ene_ub6250: restore media-ready check 5c098f20f15db USB: ulpi: fix memory leak on registration failure 699dfb6917503 USB: serial: digi_acceleport: fix write buffer corruption bcfeae431db99 USB: serial: digi_acceleport: fix hard lockup on disconnect 8d50a910194f6 USB: serial: digi_acceleport: fix broken rx after throttle 64a115456397c USB: serial: option: add Telit Cinterion FE990D50 compositions 2f7a6b8ab3845 USB: serial: keyspan_pda: fix information leak 4183874b7925f usb: mtu3: unmap request DMA on queue failure 0b3073f40cc9f USB: misc: uss720: unregister parport on probe failure 6a935158d01f9 USB: storage: include US_FL_NO_SAME in quirks mask bb545c4dd22a3 usb: sl811-hcd: disable controller wakeup on remove 0b57e5ddbd89d USB: legousbtower: fix use-after-free on disconnect race 9b40d283ac2ad USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD 164398601a7f1 USB: iowarrior: fix use-after-free on disconnect 02ca08fff74cf USB: ldusb: fix use-after-free on disconnect race 60fc5ef4ecea3 USB: idmouse: fix use-after-free on disconnect race 75c0ad13e1369 usb: gadget: f_printer: take kref only for successful open 7a5214dae906d usb: gadget: udc: Fix use-after-free in gadget_match_driver 56add2b9b2e89 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler be5004395dfd0 usb: free iso schedules on failed submit 164a966035039 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume() dd338e4ffa7fe USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub fde3c095e1d48 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() 19d9ff2b423d1 usb: cdc_acm: Add quirk for Uniden BC125AT scanner 46ab32870d010 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() 702d75f1a6025 bpf: Restore sysctl new-value from 1 to 0 bccbab36ff228 bpf: Reject fragmented frames in devmap 2c590972a2735 xfs: fix unreachable BIGTIME check in dquot flush validation 960b29769c909 xfs: use null daddr for unset first bad log block 0fed0fc34ce73 media: mtk-jpeg: cancel workqueue on release for supported platforms only 286f77d002a33 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers 16ca053c2be5f hfs/hfsplus: zero-initialize buffer in hfs_bnode_read 798d762a5e55b HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads 33cd1a000daf9 HID: lg-g15: cancel pending work on remove to fix a use-after-free 523db788c0f84 HID: letsketch: fix UAF on inrange_timer at driver unbind 1a1ebdcb56ae5 HID: wacom: stop hardware after post-start probe failures 5b535bde893f5 tools/mm/slabinfo: fix total_objects attribute name d2468e241af4c tools/mm/slabinfo: Fix trace disable logic inversion 459b3a373d197 X.509: Fix validation of ASN.1 certificate header 9638d3d28f9fe clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances e5ffc638faf5d posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path 982c9f92d57bd cpufreq: pcc: fix use-after-free and double free in _OSC evaluation 73255d702c756 cpufreq: Fix hotplug-suspend race during reboot 860aaff72c844 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT 069ae9502f27f cpufreq: intel_pstate: Sync policy->cur during CPU offline 46d403da376a8 firmware_loader: fix device reference leak in firmware_upload_register() f0776d142e530 OPP: of: Fix potential memory leak in opp_parse_supplies() 08c600b7e1818 smb: client: mask server-provided mode to 07777 in modefromsid 0de5b8e76847f smb: client: harden POSIX SID length parsing b723097775598 smb: client: use unaligned reads in parse_posix_ctxt() 9136a08dc2932 smb: client: Fix next buffer leak in receive_encrypted_standard() 037511726228a smb: client: fix double-free in SMB2_close() replay 02bc2896bdc3e smb: client: fix double-free in SMB2_open() replay 6e27f40b682a5 smb: client: fix double-free in SMB2_flush() replay 5821f9dbb8b5b smb: client: fix change notify replay double-free 0be4bc64882ed smb: client: fix double-free in SMB2_ioctl() replay 100fb7c455fa8 smb: client: fix query_info() replay double-free 3409aedf3c81a smb: client: fix query directory replay double-free f08b3f451f12e ksmbd: use opener credentials for delete-on-close 2b9d2a370d639 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION 288a4abc16fe5 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION b35afd5cf8fab ksmbd: run set info with opener credentials e6aa731f1b4b3 ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY 67bdad9cf01b2 ksmbd: require source read access for duplicate extents 7703fd9aba1f2 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation 2a64dbf9c739d ksmbd: serialize QUERY_DIRECTORY requests per file 3072d82461f49 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA 620d133d46929 ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE aa37f5fef78dd smb/client: Fix error code in smb2_aead_req_alloc() 38dbc8db8341c coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() ea59d9dbc5504 fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() 3ca13af5a4004 fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio() 92300ac7ff17c fs/ntfs3: handle attr_set_size() errors when truncating files caa36a91c9c51 fs/ntfs3: fsync files by syncing parent inodes 98d93c226bdfa Bluetooth: L2CAP: validate option length before reading conf opt value c66a95e60b65d Bluetooth: fix UAF in bt_accept_dequeue() 21e60eb4d9585 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() ae215c5b6422d Bluetooth: bnep: pin L2CAP connection during netdev registration 466540e045d01 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() 2664f537ca5bc netfilter: ebtables: terminate table name before find_table_lock() d2367d99f2455 netfilter: ebtables: module names must be null-terminated e44f78f5f0585 netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump 09d2407985b8c mm: shrinker: fix NULL pointer dereference in debugfs 729ae27dc2503 mfd: cros_ec: Delay dev_set_drvdata() until probe success e81f805824a81 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes 76d030ac95e17 ipv4: igmp: remove multicast group from hash table on device destruction ea61b04e1d724 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item 19d63fd528719 gpio: eic-sprd: use raw_spinlock_t in the irq startup path 1dba8444ac010 NTB: epf: Avoid calling pci_irq_vector() from hardirq context 946046841013e fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns d663fbf28b2ee debugobjects: Plug race against a concurrent OOM disable caed4a96d5575 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete 7ff42312ccde5 audit: Fix data races of skb_queue_len() readers on audit_queue 273c06b81d2e9 net: af_key: initialize alg_key_len for IPComp states b8e274e69ab09 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL f30e2b879bda1 crypto: amlogic - avoid double cleanup in meson_crypto_probe() bb3b942da4123 staging: rtl8723bs: fix OOB write in HT_caps_handler() 6f26cc55affd9 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop 4c21eec80cf50 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() 9193c34f75fd9 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop 0406d746574e8 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop 1f6c9d255bdda staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() 5d7812360abf3 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() 85263739e810d staging: media: atomisp: reduce load_primary_binaries() stack usage b7da3b9f7c3c5 media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe eef048dd77ebf staging: vme_user: fix location monitor leak in tsi148 bridge 0471a3c725326 staging: vme_user: fix location monitor leak in fake bridge 573e502d14714 smb: client: restrict implied bcc[0] exemption to responses without data area adc8b9c30d716 staging: vme_user: bound slave read/write to the kern_buf size 9a51115fcdc78 tipc: fix out-of-bounds read in broadcast Gap ACK blocks a8e3a94711134 6lowpan: fix NHC entry use-after-free on error path 5e5798880eb15 usb: dwc3: run gadget disconnect from sleepable suspend context 6c82f88bc7a84 USB: chaoskey: Fix slab-use-after-free in chaoskey_release() fde19b0d4eeab hwrng: virtio: clamp device-reported used.len at copy_data() 74a4cac9603d3 virtio-mmio: fix device release warning on module unload 96fbafc20ebd9 netfilter: ipset: fix race between dump and ip_set_list resize 74fef68d52115 mm/damon/ops-common: handle extreme intervals in damon_hot_score() 0f90c4fadef8c PCI: host-common: Request bus reassignment when not probe-only b8189e8b0343d PCI: altera: Do not dispose parent IRQ mapping ce2e36e8759df usb: typec: tcpci_rt1711h: unregister TCPCI port with devres 10666ac9c5529 usb: xhci: Fix sleep in atomic context in xhci_free_streams() 45df558c543bb binder: fix UAF in binder_free_transaction() faa070c7ad8ba binder: fix UAF in binder_thread_release() 7370cb0dccd6d Bluetooth: btusb: fix wakeup source leak on probe failure 6e1b10df890f4 Bluetooth: btusb: fix use-after-free on marvell probe failure e6313b800da61 Bluetooth: btusb: fix use-after-free on registration failure 9cc0350f2677e Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB 8e872c07e40d5 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc 08b74e320c7a2 vfio/pci: Fix racy bitfields and tighten struct layout 9e0a3f642e607 vfio/pci: Release the VGA arbiter client on register_device() failure 654710ef3135c vfio/pci: Latch disable_idle_d3 per device 28f92b8d3fefc vfio/pci: Use a private flag to prevent power state change with VFs 90310e29ca74e ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes 73178209f2fec ALSA: usb-audio: Update Babyface Pro control caches only after successful writes b31c5faf77cdf ALSA: usb-audio: Roll back quirk control caches on write errors a851636ef95a3 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks 29dc393ab69b8 ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() a47ecd904c51a ALSA: usb-audio: avoid kobject path lookup in DualSense match ea672a9f6cc38 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() 69bf1dfa32155 ALSA: ice1712: check snd_ctl_new1() return value eccf8e91266e3 ALSA: gus: check snd_ctl_new1() return value 3ed2fa1ed8cc6 ALSA: firewire: isight: bound the sample count to the packet payload 7531a37720c25 ALSA: es1938: check snd_ctl_new1() return value 8825a06bfa793 ALSA: cmipci: check snd_ctl_new1() return value 05df59b9a61f7 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser 91095474eea29 ALSA: ymfpci: check snd_ctl_new1() return value c31679fedfedc ALSA: virtio: Add missing 384 kHz PCM rate mapping 46a2cbf57dc3e iio: temperature: ltc2983: Fix reinit_completion() called after conversion start ae73df471a835 iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call 664376579d1fd iio: light: veml6030: fix channel type when pushing events 4337683a3639d iio: light: tsl2591: return actual error from probe IRQ failure 140117813afde iio: light: opt3001: fix missing state reset on timeout f350883989ced iio: light: gp2ap002: fix runtime PM leak on read error 06158c241f9a3 iio: light: al3010: fix incorrect scale for the highest gain range 34d9d5c81e9df iio: imu: st_lsm6dsx: deselect shub page before reading whoami 00982b61d026b iio: imu: inv_icm42600: fix timestamp clock period by using lower value 5a62be142e28e iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ 5240dd5cf02ba iio: gyro: bmg160: wait full startup time after mode change at probe 8d202515baea4 iio: gyro: bmg160: bail out when bandwidth/filter is not in table 0d4a646d7f87e iio: event: Fix event FIFO reset race b131f0011dfef iio: chemical: scd30: Cleanup initializations and fix sign-extension bug 030fb84816471 iio: adc: ti-ads124s08: Return reset GPIO lookup errors f3f90bc7b38ba iio: adc: spear: Initialize completion before requesting IRQ 820c4f15353ef iio: adc: lpc32xx: Initialize completion before requesting IRQ 36154171385a8 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error bfffc98f3de92 iio: accel: bmc150: clamp the device-reported FIFO frame count d6ef5af7d0fe1 usb: gadget: function: rndis: add length check for header caea8b1206043 usb: gadget: function: rndis: add length check to response query e1919d0267065 MIPS: smp: report dying CPU to RCU in stop_this_cpu() cd2463ec60f0d net: Drop the lock in skb_may_tx_timestamp() b0b39425b5202 LoongArch: Add PIO for early access before ACPI PCI root register 865a048a3f5ac virtio_net: Support dynamic rss indirection table size dbab796ff3803 arm64: sysreg: Correct sign definitions for EIESB and DoubleLock 804e2e41641bd arm64: Revamp HCR_EL2.E2H RES1 detection 6e5714bcc98f3 KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu() a2c343370351f KVM: arm64: Initialize HCR_EL2.E2H early 153ed820d525b arm64: Fix early handling of FEAT_E2H0 not being implemented 4f25422239d09 arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative d087272c49aa5 arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 5b8729416ee88 crypto: talitos - rename first/last to first_desc/last_desc 22e2db16c8011 crypto: talitos - fix SEC1 32k ahash request limitation 1981cde2f0be4 crypto: talitos - stop using crypto_ahash::init 7c3ba8f490f5b Revert "crypto: talitos - fix SEC1 32k ahash request limitation" f35e5399c97b1 Revert "crypto: talitos - rename first/last to first_desc/last_desc" 4cdb1b3ab96eb perf/core: Detach event groups during remove_on_exec a44343fe230aa ACPI: NFIT: core: Fix possible NULL pointer dereference 2fb80e9620290 ACPI: CPPC: Suppress UBSAN warning caused by field misuse 140133dac0ae9 perf trace beauty fcntl: Fix build with older kernel headers 927ef409f7139 Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID a444c3de7187b xfs: move ->iop_recover to xfs_defer_op_type 5e327f772ca89 xfs: use xfs_defer_finish_one to finish recovered work items ce9d7f9188f18 xfs: dump the recovered xattri log item if corruption happens 9395d11f63415 xfs: recreate work items when recovering intent items 9af37d8be0fb6 mm/vmscan: flush deferred TLB before freeing large folios 420e5aad7ba89 team: fix header_ops type confusion with non-Ethernet ports 9532d0d0ad1d7 bonding: prevent potential infinite loop in bond_header_parse() 5d0fb9806ab6c bonding: fix type confusion in bond_setup_by_slave() 4128ccd7683f8 bonding: fix xfrm offload feature setup on active-backup mode 8d5c8ac644554 bonding: use common function to compute the features a1d397dbc00a7 net: add a common function to compute features for upper devices ed976725dba37 bonding: Correctly support GSO ESP offload 3b2bd2018938b bonding: add ESP offload features when slaves support 4a85b335f8704 bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features 7cf5a74558e31 net, team, bonding: Add netdev_base_features helper 1f1fe94e0c727 net: team: rename team to team_core for linking f59f8c2addba0 nfsd: change nfs4_client_to_reclaim() to allocate data 2a8ff394907fe nfsd: move name lookup out of nfsd4_list_rec_dir() 42726c616d958 apparmor: advertise the tcp fast open fix is applied 655349816642f nfsd: Don't reset the write verifier on a commit EAGAIN eeabb9020721d NFSv4/flexfiles: reject zero filehandle version count a7a526fbc847f fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() da9d8d9711f78 i2c: core: fix adapter registration race 4a0034756c2a6 i2c: core: fix adapter debugfs creation ad4322d84ebf7 i2c: core: fix NULL-deref on adapter registration failure 2f8a894e148a0 i2c: core: fix hang on adapter registration failure 055aff407db51 i2c: core: fix irq domain leak on adapter registration failure 1a02a5028bd6d block: Avoid mounting the bdev pseudo-filesystem in userspace 92fc631b69deb KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() 2770041f34b52 f2fs: fix listxattr handling of corrupted xattr entries 1436031b33fa2 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() 345c1d1ff7511 f2fs: fix potential deadlock in f2fs_balance_fs() 76e1a05cf6d40 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes 7d3ae21783e59 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode d2f236196d542 f2fs: validate orphan inode entry count f0b4e1cc8ad76 device property: initialize the remaining fields of fwnode_handle in fwnode_init() e54c05ed3d9c2 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink c717f052d7023 drm/amd: Fix set but not used warnings 290014c798763 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd c75f153e5d547 slimbus: Convert to platform remove callback returning void e43819a198b56 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership da82ec28a0cf1 slimbus: qcom-ngd-ctrl: Fix probe error path ordering ade787f047906 Bluetooth: btmtk: Fix btmtk.c undefined reference build error f6290849b88a0 perf: Fix dangling cgroup pointer in cpuctx backport 5f4dbdb0a8759 userfaultfd: gate must_wait writability check on pte_present() 9440a6980fc63 Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown 51c4b6e9c0e56 Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices. f344a2d77d47e Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c 9eca71da3b843 Bluetooth: btusb: mediatek: return error for failed reg access 6501b60129664 Bluetooth: btusb: mediatek: remove the unnecessary goto tag 6b6d985e7a889 Bluetooth: btusb: mediatek: add MT7922 subsystem reset 1c770a550df2f Bluetooth: btusb: mediatek: reset the controller before downloading the fw eae5bb7c0c160 Bluetooth: btmtk: apply the common btmtk_fw_get_filename 1fa22de588a65 LoongArch: Report dying CPU to RCU in stop_this_cpu() dd699a60a29ee ext4: get rid of ppath in get_ext_path() 666e837b247fc nfsd: reset write verifier on deferred writeback errors 48a586e382e4d nfsd: release layout stid on setlease failure c39973ebd7329 bpf, arm64: Reject out-of-range B.cond targets bb51b626b5a8e ia64: Make acpi_cpufreq_cpu_exit return void (From OE-Core rev: 92b8d1a7a5576a677c1e299963b44174ed2dceb6) Signed-off-by: Bruce Ashfield Signed-off-by: Fabien Thomas --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index cb8d8c418f1..d252eb8c4a2 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "d7fbdb4e5e7a35bdb8bb87d159204d74ef130a32" -SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af" +SRCREV_machine ?= "27ed791688e060988fb39429477ee529093c9a01" +SRCREV_meta ?= "127bac58b21e8c3769d0cf2432f706f5605c4afb" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.144" +LINUX_VERSION ?= "6.6.147" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index 73d971f7eee..f50f5cd51e1 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.144" +LINUX_VERSION ?= "6.6.147" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "25b07b85b558f3587c11c9363cccd9cb93fcef45" -SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af" +SRCREV_machine ?= "18f147623b634b40b3bc5823ae03f049bb14fc84" +SRCREV_meta ?= "127bac58b21e8c3769d0cf2432f706f5605c4afb" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index 64609554ee2..77274850c2b 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "3adc19c1e1e3ee865f9b0d7bc0fedd0e4aeee995" -SRCREV_machine:qemuarm64 ?= "39a4fe09d3d795042cc14eb3c78f6a03874c48df" -SRCREV_machine:qemuloongarch64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec" -SRCREV_machine:qemumips ?= "ba0b8f925ec8b5926c6c2ddbc2c2c77305324bab" -SRCREV_machine:qemuppc ?= "66c01b44545110249c940f865c4ed10d4d315b29" -SRCREV_machine:qemuriscv64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec" -SRCREV_machine:qemuriscv32 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec" -SRCREV_machine:qemux86 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec" -SRCREV_machine:qemux86-64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec" -SRCREV_machine:qemumips64 ?= "1793417d6568e244579278e6f1fc7107987946f5" -SRCREV_machine ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec" -SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af" +SRCREV_machine:qemuarm ?= "1790b505a65896a34abc5abe3109f9811f6f2960" +SRCREV_machine:qemuarm64 ?= "4da6f6f6201c34d32cf5ae6524f8de44d003f0ed" +SRCREV_machine:qemuloongarch64 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82" +SRCREV_machine:qemumips ?= "254643819dbbde9f388d8d02b6d2550606b8e442" +SRCREV_machine:qemuppc ?= "c0e9acf672bff2c9001b96423b8ae5723d7f7190" +SRCREV_machine:qemuriscv64 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82" +SRCREV_machine:qemuriscv32 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82" +SRCREV_machine:qemux86 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82" +SRCREV_machine:qemux86-64 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82" +SRCREV_machine:qemumips64 ?= "830cb34f387303f99b95f1f3e3938794195ff1a6" +SRCREV_machine ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82" +SRCREV_meta ?= "127bac58b21e8c3769d0cf2432f706f5605c4afb" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "da47cbc254661aa66d61ef061485a7080305c4be" +SRCREV_machine:class-devupstream ?= "a1153c0deb44f75190f07677c0c6d61efd887246" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.144" +LINUX_VERSION ?= "6.6.147" PV = "${LINUX_VERSION}+git"