From patchwork Sun Sep 27 19:36:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99387 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9754FC98338 for ; Sun, 27 Sep 2026 19:36:30 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43451.1790537782950787514 for ; Sun, 27 Sep 2026 12:36:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=ZSNEMTcU; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-20260927193619fa8246bbcc00020778-fc_kox@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20260927193619fa8246bbcc00020778 for ; Sun, 27 Sep 2026 21:36:19 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=4t5O3+HR32pN4VoOeE6uSRATcOixduNEnzo6i0bOxNI=; b=ZSNEMTcUcrYeIYggYdLuXOEZKha0QK4gVrvz4B0sTUKcJBQMbkGYLtjU6Qq+/IADzfPQxi jpn38Unc1Wbsl66DTPZZCt5seA/JZ8C9LotmBaBI7cpE+9ZOFBvnwwudpSe1zSlOr4FcKM6V xOBvhnfBP0rKNW4PUsAj843lSVbG7ostEyBH3d1eyDmsvJwEDIzp++EyX/O5KNjMQnsGGpZx iG8o/Cic/D8K8bwtdSVWZA/823feCwH+Tod/bhBU7PFG0CzzDXuyKfUfAuKJqTjAsah7R291 ABq37pDS7Ktpmpa1skA4oAoJHs2g+p9w4dCydE1a0jYVu3yQoTURSbpw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 1/9] binutils: set status for CVE-2026-3441 and CVE-2026-3442 Date: Sun, 27 Sep 2026 21:36:01 +0200 Message-ID: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:36:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246707 From: Peter Marko These are version-less RedHat CVEs. These CVEs are fixed with [1] included in tag binutils-2_47. This is uquivalent commit to those which were picked in Wrynose and Scarthgap branches to fix these CVEs. [1] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=c2bf7de1eb77a91d7a3c86d56408bf57de540faf Signed-off-by: Peter Marko --- meta/recipes-devtools/binutils/binutils-2.47.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/binutils/binutils-2.47.inc b/meta/recipes-devtools/binutils/binutils-2.47.inc index 485da4a13c..b66d9110fd 100644 --- a/meta/recipes-devtools/binutils/binutils-2.47.inc +++ b/meta/recipes-devtools/binutils/binutils-2.47.inc @@ -18,6 +18,8 @@ SRCBRANCH ?= "binutils-2_47-branch" UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P\d+_(\d_?)*)" +CVE_STATUS[CVE-2026-3441] = "fixed-version: fixed-version: Fixed from version 2.47" +CVE_STATUS[CVE-2026-3442] = "fixed-version: fixed-version: Fixed from version 2.47" CVE_STATUS[CVE-2026-4647] = "fixed-version: fixed-version: Fixed from version 2.47" GIT_TAG = "binutils-${@d.getVar('PV').replace('.', '_')}" From patchwork Sun Sep 27 19:36:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99388 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70096C98338 for ; Sun, 27 Sep 2026 19:37:00 +0000 (UTC) Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.42535.1790537816004149145 for ; Sun, 27 Sep 2026 12:36:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=Cf6liCLG; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.228, mailfrom: fm-256628-202609271936536cf6252b2d00020789-lzpa3h@rts-flowmailer.siemens.com) Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 202609271936536cf6252b2d00020789 for ; Sun, 27 Sep 2026 21:36:53 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=p/3bW7fbeirS9sex09NoioETcV/uzs5rSNiJnJj8mKs=; b=Cf6liCLGGicpMTLSOcike98AVApGi5OfJyKUY4SbdW42QudWFv0BZ9wvijY93OTf7GMQw9 zz6+1SGL7UPmFRD43w37UO+lXH846PchcHCDasqiv6lxiWb1GNJyfrxk+f09zVRUKSNlJBYP Qi1Sn+AqTW3yokwMEEUXpTQS8xJBLjD1YVXY47P9Rzyubw53ly6cZmSeVOU9x3kj9gdZvWBW l2g+3K3vaqcYp4pTRYEv+wiGJT0eggoC5zl8ysqb92ByQZML3GajcRuY1tV8qzUP73xNiRhR KqDHAuZ4QN/zVwP0eVtKLkM4ua/9xy3ioAGUPyeNzWPna4TFiNDAzIXw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 2/9] glibc: set status for CVE-2026-19542 Date: Sun, 27 Sep 2026 21:36:02 +0200 Message-ID: <20260927193609.359250-2-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:37:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246708 From: Peter Marko This CVE is fixed via commit [1] included in current hash. It is backported commit of [2] mentioned to fix this CVE in [3]. [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=d6ff274313d79feb864cc10eb775b91c817a67e9 [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=e2789c46e3bfdcd67a82bea9946b315c179e83d3 [3] https://security-tracker.debian.org/tracker/CVE-2026-19542 Signed-off-by: Peter Marko --- meta/recipes-core/glibc/glibc_2.44.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-core/glibc/glibc_2.44.bb b/meta/recipes-core/glibc/glibc_2.44.bb index b4a5fbf8c3..d547f595ab 100644 --- a/meta/recipes-core/glibc/glibc_2.44.bb +++ b/meta/recipes-core/glibc/glibc_2.44.bb @@ -22,7 +22,7 @@ CVE_STATUS[CVE-2025-0577] = "not-applicable-platform: specific to RHEL patches" # when upgrading, clear CVE list but keep the variables CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS" CVE_STATUS_STABLE_BACKPORTS = "\ - CVE-2026-5435 \ + CVE-2026-5435 CVE-2026-19542 \ " CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash" From patchwork Sun Sep 27 19:36:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99389 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75505C98338 for ; Sun, 27 Sep 2026 19:37:10 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43469.1790537824748149525 for ; Sun, 27 Sep 2026 12:37:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=a11fmi59; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-256628-20260927193702883ac9904a000207c0-_83kw9@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 20260927193702883ac9904a000207c0 for ; Sun, 27 Sep 2026 21:37:02 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=BYWeEB65jetJ7u+BPs2HjYiWWZN86/CBXRn49avb2ZY=; b=a11fmi59/1JeXHT98ApfLxQOr1XvnzCB4nCaRrVA8msTFze3w14Uu+itRQbDapjG+fxksy K8yCXhzdftWmPfGIVs7Ks6QLftYBOzF8IBzTb3ziBL9547jE3oA2WK0wxvtOjU3UiGKwUFZL CpvGWS9pLF2OHQ3ikart4uu86TmyoaYM18JZ5YII2xUTrhdbioFlWz2UV9AFrkocgD0vIUNS YRC+6SGeNDCxwstbEnemHW5yQUlSeE7BReKPtNHVjmHYuU79OLSH5Oe0/iebEC4mbaAVdH+H 4n9mKUFWxfLQ+oy1p3kHvAtDWoa/UzZQ9SsmpsPEfN3eCjjJknmyT2UA==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 3/9] ffmpeg: set status for CVE-2026-58049 Date: Sun, 27 Sep 2026 21:36:03 +0200 Message-ID: <20260927193609.359250-3-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:37:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246709 From: Peter Marko Per [1] this is fixed in a commit included in tag n9.0. This is a version-less RedHat CVE. [1] https://security-tracker.debian.org/tracker/CVE-2026-58049 Signed-off-by: Peter Marko --- meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb index 4942e873ce..bb070d75c5 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb @@ -180,3 +180,4 @@ CVE_STATUS[CVE-2025-25468] = "fixed-version: these CVEs are fixed since v8.0" CVE_STATUS[CVE-2025-25469] = "fixed-version: these CVEs are fixed since v8.0" CVE_STATUS[CVE-2025-59729] = "fixed-version: this CVE are fixed since v8.0" CVE_STATUS[CVE-2025-59730] = "fixed-version: this CVE are fixed since v8.0" +CVE_STATUS[CVE-2026-58049] = "fixed-version: this CVE are fixed since v9.0" From patchwork Sun Sep 27 19:36:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99390 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C866C9832F for ; Sun, 27 Sep 2026 19:37:20 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.42545.1790537833663729111 for ; Sun, 27 Sep 2026 12:37:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=ik/IOsS1; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20260927193711dc22758f5200020746-gvwzcq@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20260927193711dc22758f5200020746 for ; Sun, 27 Sep 2026 21:37:11 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=PUx1PzQW+dkHbM7fO0TF+rRud2+7ri9xEmhfwKA7cdg=; b=ik/IOsS1GxBFyAFAHzDguAjDV1jM2mrraNFmCXuvO4JarguNpkrms+TH/4BxG0tFGcGTrx ZiHT4XmPWxlMS/DKpMxFRURgcfaFegksQh5A6eMZlvgyAUR6vLzh+883t4JOsjoOBINzYWWd Eh40ELRSh43u5eGDfVsSWPzhLKYScb7m6BBHnMojO7x7V41vYafp2idNxf0ZCemItJPL7drm EH6iKkabmXUYSJm751r9KXgi8Obs6Jxfg02oGHzsaYa3pnrT9ROuUd78FosT2cjOUMdk3Lt6 nC+OYqjibvvF0AuijdFO7DWyad+NSyxVWqy3MjMJ+zesWMiNA6zGbzFA==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 4/9] ffmpeg: set status for 6 CVEs Date: Sun, 27 Sep 2026 21:36:04 +0200 Message-ID: <20260927193609.359250-4-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:37:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246710 From: Peter Marko Per their Debian status, they are fixed in tag n9.0.1. All these have git hash as fixed version so it cannot be compared to in Yocto cve-check. Signed-off-by: Peter Marko --- meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb index bb070d75c5..af92a0b0df 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_9.0.2.bb @@ -181,3 +181,6 @@ CVE_STATUS[CVE-2025-25469] = "fixed-version: these CVEs are fixed since v8.0" CVE_STATUS[CVE-2025-59729] = "fixed-version: this CVE are fixed since v8.0" CVE_STATUS[CVE-2025-59730] = "fixed-version: this CVE are fixed since v8.0" CVE_STATUS[CVE-2026-58049] = "fixed-version: this CVE are fixed since v9.0" +CVE_STATUS_GROUPS += "CVE_BACKPORTS_v9_0_1" +CVE_BACKPORTS_v9_0_1 = "CVE-2026-75141 CVE-2026-75142 CVE-2026-75143 CVE-2026-75144 CVE-2026-75145 CVE-2026-75146 CVE-2026-75147" +CVE_BACKPORTS_v9_0_1[status] = "cpe-stable-backport: fix backported to v9.0.1" From patchwork Sun Sep 27 19:36:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99391 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CE52C9832F for ; Sun, 27 Sep 2026 19:37:30 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43478.1790537843680594474 for ; Sun, 27 Sep 2026 12:37:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=ASI4D0+C; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-256628-20260927193722d184462b02000207eb-rtbbut@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 20260927193722d184462b02000207eb for ; Sun, 27 Sep 2026 21:37:22 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=ENplt8LjoE26zvfD/K/QbNzTLvf2eN/pYzhnja0LnLw=; b=ASI4D0+C2H9T9fj1wxkAE+JI7cPzp6TAzgN+CGqlex9QUFOWFPnIsbwRiIP+LdeIpluf0E 8Mh6gzxfi81g+REn6XfB4IC9IZC+fSrnRdpygeE9KVsXdViNYkCOF+gPujjjjgufNucP5WYE AzlnSU3pYQEd+FiRKmroXrikb9jh4S2U90P0K+KmHJL6YtdKPtBu7Ib7fX8BFx5UfrwS9GPY 6HTNFVyG8ar8iIO7iZD3lwlxOMXuzlvUp4uaMxb8VNgVnUXbCj73gJTZ8taMjXlZwPoKEGL/ dVBZpoCO2ZbvKOEdXmmtj4AoVBZtDPUgf725/pIzOYw1M1FpITJUuQnQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 5/9] libxfont: set status for CVE-2026-44950 and CVE-2026-59679 Date: Sun, 27 Sep 2026 21:36:05 +0200 Message-ID: <20260927193609.359250-5-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:37:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246711 From: Peter Marko These CVEs have '?' in affected version (start). This cannot be parsed by sbom-cve-check so it ends up with 'no-version-ranges'. Affected version (lessThanOrEqual) is set to 2.0.8. Signed-off-by: Peter Marko --- meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb index 82ca4d5024..18e822aebd 100644 --- a/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb +++ b/meta/recipes-graphics/xorg-lib/libxfont2_2.0.9.bb @@ -21,3 +21,6 @@ PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," CVE_PRODUCT = "libxfont libxfont2" + +CVE_STATUS[CVE-2026-44950] = "fixed-version: fixed since v2.0.9" +CVE_STATUS[CVE-2026-59679] = "fixed-version: fixed since v2.0.9" From patchwork Sun Sep 27 19:36:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99392 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74A01C98338 for ; Sun, 27 Sep 2026 19:37:40 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43479.1790537857578019791 for ; Sun, 27 Sep 2026 12:37:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=sePRH8oE; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-20260927193735ebc52366f600020738-fu46kj@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 20260927193735ebc52366f600020738 for ; Sun, 27 Sep 2026 21:37:35 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=++A7zlNI8qlTjUQiVhUxZoDhksw2+kqTHgJKf98Os6Q=; b=sePRH8oEIHwBtHGM6AJaBWBzgyTEza7CyfUMVSUbPVLriswz7HAfQzL75o7+nn0F6ZjzON 0zHaExcmH3DNdbvrLT8G/8ccm4zyhQ8aI3VQryffto8ZH0mpFmcfi1/EgSJHWVNtjejS1Gmn /ereIL62hZKHvFQj3UsyuguoVunW5r2LIKLZP/asoU9XWJFOgXWoeDiysDZb5QnPo9T1IGvv Vdun8lMwaGblAvWODFaMM2KqQcb/FgtZwi+F+22wxff8gY6JBfVACLjCqW0nqnR7aveOMelV F75603uvFG6fXnJmkO4m+ZdC+g04k5dWLWkdazwbOCBmXBOdRoSQf40w==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 6/9] openssh: set status for CVE-2026-55655 Date: Sun, 27 Sep 2026 21:36:06 +0200 Message-ID: <20260927193609.359250-6-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:37:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246712 From: Peter Marko Per [1] and [2] this this is only problem in RedHet patches. [1] https://security-tracker.debian.org/tracker/CVE-2026-55655 [2] https://ubuntu.com/security/CVE-2026-55655 Signed-off-by: Peter Marko --- meta/recipes-connectivity/openssh/openssh_10.5p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb index e4b6ddef9d..d8b5f8bc14 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb @@ -38,6 +38,7 @@ CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distr CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1." CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh." CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches." +CVE_STATUS[CVE-2026-55655] = "not-applicable-platform: Only applies to RHEL patches." PAM_SRC_URI = "file://sshd" From patchwork Sun Sep 27 19:36:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99393 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6EA54C98338 for ; Sun, 27 Sep 2026 19:37:50 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43482.1790537867048511050 for ; Sun, 27 Sep 2026 12:37:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=ahpVYasx; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-20260927193745131168101c0002070f-ohvccs@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20260927193745131168101c0002070f for ; Sun, 27 Sep 2026 21:37:45 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=YYgFOonoxt93V3k5o4YD4UbyCXrt0ZnnhHmPfnKaJXI=; b=ahpVYasxmpbLLG7v9wmoJu5/Kvem0FNgCtENx6AyNVDUaQoks2Lgjk+rFV4ZmFjOtvNGdJ Sd84EGt7jXdFW2pz2nGQU+R9zY9fQzAHyvgmbzA8rjnpqUTb/asjOb4c6a6BJ15YUX4nKB+O NyvHIuDoutgwi1DmHQNUyCOaMw9hhYqDMmVoTggbvHxsxoqX49wgFeC3MotpGV34kOZs8fpk e+kjIjHs3hmMSLcQQFcXFd+iGvcCjTuTQgouTb3DRZA8+9iCjqEJEx+CXzH3Zz/mJbG5BSp2 O3Zo3/6Y+WIQsTPWYyHi91H3XPYFXaYcOefdEKLong6r8xjzAnTHH3lQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 7/9] openssh: set status for CVE-2026-55654 Date: Sun, 27 Sep 2026 21:36:07 +0200 Message-ID: <20260927193609.359250-7-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:37:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246713 From: Peter Marko Per desctiption in [1] (which is different than description in [2]), this is RedHat patches. Also [3] suggests this. [1] https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/55xxx/CVE-2026-55654.json [2] https://security-tracker.debian.org/tracker/CVE-2026-55654 [3] https://ubuntu.com/security/CVE-2026-55654 Signed-off-by: Peter Marko --- meta/recipes-connectivity/openssh/openssh_10.5p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb index d8b5f8bc14..052686f289 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.5p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.5p1.bb @@ -38,6 +38,7 @@ CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distr CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1." CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh." CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches." +CVE_STATUS[CVE-2026-55654] = "not-applicable-platform: Only applies to RHEL patches." CVE_STATUS[CVE-2026-55655] = "not-applicable-platform: Only applies to RHEL patches." PAM_SRC_URI = "file://sshd" From patchwork Sun Sep 27 19:36:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99394 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E6BBC9832F for ; Sun, 27 Sep 2026 19:38:10 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.42566.1790537887158383304 for ; Sun, 27 Sep 2026 12:38:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=RFFL2nFA; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-202609271938057f0634984e00020758-cg3ypg@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 202609271938057f0634984e00020758 for ; Sun, 27 Sep 2026 21:38:05 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=F7rqOX2RTmOo9h7taBPXU48PfXHAL5JMt5DEMRXm7dM=; b=RFFL2nFAextL6f4OqPuaygo3eZZA/cDFqQZunXTiW3y9ITxADZy/IAwf1rf6AyrWV6ipi7 oqLKVm2TYVlBLJCJTWWWjPV9uPfkPjcvvDmtmQCU9QTBglE8fYDQ/BwKYyRMj4VHq6L1Jwz9 bCeTQ5jOqFqKYkgh3FNBaayRpqmpu788WtqzOYAm7PNgVSqCw5orNR39P8xw4Lz8ojyxaxEz Y43VOhAiFSwIfoyq16wgLmP0dPAcBmNgxzuYFggre7+S5VbjFS5Hft/oIJ+8nh0SYGMmgip1 /ZTnm5obDhHyopBKNXR6Y3rXhxCVmFt/j/UppzsqNG/IiED+ruMPyyDg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 8/9] bluez5: set status for CVE-2026-19774 Date: Sun, 27 Sep 2026 21:36:08 +0200 Message-ID: <20260927193609.359250-8-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:38:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246714 From: Peter Marko Per [1] this is fixed in 5.87. NVD tracks fix via hash, which cannot be used for version comparison in sbom-cve-check. [1] https://nvd.nist.gov/vuln/detail/cve-2026-19774 Signed-off-by: Peter Marko --- meta/recipes-connectivity/bluez5/bluez5_5.87.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/bluez5/bluez5_5.87.bb b/meta/recipes-connectivity/bluez5/bluez5_5.87.bb index 687780de21..08682b70d8 100644 --- a/meta/recipes-connectivity/bluez5/bluez5_5.87.bb +++ b/meta/recipes-connectivity/bluez5/bluez5_5.87.bb @@ -7,6 +7,7 @@ SRC_URI[sha256sum] = "26bdcf2cebd7310c6f598850606b037ef0c515fe6608ebc54d22c50c4c CVE_STATUS[CVE-2020-24490] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes" CVE_STATUS[CVE-2020-12351] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes" CVE_STATUS[CVE-2020-12352] = "cpe-incorrect: This issue has kernel fixes rather than bluez fixes" +CVE_STATUS[CVE-2026-19774] = "fixed-version: Fixed from version 5.87" # noinst programs in Makefile.tools that are conditional on READLINE # support From patchwork Sun Sep 27 19:36:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99395 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CDCFC9832F for ; Sun, 27 Sep 2026 19:38:30 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.43494.1790537900336354767 for ; Sun, 27 Sep 2026 12:38:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=AOcWO4d1; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-256628-20260927193818299c6d3a85000207f5-uxu6cr@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 20260927193818299c6d3a85000207f5 for ; Sun, 27 Sep 2026 21:38:18 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=wTPFveGm31WQHhZOjBMDp1xPreTRUM2cW4ACDCdI+VM=; b=AOcWO4d1uo2UO0hLyl+KIrlh2wGmuI5YB675EBwVEIHo4uoPyxDrmUC0Br6le1uC5A3qeb /2mZGB2rmtw2tl9XIJA/5TPOCVYOLPwb5CsMzoDkQayhkMM4lexeyINdDFfNvlM9ljBAWP5u 64hwbOFXMD1ed+2Qx1FRbIDezvctqUcitkk8Os1sywLaFDyVLo0ajLP2vRv3rbFdEWwUjm/W O3b8+3Qrj+O2uGk2mAnrK1pPdeogRpj+MjYXH76bnhQkgADyDYzhW9NrKscVwa6AEELkg8DJ yDM2s+geBS5Dq4zeox1f07/4y8JKbYl0WVvsgBa4BgN43VycvUQr8ZUQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [PATCH 9/9] graphene: set status for CVE-2026-81281 Date: Sun, 27 Sep 2026 21:36:09 +0200 Message-ID: <20260927193609.359250-9-peter.marko@siemens.com> In-Reply-To: <20260927193609.359250-1-peter.marko@siemens.com> References: <20260927193609.359250-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 19:38:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246715 From: Peter Marko Per description in [1] and also per [2] this is CVE is for WordPress theme. [1] https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/81xxx/CVE-2026-81281.json [2] https://security-tracker.debian.org/tracker/CVE-2026-81281 Signed-off-by: Peter Marko --- meta/recipes-graphics/graphene/graphene_1.10.8.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-graphics/graphene/graphene_1.10.8.bb b/meta/recipes-graphics/graphene/graphene_1.10.8.bb index 7aa72b4a78..0d526d3d76 100644 --- a/meta/recipes-graphics/graphene/graphene_1.10.8.bb +++ b/meta/recipes-graphics/graphene/graphene_1.10.8.bb @@ -28,3 +28,4 @@ FILES:${PN} += "${libdir}/graphene-1.0" BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2024-1984] = "cpe-incorrect: issue in a WordPress theme" +CVE_STATUS[CVE-2026-81281] = "cpe-incorrect: issue in a WordPress theme"