From patchwork Thu Oct 15 05:02:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100732 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66AEDCC6B2E for ; Thu, 15 Oct 2026 05:03:40 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32813.1792040619465163971 for ; Wed, 14 Oct 2026 22:03:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=20VoBm7n; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a02753c04fso25874415e9.3 for ; Wed, 14 Oct 2026 22:03:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040618; x=1792645418; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=37qGsYNqk4JrjGWFblWN2ZgDuVFH8YnuUkWq8mWgbiI=; b=20VoBm7nPx/N3rCasf0C41oeiBfFY620tlmbRhR3Yb5iET4d1hYv3lDpbzX2sEwytM ExpzvDOSe7RDuRdkSWvpQ1RNalAKyRkfys3W/iuqqioFu349wzeMA79h26ayd72NZzln KtA7hVK0YUpXfeabvsrFDmi79gMyfF7682fG0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040618; x=1792645418; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=37qGsYNqk4JrjGWFblWN2ZgDuVFH8YnuUkWq8mWgbiI=; b=gace/HSbwEhyw+7dIvyfHIW2qBzgAsaxj1jPoAbUFobxtmifKla/X+dZJecmdjJcSx BpjZixAaTDjSjYx07EWjBk0Ag/MkScrnFIpsbOIGEhAbHbmxHSPH9/6izkuwr76nl0/9 7Y66i3thUYXep5acoMtMqhyzAwG1SEDxIdtuS11MuIh1/d/KpqyDn14jlZcUvkyO2ds8 ESf+IxpQqHDHpIeqTD0JydRsTgh7A/LenA6Ku8Y2n9AJjy8Rcc9Cs35/znwo5O5rBzyh h26veA30UkBSIG0QhMAqbAkcjJopN6GqNPeQbwiZXO5WYZEi2dL+F0dj188i08pEiAW/ wZRQ== X-Gm-Message-State: AFq9FYKp51/3dT9THrBoykY3WvDCUrFe92o+dYlNFC7E5hNXAEkUCsVJ 4RIohIdTrBewX9BtAC+vbt0+TlMWasuliuxalOxviUpv7pf4rbMLzJaWK9YP6SOzeVQwSGzrWSN HpuRplB4= X-Gm-Gg: AYBFou2YDeNRMaIZinxyUFDLm+IVrsns7kQaA36BruiLjnH5peeNUK5tzJ4/rnPSmBB DImwll95wDFh3W2NZy5SN332vOK+qpUIDqVF0mIcDQKAYCJnwTVblJKRGaFBqAENIVtTkLmJGuw WHM11sMLFDd7RLda4k4mf3yvRosTCOcV4iD+rAJv4fwLnFWvttJKr90K/+CcxWSqinUZ2wHyxxZ LRM4xGAATfbJpjlKJmh83vAPCERpKSKl9Rf4ohYmwezPMAepjDUibTksn0j9SqhulMRIB90mwcI +B9EuLwqwsrxrblrUJ88SPS7kl/NmW/LT7r68uAdkMCIEfLPNA9P0AjsH21WktL8DeG6R/BIdV8 ht7n9trUBVLKiqzbKkZNYb01FBiMeS9/JhQ3xyHxiUi6EKSzLT+f25NdI8gj43ANey8Coddnj/B xltGCIn1gFqWhbRqJotcdau2lPCMs0IwIklYXr9AoFRfk5kMz6uam1aB24EBRUWpKU8chTjMrp+ bhKrqMMHrZPeqnlNcAZi3i5v39DobAngr5qup7pQWAOpPU4Hq6N4EVEkSqwZrf/+mDM8L1b1Q== X-Received: by 2002:a05:600c:3146:b0:49d:1fd8:b874 with SMTP id 5b1f17b1804b1-4a18e4af3a8mr372017055e9.19.1792040617493; Wed, 14 Oct 2026 22:03:37 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:37 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 01/55] libaio: update SRC_URI Date: Thu, 15 Oct 2026 07:02:24 +0200 Message-ID: <30151c54ac1d729e5ec0778861fb3d843a260d99.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247798 From: Ross Burton libaio has moved to Codeberg as pagure.io will be closed down shortly. Signed-off-by: Ross Burton Signed-off-by: Mathieu Dubois-Briand (cherry picked from commit 237c32e181cd47194c3877d220360d6e6fbb2af8) [YC: dropped the tag= SRC_URI parameter which does not mean the same thing as in master. In bitbake=2.8/scarthgap, "tag=" conflicts with SRCREV instead of checking it against the remote tag. ] Signed-off-by: Yoann Congal --- meta/recipes-extended/libaio/libaio_0.3.113.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-extended/libaio/libaio_0.3.113.bb b/meta/recipes-extended/libaio/libaio_0.3.113.bb index 87ab22ed176..733002cb90d 100644 --- a/meta/recipes-extended/libaio/libaio_0.3.113.bb +++ b/meta/recipes-extended/libaio/libaio_0.3.113.bb @@ -5,7 +5,7 @@ HOMEPAGE = "http://lse.sourceforge.net/io/aio.html" LICENSE = "LGPL-2.1-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=d8045f3b8f929c1cb29a1e3fd737b499" -SRC_URI = "git://pagure.io/libaio.git;protocol=https;branch=master \ +SRC_URI = "git://codeberg.org/jmoyer/libaio.git;protocol=https;branch=master \ file://00_arches.patch \ file://libaio_fix_for_mips_syscalls.patch \ file://system-linkage.patch \ From patchwork Thu Oct 15 05:02:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100735 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41710CC6B34 for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32814.1792040620011206514 for ; Wed, 14 Oct 2026 22:03:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=0iccKiwP; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-49e73611928so42318435e9.1 for ; Wed, 14 Oct 2026 22:03:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040618; x=1792645418; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WIRXCdXZVc9WzMbUN4i/LNEtKjG/94kmifWRBM2z2og=; b=0iccKiwPqBDuLqHpmAbinNRzxPiyrRujwy//yYTDePk0cnWvbp5R/GEAt3tOkYeorM kaPjGBr+BLzKAgFdu+oVadrQLzrPVURk0T011J9vKNKH07oIedYImP+s5PdK9YARxqSe zVyKqGELbp8DawnWPTRg/1SQdJaLI7rvLJ2r8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040618; x=1792645418; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=WIRXCdXZVc9WzMbUN4i/LNEtKjG/94kmifWRBM2z2og=; b=uUN2hqGXVJsro9RrECq686IdwI7+wKsWmMQ36neFhGWAGSYWivFLoSBL9LtfBReeUO pvNIs+y2QmuUyC39Pms5NNhEYOitmueEmx4nv+ujgJaEzFftxWbIF2kjGxC4XBjGtSaG BFInI+/2IkRDVMZzuyiONkDXPFKr/P+KfSwyQvnGbkYvmCswNEaR6vaEItYt0KUAmJXt oUSQU6skQ27ZSGsMEiQc3WIGL7ATIfAAgktGTzvPaSURntthkhyoD37dSsoH+Ki31wxE 58wpKMg+hwsdPu/TMbigD8oMhlnDocxfJ3cdywo4gVJ5IkGeW6AhYNaeUB3GxGm72fvh mtsA== X-Gm-Message-State: AFq9FYLVhVJpTPW5Q63fcDlx3WzN/kVL9IvuHxzpP0k8tR2vTi4TwxKU JQ42KQCwCpWYt+zNNyadpUS0/eriOEYe9P52MYdeVOxzZw3knlx+6l/zHSToeUJRty19FcK/OZh lfhpQlhY= X-Gm-Gg: AYBFou2zBiJ92YoWtwzEy8AOIlYk5BYvLnNL3Yy4z40Pj1McSKFuWRJJ1UljE6ykZcA yJALTvDcsARjOPVgpcQrZ99vrvFdUfhT1ikwf8jvDUFRvqcUAddNg1Q6yCb+0DE5HBJAUaZsrPD epyFQRJpwepAQJj8v+mEzs6Yz/sNsFqCQwVtUF1yab5TA4xMqKnOxQsCQQQzF++elqoUhoVpXV4 4FY+ycJM0ATdnfbMqAJbaiWL2LZNRaBLq6Fwo0AXVnZNTXJGJYr+5TG7jMmCiQ+YDf6Vla1AgSx yYg5x4wIsBhOrAHAuIQ8TIwAvut2Nm4wEMMHEQ6KWrk9bhKcmvU4Ia8Az8WgOU13EZXNCdSRaOl 7GL5N8WdN2wUYyG5z8W7zzCrNUTuZylMpeAVnbyr4kpoLaqeS7IC+vnFZZk3gvi8VTaGZLcA88w 1w38sybp3Sg+QWP8aVF5cvHdgkhpVatMRRc1SxKOsKRUcthWD+631OtsDmXujgHGpueZz4e+YTR 1NAXYvawJDPGK7agB7LD5yaJYJ8m1ERU6QQdsalY814O9M0iVox3IjMi0m0KSqkNCucwZWWarpO 1ZacCr9R X-Received: by 2002:a05:600c:5254:b0:4a0:20b4:ba93 with SMTP id 5b1f17b1804b1-4a18e4aa11dmr360573415e9.16.1792040618016; Wed, 14 Oct 2026 22:03:38 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:37 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 02/55] gnutls: fix CVE-2026-42012 Date: Thu, 15 Oct 2026 07:02:25 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247800 From: Jakub Szczudlo (Nokia) Backport patch to fix CVE-2026-42012. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42012 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/8dcc6a1f48945997666ac9f10896819edd01a03b Tested with ptest Pre patches taken from upstream so CVE fix will land cleanly Signed-off-by: Jakub Szczudlo Signed-off-by: Yoann Congal [YC: fixed patch format] --- .../gnutls/gnutls/CVE-2026-42012-pre1.patch | 69 ++++++++ .../gnutls/gnutls/CVE-2026-42012-pre2.patch | 162 ++++++++++++++++++ .../gnutls/gnutls/CVE-2026-42012-pre3.patch | 129 ++++++++++++++ .../gnutls/gnutls/CVE-2026-42012.patch | 48 ++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 4 + 5 files changed, 412 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre3.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42012.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch new file mode 100644 index 00000000000..9b2a5d16cab --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre1.patch @@ -0,0 +1,69 @@ +From 6133fb459b74a9dcfa2d0ff010a4e03c56822d39 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Fri, 13 Mar 2026 17:00:03 +0100 +Subject: [PATCH] x509/hostname-verify: refactor and simplify CN fallback logic + +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42012 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/6133fb459b74a9dcfa2d0ff010a4e03c56822d39] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/hostname-verify.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/lib/x509/hostname-verify.c b/lib/x509/hostname-verify.c +--- a/lib/x509/hostname-verify.c ++++ b/lib/x509/hostname-verify.c +@@ -108,7 +108,7 @@ unsigned gnutls_x509_crt_check_ip(gnutls + * that we do not fallback to CN-ID if we encounter a supported name + * type. + */ +-#define IS_SAN_SUPPORTED(san) \ ++#define PRECLUDES_CN_FALLBACK(san) \ + (san == GNUTLS_SAN_DNSNAME || san == GNUTLS_SAN_IPADDRESS) + + /** +@@ -151,13 +151,12 @@ unsigned gnutls_x509_crt_check_hostname2 + { + char dnsname[MAX_CN]; + size_t dnsnamesize; +- int found_dnsname = 0; + int ret = 0; + int i = 0; + struct in_addr ipv4; + char *p = NULL; + char *a_hostname; +- unsigned have_other_addresses = 0; ++ bool cn_fallback_allowed = true; + gnutls_datum_t out; + + /* check whether @hostname is an ip address */ +@@ -213,9 +212,10 @@ hostname_fallback: + ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname, + &dnsnamesize, NULL); + +- if (ret == GNUTLS_SAN_DNSNAME) { +- found_dnsname = 1; ++ if (PRECLUDES_CN_FALLBACK(ret)) ++ cn_fallback_allowed = false; + ++ if (ret == GNUTLS_SAN_DNSNAME) { + if (memchr(dnsname, '\0', dnsnamesize)) { + _gnutls_debug_log( + "certificate has %s with embedded null in name\n", +@@ -236,13 +236,10 @@ hostname_fallback: + ret = 1; + goto cleanup; + } +- } else { +- if (IS_SAN_SUPPORTED(ret)) +- have_other_addresses = 1; + } + } + +- if (!have_other_addresses && !found_dnsname && ++ if (cn_fallback_allowed && + _gnutls_check_key_purpose(cert, GNUTLS_KP_TLS_WWW_SERVER, 0) != 0) { + /* did not get the necessary extension, use CN instead, if the + * certificate would have been acceptable for a TLS WWW server purpose. diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch new file mode 100644 index 00000000000..323b0e80d21 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre2.patch @@ -0,0 +1,162 @@ +From 5cc003b9688378f6c7934b1df0aa147e80006be4 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Fri, 13 Mar 2026 17:41:33 +0100 +Subject: [PATCH] x509: add bare-bones awareness of SRV virtual SAN + +There's no support for constraints, no certtool support, no nothing. +Just added what's easy to add because I needed a virtual SAN for them. + +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42012 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/5cc003b9688378f6c7934b1df0aa147e80006be4] + +Backport Changes: +- common.h context updated for 3.8.4 (PKIX1_RSA_OAEP_P_SPECIFIED_OID). +- virt-san.c: use _gnutls_steal_datum instead of upstream _gnutls_take_datum + (steal_datum comes from CVE-2026-42012-pre3). + +Signed-off-by: Jakub Szczudlo +--- + lib/includes/gnutls/gnutls.h.in | 4 +++- + lib/x509/common.h | 1 + + lib/x509/name_constraints.c | 3 ++- + lib/x509/output.c | 6 ++++++ + lib/x509/virt-san.c | 23 +++++++++++++++++++++++ + lib/x509/x509.c | 3 ++- + 6 files changed, 37 insertions(+), 3 deletions(-) + +diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in +--- a/lib/includes/gnutls/gnutls.h.in ++++ b/lib/includes/gnutls/gnutls.h.in +@@ -2646,6 +2646,7 @@ void gnutls_psk_set_server_params_functi + * @GNUTLS_SAN_OTHERNAME_XMPP: Virtual SAN, used by certain functions for convenience. + * @GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL: Virtual SAN, used by certain functions for convenience. + * @GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL: Virtual SAN, used by certain functions for convenience. ++ * @GNUTLS_SAN_OTHERNAME_SRV: Virtual SAN, used by certain functions for convenience. + * + * Enumeration of different subject alternative names types. + */ +@@ -2663,7 +2664,8 @@ typedef enum gnutls_x509_subject_alt_nam + Used by gnutls_x509_crt_get_subject_alt_othername_oid. */ + GNUTLS_SAN_OTHERNAME_XMPP = 1000, + GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL, +- GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL ++ GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL, ++ GNUTLS_SAN_OTHERNAME_SRV + } gnutls_x509_subject_alt_name_t; + + struct gnutls_openpgp_crt_int; +diff --git a/lib/x509/common.h b/lib/x509/common.h +--- a/lib/x509/common.h ++++ b/lib/x509/common.h +@@ -107,6 +107,7 @@ + #define XMPP_OID "1.3.6.1.5.5.7.8.5" + #define KRB5_PRINCIPAL_OID "1.3.6.1.5.2.2" + #define MSUSER_PRINCIPAL_NAME_OID "1.3.6.1.4.1.311.20.2.3" ++#define SRV_OID "1.3.6.1.5.5.7.8.7" + #define PKIX1_RSA_PSS_MGF1_OID "1.2.840.113549.1.1.8" + #define PKIX1_RSA_OAEP_P_SPECIFIED_OID "1.9" + +diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c +--- a/lib/x509/name_constraints.c ++++ b/lib/x509/name_constraints.c +@@ -516,7 +516,8 @@ static int validate_name_constraints_nod + if (type != GNUTLS_SAN_DNSNAME && type != GNUTLS_SAN_RFC822NAME && + type != GNUTLS_SAN_DN && type != GNUTLS_SAN_URI && + type != GNUTLS_SAN_IPADDRESS && +- type != GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL) { ++ type != GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL && ++ type != GNUTLS_SAN_OTHERNAME_SRV) { + return gnutls_assert_val(GNUTLS_E_X509_UNKNOWN_SAN); + } + +diff --git a/lib/x509/output.c b/lib/x509/output.c +--- a/lib/x509/output.c ++++ b/lib/x509/output.c +@@ -121,6 +121,7 @@ static void print_name(gnutls_buffer_st + if ((type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_OTHERNAME_XMPP || + type == GNUTLS_SAN_OTHERNAME_KRB5PRINCIPAL || + type == GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL || ++ type == GNUTLS_SAN_OTHERNAME_SRV || + type == GNUTLS_SAN_RFC822NAME || type == GNUTLS_SAN_URI) && + sname != NULL && strlen(sname) != name->size) { + adds(str, _("warning: SAN contains an embedded NUL, " +@@ -180,6 +181,11 @@ static void print_name(gnutls_buffer_st + name->size, NON_NULL(name->data)); + break; + ++ case GNUTLS_SAN_OTHERNAME_SRV: ++ addf(str, _("%sSRVName: %.*s\n"), prefix, name->size, ++ NON_NULL(name->data)); ++ break; ++ + default: + addf(str, _("%sUnknown name: "), prefix); + _gnutls_buffer_hexprint(str, name->data, name->size); +diff --git a/lib/x509/virt-san.c b/lib/x509/virt-san.c +--- a/lib/x509/virt-san.c ++++ b/lib/x509/virt-san.c +@@ -45,6 +45,9 @@ static int san_othername_to_virtual(cons + memcmp(oid, MSUSER_PRINCIPAL_NAME_OID, + sizeof(MSUSER_PRINCIPAL_NAME_OID) - 1) == 0) + return GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL; ++ else if ((unsigned)size == (sizeof(SRV_OID) - 1) && ++ memcmp(oid, SRV_OID, sizeof(SRV_OID) - 1) == 0) ++ return GNUTLS_SAN_OTHERNAME_SRV; + } + + return GNUTLS_SAN_OTHERNAME; +@@ -59,6 +62,8 @@ static const char *virtual_to_othername_ + return KRB5_PRINCIPAL_OID; + case GNUTLS_SAN_OTHERNAME_MSUSERPRINCIPAL: + return MSUSER_PRINCIPAL_NAME_OID; ++ case GNUTLS_SAN_OTHERNAME_SRV: ++ return SRV_OID; + default: + return NULL; + } +@@ -126,6 +131,15 @@ int _gnutls_alt_name_assign_virt_type(st + name->type = GNUTLS_SAN_OTHERNAME; + break; + ++ case GNUTLS_SAN_OTHERNAME_SRV: ++ ret = _gnutls_x509_encode_string(ASN1_ETYPE_IA5_STRING, ++ san->data, san->size, ++ &encoded); ++ if (ret < 0) ++ return gnutls_assert_val(ret); ++ name->san = _gnutls_steal_datum(&encoded); ++ break; ++ + default: + return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + } +@@ -187,6 +201,15 @@ int gnutls_x509_othername_to_virtual(con + othername->data, + othername->size, virt, 0); + if (ret < 0) { ++ gnutls_assert(); ++ return ret; ++ } ++ return 0; ++ case GNUTLS_SAN_OTHERNAME_SRV: ++ ret = _gnutls_x509_decode_string(ASN1_ETYPE_IA5_STRING, ++ othername->data, ++ othername->size, virt, 0); ++ if (ret < 0) { + gnutls_assert(); + return ret; + } +diff --git a/lib/x509/x509.c b/lib/x509/x509.c +--- a/lib/x509/x509.c ++++ b/lib/x509/x509.c +@@ -1554,7 +1554,8 @@ inline static int is_type_printable(int + { + if (type == GNUTLS_SAN_DNSNAME || type == GNUTLS_SAN_RFC822NAME || + type == GNUTLS_SAN_URI || type == GNUTLS_SAN_OTHERNAME_XMPP || +- type == GNUTLS_SAN_OTHERNAME || type == GNUTLS_SAN_REGISTERED_ID) ++ type == GNUTLS_SAN_OTHERNAME_SRV || type == GNUTLS_SAN_OTHERNAME || ++ type == GNUTLS_SAN_REGISTERED_ID) + return 1; + else + return 0; diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre3.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre3.patch new file mode 100644 index 00000000000..7ed76d03660 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012-pre3.patch @@ -0,0 +1,129 @@ +From 9f635788da50eb1285cae5c8d787b12bda01ae4d Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Wed, 22 Jan 2025 07:45:46 +0900 +Subject: [PATCH] datum, mem, str: add helper functions to steal pointers + +This introduces 3 new inline functions, namely _gnutls_steal_datum, +_gnutls_steal_buffer, and _gnutls_steal_pointer, to return a copy of +data structure and reset the original pointer. Those would enable to +return a populated data structure upon success; otherwise free the +partially filled data structure in a single code path, e.g., + +```c + gnutls_datum_t tmp_result = { NULL, 0 }; + + // Calculate tmp_result + ... + if (error) + goto cleanup; + + // Propagate tmp_result to *result + *result = _gnutls_steal_datum(&tmp_result); + +cleanup: + _gnutls_free_datum(&tmp_result); + return ret; +``` + +Signed-off-by: Daiki Ueno +CVE: CVE-2026-42012 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/9f635788da50eb1285cae5c8d787b12bda01ae4d] + +Signed-off-by: Jakub Szczudlo +--- + lib/datum.h | 11 +++++++++++ + lib/mem.h | 9 +++++++++ + lib/str.h | 23 +++++++++++++++-------- + 3 files changed, 35 insertions(+), 8 deletions(-) + +diff --git a/lib/datum.h b/lib/datum.h +--- a/lib/datum.h ++++ b/lib/datum.h +@@ -68,4 +68,15 @@ inline static ATTRIBUTE_NONNULL() void _ + dat->size = 0; + } + ++inline static ATTRIBUTE_NONNULL() gnutls_datum_t ++ _gnutls_steal_datum(gnutls_datum_t *src) ++{ ++ gnutls_datum_t dst = *src; ++ ++ src->data = NULL; ++ src->size = 0; ++ ++ return dst; ++} ++ + #endif /* GNUTLS_LIB_DATUM_H */ +diff --git a/lib/mem.h b/lib/mem.h +--- a/lib/mem.h ++++ b/lib/mem.h +@@ -33,6 +33,8 @@ + #include + #endif + ++#include "attribute.h" ++ + /* These realloc functions will return ptr if size==0, and will free + * the ptr if the new allocation failed. + */ +@@ -78,4 +80,11 @@ static inline void _gnutls_memory_mark_d + #endif + } + ++static inline ATTRIBUTE_NONNULL() void *_gnutls_steal_pointer(void **src) ++{ ++ void *dst = *src; ++ *src = NULL; ++ return dst; ++} ++ + #endif /* GNUTLS_LIB_MEM_H */ +diff --git a/lib/str.h b/lib/str.h +--- a/lib/str.h ++++ b/lib/str.h +@@ -30,6 +30,7 @@ + #include "datum.h" + #include + #include "errors.h" ++#include "attribute.h" + + #ifdef HAVE_DCGETTEXT + #include "gettext.h" +@@ -97,6 +98,19 @@ inline static void _gnutls_buffer_reset( + buf->length = 0; + } + ++inline static ATTRIBUTE_NONNULL() gnutls_buffer_st ++ _gnutls_steal_buffer(gnutls_buffer_st *src) ++{ ++ gnutls_buffer_st dst = *src; ++ ++ src->allocd = NULL; ++ src->data = NULL; ++ src->max_length = 0; ++ src->length = 0; ++ ++ return dst; ++} ++ + int _gnutls_buffer_resize(gnutls_buffer_st *, size_t new_size); + + int _gnutls_buffer_append_str(gnutls_buffer_st *, const char *str); +@@ -161,15 +175,8 @@ int _gnutls_buffer_append_escape(gnutls_ + size_t data_size, const char *invalid_chars); + int _gnutls_buffer_unescape(gnutls_buffer_st *dest); + +-#ifndef __attribute__ +-/* This feature is available in gcc versions 2.5 and later. */ +-#if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 5) +-#define __attribute__(Spec) /* empty */ +-#endif +-#endif +- + int _gnutls_buffer_append_printf(gnutls_buffer_st *dest, const char *fmt, ...) +- __attribute__((format(printf, 2, 3))); ++ ATTRIBUTE_FORMAT((printf, 2, 3)); + + void _gnutls_buffer_hexprint(gnutls_buffer_st *str, const void *data, + size_t len); diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42012.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012.patch new file mode 100644 index 00000000000..1f43efc1222 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42012.patch @@ -0,0 +1,48 @@ +From 8dcc6a1f48945997666ac9f10896819edd01a03b Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Fri, 13 Mar 2026 17:02:07 +0100 +Subject: [PATCH] x509/hostname-verify: make URI/SRV SAN preclude CN fallback + +URI/SRV SAN did not suppress CN fallback as required by RFC 6125 6.4.4: +> a client MUST NOT seek a match for a reference identifier of CN-ID +> if the presented identifiers include a DNS-ID, *SRV-ID*, *URI-ID*, +> or any application-specific identifier types supported by the client. + +With this change, certificates containing URI or SRV SAN +no longer pass DNS hostname checks via CN fallback +to avoid potential misuse of such certificates +beyond their original purpose. + +Reported-by: Oleh Konko +Fixes: #1802 +Fixes: CVE-2026-42012 +Fixes: GNUTLS-SA-2026-04-29-7 +CVSS: 6.5 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42012 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/8dcc6a1f48945997666ac9f10896819edd01a03b] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/hostname-verify.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/lib/x509/hostname-verify.c b/lib/x509/hostname-verify.c +index e7597ad3b0..d989bb1abc 100644 +--- a/lib/x509/hostname-verify.c ++++ b/lib/x509/hostname-verify.c +@@ -108,8 +108,9 @@ unsigned gnutls_x509_crt_check_ip(gnutls_x509_crt_t cert, + * that we do not fallback to CN-ID if we encounter a supported name + * type. + */ +-#define PRECLUDES_CN_FALLBACK(san) \ +- (san == GNUTLS_SAN_DNSNAME || san == GNUTLS_SAN_IPADDRESS) ++#define PRECLUDES_CN_FALLBACK(san) \ ++ (san == GNUTLS_SAN_DNSNAME || san == GNUTLS_SAN_IPADDRESS || \ ++ san == GNUTLS_SAN_URI || san == GNUTLS_SAN_OTHERNAME_SRV) + + /** + * gnutls_x509_crt_check_hostname2: +-- +GitLab + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 641289be134..646cc350d9d 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -52,6 +52,10 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-33846.patch \ file://CVE-2026-33845.patch \ file://CVE-2026-5419.patch \ + file://CVE-2026-42012-pre1.patch \ + file://CVE-2026-42012-pre2.patch \ + file://CVE-2026-42012-pre3.patch \ + file://CVE-2026-42012.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b" From patchwork Thu Oct 15 05:02:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100744 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2770ECC6B3E for ; Thu, 15 Oct 2026 05:03:51 +0000 (UTC) Received: from mail-wr1-f45.google.com (mail-wr1-f45.google.com [209.85.221.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32815.1792040620339474105 for ; Wed, 14 Oct 2026 22:03:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=S34qqyXR; spf=pass (domain: smile.fr, ip: 209.85.221.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-48b0584ad71so2872227f8f.0 for ; Wed, 14 Oct 2026 22:03:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040618; x=1792645418; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qhUg5JeXtSlF0vS+Fv0VzyR6D3TT1mk/tBVDuxp7Cso=; b=S34qqyXRuHquUyKChN0Dj8IGD4L4FsbNICreeNYsoRf1+cSIYavN8v4+hMi5PeBBtl LLWgJGfU5PQDKaNq4niMWHLFdQ0dh7CBd3nK/cmH0SKPALAEDblIDOF9Z+/33eoDEs0V HdrOCCKqSewjdbjM6uAz6MlEyHbCHiob/K6So= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040618; x=1792645418; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=qhUg5JeXtSlF0vS+Fv0VzyR6D3TT1mk/tBVDuxp7Cso=; b=wAZE0X1SKjawEyDCejDUWk3ZcI7N+5EMQXjIVSXH41nMZuEDFc2+doHXyjrOnCNn9R mpui6OyRpl6aYUwtysEbE9Jno3BQCVvU8jFD4vXxeY9mx2vVWaGGw6SZEMNK3ul1OHFD 6BJZHhqUPwlDWN3J2reYIFeYB3AUBHYKyFGnGofbqEiXoC8zakVKwN9UmvVQHskkUps1 uaFkoQYmIPyDs4VMGSYS0kCTo1Oo0biP91/LCR2TMeP699na76IxBpYuGWTaa37Xwajk BvWW+ePq2mGKcR9dB4e2Fg/sn0mc4o9jsw8vVFMwBEtG5XnIgeNyloTj3Z8ke9swZxwP EbEA== X-Gm-Message-State: AFq9FYISIlLjSLAfgja3lM2WlOvNiG5WMvrb2L7fRdWfmZf1rvMCYqr1 seNoUvk3aTV3YYe2/BtwU1qsam5ZsoqQ+c84TzhT1bG9UwB8+93d3gWD98fF91eWZoM6jSPGN1X 61/Zbg3A= X-Gm-Gg: AYBFou3VjRUtZrBCnxkt40cYFX6pqYRXtP5DqbYr/4O/dk3CaL0yO/4A2U5U9/SsBya FZC1+okJw6cy/TbO7h3jbKbchNXH4xMZO59KJ+Ui8hmh23RDWdmk4Hg6PdMFIau0O1An3PHfu0q zoK3S0bVcmgmI9VS5PgFPBFQaxwgznEr0jW4H/FLjaskW7GgoMSalFzsCxFIRzvmxgPvPqkVSuJ 7vEhSrmNRYKF5sbMDN25Tm+aAoejNpanATuRVD2s5w1JjOjjsY+dkKyPLRPXJachGue58H8t7J/ b18g39cJ8bq7wXPxlTHrTn6l0hPIAHgm00ULUQLqNqr7tbYzLuIpSrd+3Dt+mEciw7HW9H6vEdV hXvtoxavDhny1gnxYwcnerIsylvvMBMvmTVEBFuPSpQbS2GVV083H2Srk/l+WgxcniNctfqKlN0 TlfVKnSzvJEDUVRKsH6LFr222adPNibdFsauByh4iafWJmYL8ujQxQ+nkGocpcaD0msfcxWak6X hYtKpSUpadBtFyiR86CqZ0RKX7ahLxnOxoX1Jj6UM9V3gOfLsQrGX+ud3sNdPfLv0ufdBJ71mFR 6AGv5pGp X-Received: by 2002:a05:600c:a088:b0:4a0:2644:80db with SMTP id 5b1f17b1804b1-4a18e4d55a2mr346683785e9.35.1792040618530; Wed, 14 Oct 2026 22:03:38 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:38 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 03/55] gnutls: fix CVE-2026-42013 Date: Thu, 15 Oct 2026 07:02:26 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247801 From: Jakub Szczudlo (Nokia) Backport patch to fix CVE-2026-42013. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42013 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Tested with ptest Pre patch taken from upstream so CVE fix will land cleanly Signed-off-by: Jakub Szczudlo Signed-off-by: Yoann Congal --- .../gnutls/gnutls/CVE-2026-42013-pre1.patch | 56 ++++++++++++++ .../gnutls/gnutls/CVE-2026-42013.patch | 74 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 2 + 3 files changed, 132 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch new file mode 100644 index 00000000000..53687cb53b9 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013-pre1.patch @@ -0,0 +1,56 @@ +From 3ee2cb707002f755e4bda3f75285caa0cb36c214 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 15:35:59 +0200 +Subject: [PATCH] x509/email-verify: call fallback DN fallback + +A comment was inaccurately referring to DN email field fallback +as CN fallback. +Rename a few things as well to match x509/hostname-verify more closely. + +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3ee2cb707002f755e4bda3f75285caa0cb36c214] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/lib/x509/email-verify.c b/lib/x509/email-verify.c +index dbef0bb86e..3c22ffed37 100644 +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -42,7 +42,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + { + char rfc822name[MAX_CN]; + size_t rfc822namesize; +- int found_rfc822name = 0; ++ bool dn_fallback_allowed = true; + int ret = 0; + int i = 0; + char *a_email; +@@ -76,7 +76,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + cert, i, rfc822name, &rfc822namesize, NULL); + + if (ret == GNUTLS_SAN_RFC822NAME) { +- found_rfc822name = 1; ++ dn_fallback_allowed = false; + + if (memchr(rfc822name, '\0', rfc822namesize)) { + _gnutls_debug_log( +@@ -102,12 +102,10 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, + } + } + +- if (!found_rfc822name) { +- /* did not get the necessary extension, use CN instead +- */ ++ if (dn_fallback_allowed) { ++ /* did not get the necessary extension, use DN email instead */ + +- /* enforce the RFC6125 (ยง1.8) requirement that only +- * a single CN must be present */ ++ /* only a single one must be present */ + rfc822namesize = sizeof(rfc822name); + ret = gnutls_x509_crt_get_dn_by_oid(cert, + GNUTLS_OID_PKCS9_EMAIL, 1, diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch new file mode 100644 index 00000000000..c63e4d7039d --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42013.patch @@ -0,0 +1,74 @@ +From 29801bef00ecc0f23c0bac4cd333b269cd2c1af4 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 15 Apr 2026 16:02:19 +0200 +Subject: [PATCH] x509: prevent fallback on oversized SAN + +Passing oversized SAN did not preclude CN (or DN email) fallback +during verification, which is an RFC 6125 6.4.4 violation. + +Now oversized SAN are skipped over, +but prevent the fallback from happening. + +Reported-by: Haruto Kimura (Stella) +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1825 +Fixes: #1849 +Fixes: CVE-2026-42013 +Fixes: GNUTLS-SA-2026-04-27-8 +CVSS: 6.5 Moderate CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N +Signed-off-by: Alexander Sosedkin +CVE: CVE-2026-42013 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/29801bef00ecc0f23c0bac4cd333b269cd2c1af4] + +Signed-off-by: Jakub Szczudlo +--- + lib/x509/email-verify.c | 14 ++++++++++++++ + lib/x509/hostname-verify.c | 14 ++++++++++++++ + 2 files changed, 28 insertions(+) + +--- a/lib/x509/email-verify.c ++++ b/lib/x509/email-verify.c +@@ -75,6 +75,20 @@ unsigned gnutls_x509_crt_check_email(gnu + ret = gnutls_x509_crt_get_subject_alt_name( + cert, i, rfc822name, &rfc822namesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without DN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling DN fallback\n"); ++ dn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (ret == GNUTLS_SAN_RFC822NAME) { + dn_fallback_allowed = false; + +--- a/lib/x509/hostname-verify.c ++++ b/lib/x509/hostname-verify.c +@@ -213,6 +213,20 @@ hostname_fallback: + ret = gnutls_x509_crt_get_subject_alt_name(cert, i, dnsname, + &dnsnamesize, NULL); + ++ if (ret < 0) { ++ if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { ++ /* oversized SAN; proceed without CN fallback */ ++ _gnutls_debug_log("oversized SAN ignored, " ++ "disabling CN fallback\n"); ++ cn_fallback_allowed = false; ++ ret = 0; ++ continue; ++ } ++ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) ++ gnutls_assert(); ++ break; ++ } ++ + if (PRECLUDES_CN_FALLBACK(ret)) + cn_fallback_allowed = false; + diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 646cc350d9d..f85feb7dd2e 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -56,6 +56,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42012-pre2.patch \ file://CVE-2026-42012-pre3.patch \ file://CVE-2026-42012.patch \ + file://CVE-2026-42013-pre1.patch \ + file://CVE-2026-42013.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b" From patchwork Thu Oct 15 05:02:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100747 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4622CC6B3F for ; Thu, 15 Oct 2026 05:03:51 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32432.1792040621490125311 for ; Wed, 14 Oct 2026 22:03:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=k9+ST6t1; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a1698ea378so39096825e9.2 for ; Wed, 14 Oct 2026 22:03:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040620; x=1792645420; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=sUbQsXKsfLGDW4xc9jSZ1GqcpJilKp/qSja+SkRBrNQ=; b=k9+ST6t1meLLcXaUes084JnR1HkyxzGj/W1GpAPSXsWoJShqDmz0aDP0hHNAD4Zj3f 4AlsiCYFTyBBDMM0AuuasJqXtQr2dOPdseUHHKOMivfKjgBHleTd39H4Nwn+YNypLvTw XvyI3Wda+7/N6qwIxttYB+sFD/uzavGL38AZo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040620; x=1792645420; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=sUbQsXKsfLGDW4xc9jSZ1GqcpJilKp/qSja+SkRBrNQ=; b=ICHaem2CD5UQwB/DGw64ULCUF0EWJCidLYKdJwZjGasxnQp92EYV1am1Ignugte3/r SdTUMer8iPi+dmRugouhV6pofizAhieeRHbOLQrU0hi6tywY5r9mPndULdcqrSeSEysS UzuCsiQKEBfsRgRdeMmXjgpc17BBmqdiHUzceXhpec/r4cF0c7jomdgjBY5ArXrP89Ig V5u7cwitZtGkUIiTj64ukX8lhHYQGTpO5l/5DIyh5+irqEx1xqDPF2waY3YLvmRTngAO qXjtiy7+S8F3Iq2sEL8KbtuhtYlOh968s1KmaKvho7rszOfmS6OiO8Zy3oJSsHj/LXDP a85w== X-Gm-Message-State: AFq9FYLfAQnkftrNY5gq9mnT2/mEXR4lcawJEMIkRI1kCWDd9nuHR9qR s2xXEsm9k6y6+EZKKd9gQnluNWHGup2uX3DwUxhNumjtyMwFk4YR4+Jd58GZIANj6Am15l7Zc2m LenkpY9E= X-Gm-Gg: AYBFou3VFeE5mYTcZpEOIHQHCOa0OFbhibwKj0G91+oT/4JhCSJFrlWm5mbCtSjUPET ULtTF5ELr/35RtkpJQwWVFXILzogc1Xm1W6hun9tDI+FrIiBD0CBQ0x4eyqKaXmlEI2HfE57KJY Q3EaJorgXDvpaYGibLbAHE6dyl7fgYznuncAPMK1njtT5Uca5txVyqnXTtoUZq0poAoxYNPoHO0 rHdideJSYCXzy8C46/ai0/Jqnkt47GVc0zIiik8rrMgegQVi0O6c6OcLGPHbhWC7SWH8MwxxMWf qTRVnu/kzXzvrdb8oiIx+kPTm2H0UGc4AVUa6eVN6Gre9R/3MfQY/S0SflbwZsX14yC8AnDaSpz W2vZX8u9p0DfgrLpjLgKQk+vElqQ2+hLmacjybN1+ZQcKxWc1Yu5PcGQ7zMj6G2wDFkKnyWgIjA pLEO3Wd8oYi9F1yii41YZFGTfQcl8/x9khnCIul5dSR38wCEjCru+WlGor3GWcQtCwBMb1y9wsj 0oafrtfvUoLAX8R9STMgVXu0Xj97cnRVJHnfVfLH5AMMHmG1Z2MBgQ+1xAUUCEXUQEm7X+SNw== X-Received: by 2002:a05:600c:8b78:b0:4a0:25d5:e853 with SMTP id 5b1f17b1804b1-4a18e4ddd99mr359519465e9.35.1792040618975; Wed, 14 Oct 2026 22:03:38 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:38 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 04/55] gnutls: fix CVE-2026-42014 Date: Thu, 15 Oct 2026 07:02:27 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247802 From: Jakub Szczudlo (Nokia) Backport patch to fix CVE-2026-42014. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42014 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/3957f136e2ed23caf176a594b54b3827f5cef701 Tested with ptest Signed-off-by: Jakub Szczudlo Signed-off-by: Yoann Congal --- .../gnutls/gnutls/CVE-2026-42014.patch | 60 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch new file mode 100644 index 00000000000..7fd0c163f8a --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42014.patch @@ -0,0 +1,60 @@ +From 3957f136e2ed23caf176a594b54b3827f5cef701 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Wed, 18 Mar 2026 18:19:06 +0100 +Subject: [PATCH] pkcs11_write: fix UAF and leak in gnutls_pkcs11_token_set_pin + +Changing Security Officer PIN with gnutls_pkcs11_token_set_pin() with +oldpin == NULL for a token that lacks a protected authentication path +led to a use-after-free. + +Reported-by: Luigino Camastra and Joshua Rogers of AISLE Research Team +Fixes: #1766 +Fixes: #1809 +Fixes: CVE-2026-42014 +Fixes: GNUTLS-SA-2026-04-29-9 +CVSS: 4.0 Medium CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-42014 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3957f136e2ed23caf176a594b54b3827f5cef701] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c +index 961e1b9..9fe571e 100644 +--- a/lib/pkcs11_write.c ++++ b/lib/pkcs11_write.c +@@ -1267,10 +1267,9 @@ int gnutls_pkcs11_token_set_pin(const char *token_url, const char *oldpin, + ses_flags = SESSION_WRITE | SESSION_LOGIN; + + ret = pkcs11_open_session(&sinfo, NULL, info, ses_flags); +- p11_kit_uri_free(info); +- + if (ret < 0) { + gnutls_assert(); ++ p11_kit_uri_free(info); + return ret; + } + +@@ -1291,9 +1290,11 @@ int gnutls_pkcs11_token_set_pin(const char *token_url, const char *oldpin, + oldpin_size = L(oldpin); + + if (!(sinfo.tinfo.flags & CKF_PROTECTED_AUTHENTICATION_PATH)) { +- if (newpin == NULL) +- return gnutls_assert_val( ++ if (newpin == NULL) { ++ ret = gnutls_assert_val( + GNUTLS_E_INVALID_REQUEST); ++ goto finish; ++ } + + if (oldpin == NULL) { + struct pin_info_st pin_info; +@@ -1325,6 +1326,7 @@ int gnutls_pkcs11_token_set_pin(const char *token_url, const char *oldpin, + ret = 0; + + finish: ++ p11_kit_uri_free(info); + pkcs11_close_session(&sinfo); + return ret; + } diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index f85feb7dd2e..8f24f01fd34 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -58,6 +58,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42012.patch \ file://CVE-2026-42013-pre1.patch \ file://CVE-2026-42013.patch \ + file://CVE-2026-42014.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b" From patchwork Thu Oct 15 05:02:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100746 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B93DBCCA460 for ; Thu, 15 Oct 2026 05:03:51 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32433.1792040622205823745 for ; Wed, 14 Oct 2026 22:03:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Uyo2GuFh; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4a022fee0caso45223835e9.1 for ; Wed, 14 Oct 2026 22:03:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040620; x=1792645420; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=gn8T8hURTa5YoXhAtWQQfQ0LZoYLpQuwnKOsFj/NQA0=; b=Uyo2GuFhecLpWrXHD/5qx5moLQzE5qYpX3kyet5Uq1KIUGK+pcqVb6ckCZ6PVBBuCw Fc+opGaHaWVzIhg87pTtu7CPI+PWbFwqjiP1blrbKe9qppF7+KjKo9IziJAdH223EzZy C0wtNKQSyxzJcv3zfLuS70M3TPX3+4U6QUg2M= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040620; x=1792645420; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=gn8T8hURTa5YoXhAtWQQfQ0LZoYLpQuwnKOsFj/NQA0=; b=fOEOpsXz1nVfzwZb6mX1tkUwmMGUTICUmwtDZvZY6f38IWLAwDPLxSbLqcYXnB72yL BRWwDWuNTTiMMJs3r8Ww4/W/SjMLbNwBr5XOMVD2fNkFnOT++3cB+Npe4ZVbbIPNJeyU qIUy2mA1WpeZKeZbJ2MsBNY3KzzOfmnuASXtduYTCBifh9jRjDjsmyGRf7cnRmFZNMP2 w/IQIbfxSqYISf03YEImnboVybuP3tCgQTt7fLYd3z7UAZJboW0iPnejd8wH6/kDXKkb fEu9b/aTHt9vEqiq151KmTES1UwX6Iltg3tE8/q0pSETy6uB6bJuxooY96Aj/S092wyf k9Xg== X-Gm-Message-State: AFq9FYL2TnfWPlKas6LKwarbLh9o3NCwXEHlZo+66s8OQcGIA2Wyyw4R 9a0mejXB/rtv60KMwd1fuSrnDhZHO0eW6nZ8CNoqoqCyk2hjMBM89lrUjGfr5vXSsdUIuqQ7ULR Pez7IKGE= X-Gm-Gg: AYBFou2kTWlAtadIV8NWR/zyODwGIkMW6GJVBYuDTNHNuqYHmpUGXBCYxVCDuCPx0lP F5TAUdDamN/fN+mWd3Uj0KJJpscXiSh4Hgyn5dyRr7TznFAlfhtl46Z3BeNvKDlmRBSXJaQQXjX I7n8ZP0OPMmatHsd8PsHBlKIg+Bhs6SqcDOye4pjMrAtuvaFc9tuRfPp/ClpM6d3TF3m2wvOdbM XJ5dFUwe/0VpxpKVAT9F8mQAm0TAcYzGtEMnkigrtijP1jDJiQcyr+Jv6EjX7+SwKvi1Yy90yyw SktlPYxbEeTcxNkJajY/uTejeJCZvDf6aZB7bJNitPsQnvwUilLh2DK/UtcdMCUgmBN5a1LqMEB vdU80sxoY2qPLiavQy0btyz5MzQTlbcCfX45YzxrnjJNoH0xnRZebHDWRuqlNPE57kAa+Wh9C2W t+0FyKCZOFa6FhxR5UcIX1CC3K2JA6pM6DwhdYWptQ2S5yJBMcCDK2I+CCyNgEPK3UHrJ25KlAg uQNsIPVwtxv0MXLNt0ffvmmOWM1zUjzWgkJImmvf7DA3wG3+owDZclrU7aN9HIki3IIs7lFWg== X-Received: by 2002:a05:600c:609b:b0:4a1:83f0:7c91 with SMTP id 5b1f17b1804b1-4a18e4ca1dcmr341722095e9.18.1792040620322; Wed, 14 Oct 2026 22:03:40 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:39 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 05/55] gnutls: fix CVE-2026-42015 Date: Thu, 15 Oct 2026 07:02:28 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247803 From: Jakub Szczudlo (Nokia) Backport patch to fix CVE-2026-42015. References: https://nvd.nist.gov/vuln/detail/CVE-2026-42015 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Tested with ptest Signed-off-by: Jakub Szczudlo Signed-off-by: Yoann Congal --- .../gnutls/gnutls/CVE-2026-42015.patch | 43 +++++++++++++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch new file mode 100644 index 00000000000..1a2065371d4 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42015.patch @@ -0,0 +1,43 @@ +From a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 20 Apr 2026 22:42:20 +0200 +Subject: [PATCH] x509/pkcs12_bag: fix off-by-one in bag element bounds check + +Appending elements to a PKCS#12 bag had a bounds check that +prevented adding the 32nd element. +On the other hand, it is possible to import one that already has 32. +Subsequent appending then led to writing past the 32-element array, +smashing its length. + +Tighten the check to reject any bag with 32 or more elements. + +We'll treat this vulnerability as a Low due to how contrived +the requirements are: for the code to be vulnerable, +it needs to append to an imported untrusted unencrypted PKCS#12 structure. + +Reported-by: Zou Dikai +Fixes: #1840 +Fixes: CVE-2026-42015 +Fixes: GNUTLS-SA-2026-04-29-11 +CVSS: 6.1 Medium CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H +Severity: Low +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-42015 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/a3e7c50d3e1761e5ef1d4b225507cab8f2b2c3ca] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/x509/pkcs12_bag.c b/lib/x509/pkcs12_bag.c +index 911aeff..3822861 100644 +--- a/lib/x509/pkcs12_bag.c ++++ b/lib/x509/pkcs12_bag.c +@@ -375,7 +375,7 @@ int gnutls_pkcs12_bag_set_data(gnutls_pkcs12_bag_t bag, + return GNUTLS_E_INVALID_REQUEST; + } + +- if (bag->bag_elements == MAX_BAG_ELEMENTS - 1) { ++ if (bag->bag_elements >= MAX_BAG_ELEMENTS - 1) { + gnutls_assert(); + /* bag is full */ + return GNUTLS_E_MEMORY_ERROR; diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index 8f24f01fd34..bb9bc0af05d 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -59,6 +59,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42013-pre1.patch \ file://CVE-2026-42013.patch \ file://CVE-2026-42014.patch \ + file://CVE-2026-42015.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b" From patchwork Thu Oct 15 05:02:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100749 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 092F9CCA463 for ; Thu, 15 Oct 2026 05:03:52 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32816.1792040622715764544 for ; Wed, 14 Oct 2026 22:03:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Zua/sf6N; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a1ad2e2391so18762495e9.0 for ; Wed, 14 Oct 2026 22:03:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040621; x=1792645421; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=OQxF8e3E/eKlsMra0h2EfckzilfN9n23pV25fI8zgys=; b=Zua/sf6Nkadi3ZgKbc6e3umFs8AeBPYV+tijeRXO2DJmpUpLFeVhI5es1xHg+JbrIa e7rHpDZc49Flek8DCLspwasXbIlhjqW1fxS9lUGSHbgy4QFsDrjV50vUZiDtFIF+sHzJ StMUxPvhrG+W8oN21I5DHAo3xkfPoUxGiMw9Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040621; x=1792645421; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=OQxF8e3E/eKlsMra0h2EfckzilfN9n23pV25fI8zgys=; b=TdB8V6qrGk+qd8Xr7/7YTLSQF8cMO4V2scVEQ+y3mTjMak3cu5m2ugsJiBLLfRHzg0 60RaIgMVgPpG/xP5lceKC0l9ZYA8bEY+CnRgO2EIef1kv/U0hO7PdrYp/txT93nFWuFV RynQAh0sN2t21k8rONDnfir3TVkO1s9oOb0bATjAv/6vlrnbHl80/C+I4Xl6Cpi1la8h dm5OTNrKPX4LQCcWeE7HExwCZKzhgoQaiWV0GiKs5GmnBPJLhBfBN/61eSm+Mbt/URrp zwgVJjjLJvPCvM2qBOyF0wN8IXrroYbaoFStgpEji4XVUCh2oWH4t5dE9Trtm6GIwLJE e2Kw== X-Gm-Message-State: AFq9FYISuVazzIsf8o+HUqvC5FZmR/WvgogPne2+iG9/NTW2/P3dvsYC zsBXIB9Sba5UTsTgc/ikYZAZiPn4hZL8uM0B71G6HhYeBkuQ9UYmAFhVZAjMkvhwarhEhrAyIlg 4rQijTAo= X-Gm-Gg: AYBFou3bOJfM/9Xqmg3wCdJp1vhzPsseQUCwvtRSP84Hzqu/N5ZZtS4mp+arOGlvWk8 V/m2XDNyVuOubt83BtEIDSgFPUMldhuU9dVnKa4aDN8qWqHlB3GkS0qBpIaeemY/YdMa/JEUq3t T/awMOhQGNjoK6E1jYEt/J2dmeBs31x+Q/9KqyUAWvW21tNumJhNhL8ryLH5UOpjJrYvQl5SH/H ShBQ+NB82q5VoAijNpOW7t5sYYwq0BZWN6p1VcIFqQpY1c+9zWRfLCVyJ8OxmBZkhBzuV3w5ttT RjwqaFzARtgVKuVz3B5kxkkeEXymTaRjqAucZvgckt/hoDVGccr9MYFFpQRbwFsiGE1eoISColR L51MFqFYJS6EhUsXoB8viNSgas0amCaDJ56I5lODWcS/n1P0L5EJyXEc74XHhepQUIurE0kFTpx eTCSzzMOZ0O78rYWj4dS5QcsliB5vx4T9yv6TljC0+hRJik8wr9pTb0UExxvl6xsNQXyEhcfliE 6QhR9pATGSXalzaVDIxKc9rBfi9LTbbmYRX24Y+h/6ChjlpPIeaV1fxyuHpTXONa/AdiECFXw== X-Received: by 2002:a05:600c:4e11:b0:4a1:7f41:b9dc with SMTP id 5b1f17b1804b1-4a18e4d67famr352213065e9.23.1792040620878; Wed, 14 Oct 2026 22:03:40 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:40 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 06/55] gnutls: fix CVE-2026-5260 Date: Thu, 15 Oct 2026 07:02:29 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247804 From: Jakub Szczudlo (Nokia) Backport patch to fix CVE-2026-5260. References: https://nvd.nist.gov/vuln/detail/CVE-2026-5260 Upstream fix: https://gitlab.com/gnutls/gnutls/-/commit/77228f2d1ac207d2f894e5a168fbb47e5378e42f https://gitlab.com/gnutls/gnutls/-/commit/cf6bdc5e4df49e5583d3fb4d2296779785f10683 Tested with ptest Signed-off-by: Jakub Szczudlo Signed-off-by: Yoann Congal --- .../gnutls/gnutls/CVE-2026-5260_p1.patch | 69 +++++++++++++++++++ .../gnutls/gnutls/CVE-2026-5260_p2.patch | 33 +++++++++ meta/recipes-support/gnutls/gnutls_3.8.4.bb | 2 + 3 files changed, 104 insertions(+) create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p1.patch create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p2.patch diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p1.patch new file mode 100644 index 00000000000..f7e6f978b1a --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p1.patch @@ -0,0 +1,69 @@ +From 77228f2d1ac207d2f894e5a168fbb47e5378e42f Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 30 Mar 2026 17:31:07 +0200 +Subject: [PATCH] lib/auth/rsa: check that ciphertext matches the modulus size + +A client sending extremely short premaster secret as part of an +RSA key exchange could've theoretically triggered a short heap overread +to nowhere when the RSA key was backed with a PKCS#11 token. +With this fix, the internal decryption function will not be called +with an mismatching plaintext length specified, avoiding the overread. + +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1814 +Fixes: CVE-2026-5260 +Fixes: GNUTLS-SA-2026-04-29-10 +CVSS: 5.9 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-5260 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/77228f2d1ac207d2f894e5a168fbb47e5378e42f] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c +index b5ecc09..24c1649 100644 +--- a/lib/auth/rsa.c ++++ b/lib/auth/rsa.c +@@ -158,6 +158,7 @@ static int proc_rsa_client_kx(gnutls_session_t session, uint8_t *data, + int ret, dsize; + ssize_t data_size = _data_size; + volatile uint8_t ver_maj, ver_min; ++ unsigned int key_bits; + + #ifdef ENABLE_SSL3 + if (get_num_version(session) == GNUTLS_SSL3) { +@@ -180,6 +181,10 @@ static int proc_rsa_client_kx(gnutls_session_t session, uint8_t *data, + } + ciphertext.size = dsize; + } ++ gnutls_privkey_get_pk_algorithm(session->internals.selected_key, ++ &key_bits); ++ if (ciphertext.size != (key_bits + 7) / 8) ++ return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED); + + ver_maj = _gnutls_get_adv_version_major(session); + ver_min = _gnutls_get_adv_version_minor(session); +diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c +index 399fb4d..7a99d87 100644 +--- a/lib/auth/rsa_psk.c ++++ b/lib/auth/rsa_psk.c +@@ -257,6 +257,7 @@ static int _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, + ssize_t data_size = _data_size; + gnutls_psk_server_credentials_t cred; + volatile uint8_t ver_maj, ver_min; ++ unsigned int rsa_key_bits; + + cred = (gnutls_psk_server_credentials_t)_gnutls_get_cred( + session, GNUTLS_CRD_PSK); +@@ -313,6 +314,10 @@ static int _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, + return GNUTLS_E_UNEXPECTED_PACKET_LENGTH; + } + ciphertext.size = dsize; ++ gnutls_privkey_get_pk_algorithm(session->internals.selected_key, ++ &rsa_key_bits); ++ if (ciphertext.size != (rsa_key_bits + 7) / 8) ++ return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED); + + ver_maj = _gnutls_get_adv_version_major(session); + ver_min = _gnutls_get_adv_version_minor(session); diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p2.patch new file mode 100644 index 00000000000..fd94c64b6c4 --- /dev/null +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-5260_p2.patch @@ -0,0 +1,33 @@ +From cf6bdc5e4df49e5583d3fb4d2296779785f10683 Mon Sep 17 00:00:00 2001 +From: Alexander Sosedkin +Date: Mon, 30 Mar 2026 17:46:40 +0200 +Subject: [PATCH] lib/pkcs11_privkey: guard against overreading on short + ciphertexts + +This is an alternative fix for the callee side. + +Reported-by: Joshua Rogers of AISLE Research Team +Fixes: #1814 +Fixes: CVE-2026-5260 +Fixes: GNUTLS-SA-2026-04-29-10 +CVSS: 5.9 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H +Signed-off-by: Alexander Sosedkin + +CVE: CVE-2026-5260 +Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/cf6bdc5e4df49e5583d3fb4d2296779785f10683] + +Signed-off-by: Jakub Szczudlo +--- +diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c +index 5093a6d..369b034 100644 +--- a/lib/pkcs11_privkey.c ++++ b/lib/pkcs11_privkey.c +@@ -826,7 +826,7 @@ int _gnutls_pkcs11_privkey_decrypt_data2(gnutls_pkcs11_privkey_t key, + if (ret != 0) + return gnutls_assert_val(GNUTLS_E_LOCKING_ERROR); + +- buffer = gnutls_malloc(siglen); ++ buffer = gnutls_malloc(MAX((size_t)siglen, plaintext_size)); + if (!buffer) { + gnutls_assert(); + return GNUTLS_E_MEMORY_ERROR; diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb index bb9bc0af05d..7f7f9c9c05f 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb @@ -60,6 +60,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar file://CVE-2026-42013.patch \ file://CVE-2026-42014.patch \ file://CVE-2026-42015.patch \ + file://CVE-2026-5260_p1.patch \ + file://CVE-2026-5260_p2.patch \ " SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b" From patchwork Thu Oct 15 05:02:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100740 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 759C0CC6B3A for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32817.1792040623312133762 for ; Wed, 14 Oct 2026 22:03:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=BzWPuwYf; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a0e1b0681bso34871865e9.3 for ; Wed, 14 Oct 2026 22:03:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040621; x=1792645421; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=bUGm5y+jdP8tQ2H9aQlKzsTlG2in/4SjEFet4mqsDAM=; b=BzWPuwYfmLfpilb9DodO6XaanTTmdJfS5d+JCXZWx86XPpyKN4PVL3SWrm4x8FcD9M 2Xk8V9NDlWmmflTWv5R1fQSzm9vNifMenBS5OcfudkMUm0F0AljQh9JNt84PpkgqS4cm blGEEPN5HozZus32toZgOOg4SGftTR2PqwJLk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040621; x=1792645421; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=bUGm5y+jdP8tQ2H9aQlKzsTlG2in/4SjEFet4mqsDAM=; b=jOs/DOs5GPdLFw6xeAM9u/6rJMhfTY7DaGJ/PEyRdvM3GsOgtVxD9eF/gZM+CuyTIe Fbw/S9GZC9eRXTMjrz0Fsck6DsnLWjnvVzBrzHdu3oOeV/NPMKojcSY8dKX5n3Bz9mJm 4YHQlB7pCqF2K9Sg3Buop6nn/i8b1NcNi6RgjpWyK3HcJqCaZQeJZWgY4d+H5xZAjBet aiZzdz0sMleq9BWrscC+779zoEgNaHwHRQagaV3pdUz0euptEl2SszgF2W6ogDgghzUY W73AWqUwBSDLAmVr3orY+c/33iLR2XLOUTl2zl6NPrt2cGAc7afBMbWG/gKJ2tN/wIDe jZYA== X-Gm-Message-State: AFq9FYJJrmlBopFcMS+EN8NIMj931XrNk9aq7ZnkF/9WGZScvUv9mjYY cEm9n+DO2WNcdmj+B2rB14Ds7+kdih5LDSb6sOJueJ7RAqfYTGTFwcPE3odNTp3Np/c2GMcw23m QHsjtnYA= X-Gm-Gg: AYBFou19Q0gdtDRFcDa3GK+3f3rDdTiUWYp/+zAqnKdhf3VvhFqTpQLFHUtfIE5+7EA 75m4P6M+tjWLiUPxUhIcxizglfXw4+h24SE6bXLqOCUWoEkbwOwZUuPASnflpbnjwYS1rHKR1fp VHFuuxKJbRcncF4pz+e9Yn1QaB6W5Y3NukCC8j6GgtVHnlDeNyfxUkm/Or0+zaXV5HwdL4Y9vBl Nc/JiWuOphm3nkQqKzFvh6TV4iQmexekRk8rEh50YqKU3yvOpLUv+QCy3DVhqz+1v3mJnim8LXG YdWuwlTyuuP/cB0yKKxxSBXWrKKkqcESVgJu2DHAluCehw1g82QQGI3yHyh8QcIhp+MlhKyLD7G Dt9DkKG/be+4yT6JSnrNX0vDYa+Ei3GZheb3gPkzRu80A1CPY/AFmTWLrpFlnDPb5p7gfkuIdaW o+z4XaILWWyxjXJHK/asTRcXRu73VMakoz5iZYvUkahIkmqNUWunquiLnEVT5KI2sYduZE2a2fg wp6zYttX/1yviMn9LZjgDkEihzAq9mWGcr8NrL1UzFGAv2TJz6Cm3MCN+Pyj22y9ndUK10AvaA= X-Received: by 2002:a05:600c:3e0a:b0:4a0:1c10:1372 with SMTP id 5b1f17b1804b1-4a18e4aa206mr375340015e9.27.1792040621466; Wed, 14 Oct 2026 22:03:41 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:41 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 07/55] gstreamer1.0-plugins-bad: Security fix for CVE-2026-3082 Date: Thu, 15 Oct 2026 07:02:30 +0200 Message-ID: <131827198caa3c9c7b8988f1fb016fb2c2e08385.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247805 From: Rohini Sangam Pick patch from [1] also mentioned at Debian tracker in [2] [1] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/83e9225bb9e89948e7b1c9f37ef9218d2dcde354 [2] https://security-tracker.debian.org/tracker/CVE-2026-3082 Signed-off-by: Rohini Sangam Signed-off-by: Yoann Congal --- .../CVE-2026-3082.patch | 46 +++++++++++++++++++ .../gstreamer1.0-plugins-bad_1.22.12.bb | 1 + 2 files changed, 47 insertions(+) create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2026-3082.patch diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2026-3082.patch b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2026-3082.patch new file mode 100644 index 00000000000..26e27ee5f59 --- /dev/null +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2026-3082.patch @@ -0,0 +1,46 @@ +From 83e9225bb9e89948e7b1c9f37ef9218d2dcde354 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?V=C3=ADctor=20Manuel=20J=C3=A1quez=20Leal?= + +Date: Wed, 11 Feb 2026 22:07:49 +0100 +Subject: [PATCH] libs: jpegparser: boundary checks before copying it + +READ_BYTES macro reads data from a byte reader and then copy it to a storage +variable. This patch adds a validation that the length to read cannot be bigger +than the storage size. + +This macro right now is used only for storage variables of guint8 arrays. + +We have validated in the specification (sections F.1.2.1.2 and F.1.2.2.1 in ITU +T.81) that Huffman tables (both AC and DC) aren't bigger than 256. + +Fixes SA-2026-0003, CVE-2026-3082, ZDI-CAN-28840. + +Fixes: +Part-of: + +CVE: CVE-2026-3082 +Upstream-Status: Backport [https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/83e9225bb9e89948e7b1c9f37ef9218d2dcde354] + +Signed-off-by: Rohini Sangam +--- + gst-libs/gst/codecparsers/gstjpegparser.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/gst-libs/gst/codecparsers/gstjpegparser.c b/gst-libs/gst/codecparsers/gstjpegparser.c +index 6411076..86125b3 100644 +--- a/gst-libs/gst/codecparsers/gstjpegparser.c ++++ b/gst-libs/gst/codecparsers/gstjpegparser.c +@@ -79,6 +79,10 @@ ensure_debug_category (void) + + #define READ_BYTES(reader, buf, length) G_STMT_START { \ + const guint8 *vals; \ ++ if (length > sizeof (buf)) { \ ++ GST_WARNING ("data size is bigger than its storage"); \ ++ goto failed; \ ++ } \ + if (!gst_byte_reader_get_data (reader, length, &vals)) { \ + GST_WARNING ("failed to read bytes, size:%d", length); \ + goto failed; \ +-- +2.44.4 + diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.22.12.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.22.12.bb index f6d0711bd8f..64e0aa6dcbe 100644 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.22.12.bb +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.22.12.bb @@ -12,6 +12,7 @@ SRC_URI = "https://gstreamer.freedesktop.org/src/gst-plugins-bad/gst-plugins-bad file://0005-v4l2codecs-Always-chain-up-to-parent-decide_allocati.patch \ file://CVE-2025-3887-1.patch \ file://CVE-2025-3887-2.patch \ + file://CVE-2026-3082.patch \ " SRC_URI[sha256sum] = "388b4c4412f42e36a38b17cc34119bc11879bd4d9fbd4ff6d03b2c7fc6b4d494" From patchwork Thu Oct 15 05:02:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100739 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6405CC6B3B for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wr1-f42.google.com (mail-wr1-f42.google.com [209.85.221.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32818.1792040623802594365 for ; Wed, 14 Oct 2026 22:03:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=CcLDCFfR; spf=pass (domain: smile.fr, ip: 209.85.221.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f42.google.com with SMTP id ffacd0b85a97d-48c14a06c95so3878833f8f.1 for ; Wed, 14 Oct 2026 22:03:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040622; x=1792645422; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=hQFRKkh6eXDPNGP2NPwcv7QOPQ5daOk1jOJHk79PL6w=; b=CcLDCFfRDUC8w2icFXhQZlsdqPRaS+YuQh1GAnptowsqceDXmWKVjxSxJGDGIG/rIC DlIjK20uT+bOV1fJiZawK8JkKwJQxOnXtiHYeuiRMNueo3tiHteYWb4l9GL+N2hCstyN YojEdPSXbz1oU/aXUcORgkDdkEp4eoo+o2u9k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040622; x=1792645422; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=hQFRKkh6eXDPNGP2NPwcv7QOPQ5daOk1jOJHk79PL6w=; b=tzY7YHhH+OTCrawZqXQPu6hteMx3/Gk6tGHFThWH7hx0jSpfn2/NmqEH8De2nWKtoI 0KnV3aPQ/O435SZ07XUm+4vDSFnEgoMrgWN6pLwhRMaTylrCgVz/qMQ9YKfjfuGVm20O DV4o2tKUQFyl/ZHt/vbmfC3EE2ysW84jNa9Q2mHWnXTmz0rk+BPm7m/urHWz+L2O0BRk MxenYQQf664kw8WITHvp2607Ec9Q4ql3yqSyd5Ls6H6uvbZFFmK2pKGl/hlvtAASIOpR 856wkAXUHbJMkEG1LOmnXFkFNdrlwA6w+eVxe1LF/d34V784Bs+giC+33etEihSpAuZy BI/Q== X-Gm-Message-State: AFq9FYITLK69UntddmUlhDih3q9JpTBzZ+KCYmHK0YaIpvjzzZGk9RTo cIdR+f6NvDIvKAiEjY3v4mDQaBF2PaFnK4l/1l5s44aYgWZce6slIm+QT4hIWK9+SsRyrb4Z/O4 zrTnd63c= X-Gm-Gg: AYBFou0dCpLbh3NP/A05MMEFrWVTeTvMFqgDxQ06IKJ6YgrgeX1/M1eweG7VRuiWts1 2Dqk3+brhhCuNvRcKKMDcAWJgasS9KxzF+MpFCRhQQtISgTfBUVuEQ/UVP1Nx/ORa14wWlqujeo emfClFgU3pWn5uQOVKlYacaXcp0LIlEbpmVLDMhnoyz1gVcGqkCrHyl+MkN8lr+eFEXZADBmFq/ YEJjQOzaemmIpMIiupYEljxg7rcwBXkbhEeq5vurgaOXOhy7LsqGzNLxcAXpv3Ohm72eqGxzI4d s7BP2mWnt4MRAmsxlAIDMvkr/rRLNPBpIjU6xS0jS3OTYNQM2FI21SKVMCfip+QEXanVpGf9fOT n2MhodiMTCr4PNnD0dFOm7DKe2fSVlxY2NZzPg1dRzLzwAJqttc3VsKA4gng36lF0++XrjVKxUn gNcEEKf8T2auIQl9NE3fSB8K204LGY8NLQcLJBCLa7msu22UlQJUueY7JA+YKzzBOZTFg1I2FoX S/HU6KmJM2tmex7Weovc7pIxHkMk7MGqFUy1aLt5vVsBmJnr4fuIyS4LXnG0+zSISh4t5q33Q== X-Received: by 2002:a05:600c:3e8d:b0:4a1:7701:f863 with SMTP id 5b1f17b1804b1-4a18e4aeae4mr326531865e9.15.1792040621914; Wed, 14 Oct 2026 22:03:41 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:41 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 08/55] devtool: standard: fix update-recipe/finish --initial-rev override Date: Thu, 15 Oct 2026 07:02:31 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247806 From: Babanpreet Singh Since 900129cbdf ("devtool: add support for git submodules") the --initial-rev option of update-recipe and finish has been broken: the parse loop in _get_patchset_revs() deliberately skips the recorded "# initial_rev ." entry from the workspace bbappend when an override is passed, but the override value itself is never inserted into the initial_revs dict. For a recipe without submodules the dict therefore ends up empty and update-recipe/finish fails in patch mode with: ERROR: Unable to find initial revision - please specify it with --initial-rev i.e. passing --initial-rev produces the very error message that instructs the user to pass --initial-rev. Before 900129cbdf the passed value simply took precedence over the one recorded in the bbappend. Seed initial_revs with the override before parsing so the option behaves as documented again; recorded values are still used for submodules and for the main repo when no override is given. AI-Generated: Uses Claude (claude-fable-5) Signed-off-by: Babanpreet Singh Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 62abb60b899e63ea6db5c745f4b1b6af0d4b40f1) Signed-off-by: Yoann Congal --- scripts/lib/devtool/standard.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/lib/devtool/standard.py b/scripts/lib/devtool/standard.py index e1e519ce5b6..d5313921f2d 100644 --- a/scripts/lib/devtool/standard.py +++ b/scripts/lib/devtool/standard.py @@ -1254,6 +1254,10 @@ def _get_patchset_revs(srctree, recipe_path, initial_rev=None, force_patch_refre commits = {} patches = [] initial_revs = {} + if initial_rev: + # A user-specified override applies to the main repo ("."); the + # parse loop below leaves it in place of the recorded value + initial_revs["."] = initial_rev with open(recipe_path, 'r') as f: for line in f: pattern = r'^#\s.*\s(.*):\s([0-9a-fA-F]+)$' From patchwork Thu Oct 15 05:02:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100743 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDAA3CC6B3C for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32819.1792040626163016211 for ; Wed, 14 Oct 2026 22:03:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Ir81ZQ+h; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a1688d7769so14137225e9.0 for ; Wed, 14 Oct 2026 22:03:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040624; x=1792645424; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=uR1u05EWS7I9rdHzaA6wXCyJDm5rc8kgH9PsWSihIQA=; b=Ir81ZQ+hWrT+i4JQ/5U11DJjHWCJoKbIKScX61u070oACjHUjnMozxe0WNBSOq9/h7 36UcMWFktocGkgxtJmyku5l/pO4H/AlglR9nCAY1AmoBgAWPDhgyU3LOp6Q0rYbRAZXj FcFQcWafLTXqYdMTPH/DPks4FZkIiN9uayatk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040624; x=1792645424; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=uR1u05EWS7I9rdHzaA6wXCyJDm5rc8kgH9PsWSihIQA=; b=jIC3HAAUcL5sVbJbeVJDIN4KjuH+NxKJQxOhBiRO610+hkCvOMKe9hnwRe8XRjYLFh 6fqgDQJWE24sgIa9RYOKxOmibPgih4vdq/CwqrvWWqIVkUmDRXgSnsGPKftdmctAkJE4 F3zlTqKig1acsk/PhQmYueWQxbFU4niNxOenYhwEZoA/xQSm5vN1cDUdYc/kCf5LwlHu ilqMM32MBDMQoirQBo23jkcbTMADneY49+XDikIcdAjhCB/Jq9pO8viZvzTPMWWMUxrq A2JseIPcjnA8EuxtVHv1H9KKes4x3EZneFoqCdauJaN4UNpxv04zCB9Q6HQqzv5m+GM7 V0MQ== X-Gm-Message-State: AFq9FYJd+B97akvAWoQQQIt9gWw7Z481O25Om+u+8lBUnBIdkqgAzpDH oOSQcn+k23VNKaWCRuYUYEkSyI35nVBE2pUHBbJTIwMk01qF1zdk8GrfhikSXxxU+NlIC9teBKd odre/VYA= X-Gm-Gg: AYBFou13YBuz7feUjJMKzO/nTe0OXhZPzpyjJqx4VO0qe9xs99RTZh8spZ4LHLundKm aPVut4pV/4KMwVE2tnbWDk0S9HY+DkpFpYgkV0B8TreF+25a6z6a4w91H8HBEYB7LVUE9/wr/4c xWNl/WwP0/NfknmxB+tZTDiuyks+L27IddWw5NeoFdRA9uivyvYy4Cp61fG1MFuIeSS8qENQ/Mf F2g9Uhgn6okCsvfaZgIDtpJbAIMkMLxgxpoxFcY9lxImwTD/kIpFdOqfrhy9d+TmpYLxb1M9fRU cAHbZ627GuUXAtwHK4fVR0m8tMc9y8gktr8x/G/nZGX/WxDOkphRjfTcuUq8efnoeDWfu3yNzZP cfZUsjilmgujhZ/KnrSlRa1pN3Tm5iGeYfQFtgrakGjS4IOe820Dx5hxzELcK6r83dxBbsAJrO4 Kf9mgvCRNFLaEMz97DwdveXmxTbcBFddyd7H1UV2x7TO49yjpZCJK6CswslgwJz6mT3OgO0Q+aB OAYp/7LdJloZPGoRB/Tn1/Rq27396CGhGK/0fiIzIAOZXKl0EteEPiIRqf1RLW5na/FZUIZnQ== X-Received: by 2002:a05:600c:5251:b0:49f:e772:6ddf with SMTP id 5b1f17b1804b1-4a18e4d5a01mr354837485e9.32.1792040622489; Wed, 14 Oct 2026 22:03:42 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:42 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 09/55] oeqa/selftest/devtool: cover update-recipe --initial-rev Date: Thu, 15 Oct 2026 07:02:32 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247807 From: Babanpreet Singh The --initial-rev option had no selftest coverage. Extend test_devtool_update_recipe to run update-recipe with --initial-rev set to the recorded initial revision, which should match the default output, and to a revision partway through the local commits, which should export only the commits after it. AI-Generated: Uses Claude (claude-fable-5) Signed-off-by: Babanpreet Singh Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 171af3b2915dd076c8d1b205ff75eac1ebd5a586) [Adjusted for scarthgap: also takes the cleanup_cmd change to this test from de635a9bc0 ("mdadm: fetch from git"), which the new steps rely on] Signed-off-by: Babanpreet Singh Signed-off-by: Yoann Congal --- meta/lib/oeqa/selftest/cases/devtool.py | 27 ++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/meta/lib/oeqa/selftest/cases/devtool.py b/meta/lib/oeqa/selftest/cases/devtool.py index 6af3e2417a3..cace9d26bd6 100644 --- a/meta/lib/oeqa/selftest/cases/devtool.py +++ b/meta/lib/oeqa/selftest/cases/devtool.py @@ -1186,13 +1186,38 @@ class DevtoolUpdateTests(DevtoolBase): result = runCmd('echo "A new file" > devtool-new-file', cwd=tempdir) result = runCmd('git add devtool-new-file', cwd=tempdir) result = runCmd('git commit -m "Add a new file"', cwd=tempdir) - self.add_command_to_tearDown('cd %s; rm %s/*.patch; git checkout %s %s' % (os.path.dirname(recipefile), testrecipe, testrecipe, os.path.basename(recipefile))) + cleanup_cmd = 'cd %s; rm %s/*.patch; git add %s; git checkout %s' % (os.path.dirname(recipefile), testrecipe, testrecipe, os.path.basename(recipefile)) + self.add_command_to_tearDown(cleanup_cmd) result = runCmd('devtool update-recipe %s' % testrecipe) result = runCmd('git add minicom', cwd=os.path.dirname(recipefile)) expected_status = [(' M', '.*/%s$' % os.path.basename(recipefile)), ('A ', '.*/0001-Change-the-README.patch$'), ('A ', '.*/0002-Add-a-new-file.patch$')] self._check_repo_status(os.path.dirname(recipefile), expected_status) + result = runCmd(cleanup_cmd) + self._check_repo_status(os.path.dirname(recipefile), []) + # Now try the same passing --initial-rev: the recorded initial + # revision must give the same result as not passing the option, and a + # later revision must export only the commits after it + result = runCmd('git rev-parse devtool-base', cwd=tempdir) + initial_rev = result.output.strip() + result = runCmd('devtool update-recipe --initial-rev %s %s' % (initial_rev, testrecipe)) + result = runCmd('git add minicom', cwd=os.path.dirname(recipefile)) + expected_status = [(' M', '.*/%s$' % os.path.basename(recipefile)), + ('A ', '.*/0001-Change-the-README.patch$'), + ('A ', '.*/0002-Add-a-new-file.patch$')] + self._check_repo_status(os.path.dirname(recipefile), expected_status) + result = runCmd(cleanup_cmd) + self._check_repo_status(os.path.dirname(recipefile), []) + result = runCmd('git rev-parse HEAD~1', cwd=tempdir) + midpoint_rev = result.output.strip() + result = runCmd('devtool update-recipe --initial-rev %s %s' % (midpoint_rev, testrecipe)) + result = runCmd('git add minicom', cwd=os.path.dirname(recipefile)) + expected_status = [(' M', '.*/%s$' % os.path.basename(recipefile)), + ('A ', '.*/0001-Add-a-new-file.patch$')] + self._check_repo_status(os.path.dirname(recipefile), expected_status) + result = runCmd(cleanup_cmd) + self._check_repo_status(os.path.dirname(recipefile), []) def test_devtool_update_recipe_git(self): # Check preconditions From patchwork Thu Oct 15 05:02:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100745 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CA81CC6B3D for ; Thu, 15 Oct 2026 05:03:51 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32434.1792040626879075343 for ; Wed, 14 Oct 2026 22:03:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=TT8U754z; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-49d05d51553so10416665e9.2 for ; Wed, 14 Oct 2026 22:03:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040625; x=1792645425; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=k91KfJ0wbhI03nb6UeIKe9ucn/GRfTFZ+SNVA40zVQ4=; b=TT8U754zyI19PsmAvOGbByj7I/53G/wHQ2xgSq0jb2ZqeN0H5BM8Dfp5OsJKjd2WFj NwScmUOdm+d/kXHNuy/UT5n0G1mNAY6t6DsiyEHZ1OF5BdTrUqHuMjlam9bI0zuHDOra 2mxGv4oRC8FS5bTyccf9DYFnc9D820FNBfHP8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040625; x=1792645425; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=k91KfJ0wbhI03nb6UeIKe9ucn/GRfTFZ+SNVA40zVQ4=; b=sgPSucCp/Y79Uo39IKO9N1OuuieCjU71LPhoyJj+6XslD7n/sWFYD3xh+dtKMoJCDf MweiyK1uTbJxVsG5MeTFwAP0h6IAQxMfQSER6tFoD0ZAEroL8myqHMK20HVKT/h5V9N4 ZHhiU3sBVBL96G+WOyhokriLokSzUbcsgb/RvVd+mG6OS+xX/OCWneq4VNGtW7B1F/cN 0DnytwJAVkiKGRnNEVSOmpNfHQXW8D6FbJd9lTnRywfhuVygD210I6BpS9dqHq0iVEIh 23A4DUjlWrCAvv5U6jNtwb6rgI99ELOYooXTkXrU2J67pqizQx7gpRCLyf7L4Xltc5y1 9gfQ== X-Gm-Message-State: AFq9FYLTZno/BMruInmoaPKMcMKSXlG6X5ZmE7xbmt2dTwxulbE8FRND X1O9oocFurDRfnXhVwx9LmIfagwgIhKT3G0jnxU1KY1BtDQIslZ8Ms3abQjuSCSWNK/D8X9zeJx nPrDpZ9Y= X-Gm-Gg: AYBFou1F+ERAPOYaJ0DLGQapeKlXtoK7ohJ65bCeDjZA3S+sdZKZO1Df/UmniQucqAd tiX2NkMvszFmeGNfzs36VL9gb0WwE9qCtPT7vjTwhA6pAAHcdo2nsgFj5Q7y2eUH2G2BWZoFNWx ac20LqruAxqDr6wM9u91MDyL6UGUfwHirbcjZlp6HC6SzIAiptTJAKwxb7qeFRdc/8M2lgRLINJ Q8+OeIF78hsucyWf7v6cbtRF8URidSVX4Pt4RJqnRcxJe/9OpwPp2OGwoXRo8eAhmESNzzH6M/i g3x9pS0njek/1jUP+qtcHKKXE+bzYj7yTU7i6GvMGQuQailViIzPoteFgI9+cOvilXyCqco6G2A F3WF84K+GVds+mRu5iQIqV9xfgKKji277J4u88aVIllVAOx1PrktMLB5AeBhz2HlWmJXK/PtPJy EOr0p3BfcUCh5eenoovSSQJm+8AAvtVaSfdy0ZHHpCRxKCxeXHhNU+LkLA1RtMtHGgmbDerK16G Ds6am9AooRgt1eXGECJM/6BY4srpARVJfWCJPkExD/sBWyZpl7zhfSzcHubNr0u+p6dqxsgMQ== X-Received: by 2002:a05:600c:8509:b0:4a1:7d9b:d4ae with SMTP id 5b1f17b1804b1-4a18e47a8cdmr335992075e9.5.1792040624961; Wed, 14 Oct 2026 22:03:44 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:44 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 10/55] libpng: patch CVE-2026-33416 regression Date: Thu, 15 Oct 2026 07:02:33 +0200 Message-ID: <333878e97547b6aeaa69691e4827af54ac838045.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247808 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-33416 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../libpng/files/CVE-2026-33416-05.patch | 58 +++++++++++++++++++ .../libpng/libpng_1.6.42.bb | 1 + 2 files changed, 59 insertions(+) create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-33416-05.patch diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-33416-05.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-33416-05.patch new file mode 100644 index 00000000000..c42f2213b35 --- /dev/null +++ b/meta/recipes-multimedia/libpng/files/CVE-2026-33416-05.patch @@ -0,0 +1,58 @@ +From d4c4e49eb5c8981075ec2cd946428758c0cda6ac Mon Sep 17 00:00:00 2001 +From: Cosmin Truta +Date: Wed, 15 Apr 2026 14:58:35 +0300 +Subject: [PATCH] fix: Sync `info_ptr->palette` unconditionally after in-place + transforms + +The palette sync in `png_read_transform_info` was guarded by +`if (transformations != 0)`, but the palette-modifying transforms clear +their own bits before this function gets to run. When one of these was +the sole transform, the guard was false and the sync was skipped, which +caused `png_get_PLTE` to return stale palette data. + +Drop this guard. + +This was a regression from commit c1b0318b39 (version 1.6.56). + +Reported-by: ralfjunker +Resolves: https://github.com/pnggroup/libpng/issues/848 + +CVE: CVE-2026-33416 +Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/d4c4e49eb5c8981075ec2cd946428758c0cda6ac] +Signed-off-by: Peter Marko +--- + pngrtran.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/pngrtran.c b/pngrtran.c +index 1b04cafa5..0ac8df749 100644 +--- a/pngrtran.c ++++ b/pngrtran.c +@@ -1984,19 +1984,15 @@ png_read_transform_info(png_structrp png_ptr, png_inforp info_ptr) + { + png_debug(1, "in png_read_transform_info"); + +- if (png_ptr->transformations != 0) ++ if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE && ++ info_ptr->palette != NULL && png_ptr->palette != NULL) + { +- if (info_ptr->color_type == PNG_COLOR_TYPE_PALETTE && +- info_ptr->palette != NULL && png_ptr->palette != NULL) +- { +- /* Sync info_ptr->palette with png_ptr->palette. +- * The function png_init_read_transformations may have modified +- * png_ptr->palette in place (e.g. for gamma correction or for +- * background compositing). +- */ +- memcpy(info_ptr->palette, png_ptr->palette, +- PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))); +- } ++ /* Sync info_ptr->palette with png_ptr->palette, which may ++ * have been modified by png_init_read_transformations ++ * (e.g. for gamma correction or background compositing). ++ */ ++ memcpy(info_ptr->palette, png_ptr->palette, ++ PNG_MAX_PALETTE_LENGTH * (sizeof (png_color))); + } + + #ifdef PNG_READ_EXPAND_SUPPORTED diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb index b226e327b64..f375aa5f4e9 100644 --- a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb +++ b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb @@ -31,6 +31,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz file://CVE-2026-33416-04.patch \ file://CVE-2026-34757_p1.patch \ file://CVE-2026-34757_p2.patch \ + file://CVE-2026-33416-05.patch \ " SRC_URI[sha256sum] = "c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450" From patchwork Thu Oct 15 05:02:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100737 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8BC5CC6B39 for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32435.1792040627399696784 for ; Wed, 14 Oct 2026 22:03:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=YskNZ43q; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-49d05d51553so10416705e9.2 for ; Wed, 14 Oct 2026 22:03:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040626; x=1792645426; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KhHdKYQ6e/0UZy2uVR9Yi/BsARcOdaUXGuAROnVtaEU=; b=YskNZ43qJLFxGAJk+5ctnvM/goBJQdsGSo3An//v/83CmZK4Wi16mi/2LXWmBQCdEV Eyj0KR2n1ug5Kpk1RkcuS1e1SbrNMvDlRoVjj9ne2tTUU9/68U9cQ+4/G50VosQ84347 rmTdTQzRb4EwBSjnmq90ZoYD84QejjzqwldZM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040626; x=1792645426; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KhHdKYQ6e/0UZy2uVR9Yi/BsARcOdaUXGuAROnVtaEU=; b=kNC6Kek5WKSM5P2AnovWLInr6goDDsJieZobLUp7UBfvtChwj9aPFLhrN560iDG63V mDBwEqWZmT4bIyiTtdUASGdmptVuUtur7El/NPDJHj/azLXZjg/X/Y5eLuTQpVtWna75 YKlgdG7y9Zkv0BIEaisK/3qW1xJyH/Pbd1Wu148dYLnflu9MQj0C49Ad2U7YPE1cxpbc o8XrZOJXH1He+MPXfUpmpmXXQgaHLoAdeDwL1jRmOsO/0zlZbm1Ze4HOKoC6sPPlNrLd FdxXd+SScC8DzOdGoYYZMNvbkdN6sIRVDyd2Vv9KtcrvIkU3TslawKEZFpX4NG3fbPLW sebg== X-Gm-Message-State: AFq9FYIfTYCCK/j2iD5od3VAETITLNVx6OjDsRCObHYN0iynq7XGFKjW mg0B0hCM+waxjFDkHsdp3+USQizv9cgBcsfu1Qs2J25KIYf3fMTd9vDisrDgm9H5yquV6u+ZkYH gsEaOt84= X-Gm-Gg: AYBFou19tLAz5RjAdi9VpAKYVymJYWa4GziZGhOtoQru2Fq2v0MUNDi5GXyTvYnDC7P rE9vxWtA/8yooKyw+53VyBpm2TU0ngDM/wS9whsPAhxNC/IBG69xXuNq5+70qrNq+Fc/AW5Y+da 8M8+R+30SDHNYknsQFmNiy50ixfogf3Lh3tyGo042PejV1IkSy0rdtfeMeCkSqjt/TDkOA5OBTB CoXvD0QAmN7W59v5YkcDT74NuxytcxYFBl/kqWzWknuyGOp1acZdzP+0FRbeP9qUS9oGQCYluAZ /fTq9jPMuFAN4kVmkMHjmsX+N+HtgywiikI6SD7eqJVWvopjjVi/NZ8qzXQZpK6M2ruUrCle6+r UcmjjrcgH4vRk/xdFd3TvEZDe6zS2HJ8FoVOAt24EAXDLQ7ao8rH763vbPVu10In2MwF+P4qtDs jSIgXo/AY1zX+kNWJ59sSDn4y7K69qI5G0M5MHNC8FuLI8940DA2GlzgTiiOYxJ83VNHLgLWfER A0WjwVFcTxhbx87u1yhmJJOrQHXXd4aAPJhCg/MGjIFhouGZGUxy5uz4eomtNeWi4lOwKTCtw== X-Received: by 2002:a05:600c:4504:b0:49c:fc6e:a3da with SMTP id 5b1f17b1804b1-4a18e4a7839mr380565485e9.25.1792040625394; Wed, 14 Oct 2026 22:03:45 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:45 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 11/55] dhcpcd: set status for CVE-2026-56116 Date: Thu, 15 Oct 2026 07:02:34 +0200 Message-ID: <26acbf957a5aae69afadb40b05e99b26ff92b889.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247809 From: Peter Marko Patch [1] mentioned as commit fixing this CVE in NVD or Debian reports is fixing code adding new feature (route advertisment processing) which is also mentioned in the CVE descripiton. That was introduced in commit [2] which is v10.0.7 (>10.0.6) [1] https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0 [2] https://github.com/NetworkConfiguration/dhcpcd/commit/f1cf924ad691bc1e6bf33013407fbf838fa40fbe Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb index e6854e1c7f2..c32db0adf5d 100644 --- a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb +++ b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb @@ -62,3 +62,5 @@ do_install:append () { } FILES:${PN}-dbg += "${libdir}/dhcpcd/dev/.debug" + +CVE_STATUS[CVE-2026-56116] = "fixed-version: vulnerability was only introduced in v10.0.7" From patchwork Thu Oct 15 05:02:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100750 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCF40CCA461 for ; Thu, 15 Oct 2026 05:03:51 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32820.1792040627834142683 for ; Wed, 14 Oct 2026 22:03:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=gDZ3z6qS; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a17baef589so14325685e9.0 for ; Wed, 14 Oct 2026 22:03:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040626; x=1792645426; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Za3Z6rlZ2hURy+whoeyit23PemGE0uyck00pz2djhO4=; b=gDZ3z6qSCxVumtOFeOXFMW754EEklY7uZ2061MnmRP6uY6rRqBj8HHqVh/GPUyDpgy +Uo1kLUhi3xUWKDVLaIO0NSYOcOSFiku7JapKjN4jKkw9xbNw47U87Gfm0StVeDsyHXL pAA+nUGDTqsgVSBlvqvfDskZhXjturFyQNvS8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040626; x=1792645426; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Za3Z6rlZ2hURy+whoeyit23PemGE0uyck00pz2djhO4=; b=LytuqjawAv6RLamujiyEjlHe8nKm2s5LQM4BD8+7482F/0+XHp+6kXSaIgNC8i5UG2 +6b0Y3qUT3wUz72bgZW1uy6JzDLinRpzr9duIp26ZNKaqeZpWiEgCejCP/zJg++wiTAK NYt8+0VBcNub3re5wBibK3Po5LoIZEfkkchVK7zA+LjJwZDKIXCE8lW0ItVWYTXr3TUp MKTXAt5gk5SwStCIMgPGQnnrcUaaBNOa1vQj+2wfTjuGc7Z1Qkh6yqxEe6/5H4oTn/c2 M3DVLZUqQVSZ4pCECx7G+Pz/Ef3CVvWJso/+ZYz2LAIts4j4lBkV2XcBPjqRhA+okiTj 73Jw== X-Gm-Message-State: AFq9FYK+TGatBM4l7ha1PK1C+mIBdvUhLhj2yhZf/2Zpf2/NtzBqdyMP 05qHAyEs9YYQuNrRUYFojhwK6C9Wh/g01tBGiy8TQp76RJYnc1k/9J0Nsl8D7XX6i8thniqUthB rq+mj5BA= X-Gm-Gg: AYBFou0xssw4li/AYw5m9RGJkWGrbpMyUQruj/rsiQpuWGFrmPD3BrqTw+oYntmtQJs X0XTkZjjuVV9qI8bP2qNK5C8XwOusQbotdmAciBBNCbgGqANnY9pPFWw3mkTk5MqBUIqNZaiVHC b8PYcFsySb3AkI0fbRU6xMal9p6Yjys1rGDThHMPu/fvgx2MKEyiFMgHnS3AouRHXP6kE07esNx KuTVLC/oXsmj6zKbolEudWa7c3+Z93kvV1c34iPLJgnGpXZEs+v3WKAQ38JA7UXI1YWIDHiyuWl 9WGUuIVcu3FOVaWZAdd7eSPX4/x99FVocJk0kH2JhH4a0Kcw94r2HtLoJTbo8vHB6A3syOBLLFm 8CpHQUNKAbLW4Jatt1d4BhnoMAfgKWBCDgQOsvHLcmuqzTl5DO7ew7ga16z/TQW+jbZbue+5GPC didK+oZlnUdL1RZ/2jO65Zse+Aa90TAl8eBoa1+KfGIYfBxol2y5RwA2DGI8ldhmdqK7HFq+EyC ka33jSSw98wmHtJaA9tYHv1Rxx5bGHthaYqiJhuLQyxPSpakEW4xqwcZsVL+UvryW3zENI8Lg== X-Received: by 2002:a05:600c:8b64:b0:49d:174e:2a1e with SMTP id 5b1f17b1804b1-4a18e498851mr379080495e9.19.1792040625860; Wed, 14 Oct 2026 22:03:45 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:45 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 12/55] mesa: patch CVE-2026-40393 Date: Thu, 15 Oct 2026 07:02:35 +0200 Message-ID: <077a8fc11e7f4767ce51f04518388631edbd4350.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247810 From: Peter Marko Pick patches per [1]. Also pick two patches preparing the used helper functions. Drop changes in .pick_status.json not affting our builds. Resolve minor conflicts. [1] https://security-tracker.debian.org/tracker/CVE-2026-40393 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../mesa/files/CVE-2026-40393-01.patch | 126 ++++++++++++++++++ .../mesa/files/CVE-2026-40393-02.patch | 119 +++++++++++++++++ .../mesa/files/CVE-2026-40393-03.patch | 103 ++++++++++++++ .../mesa/files/CVE-2026-40393-04.patch | 54 ++++++++ meta/recipes-graphics/mesa/mesa.inc | 4 + 5 files changed, 406 insertions(+) create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-01.patch create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-02.patch create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-03.patch create mode 100644 meta/recipes-graphics/mesa/files/CVE-2026-40393-04.patch diff --git a/meta/recipes-graphics/mesa/files/CVE-2026-40393-01.patch b/meta/recipes-graphics/mesa/files/CVE-2026-40393-01.patch new file mode 100644 index 00000000000..f24853a1dd4 --- /dev/null +++ b/meta/recipes-graphics/mesa/files/CVE-2026-40393-01.patch @@ -0,0 +1,126 @@ +From b0653370d0ea7d6c72cd419451debed52e09653d Mon Sep 17 00:00:00 2001 +From: Paulo Zanoni +Date: Mon, 18 Mar 2024 16:33:54 -0700 +Subject: [PATCH] vulkan: don't zero-initialize STACK_ARRAY()'s stack array + +STACK_ARRAY() is used in a lot of places. When games are running we +see STACK_ARRAY() arrays being used all the time: each queue +submission uses 6, WaitSemaphores and syncobj waiting also uses them: +they're constantly present in Vulkan runtime. + +There's no need for STACK_ARRAY()'s stack array to be initialized, +callers cannot not depend on it. If the number of elements is greater +than STACK_ARRAY_SIZE, then STACK_ARRAY() will just malloc() the array +and return it not initialized: anybody depending of +zero-initialization is going to break when the array is big. + +The reason why we're zero-intializing STACK_ARRAY()'s stack array is +to silence -Wmaybe-uninitialized warnings: see commit d7957df31848 +("vulkan: fix uninitialized variables"). I don't think that commit is +the ideal way to deal with the problem, so this patch proposes a +better solution. + +The problem here is that zero-initializing it adds code we don't need +for every single caller. STACK_ARRAY() already has 63 callers and only +3 of them are affected by the -Wmaybe-uninitialized warining. So here +we undo what commit d7957df31848 did and instead we fix the 3 cases +that actually generate the -Wmaybe-uninitialized warnings. + +Gcc is only emitting those warinings because it knows that the number +of elements in the array may be zero, so the loops we have that set +elements to the array may end up do nothing, and then we pass the +array uninitialized to other functions. + +For the cases related to vk_sync this is just returning VK_SUCCESS +earlier, instead of relying on the check that eventually happens at +__vk_sync_wait_many(). For the vkCmdWaitEvents() function, the Vulkan +spec says that "eventCount must be greater than 0", so the early +return doesn't hurt anybody either. In both cases we make the zero +case faster by not defining an 8-sized array, zero-initializing it, +then returning success without using it. + +Reference: d7957df31848 ("vulkan: fix uninitialized variables") +Acked-by: Yonggang Luo +Reviewed-by: Yiwei Zhang +Signed-off-by: Paulo Zanoni +Part-of: + +CVE: CVE-2026-40393 +Upstream-Status: Backport [https://gitlab.freedesktop.org/mesa/mesa/-/commit/b0653370d0ea7d6c72cd419451debed52e09653d] +Signed-off-by: Peter Marko +--- + src/vulkan/runtime/vk_queue.c | 4 ++++ + src/vulkan/runtime/vk_sync_binary.c | 3 +++ + src/vulkan/runtime/vk_synchronization.c | 3 +++ + src/vulkan/util/vk_util.h | 14 +++++++------- + 4 files changed, 17 insertions(+), 7 deletions(-) + +diff --git a/src/vulkan/runtime/vk_queue.c b/src/vulkan/runtime/vk_queue.c +index b54dff90d5d..c8b55b58b0a 100644 +--- a/src/vulkan/runtime/vk_queue.c ++++ b/src/vulkan/runtime/vk_queue.c +@@ -1037,6 +1037,10 @@ vk_queue_wait_before_present(struct vk_queue *queue, + return VK_SUCCESS; + + const uint32_t wait_count = pPresentInfo->waitSemaphoreCount; ++ ++ if (wait_count == 0) ++ return VK_SUCCESS; ++ + STACK_ARRAY(struct vk_sync_wait, waits, wait_count); + + for (uint32_t i = 0; i < wait_count; i++) { +diff --git a/src/vulkan/runtime/vk_sync_binary.c b/src/vulkan/runtime/vk_sync_binary.c +index 3d2720f9348..c10cabe348a 100644 +--- a/src/vulkan/runtime/vk_sync_binary.c ++++ b/src/vulkan/runtime/vk_sync_binary.c +@@ -91,6 +91,9 @@ vk_sync_binary_wait_many(struct vk_device *device, + enum vk_sync_wait_flags wait_flags, + uint64_t abs_timeout_ns) + { ++ if (wait_count == 0) ++ return VK_SUCCESS; ++ + STACK_ARRAY(struct vk_sync_wait, timeline_waits, wait_count); + + for (uint32_t i = 0; i < wait_count; i++) { +diff --git a/src/vulkan/runtime/vk_synchronization.c b/src/vulkan/runtime/vk_synchronization.c +index 53fb56e686d..701474164e4 100644 +--- a/src/vulkan/runtime/vk_synchronization.c ++++ b/src/vulkan/runtime/vk_synchronization.c +@@ -249,6 +249,9 @@ vk_common_CmdWaitEvents( + VK_FROM_HANDLE(vk_command_buffer, cmd_buffer, commandBuffer); + struct vk_device *device = cmd_buffer->base.device; + ++ if (eventCount == 0) ++ return; ++ + STACK_ARRAY(VkDependencyInfo, deps, eventCount); + + /* Note that dstStageMask and srcStageMask in the CmdWaitEvent2() call +diff --git a/src/vulkan/util/vk_util.h b/src/vulkan/util/vk_util.h +index 85807f410fa..d29db67a4d0 100644 +--- a/src/vulkan/util/vk_util.h ++++ b/src/vulkan/util/vk_util.h +@@ -358,14 +358,14 @@ vk_spec_info_to_nir_spirv(const VkSpecializationInfo *spec_info, + + #define STACK_ARRAY_SIZE 8 + +-#ifdef __cplusplus +-#define STACK_ARRAY_ZERO_INIT {} +-#else +-#define STACK_ARRAY_ZERO_INIT {0} +-#endif +- ++/* Sometimes gcc may claim -Wmaybe-uninitialized for the stack array in some ++ * places it can't verify that when size is 0 nobody down the call chain reads ++ * the array. Please don't try to fix it by zero-initializing the array here ++ * since it's used in a lot of different places. An "if (size == 0) return;" ++ * may work for you. ++ */ + #define STACK_ARRAY(type, name, size) \ +- type _stack_##name[STACK_ARRAY_SIZE] = STACK_ARRAY_ZERO_INIT; \ ++ type _stack_##name[STACK_ARRAY_SIZE]; \ + type *const name = \ + ((size) <= STACK_ARRAY_SIZE ? _stack_##name : (type *)malloc((size) * sizeof(type))) + diff --git a/meta/recipes-graphics/mesa/files/CVE-2026-40393-02.patch b/meta/recipes-graphics/mesa/files/CVE-2026-40393-02.patch new file mode 100644 index 00000000000..620d50e60d3 --- /dev/null +++ b/meta/recipes-graphics/mesa/files/CVE-2026-40393-02.patch @@ -0,0 +1,119 @@ +From f43cff3728e58c377d1e03b13db62514217abfe1 Mon Sep 17 00:00:00 2001 +From: Faith Ekstrand +Date: Tue, 29 Jul 2025 03:10:41 -0400 +Subject: [PATCH] util: Move STACK_ARRAY into util + +It's useful for more than just Vulkan. + +Reviewed-by: Boris Brezillon +Reviewed-by: Christoph Pillmayer +Part-of: + +CVE: CVE-2026-40393 +Upstream-Status: Backport [https://gitlab.freedesktop.org/mesa/mesa/-/commit/f43cff3728e58c377d1e03b13db62514217abfe1] +Signed-off-by: Peter Marko +--- + src/util/meson.build | 1 + + src/util/stack_array.h | 45 +++++++++++++++++++++++++++++++++++++++ + src/vulkan/util/vk_util.h | 17 +-------------- + 3 files changed, 47 insertions(+), 16 deletions(-) + create mode 100644 src/util/stack_array.h + +diff --git a/src/util/meson.build b/src/util/meson.build +index a60fbc7b660..ed746734b87 100644 +--- a/src/util/meson.build ++++ b/src/util/meson.build +@@ -122,6 +122,7 @@ files_mesa_util = files( + 'softfloat.h', + 'sparse_array.c', + 'sparse_array.h', ++ 'stack_array.h', + 'string_buffer.c', + 'string_buffer.h', + 'strndup.h', +diff --git a/src/util/stack_array.h b/src/util/stack_array.h +new file mode 100644 +index 00000000000..e2133bdc2f4 +--- /dev/null ++++ b/src/util/stack_array.h +@@ -0,0 +1,45 @@ ++/* ++ * Copyright ยฉ 2025 Collabora, Ltd. ++ * ++ * Permission is hereby granted, free of charge, to any person obtaining a ++ * copy of this software and associated documentation files (the "Software"), ++ * to deal in the Software without restriction, including without limitation ++ * the rights to use, copy, modify, merge, publish, distribute, sublicense, ++ * and/or sell copies of the Software, and to permit persons to whom the ++ * Software is furnished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice (including the next ++ * paragraph) shall be included in all copies or substantial portions of the ++ * Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR ++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, ++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL ++ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER ++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING ++ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS ++ * IN THE SOFTWARE. ++ */ ++ ++#include ++ ++#ifndef UTIL_STACK_ARRAY_H ++#define UTIL_STACK_ARRAY_H ++ ++#define STACK_ARRAY_SIZE 8 ++ ++/* Sometimes gcc may claim -Wmaybe-uninitialized for the stack array in some ++ * places it can't verify that when size is 0 nobody down the call chain reads ++ * the array. Please don't try to fix it by zero-initializing the array here ++ * since it's used in a lot of different places. An "if (size == 0) return;" ++ * may work for you. ++ */ ++#define STACK_ARRAY(type, name, size) \ ++ type _stack_##name[STACK_ARRAY_SIZE]; \ ++ type *const name = \ ++ ((size) <= STACK_ARRAY_SIZE ? _stack_##name : (type *)malloc((size) * sizeof(type))) ++ ++#define STACK_ARRAY_FINISH(name) \ ++ if (name != _stack_##name) free(name) ++ ++#endif /* UTIL_STACK_ARRAY_H */ +diff --git a/src/vulkan/util/vk_util.h b/src/vulkan/util/vk_util.h +index aea4c569a18..4f5972b291a 100644 +--- a/src/vulkan/util/vk_util.h ++++ b/src/vulkan/util/vk_util.h +@@ -25,6 +25,7 @@ + + #include "util/bitscan.h" + #include "util/macros.h" ++#include "util/stack_array.h" + #include "compiler/shader_enums.h" + #include + #include +@@ -356,22 +357,6 @@ struct nir_spirv_specialization* + vk_spec_info_to_nir_spirv(const VkSpecializationInfo *spec_info, + uint32_t *out_num_spec_entries); + +-#define STACK_ARRAY_SIZE 8 +- +-/* Sometimes gcc may claim -Wmaybe-uninitialized for the stack array in some +- * places it can't verify that when size is 0 nobody down the call chain reads +- * the array. Please don't try to fix it by zero-initializing the array here +- * since it's used in a lot of different places. An "if (size == 0) return;" +- * may work for you. +- */ +-#define STACK_ARRAY(type, name, size) \ +- type _stack_##name[STACK_ARRAY_SIZE]; \ +- type *const name = \ +- ((size) <= STACK_ARRAY_SIZE ? _stack_##name : (type *)malloc((size) * sizeof(type))) +- +-#define STACK_ARRAY_FINISH(name) \ +- if (name != _stack_##name) free(name) +- + static inline uint8_t + vk_index_type_to_bytes(enum VkIndexType type) + { diff --git a/meta/recipes-graphics/mesa/files/CVE-2026-40393-03.patch b/meta/recipes-graphics/mesa/files/CVE-2026-40393-03.patch new file mode 100644 index 00000000000..96ab229a552 --- /dev/null +++ b/meta/recipes-graphics/mesa/files/CVE-2026-40393-03.patch @@ -0,0 +1,103 @@ +From 978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e Mon Sep 17 00:00:00 2001 +From: Ian Romanick +Date: Fri, 23 Jan 2026 09:58:26 -0800 +Subject: [PATCH] spirv: Use STACK_ARRAY instead of NIR_VLA + +The number of fields comes from the shader, so it could be a value large +enough that using alloca would be problematic. + +Fixes: 2a023f30a64 ("nir/spirv: Add basic support for types") +Reviewed-by: Caio Oliveira +Reviewed-by: Ryan Neph +Reviewed-by: Lionel Landwerlin +(cherry picked from commit 3da828d2dd12e20ba2afc152db8d7236c7a48c13) + +Part-of: + +CVE: CVE-2026-40393 +Upstream-Status: Backport [https://gitlab.freedesktop.org/mesa/mesa/-/commit/978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e] +Signed-off-by: Peter Marko +--- + src/compiler/spirv/spirv_to_nir.c | 27 +++++++++++++++++---------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/src/compiler/spirv/spirv_to_nir.c b/src/compiler/spirv/spirv_to_nir.c +index 65229eee740..9cf2c66cec9 100644 +--- a/src/compiler/spirv/spirv_to_nir.c ++++ b/src/compiler/spirv/spirv_to_nir.c +@@ -27,7 +27,6 @@ + + #include "glsl_types.h" + #include "vtn_private.h" +-#include "nir/nir_vla.h" + #include "nir/nir_control_flow.h" + #include "nir/nir_constant_expressions.h" + #include "nir/nir_deref.h" +@@ -37,6 +36,7 @@ + #include "util/u_math.h" + #include "util/u_string.h" + #include "util/u_debug.h" ++#include "util/stack_array.h" + + #include + +@@ -1013,7 +1013,7 @@ vtn_type_get_nir_type(struct vtn_builder *b, struct vtn_type *type, + case vtn_base_type_struct: { + bool need_new_struct = false; + const uint32_t num_fields = type->length; +- NIR_VLA(struct glsl_struct_field, fields, num_fields); ++ STACK_ARRAY(struct glsl_struct_field, fields, num_fields); + for (unsigned i = 0; i < num_fields; i++) { + fields[i] = *glsl_get_struct_field_data(type->type, i); + const struct glsl_type *field_nir_type = +@@ -1023,20 +1023,25 @@ vtn_type_get_nir_type(struct vtn_builder *b, struct vtn_type *type, + need_new_struct = true; + } + } ++ ++ const struct glsl_type *result; + if (need_new_struct) { + if (glsl_type_is_interface(type->type)) { +- return glsl_interface_type(fields, num_fields, +- /* packing */ 0, false, +- glsl_get_type_name(type->type)); ++ result = glsl_interface_type(fields, num_fields, ++ /* packing */ 0, false, ++ glsl_get_type_name(type->type)); + } else { +- return glsl_struct_type(fields, num_fields, +- glsl_get_type_name(type->type), +- glsl_struct_type_is_packed(type->type)); ++ result = glsl_struct_type(fields, num_fields, ++ glsl_get_type_name(type->type), ++ glsl_struct_type_is_packed(type->type)); + } + } else { + /* No changes, just pass it on */ +- return type->type; ++ result = type->type; + } ++ ++ STACK_ARRAY_FINISH(fields); ++ return result; + } + + case vtn_base_type_image: +@@ -1647,7 +1652,7 @@ vtn_handle_type(struct vtn_builder *b, SpvOp opcode, + val->type->offsets = vtn_alloc_array(b, unsigned, num_fields); + val->type->packed = false; + +- NIR_VLA(struct glsl_struct_field, fields, count); ++ STACK_ARRAY(struct glsl_struct_field, fields, count); + for (unsigned i = 0; i < num_fields; i++) { + val->type->members[i] = vtn_get_type(b, w[i + 2]); + const char *name = NULL; +@@ -1703,6 +1708,8 @@ vtn_handle_type(struct vtn_builder *b, SpvOp opcode, + name ? name : "struct", + val->type->packed); + } ++ ++ STACK_ARRAY_FINISH(fields); + break; + } + diff --git a/meta/recipes-graphics/mesa/files/CVE-2026-40393-04.patch b/meta/recipes-graphics/mesa/files/CVE-2026-40393-04.patch new file mode 100644 index 00000000000..71e959f0edf --- /dev/null +++ b/meta/recipes-graphics/mesa/files/CVE-2026-40393-04.patch @@ -0,0 +1,54 @@ +From 45ce75f3bcd638dcf7daae09f9bf0b7c015b81c4 Mon Sep 17 00:00:00 2001 +From: Ian Romanick +Date: Fri, 23 Jan 2026 10:07:27 -0800 +Subject: [PATCH] nir: Use STACK_ARRAY instead of NIR_VLA + +The number of fields comes from the shader, so it could be a value large +enough that using alloca would be problematic. + +Fixes: c11833ab24d ("nir,spirv: Rework function calls") +Reviewed-by: Caio Oliveira +Reviewed-by: Ryan Neph +Reviewed-by: Lionel Landwerlin +(cherry picked from commit 9017d37e84771f921a63676dd8b955df9ef20f29) + +Part-of: + +CVE: CVE-2026-40393 +Upstream-Status: Backport [https://gitlab.freedesktop.org/mesa/mesa/-/commit/45ce75f3bcd638dcf7daae09f9bf0b7c015b81c4] +Signed-off-by: Peter Marko +--- + src/compiler/nir/nir_functions.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/compiler/nir/nir_functions.c b/src/compiler/nir/nir_functions.c +index 5d5f66293be..d4b3e652f1c 100644 +--- a/src/compiler/nir/nir_functions.c ++++ b/src/compiler/nir/nir_functions.c +@@ -21,10 +21,10 @@ + * IN THE SOFTWARE. + */ + ++#include "util/stack_array.h" + #include "nir.h" + #include "nir_builder.h" + #include "nir_control_flow.h" +-#include "nir_vla.h" + + /* + * TODO: write a proper inliner for GPUs. +@@ -177,12 +177,13 @@ static bool inline_functions_pass(nir_builder *b, + * to an SSA value first. + */ + const unsigned num_params = call->num_params; +- NIR_VLA(nir_def *, params, num_params); ++ STACK_ARRAY(nir_def *, params, num_params); + for (unsigned i = 0; i < num_params; i++) { + params[i] = call->params[i].ssa; + } + + nir_inline_function_impl(b, call->callee->impl, params, NULL); ++ STACK_ARRAY_FINISH(params); + return true; + } + diff --git a/meta/recipes-graphics/mesa/mesa.inc b/meta/recipes-graphics/mesa/mesa.inc index eb23a3f82c3..357d371a3d1 100644 --- a/meta/recipes-graphics/mesa/mesa.inc +++ b/meta/recipes-graphics/mesa/mesa.inc @@ -20,6 +20,10 @@ SRC_URI = "https://mesa.freedesktop.org/archive/mesa-${PV}.tar.xz \ file://0002-glxext-don-t-try-zink-if-not-enabled-in-mesa.patch \ file://0001-Revert-meson-do-not-pull-in-clc-for-clover.patch \ file://0001-c11-threads-fix-build-on-c23.patch \ + file://CVE-2026-40393-01.patch \ + file://CVE-2026-40393-02.patch \ + file://CVE-2026-40393-03.patch \ + file://CVE-2026-40393-04.patch \ " SRC_URI[sha256sum] = "7454425f1ed4a6f1b5b107e1672b30c88b22ea0efea000ae2c7d96db93f6c26a" From patchwork Thu Oct 15 05:02:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100736 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FAF7CC6B35 for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32436.1792040628174560675 for ; Wed, 14 Oct 2026 22:03:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=pJu1nbhj; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a172eb31f0so41257895e9.1 for ; Wed, 14 Oct 2026 22:03:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040626; x=1792645426; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=G/DuAt0I2Yn9btp8hElahjO6zcQT/p7N7Pkxm1USlYg=; b=pJu1nbhjjvICarbEMhXf9zVIY4iJWMpKr7Ntocdd65bKrpmR5Wpdam+sjAzwAEnA78 oFIO/QRiXU65/Sn0vfrD38SUy9mlVQbF2rnk9KrCo+4dSPxxc9ZMR7O/xMJ2v4HUmbo1 FVVeaVbzbX82LhR2gVfExayVcPqclmaeN62gM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040626; x=1792645426; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=G/DuAt0I2Yn9btp8hElahjO6zcQT/p7N7Pkxm1USlYg=; b=bhKFPei22M30g5HlteHw4mBWftZSoeYRdeTDMR5Ya/HuUcg76csEwuO9VB77Pf1cnN rX9e0sfgknWisRoe8anLc969bmjvVsP2en2O2kZ8D0Ds/wgQbbxgObByXq2t205FYjuf voQGzeS2cp5o7PiaMq2jCoRWttAD01WZ4FuH4MbK/z9Xnw+k92sPRUugfoAmx/vddoa5 dFROegKJCi3aTPeYhAIICa3A+e4XByofnF6BdZxYRmUcvtzAbz+Ei2tvVd4UqAw4Mepw YHAUOXzCPkvLrm6+3pYfO41DZGnIugbsD4mZBpaQ1GpU3jHrrLZ6pHKSmN7NM/QKS7xl 9hgw== X-Gm-Message-State: AFq9FYKNAjZt11iJm6ZpwJmv3ImL7zxX5v2MuPYpp7T9+zrb3+45/Yr8 +5KtScUGjUFA/9PszDoC3aviG4tUovfDuMyyidBeY5TR3mkRyUDKQz2ot6bmVdQlhbjVXSnPf3w n6esXGGk= X-Gm-Gg: AYBFou3DTNkijqXIPrmUpjhpO7zR2OdECvrGItv8S2QYRuLceGBivRNBWZuhHBoWLrM 6CDjPAbBwLMwlPIbClkzWafz3FN+yzuiRku03HCj+1sB/jnmvtkpW5o+jZiMcc44CyG+M3gKAHP rdBZpJa/YGt3hLIrTNBf5hRFLv8uO1h46St10mFIq3SpKzPwEfl70NFUS4Yg1gcqkFHyZzjZcq7 ju8fZlzvhgk6X6VRsHmdH+f00joBw+BxiTVkq5cSfLHV0Xc8hkFyrD/kEHM9XBUbJChHFprEtLO RnEv9MSgPk8DNsDlg69lZXGQtW497QyiZvQhhowdoHRUcXCMh0XcrOuuqdHjuAVg06XdDH2ZfYv ns4sbf1rVE9qeuHC57c5PIUY1wg2lfVMu96h/E6nneEvJzdRre8WgQoSfJlBhNNXK+rrhOAftC+ IlklcGHSb0trhk1EYoUj582IPNKFYSZ5IwHjI3sIGmeFNsR5glgFC7hi55WVVIIjfeVADPQk8rG C3i9WD1AxSBuGelZyqEHjJ4dakTT0qJR/IBV9BLo240GU/Z/7nZLenQHdyODen2gWZB6ksbzA== X-Received: by 2002:a05:600c:4747:b0:4a1:88de:9e8b with SMTP id 5b1f17b1804b1-4a18e49d65dmr351662465e9.5.1792040626409; Wed, 14 Oct 2026 22:03:46 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:46 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 13/55] systemd: patch CVE-2026-4105 Date: Thu, 15 Oct 2026 07:02:36 +0200 Message-ID: <1018aaf3c77d7d140cdea7d7d74e2ec34b8710a6.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247811 From: Peter Marko Pick patch per [1]. machine-varlink.c is not yet present in v255, so drop that hunk. Same resolution is also done by Debian in [2] for v252. [1] https://security-tracker.debian.org/tracker/CVE-2026-4105 [2] https://sources.debian.org/src/systemd/252.39-1~deb12u2/debian/patches/CVE-2026-4105.patch Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../systemd/systemd/CVE-2026-4105.patch | 32 +++++++++++++++++++ meta/recipes-core/systemd/systemd_255.22.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-core/systemd/systemd/CVE-2026-4105.patch diff --git a/meta/recipes-core/systemd/systemd/CVE-2026-4105.patch b/meta/recipes-core/systemd/systemd/CVE-2026-4105.patch new file mode 100644 index 00000000000..5b5c8e621e8 --- /dev/null +++ b/meta/recipes-core/systemd/systemd/CVE-2026-4105.patch @@ -0,0 +1,32 @@ +From 6941d92dc299667036cbe264435971cec59ebc76 Mon Sep 17 00:00:00 2001 +From: Luca Boccassi +Date: Sun, 8 Mar 2026 14:30:52 +0000 +Subject: [PATCH] machined: reject invalid class types when registering + machines + +Follow-up for fbe550738d03b178bb004a1390e74115e904118a + +(cherry picked from commit 6df5f80bd374be1b45c52d740e88f0236da922c7) +(cherry picked from commit 497d0172416cbb5b70f96b95399d041407c223bd) +(cherry picked from commit 749e2eaf7086c91598cf7043a31919854b1c2dfe) + +CVE: CVE-2026-4105 +Upstream-Status: Backport [https://github.com/systemd/systemd/commit/6941d92dc299667036cbe264435971cec59ebc76] +Signed-off-by: Peter Marko +--- + src/machine/machined-dbus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c +index f4915f67da..3565836dc8 100644 +--- a/src/machine/machined-dbus.c ++++ b/src/machine/machined-dbus.c +@@ -271,7 +271,7 @@ static int method_create_or_register_machine(Manager *manager, sd_bus_message *m + c = _MACHINE_CLASS_INVALID; + else { + c = machine_class_from_string(class); +- if (c < 0) ++ if (c < 0 || !IN_SET(c, MACHINE_CONTAINER, MACHINE_VM)) + return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid machine class parameter"); + } + diff --git a/meta/recipes-core/systemd/systemd_255.22.bb b/meta/recipes-core/systemd/systemd_255.22.bb index e5a0fd91700..3c5e59542bf 100644 --- a/meta/recipes-core/systemd/systemd_255.22.bb +++ b/meta/recipes-core/systemd/systemd_255.22.bb @@ -37,6 +37,7 @@ SRC_URI += " \ file://CVE-2026-29111-02.patch \ file://CVE-2026-29111-03.patch \ file://CVE-2026-29111-04.patch \ + file://CVE-2026-4105.patch \ " # patches needed by musl From patchwork Thu Oct 15 05:02:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100738 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53F06CC6B2F for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32821.1792040628845195165 for ; Wed, 14 Oct 2026 22:03:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=3ZhrKMjB; spf=pass (domain: smile.fr, ip: 209.85.221.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-48c4d870d54so3010228f8f.2 for ; Wed, 14 Oct 2026 22:03:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040627; x=1792645427; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=qeCj9h8In//Mm6oMYawrfWoQCayQ5xjGqwUEes7MaVQ=; b=3ZhrKMjB24OGSrtO8VCI+utXIoIJK0fZwQXDDNUpPrL9sg5Hx/lO1zGB9nRxDvBwOS aS/vuJOLtMqr/mh/ITBMQ3crRZ3PiTiiqZD9bFnnPYyOeylFFV6Vx9aGDbMkzPnjvjCZ MABTKAw+tPwEnytYTJDrC0QJVCGZv6eRGDUkI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040627; x=1792645427; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qeCj9h8In//Mm6oMYawrfWoQCayQ5xjGqwUEes7MaVQ=; b=ov1OdjNJlWLHwmYWzAx/GQDb9K5ZYJOGJSOWAjhsBSsTxEUzyBCNvybKQ+r7JwdzeD rLxLZbtt3/6aSi+ajbTH3BFxxhbN+KQyKR6czWkMDRwHH4/alLGaGxkV+yAX52gJ0CqG 3sJrlP/Kf9hlfpE997wIXNFzLjSD63QVbPrO7/02t5KDTxEy2cCZ52GGvxcebU/AuUj1 Z6I2LpumnDKhuVG3ylhpSMWMffwwTMgadH24fS2smSMqj9c/PH5TTyPNAxUBdbSySw4j WP4vBMjT+5KFlX6ZyMvuPIkDDHwExW4lFelXMQvqCfHmphBiYz7uqBti+Tliunt4NLwF Okgw== X-Gm-Message-State: AFq9FYKzuFS80FEymx0vJI8jmZeb7zPuo1WQuyBbkHUgODelmu9aIPfG mtIlbODK8E1Hd8otku4ECxb9c8iCxFrF8Neq9jG34tKesCW+hMQk6UDGGXw3D93bNhWBZVUNkgK VUQM6JyI= X-Gm-Gg: AYBFou1D/68szBUB1AWFPfq51Ri/ENBqLBFd7uvVqZY5CCnfzlrSXw9UDu0Ml++WuZl EVj3G0giFXEQaJYVfqasw4Lt6WdpzNCiS12lrNpzFz3wFN0gVCfPacDwRMbIFR231PT93ns9Jhn 4zhGyNko6/WF0XAmVowCZqelXRuPmI0nZmswr+UFrk2Hwib88PSNGhB2day4FOXlrxiJ9gqZqqM wHGkl7C07EEJW84iZhqXR3xdUz2JE7t+w6APQyryBYnF5i9DWIilMBIAoggJyCRsN6VRmgegnvn 1zmEn45hrS1m6uq/0We4JJTAp0te+DNfvnvZSZ2RyHl88a0a+roGQnI63xnh+f/lsNY1heIPqg/ hLRU4VEi2pqdZXJW02P74mSGdOn8CEPbeYszhfSAep6j112Kokqvn98id+gzMI25GaF3f/T+c8Y ZTuKth09kX3Q6EqQqyASQPwnt2e17rlsSwE4kxENYg3/QdSFI9Evf/6YYd2iANJ0wrPns9+9cSj lvQxtWYpJ/gVeCCNWMGQABxu9tmmgQM2TRpxAXriTxttDMy4FXm5EkVke9ykKVhlyzQzPuwLA== X-Received: by 2002:a05:600c:3e05:b0:4a0:2391:6540 with SMTP id 5b1f17b1804b1-4a18e4cdbd0mr337769095e9.25.1792040627073; Wed, 14 Oct 2026 22:03:47 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:46 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 14/55] libxml2: Fix CVE-2026-86137 Date: Thu, 15 Oct 2026 07:02:37 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247812 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86137 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../libxml/libxml2/CVE-2026-86137.patch | 63 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 64 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch new file mode 100644 index 00000000000..4a224365634 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch @@ -0,0 +1,63 @@ +From a9d489b86e46188d1c0fde7dbd0aa8281596e6d6 Mon Sep 17 00:00:00 2001 +From: Hieu Le Minh +Date: Sat, 18 Apr 2026 21:18:24 +0700 +Subject: [PATCH] xmlregexp: Prevent out-of-bounds read in NXT macro + +Fixes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1099 + +CVE: CVE-2026-86137 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2] + +Backport Changes: +- Add the parser-context length field and allocation-failure guard required by + the Scarthgap 2.12.10 source, which lacks both pieces of the upstream + context. +- The allocation-failure guard is completed by the subsequent + CVE-2026-86141.patch, which moves strlen() after the xmlStrdup() null check; + keep that patch after this one in SRC_URI. + +(cherry picked from commit 76fe08d97de88bfaef2f7d5cd27f11954cc5bee2) +Signed-off-by: Hetvi Thakar +--- + xmlregexp.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/xmlregexp.c b/xmlregexp.c +index f434a0cf..320a35ce 100644 +--- a/xmlregexp.c ++++ b/xmlregexp.c +@@ -56,7 +56,9 @@ + xmlRegexpErrCompile(ctxt, str); + #define NEXT ctxt->cur++ + #define CUR (*(ctxt->cur)) +-#define NXT(index) (ctxt->cur[index]) ++#define NXT(index) \ ++ (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len) \ ++ ? ctxt->cur[index] : 0) + + #define NEXTL(l) ctxt->cur += l; + #define XML_REG_STRING_SEPARATOR '|' +@@ -245,6 +247,7 @@ typedef xmlRegParserCtxt *xmlRegParserCtxtPtr; + struct _xmlAutomata { + xmlChar *string; + xmlChar *cur; ++ size_t len; + + int error; + int neg; +@@ -698,8 +701,14 @@ xmlRegNewParserCtxt(const xmlChar *string) { + if (ret == NULL) + return(NULL); + memset(ret, 0, sizeof(xmlRegParserCtxt)); +- if (string != NULL) ++ if (string != NULL) { + ret->string = xmlStrdup(string); ++ ret->len = strlen((const char *) ret->string); ++ if (ret->string == NULL) { ++ xmlFree(ret); ++ return(NULL); ++ } ++ } + ret->cur = ret->string; + ret->neg = 0; + ret->negs = 0; diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index d476ba14b6e..e4db345af42 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -32,6 +32,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-0992-03.patch \ file://CVE-2026-1757.patch \ file://CVE-2026-11979.patch \ + file://CVE-2026-86137.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Thu Oct 15 05:02:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100734 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C585CC6B2E for ; Thu, 15 Oct 2026 05:03:50 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32822.1792040629738588429 for ; Wed, 14 Oct 2026 22:03:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=LQBA1/J0; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a16af2a232so37623705e9.1 for ; Wed, 14 Oct 2026 22:03:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040628; x=1792645428; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=O/HwnYvZMxiEtViUbWb+WVHnIMCzrwDnvvkTVkze1yI=; b=LQBA1/J0LUO+l4GwLUh7zUlDD6L1HkIgx/u8vT72cDY7CfvU6EAc+vgtmeTtP1bPX0 pbopc+AkMmo1WWiA1OhgFxyKR4s+LxGU/GgoYVP0YhUK88Nhd0aPmFtvirr0HCSuOoDA K5ZrioPDjRpgS75zE3Q0ggKpp5D7hgWgsMtqA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040628; x=1792645428; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=O/HwnYvZMxiEtViUbWb+WVHnIMCzrwDnvvkTVkze1yI=; b=F12Yj8N74g3dHKB2F8R6ecokX8CVIWxAtUiNNVr3MFLRO2MALXXIt3fFRgW8BPpw1e PmzJMThccYjkgTW/nGIKltZtTbtPxoIPIiesy4ABhybiiaUkeu+LKJ75+wMjfvI6aYOb K0ZjCpRy0d3/YdxZzu92W2DGOJKuLqXvqUj7x2SJUKewmHcFER4r4brS3shGP7QNGESY oLuyMLwE5ZMXYHknjyIjKtss6Xfz9H5I0QFi8sqtkkqTHMEQ4LJl4uIRSvwjRe535KlD xmuZ6zIwNRFE4xeD5KokYEhjcOvOlsge82gCO4GFrwMO1Dh1iDOiXQ8nXidZFXXAtDcr 5nWw== X-Gm-Message-State: AFq9FYKi+nGWyD8ixnKiJVmX8YnodvfEGlf9Cm+YIot+hdO9drRmemL5 BViaSftwO/pchMlqtyLm7ZEyhn1KfrZkT/FriXCrZfguagM2QhxbJpwwOlgLAArsUZujc/NM3uS d478qqsA= X-Gm-Gg: AYBFou3fIsNHwrk3ccHO4XjPNPQzSd5+bR8qzztMOiVN6oaTueBGUO3b4mljCdcQOCc vLD7K+a9nxbMT7N+TlXkkUZnbXP5IEn2VFwmJfj5iHt7TfATi10sNOSJZvTtryJjdBG1asHzMrZ 93ClRqFFMXTFy/ODnqI6zPHG5K30ac6KL+d/mHwYmbdrjRejlB8lKlUrTWmPW9p6nlZtoDLLNdg nOZt6xqle3J4lhYr26yWCdU1/nv8Wn3kww+83zwKwATq+pbF4SNmIolpXAbQIxBHGtBEzRw1Ahw XPegRCGdgUWDU5Bj1WImr9W1hb6lrEqDblJkC5jldmFC+V+QxwsAo4reI/6EOX4tJsPnOIdwFfP ZEl+DL5V2mIGKNp/iJYT6fauKMcXuq6TwbqVH4Wwz56Mkedrtv5KxFjEJ1Uxg+KXoDg5hDUZE6m RF+oTH2Aklsx1gNQkXSFZQX61JJviElS3vYuL1pNoIYWJZkkUzDvxNBe2sLKQcP22jEjHHwCmQm gNDw5MYYDF/axdoMazIMXXzTlz1G20imM9o3VXYQCNqYGAcxZt5i2iMatcZgv2tw+Sv3Fzu1g== X-Received: by 2002:a05:600c:3f06:b0:49f:ce78:356f with SMTP id 5b1f17b1804b1-4a18e4ca2acmr350494215e9.32.1792040627778; Wed, 14 Oct 2026 22:03:47 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:47 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 15/55] libxml2: Fix CVE-2026-86138 Date: Thu, 15 Oct 2026 07:02:38 +0200 Message-ID: <1d57767b489ef6bc240020b40b834d2e1313ec44.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247813 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86138 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../libxml/libxml2/CVE-2026-86138.patch | 52 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch new file mode 100644 index 00000000000..9b918f75708 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch @@ -0,0 +1,52 @@ +From d2e3efc8502313a1099ccc4aac19e8e03734e8c9 Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:24 +0200 +Subject: [PATCH] fix: add overflow checks to xmlDictAddQString in dict.c + +xmlDictAddString has overflow guards for pool size calculations, but its +sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1 +addition can overflow unsigned int, and 4 * (overflowed_value) produces +a small allocation, leading to heap buffer overflow when memcpy writes +the prefix and name. + +Add the same SIZE_MAX-based overflow guards and safe size_t cast. + +CVE: CVE-2026-86138 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4] + +(cherry picked from commit a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4) +Signed-off-by: Hetvi Thakar +--- + dict.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/dict.c b/dict.c +index d7156ed3..ae0210ea 100644 +--- a/dict.c ++++ b/dict.c +@@ -225,10 +225,21 @@ xmlDictAddQString(xmlDictPtr dict, const xmlChar *prefix, unsigned int plen, + return(NULL); + } + +- if (size == 0) size = 1000; +- else size *= 4; /* exponential growth */ +- if (size < 4 * (namelen + plen + 1)) +- size = 4 * (namelen + plen + 1); /* just in case ! */ ++ if (size == 0) { ++ size = 1000; ++ } else { ++ if (size < (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size *= 4; /* exponential growth */ ++ else ++ size = SIZE_MAX - sizeof(xmlDictStrings); ++ } ++ if (size / 4 < namelen + plen + 1) { ++ if ((size_t) namelen + plen + 1 < ++ (SIZE_MAX - sizeof(xmlDictStrings)) / 4) ++ size = 4 * ((size_t) namelen + plen + 1); /* just in case ! */ ++ else ++ return(NULL); ++ } + pool = (xmlDictStringsPtr) xmlMalloc(sizeof(xmlDictStrings) + size); + if (pool == NULL) + return(NULL); diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index e4db345af42..28ae601118d 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -33,6 +33,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-1757.patch \ file://CVE-2026-11979.patch \ file://CVE-2026-86137.patch \ + file://CVE-2026-86138.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Thu Oct 15 05:02:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100748 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FA12CCA462 for ; Thu, 15 Oct 2026 05:03:52 +0000 (UTC) Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32823.1792040630226083786 for ; Wed, 14 Oct 2026 22:03:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=GTyEHDUP; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a018dc1f98so38667665e9.3 for ; Wed, 14 Oct 2026 22:03:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040628; x=1792645428; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=2BXre/4kpMyy5mbTmpOVhwWOKUDl6RaHw6WrkpdEylQ=; b=GTyEHDUPKX2MMA+mpGyu0tDE5h+Op717RNOUpS/RAUV9WnqITWUehRnjMDaWYiHpnB PdT4Zw7RdTRYC+YfT1x0yZE9x0uLBIaw4yXYcZchO/RF24/O1W5VgZPjSEtP3jwRLeb4 y1kO/DecyFbd11qwFinDNjyJJbTxaXI3RgeMg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040628; x=1792645428; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=2BXre/4kpMyy5mbTmpOVhwWOKUDl6RaHw6WrkpdEylQ=; b=tfjJha02LhQd1PqhxUWZ3WPzM9wSKpUQzU/ixinNqkA5xCd3rTXX8XrHYXOyu6pRaM jNKsDcl90BcdGJJIBtBweLpUrv+XKdatYsYXeSn+X+nk9SUH4Kast1lyDLEELyBeydTO hlYCEVz8YZlIEK/1LE2pFahVL0ibpoWbAxnfrRnxmXSiGja3V429+tIdAYzH77pt7d1V oefbQ8jDKK1MUYlvF2ZKKsmZMl5LkMK9hQGgOBCPTSNqTTIyVTqWhM0Qh3Ici7rZhMyU dvsLDVm5k6MfeVUS8BbWEIPxcygM0/kjGPVtolL8zkwWyQx7+5VcmnRIUAUBE8jTkYHK xtsA== X-Gm-Message-State: AFq9FYLQ0xLyAifoDohmcbtfRxODdVpr7Z6NmRtaqFObazRoIVPCUN3C ZvWz2t+3gQo5lUN38p2fcO0kODrspdNaX0h/h92lvELqqIf9Hsn6lUeCbY64z75V6QKpeZzOfyR 9pGWie8U= X-Gm-Gg: AYBFou0GbOyutNOealFWS4EPkhKXenorXEV/xpeciUnj+nlQvVTwnj+lcVj3wlBkL6Z ssAsudf+9P1uR/cCfFHkMn7r9ACGdFaIWPynGeVGiNmPggwa4y6SME3VEwEJsLC1CqMQjk8h0WZ wlcRI3uNdED2YJLO+xfTcwXnOItd86m0zHjf5hdI6sbX3afyjANDzwMtve9yvAGsmXBJXG63IQE TujRV/MLh8qhAs1hQ6dqm/RhxfziGdjjP3zK7O5SZTqhbOY1YE3spybZj0O6+hNsecthFdeXu4p RDJlT4SBlRQ/TJG8SADpPHZXjPqXT3GvPuG13oQ4fLwylh8xsJd0Abu0egLDXu21mTHXxgKzrKS lPn/Ok0B7AdONfat9O5Y4w8tX+Vcj2wp1s+rnVNm0tRKOiw3VqQQqSyRiXFCHPRAFx53YpEtiQF OUiap0wbllMG6l+kjZ9JlGDLQsqdnX7uCNqjpx5jBhVgizjGghF/9oyulikpSY5Kb2rDUmOoWEh PfdEsFAlGXmiEKBv5HjW+JSfTC66irQEZTRMk2HmoLWka4Xhgyde7I/67gW2BWjXHovRrjvbA== X-Received: by 2002:a05:600c:6215:b0:49c:fa20:cbfc with SMTP id 5b1f17b1804b1-4a18e4b72e4mr319565045e9.19.1792040628303; Wed, 14 Oct 2026 22:03:48 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:47 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 16/55] libxml2: mark CVE-2026-86139 fixed Date: Thu, 15 Oct 2026 07:02:39 +0200 Message-ID: <5485bd1b14421f0519fab93c28e03cfe5bba9969.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247814 From: Hetvi Thakar The fix for CVE-2026-86139 adds a zero-length guard in xmlURIEscapeStr, as shown in the upstream commit [1]. The libxml2 2.12.10 source already contains the equivalent guard [3], so no additional patch is required. Mark the CVE as fixed in the recipe. [1] https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86139 [3] https://github.com/GNOME/libxml2/blob/v2.12.10/uri.c#L1689-L1700 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- meta/recipes-core/libxml/libxml2_2.12.10.bb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 28ae601118d..53e8660366e 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -46,6 +46,11 @@ CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail # https://gitlab.gnome.org/GNOME/libxml2/-/issues/958 CVE_STATUS[CVE-2025-8732] = "disputed: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided. https://gitlab.gnome.org/GNOME/libxml2/-/issues/958" +# The Scarthgap 2.12.10 source already contains the equivalent zero-length +# guard required for the xmlURIEscapeStr integer-overflow issue. +# https://github.com/GNOME/libxml2/blob/v2.12.10/uri.c#L1689-L1700 +CVE_STATUS[CVE-2026-86139] = "fixed-version: xmlURIEscapeStr returns NULL when xmlStrlen returns zero" + BINCONFIG = "${bindir}/xml2-config" PACKAGECONFIG ??= "python \ From patchwork Thu Oct 15 05:02:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100752 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 540C3CCA464 for ; Thu, 15 Oct 2026 05:03:52 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32437.1792040630921013945 for ; Wed, 14 Oct 2026 22:03:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=MEnwwoVM; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a018792ab3so38966215e9.0 for ; Wed, 14 Oct 2026 22:03:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040629; x=1792645429; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=9DoKAtTOHn9exmU2ewuAIRxHevFkURvXOIwWX/v74B8=; b=MEnwwoVMUkKRE+EoU+4xvfFO/s9m17KYQdpxDHqV8RkZCbV2zFSFBByxjMAosv65v7 E9mctDrT4jUQCHmDcnFr+rFKLo/dISX1bHfRM2V+ykJyAYbf3nOZaqOqG7/7Cj5GPQLP KIwKWhmVvxNMA1pVYG23yWyLfNbV/bA6u8jrs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040629; x=1792645429; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=9DoKAtTOHn9exmU2ewuAIRxHevFkURvXOIwWX/v74B8=; b=RFA9lV2A3yTpG2eDdPDYiiPg0vkfuMI92qoHuqn9tIMlnHLu0KFSn59QwDARBXQJNY 0mrVeFhtJ9CYAJExW5fdeeFSQ0zbpfsS9SlYT4RT1vQlNfsCYthcTFOcyHwH3dds0MYk dpEEBEsSf2Md33TzBab7RUg3TXBu2wS07pQn8GS0iKoSdnqEQy7oGQJYroa++7183Lyq nIzh4qMSQtE3fPhhMY4VdOlXeIvNQ0rZhGb7koX7ykuq5k8NZ8qoRiwkqji9r9vOnwwY k0MK9bbzGyAErns4DMs47NudA6x6cG8B9FajMfg17YfE2G4mZ5u+e35kFxWrnNUPe96O CxKg== X-Gm-Message-State: AFq9FYLyFnhlckHjJiIjFT3nLsNrIalBqmtYHcJlMGoA7OltuUCvlCJG sr0p/1stQxoX+/4pxd9RhB3JiNmliR3kEDbQJpyeCAxJQNOKAbjYz6Y+W+GFrM31fbwRvSZJdQy nF6pj7w4= X-Gm-Gg: AYBFou2D92OWL55iXtsk7cS/VyV1gJRDiWI+YUSc9e3DTQyJ5FtbkWvfVA3CTDfy8vC aN6ICTib2SpBxy50mvcVQrTnw+YbaaOIXwJ0JRJpf9jS6TQ2iX2Krl7FvmtrEZ0DtlNNkRPLSKu 4h5SfkvvJyD+ZNh9QTy9R+ucDjQiE39fmzOxAJQwFzmFHactg1OiGtd78yWYUIBWoZNlEwcBaMy FMH5w11pUWDnvjvsh3KfJOvnEo42IJF5bih3PUXxg/HY2HwtXMVrB2407Nk22QDXvyvZgdZ2S3s Ty0Vog5oQCvGc476uxYPLk5OqvpjLftSdexx24tHYI5JhH3xX+vwHb8+7SkUT3JlnsQboMEVXw8 ntxpdZhKYHOT6CFlALJYgg1QSzbYO0j8xzXGuzTkw+/wZCA6FSRb49ulQWCmDjjJLtpNSO577WG SOZQqAz1SIcH+pu7mvz+2zq9feF5goeg3YEEprQDZ+eqNQZykv0naPihNYANnlAuMf1ZIp89UJo G6zHJJhc62Yx2Osg6JFgpQDxaWtdWkprV80Srl0sgdvXGXhgi+phI0kmS2qB+uXYdsMCT9TIw== X-Received: by 2002:a05:600c:1d0b:b0:4a0:13ea:2ec3 with SMTP id 5b1f17b1804b1-4a18e4ddca6mr356786775e9.35.1792040629095; Wed, 14 Oct 2026 22:03:49 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:48 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 17/55] libxml2: Fix CVE-2026-86140 Date: Thu, 15 Oct 2026 07:02:40 +0200 Message-ID: <2c45b60e5d543bca0c1a239254d879d1ad7e3a72.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247815 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86140 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../libxml/libxml2/CVE-2026-86140.patch | 56 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch new file mode 100644 index 00000000000..bc7e069b092 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch @@ -0,0 +1,56 @@ +From 7d324fcfa71e8567678ad254c0e10e509ebae99b Mon Sep 17 00:00:00 2001 +From: mohammadmseet-hue +Date: Thu, 16 Apr 2026 02:54:37 +0200 +Subject: [PATCH] fix: add bounds checks to xmlSnprintfElements in valid.c + +CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat() +writes, but the sibling function xmlSnprintfElements has the identical +unfixed pattern. The strcat(buf, "(") before the while loop and +strcat(buf, ")") after the loop exit have no bounds checks. + +Add remaining-space checks before both strcat calls, with early return +and ellipsis when space is insufficient. + +CVE: CVE-2026-86140 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340] + +(cherry picked from commit d1686f91dbda141a752200419d35639fd6b38340) +Signed-off-by: Hetvi Thakar +--- + valid.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/valid.c b/valid.c +index ae4bb822..718e6d85 100644 +--- a/valid.c ++++ b/valid.c +@@ -5047,7 +5047,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + int len; + + if (node == NULL) return; +- if (glob) strcat(buf, "("); ++ len = strlen(buf); ++ if (glob) { ++ if (size - len < 50) { ++ if ((size - len > 4) && (buf[len - 1] != '.')) ++ strcat(buf, " ..."); ++ return; ++ } ++ strcat(buf, "("); ++ } + cur = node; + while (cur != NULL) { + len = strlen(buf); +@@ -5111,7 +5119,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) { + } + cur = cur->next; + } +- if (glob) strcat(buf, ")"); ++ if (glob) { ++ len = strlen(buf); ++ if (size - len > 1) ++ strcat(buf, ")"); ++ } + } + + /** diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 53e8660366e..98a3e3ce366 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -34,6 +34,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-11979.patch \ file://CVE-2026-86137.patch \ file://CVE-2026-86138.patch \ + file://CVE-2026-86140.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Thu Oct 15 05:02:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100751 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62324CCA466 for ; Thu, 15 Oct 2026 05:03:52 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32824.1792040631473172534 for ; Wed, 14 Oct 2026 22:03:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=1u649OiV; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a022fee0caso45224815e9.1 for ; Wed, 14 Oct 2026 22:03:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040630; x=1792645430; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=4XXozX42qbuVN1UM9v+q/Eaz/as+GoHU87Rh0ZAsgRI=; b=1u649OiVv+aad5izCFEiHFeW8+rNESs6/NUCFnInGSItdk7aRFcmTixx0ujpq7gQC0 XBSib7k3n984oLxqBhDgYz6/KwuSzCapVm5tvJVTVBhLrhYSrmzIp42k//BfehtSuyAD s3vXZX84LJQ7nBOXbZ3TuclpmuBH+dH4X9SKM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040630; x=1792645430; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=4XXozX42qbuVN1UM9v+q/Eaz/as+GoHU87Rh0ZAsgRI=; b=o6OEmh9pv6a861OGYpz6BNBM7MLgnkrsAy8cjd8jI55euRCr5TJfk4kdIaQxKNqlkO ZzjzGXRd0xnWVqXN1iP6iekvScyt0AhLFO6a2tzVyGIU0AtOwneAlykVgCQTMgMZRG+R 54xUX/q+0YEDOUvfpwc1DSK+HueL9b5aMwo379vGVaUhoZpQ6gOMfpF1LRrBK9BuTljL ggZjlFcMN/MoQRODcwGaIrpepduw5QS59hDxWyoioxjwxBo9x9Xzv9QLsMop0d53IQYQ cdXlJY1eil3faq7T/unZxJsSBZS/R0ElxzfhI7YZVLvvJ6xs2CBi9gOCq4BSblPPhIIq LeAA== X-Gm-Message-State: AFq9FYJWVKop6htFDIlIZStv1NspXVghICHlwuEYNNi3wgVJxXmwuFlU D0R6w+ZECTfHjf9L2N3sgRH8QTTDsxkfAmcWq7vibLNcjBSxzXeqwzDTRXVlyW9laDWy6IR9Qle VMG2BrkU= X-Gm-Gg: AYBFou0aEWh9fw9K3TryM65VX5CP9fMKdeKAW2Ecw6xpWKim9W3UGkOrdV0KuxCE6SS NVUuH97/dBQcXRhczBnHXa0dMW8j3xbPUwMFpMwPZM8h4FTQkMauOxXM4Jk1HC8S6T+V6OSp12a 8HE/SJamucFulbdlFWrByDYxgZENP+1V+Wx59lQ03SmDL54x8N0fXCrIBCEN2frJVXRxJpRjQk6 DOTKbB4Wdefym1JCjIC/Cy/V6nBS1WBgHE2saupmfpksji6YSFx6dToLGtNWFcBHkeOa6lnegsj DcMFciXcEogojCCxK/3tMfj8a0SBp1lDaEAg25bCUhuhwU0pRt76c/q05nq7Gl2gDfr7b/TTbFD Z65WH+V+ulCtLhFmoo4x7QgUDKp+8i7hKxtA/sd64nfqz+7rpSiAuWyHdRD1Lx8j7G45ax1e2LC hsYwH3hC7AsX+83AlU7b7xX/Auf7DJ6gpcxD3l7w7NkKHdIADpbAbiSuS2s9U1rUzDKekuv/z6S l+62HULtvax3d5J4wtwNvqwjWlvQoU+52MSILMZhZX1AhIEzqFF8J8F4Qre1jlLQbPpBEvmfx/e JPYce5zC X-Received: by 2002:a05:600c:c16f:b0:49f:ed8c:6cad with SMTP id 5b1f17b1804b1-4a18e4ca869mr328592345e9.19.1792040629714; Wed, 14 Oct 2026 22:03:49 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:49 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 18/55] libxml2: Fix CVE-2026-86141 Date: Thu, 15 Oct 2026 07:02:41 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:03:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247816 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86141 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../libxml/libxml2/CVE-2026-86141.patch | 35 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch new file mode 100644 index 00000000000..416a50eda50 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch @@ -0,0 +1,35 @@ +From adb9287ae35770d9b281ed8f2160774198fbaf25 Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 07:56:18 +0200 +Subject: [PATCH] xmlregexp: Calc string length after null checking + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107 + +CVE: CVE-2026-86141 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55] + +(cherry picked from commit e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55) +Signed-off-by: Hetvi Thakar +--- + xmlregexp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/xmlregexp.c b/xmlregexp.c +index 320a35ce..72e8e459 100644 +--- a/xmlregexp.c ++++ b/xmlregexp.c +@@ -702,12 +702,12 @@ xmlRegNewParserCtxt(const xmlChar *string) { + return(NULL); + memset(ret, 0, sizeof(xmlRegParserCtxt)); + if (string != NULL) { +- ret->string = xmlStrdup(string); +- ret->len = strlen((const char *) ret->string); ++ ret->string = xmlStrdup(string); + if (ret->string == NULL) { + xmlFree(ret); + return(NULL); + } ++ ret->len = strlen((const char *) ret->string); + } + ret->cur = ret->string; + ret->neg = 0; diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 98a3e3ce366..240e8fe670d 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -35,6 +35,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86137.patch \ file://CVE-2026-86138.patch \ file://CVE-2026-86140.patch \ + file://CVE-2026-86141.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Thu Oct 15 05:02:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100754 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B551CC6B2E for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32438.1792040632080522820 for ; Wed, 14 Oct 2026 22:03:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=NoJvJCPD; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a02718da81so38469515e9.1 for ; Wed, 14 Oct 2026 22:03:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040630; x=1792645430; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5Au6EcgKK9qiy2aV1MpBay6nsK/H3a/qx4G9C++DnRk=; b=NoJvJCPDpF0KCpmaKGFplgHiD9Srnu0MuSGecODL7W9r2pxMmHbj5T7BfH66ujjS1b IkHPUVfX65NrG6C/fgEzhYh2uxZqKswKqScQU4g4r/gacFM33Y9Ic+SI8YU+qJrTNb90 uZMK1eNiaLIAgS8K/bubBzF4+AL07YVLdDTWc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040630; x=1792645430; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5Au6EcgKK9qiy2aV1MpBay6nsK/H3a/qx4G9C++DnRk=; b=hD7857sUNHnotV9qtePzWPjRAdcyFqLonEZbzTNf9q36Em3WeQCKKg5vGh2W32xGOk tVxdNybsWr+mvmUvso8JHIpcP5brxo+oIQpKnEmi2YKFa4oo4BGvUiiXqBfxyRUqKjri xOih734oe7S/z/N/xphSgQ3d/msH6JaRkD1y2EJBKJ+ZydXDLgpudMdSAobjSnB1wq+m CkDeGUxpKG4uxtPyhIkAJJII/LykfcwHj000vLPpbqhudAt3RYifAH7nqHEEqkA69OyY ZQPjKl4sLaA7hQMimljow8lBajt8HpQT2+LxilH1IQTV0WFBiWfdsvV9lYXISP6NYYcq 83jQ== X-Gm-Message-State: AFq9FYKzq8D0Vu4h0kWn3xT9puQjRnsLKKOL3tH+W+vcEXlsRKFBjsct PjqOaazUA9Mpmq326S8lSrIRYbGLdF+anFQG3myxnBoI7NslHC/fGX+cG5i+lYIfNJZ1AVJglcB SGPZuitQ= X-Gm-Gg: AYBFou2yulb0paBlP2kuJR3JClMXin5ovdBMDzVdDhIqnc0fB/yYcCWoatP4v6132HA /alyoaH5LMRisA/ChKkQYNjB4Si2qu8fsT7PR6iR+0LlCY5g/VE4nI9T0wHmh09FvIhX6VK2Cug Vd9kKZkvVOoi4IFuZE7TVg4BV7ua/MhZ7DffKLti0vo7TZKXssXXOaxMcMZqmNjlwITDLwj2Y+D vAPFRoFAnC9SrS92I5b4P4Vi4XRqiEZyodpBYZg/sE6sbkWFITfYOv5rLO3L0xrRwBCS+OcYZEx 1zaBipi3TcCKG6zXBpbTGnkVZvW5QjUuxgedMDfhplBlYLYGUC358YAo4+Df0WKk85jPOyR31bd mdDH6b/xnp7HufVtxD5x82khLsT921gxPZylM9EhjD7nF7GP9PRzDw7eltG5XBYPVHuN0ptZxqp xiy20yyH9ikzNfTbm3D+cGmn6OWTgjLdnvGoQwsiRECU98n9Hid5YwiBVEWIPjfYzNK9owNvTFW l9IFtzEOpDG3XIbLnGPtEXMwxlimsKLAqcVFNh6HEomwKjWjAuV3mZWHdGpp4lCmZWN6yvsR0m3 GmC68RZW X-Received: by 2002:a05:600c:19ca:b0:4a0:2484:2800 with SMTP id 5b1f17b1804b1-4a18e4464famr343319725e9.3.1792040630165; Wed, 14 Oct 2026 22:03:50 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:49 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 19/55] libxml2: Fix CVE-2026-86142 Date: Thu, 15 Oct 2026 07:02:42 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247817 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86142 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../libxml/libxml2/CVE-2026-86142.patch | 40 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch new file mode 100644 index 00000000000..33081886492 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86142.patch @@ -0,0 +1,40 @@ +From 51f0e78349cbbc9081f14e02f440733e5880fb3d Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 09:32:43 +0200 +Subject: [PATCH] xpointer: Check overflow in xmlXPtrEvalXPtrPart + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113 + +CVE: CVE-2026-86142 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58] + +Backport Changes: +- Use xmlXPathErr(ctxt, XPATH_MEMORY_ERROR) because the Scarthgap xpointer + implementation does not provide the newer xmlXPathPErrMemory() call shape. + This preserves the XPath parser error state as well as reporting the + allocation failure. + +(cherry picked from commit 6b3a736c0edc74ceec3d82f5252499d7911b3a58) +Signed-off-by: Hetvi Thakar +--- + xpointer.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/xpointer.c b/xpointer.c +index 6e1e5f46..f5457c9f 100644 +--- a/xpointer.c ++++ b/xpointer.c +@@ -956,6 +956,13 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) { + level = 1; + + len = xmlStrlen(ctxt->cur); ++ /* Overflow in xmlStrlen */ ++ if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) { ++ xmlXPathErr(ctxt, XPATH_MEMORY_ERROR); ++ xmlFree(name); ++ return; ++ } ++ + len++; + buffer = (xmlChar *) xmlMallocAtomic(len); + if (buffer == NULL) { diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 240e8fe670d..ec4b41bde53 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -36,6 +36,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86138.patch \ file://CVE-2026-86140.patch \ file://CVE-2026-86141.patch \ + file://CVE-2026-86142.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Thu Oct 15 05:02:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100759 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1DB4CC6B3C for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32439.1792040632488169633 for ; Wed, 14 Oct 2026 22:03:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=hxTpfO6r; spf=pass (domain: smile.fr, ip: 209.85.221.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-48c4d99c32bso1289088f8f.1 for ; Wed, 14 Oct 2026 22:03:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040631; x=1792645431; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=2MsxUOGpqxCiQ+ki+0YPM4KWGRFCkYFNaWNQTEMzAEo=; b=hxTpfO6rz78ZNtTFDCFqrm+WaqvLaK4k3yv/3JGB1Vymxh/gP0oU7Qwx6K4+zolaP7 74K+o62H9jAFKyfDurb1s2w5r7jgaeRJDe5oBsv4Io+NZRpC81W78c/MQb82J9/k19/A b/v9Xp5PGxjTjZQoLDH+uj8a3uO2/PTODB42s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040631; x=1792645431; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=2MsxUOGpqxCiQ+ki+0YPM4KWGRFCkYFNaWNQTEMzAEo=; b=1v6FXyy8olNvgeYUh7pizINj1dKlVeQTLZbWHtfbawkK0+ClEoQie5hKTTV34/R/wf +drazWJ+cwqNQ6kAAEhwmzUeu2B5+Y3LMfPsZmYevwXR9cpks07EjK/Cj3FmjaQ+Ezo+ 6U0Nbm7zyb9IrOZrkEUj8qFZE/N0bG9tLdYhrEv81RMM5n7KXZ6pKxstlCP09HHdlTc7 QmYTBV9COYDk8QsGFnfrJVf8klzzjyLZe5FZI98sZc5cDpMKkyamwW81cjs9Cncdmtqv nSg1IWQ5e4KPrSRHeZUHZFhUk06jil9QRLtBDNysCJydr6NcX/P9DNiSBunsPLkKXZtW vpOA== X-Gm-Message-State: AFq9FYKHmYb7cd3eISh4210PefWyKpiqnUQ+qWQik+5L3gznekszdOwJ 4zA3Q6KODUnBWGbDptNho3OlMJXeNaehH2BRqQu04nV2yCn65e51KbzI/3yOKsHBIoHR7szBgk0 1mjOt7IY= X-Gm-Gg: AYBFou3/jCvi1FRrCJs8tovznQgommEKv8uHOHhTYKfksNCw0Sw9873D9fFuTsXzo6J inBsiSkuHDxel1xVX1hBVuRRqu41KkavADwX4MI4YDT1nAAfS3nQJnNuuW5Ww8eVfeBniCBKBoP vCSjOyDPgGwgZzbE3BNovNykytvjSIM5tA9GMImWFUjzcFSLwXIV7H5KD9vpIG8admskPqsUqGt RcxAljbwayklKGyw7/pAz+76uRe2j/Dn4Vyy46p88N7X2HE6lC2+6hzU5BtsyWJ4SCoPwQv342v b2g0H/BPharCkrDLM3Xqkl1nnAQNdNOGN4uKd+Ug1ReryoK/WF2MJ1x6OwtNYrh6khLUHKiN/dO AnUI4pXl9XpjIVWyak1TkNK4LRdMBmqv/Y+AS2TGEOH+3skMKRf7+4NlJcgORxOxMcVI8f71wSh hCioB7sKpLTamSOA8zjlYKGDXawZuvTLnRmYqlVOl5ksCk/vhqrRUqlbjPghFI9aSkP1RBe/M3N Qtz2A7Te+cuh1GpjXrLnpQty1DSVTD83HjnIVoKex7VrecuLTLb0ZyFBu+CgVmuTfmixyAe5Yc= X-Received: by 2002:a05:600c:19cf:b0:4a1:7b56:1151 with SMTP id 5b1f17b1804b1-4a18e48f00dmr352213425e9.18.1792040630692; Wed, 14 Oct 2026 22:03:50 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:50 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 20/55] libxml2: Fix CVE-2026-86143 Date: Thu, 15 Oct 2026 07:02:43 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247818 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86143 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../libxml/libxml2/CVE-2026-86143.patch | 96 +++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 97 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch new file mode 100644 index 00000000000..98335f88fbf --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch @@ -0,0 +1,96 @@ +From 83259eee08067b547d2aaedd436504939b2c343b Mon Sep 17 00:00:00 2001 +From: Daniel Garcia Moreno +Date: Mon, 4 May 2026 09:54:34 +0200 +Subject: [PATCH] xmlIO: Check for int overflow before calling writecallback + +Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111 + +CVE: CVE-2026-86143 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35] + +Backport Changes: +- Change nbchars to size_t in both Scarthgap write functions before assigning + the size_t result of xmlBufUse(). Add the INT_MAX guard to both + xmlOutputBufferWrite() callback paths. The upstream commit assumes earlier + refactoring that changed nbchars to size_t and routed + xmlOutputBufferWriteEscape() through the protected write path; the existing + flush guards are retained. + +(cherry picked from commit 90f293ba74d28b1d570920382e707586f68ebf35) +Signed-off-by: Hetvi Thakar +--- + xmlIO.c | 26 ++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/xmlIO.c b/xmlIO.c +index 95d27157..de227d8c 100644 +--- a/xmlIO.c ++++ b/xmlIO.c +@@ -3318,7 +3318,7 @@ + */ + int + xmlOutputBufferWrite(xmlOutputBufferPtr out, int len, const char *buf) { +- int nbchars = 0; /* number of chars to output to I/O */ ++ size_t nbchars = 0; /* number of chars to output to I/O */ + int ret; /* return from function call */ + int written = 0; /* number of char written to I/O so far */ + int chunk; /* number of byte current processed from buf */ +@@ -3378,6 +3378,10 @@ + if ((nbchars < MINLEN) && (len <= 0)) + goto done; + ++ if (nbchars >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + /* + * second write the stuff to the I/O channel + */ +@@ -3487,7 +3491,7 @@ + int + xmlOutputBufferWriteEscape(xmlOutputBufferPtr out, const xmlChar *str, + xmlCharEncodingOutputFunc escaping) { +- int nbchars = 0; /* number of chars to output to I/O */ ++ size_t nbchars = 0; /* number of chars to output to I/O */ + int ret; /* return from function call */ + int written = 0; /* number of char written to I/O so far */ + int oldwritten=0;/* loop guard */ +@@ -3572,6 +3576,10 @@ + if ((nbchars < MINLEN) && (len <= 0)) + goto done; + ++ if (nbchars >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + /* + * second write the stuff to the I/O channel + */ +@@ -3667,15 +3675,25 @@ + */ + if ((out->conv != NULL) && (out->encoder != NULL) && + (out->writecallback != NULL)) { ++ size_t bufsize = xmlBufUse(out->conv); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->conv), +- xmlBufUse(out->conv)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->conv, ret); + } else if (out->writecallback != NULL) { ++ size_t bufsize = xmlBufUse(out->buffer); ++ if (bufsize >= INT_MAX) { ++ out->error = XML_ERR_INTERNAL_ERROR; ++ return(-1); ++ } + ret = out->writecallback(out->context, + (const char *)xmlBufContent(out->buffer), +- xmlBufUse(out->buffer)); ++ bufsize); + if (ret >= 0) + xmlBufShrink(out->buffer, ret); + } diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index ec4b41bde53..1363beba7a5 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -37,6 +37,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86140.patch \ file://CVE-2026-86141.patch \ file://CVE-2026-86142.patch \ + file://CVE-2026-86143.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Thu Oct 15 05:02:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100768 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 223EBCC6B3F for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32440.1792040633246093218 for ; Wed, 14 Oct 2026 22:03:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=fzUkNLNj; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a16af2a232so37623935e9.1 for ; Wed, 14 Oct 2026 22:03:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040631; x=1792645431; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=+raIgylfxOu9u25h0Xt/8jkjz1UnasRUYdWP2Y+1zRg=; b=fzUkNLNjkBBDhmlWgbJll3OHWVetYtxxx6flKOPdGF+89jHrl9j+izDX/L2Vnsop4+ TQErYrDc+RCWJYqLuFo7CRKRZR1Fyaf0GhF3F/7MbAId/Pyhjb46Eigb8BixSDbbvd0o 1kwWK2RaHxuPBoPJXCJWoY+JRTrgbX30p3fyk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040631; x=1792645431; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=+raIgylfxOu9u25h0Xt/8jkjz1UnasRUYdWP2Y+1zRg=; b=Hq2a3h8taE+tckJ3SZBmO5uwKkCm6ljiWWam33S3PamJqH07yHAaGgh+8/VuGQID/I mVdDyHj07GtJBL64G8vW/Kr/ClCRJ2158AoRzQACxSbw9C/x0Y0dsxqyBFUDqw9d42RO CMt47lQkxY8kDCZEB19FURiozJf84zXjMLfDuW3P/TAl0Rvz/F2LrDNSrqQ+yyZBb4f5 Ne2ht2CgmoO/l0JvQVXf0y/xYXJ6ILkD/NWKukDWSUzmkOKqePd1kPp7JIPYeOw8xDti BhytrTz7LNd8Ynk0OucGDeWYqkXbhzDX70czoPg9H13504A3CEzB4Rw+zJqXTP9bVlyj RanQ== X-Gm-Message-State: AFq9FYI1hqEKVCdbBJsOnX6xUEF3F5kxNoZbRivjN0lZAPQ3Ejdb5VVL O3vHiCUeMKEM/hdVlQnDMC4+ry6BDorcB3rQZHIBr6AilS/uNntbOtPeB2NiAQ828d5ALV6jaLL hhGLaZRQ= X-Gm-Gg: AYBFou0QcH+CIS98blHyOrr8eJVYwLw+P5YrXh0dZwx+FyJMlvvURdB25yeU8Azbnxi lQRV0TTswspQsSfTtquZX3ak2nvTqmSImZP5ISahhh46YBPE9HTofISBLl4gt9K/YTM1ESA+BpG EhxatqLmBF8Q1ocleQ7p13IjZ2rWwCUF9FyyjDjJU6TE0S2XJys5Zch9G46xrIJ+aci3pfjyt33 BdF2b5mNdpulBA0h17/jt7d01whBYoaI0vrgZSm0DXjMp9OAcgZiLubacVNRblX3Hzj1uWXQFLC YaO9yQV7xZ7jLKV09mixcDVtQpX0Wtir4D4PvMzONRuLVLeLOFlmBW1EB5MVIANoNjhFDkVtFiT 2tWyyeJiV6CKuReQGPvdoUqDcEHw8b2cJeCOlHRpRuphI/r05cfCezmQMqs2Zw23W+d/xxY1M7v lIdjkvQ8jX3vpGFQMRbBl9fbKUPKZf0fMtytbgtqUwB3iLH3QSrR41VfR2QZ/EskrbviSDY8VID LPkMuO/KdiiDKba4eTtggHUoR281K4j1szLxBM/95ibNWhNyG26tYzlqB33MJy5yIIAeWyrN1xx dkDd+sK7 X-Received: by 2002:a05:600c:4e55:b0:49f:fe39:5bc8 with SMTP id 5b1f17b1804b1-4a18e49c008mr322528635e9.12.1792040631409; Wed, 14 Oct 2026 22:03:51 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:50 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 21/55] libxml2: Fix CVE-2026-86144 Date: Thu, 15 Oct 2026 07:02:44 +0200 Message-ID: <4b03cdc9cab9419ba55f0b0baf10c04412d690fa.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247819 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-86144 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../libxml/libxml2/CVE-2026-86144.patch | 225 ++++++++++++++++++ meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 + 2 files changed, 226 insertions(+) create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch new file mode 100644 index 00000000000..77dd2a07e28 --- /dev/null +++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86144.patch @@ -0,0 +1,225 @@ +From 8d0c6eb94f8a32a49e3c9122a6da82c519198063 Mon Sep 17 00:00:00 2001 +From: Ruben Thijssen +Date: Fri, 15 May 2026 15:42:18 +1000 +Subject: [PATCH] fix(xinclude): propagate parseFlags in xmlXIncludeProcess and + xmlXIncludeProcessTree + +CVE: CVE-2026-86144 +Upstream-Status: Backport [https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61] + +Backport Changes: +- Use xmlLoadExternalEntity() with xmlCtxtUseOptions() because Scarthgap + 2.12.10 predates xmlLoadResource() and resource-loader callbacks. +- Adapt the regression tests for 2.12.10 by using the global structured-error + handler, matching 2.12.10 loader network-entity diagnostics, and restoring + the test handler after xmlXIncludeProcess(). +- Omit the upstream XML_IO_NETWORK_ATTEMPT filter because the 2.12.10 + xmlLoadExternalEntity() path has no corresponding post-load error-filtering + block. +- Add a parser-context allocation guard because the target version can return + NULL from xmlNewParserCtxt(). + +(cherry picked from commit b63cd517afecb76582dd9488c55e54ceaf50de61) +Signed-off-by: Hetvi Thakar +--- + result/XInclude/issue1120-1.xml | 4 ++ + result/XInclude/issue1120-1.xml.err | 1 + + result/XInclude/issue1120-2.xml | 4 ++ + result/XInclude/issue1120-2.xml.err | 1 + + runtest.c | 75 +++++++++++++++++++++++++ + test/XInclude/issue1120/issue1120-1.xml | 6 ++ + test/XInclude/issue1120/issue1120-2.xml | 6 ++ + xinclude.c | 9 ++- + 8 files changed, 104 insertions(+), 2 deletions(-) + create mode 100644 result/XInclude/issue1120-1.xml + create mode 100644 result/XInclude/issue1120-1.xml.err + create mode 100644 result/XInclude/issue1120-2.xml + create mode 100644 result/XInclude/issue1120-2.xml.err + create mode 100644 test/XInclude/issue1120/issue1120-1.xml + create mode 100644 test/XInclude/issue1120/issue1120-2.xml + +diff --git a/result/XInclude/issue1120-1.xml b/result/XInclude/issue1120-1.xml +new file mode 100644 +index 00000000..5d83cc96 +--- /dev/null ++++ b/result/XInclude/issue1120-1.xml +@@ -0,0 +1,4 @@ ++ ++ ++ Network access is not allowed ++ +diff --git a/result/XInclude/issue1120-1.xml.err b/result/XInclude/issue1120-1.xml.err +new file mode 100644 +index 00000000..c134bed1 +--- /dev/null ++++ b/result/XInclude/issue1120-1.xml.err +@@ -0,0 +1 @@ ++I/O error : Attempt to load network entity http://example.invalid/file.txt +diff --git a/result/XInclude/issue1120-2.xml b/result/XInclude/issue1120-2.xml +new file mode 100644 +index 00000000..af5bde91 +--- /dev/null ++++ b/result/XInclude/issue1120-2.xml +@@ -0,0 +1,4 @@ ++ ++ ++

Network access is not allowed

++ +diff --git a/result/XInclude/issue1120-2.xml.err b/result/XInclude/issue1120-2.xml.err +new file mode 100644 +index 00000000..051f5928 +--- /dev/null ++++ b/result/XInclude/issue1120-2.xml.err +@@ -0,0 +1 @@ ++I/O error : Attempt to load network entity http://example.invalid/file.xml +diff --git a/runtest.c b/runtest.c +index e91e2dfd..297cb5e2 100644 +--- a/runtest.c ++++ b/runtest.c +@@ -2444,6 +2444,75 @@ noentParseTest(const char *filename, const char *result, + return(res); + } + ++#ifdef LIBXML_XINCLUDE_ENABLED ++/** ++ * Parse a file and run xmlXIncludeProcess() to verify that doc->parseFlags ++ * is propagated properly. ++ * ++ * @param filename the file to parse ++ * @param result the file with expected result ++ * @param err the file with error messages ++ * @returns 0 in case of success, an error code otherwise ++ */ ++static int ++xincludeProcessTest(const char *filename, const char *result, const char *err, ++ int options) { ++ xmlParserCtxtPtr ctxt; ++ xmlDocPtr doc; ++ xmlChar *base = NULL; ++ int size, res; ++ int ret = 0; ++ ++ nb_tests++; ++ ++ /* Create a new parser context */ ++ ctxt = xmlNewParserCtxt(); ++ if (ctxt == NULL) ++ return(-1); ++ ++ /* Load the data from `filename` into a parser context */ ++ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); ++ doc = xmlCtxtReadFile(ctxt, filename, NULL, options); ++ xmlFreeParserCtxt(ctxt); ++ ++ /* Check if `doc` was created successfully */ ++ if (doc == NULL) { ++ testErrorHandler(NULL, "%s : failed to parse\n", filename); ++ return(-1); ++ } ++ ++ /* ++ * Run xmlXIncludeProcess() with a structured error handler to check that ++ * the parse flags are propagated. ++ */ ++ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); ++ xmlXIncludeProcess(doc); ++ xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); ++ ++ /* Check the result and for any errors */ ++ if (result) { ++ xmlDocDumpMemory(doc, &base, &size); ++ res = compareFileMem(result, (char *) base, size); ++ xmlFree(base); ++ if (res != 0) { ++ fprintf(stderr, "Result for %s failed in %s\n", filename, result); ++ ret = -1; ++ } ++ } ++ ++ if ((ret == 0) && (err != NULL)) { ++ res = compareFileMem(err, testErrors, testErrorsSize); ++ if (res != 0) { ++ fprintf(stderr, "Error for %s failed\n", filename); ++ ret = -1; ++ } ++ } ++ ++ xmlFreeDoc(doc); ++ return(ret); ++} ++#endif ++ + /** + * errParseTest: + * @filename: the file to parse +@@ -5134,6 +5203,12 @@ testDesc testDescriptions[] = { + { "XInclude regression tests without reader", + errParseTest, "./test/XInclude/without-reader/*", "result/XInclude/", "", + ".err", XML_PARSE_XINCLUDE }, ++ { "XInclude issue1120 regression tests", ++ errParseTest, "./test/XInclude/issue1120/*", "result/XInclude/", "", ++ ".err", XML_PARSE_XINCLUDE | XML_PARSE_NONET }, ++ { "XInclude xmlXIncludeProcess() issue1120 regression tests", ++ xincludeProcessTest, "./test/XInclude/issue1120/*", "result/XInclude/", ++ "", ".err", XML_PARSE_NONET }, + #endif + #ifdef LIBXML_XPATH_ENABLED + #ifdef LIBXML_DEBUG_ENABLED +diff --git a/test/XInclude/issue1120/issue1120-1.xml b/test/XInclude/issue1120/issue1120-1.xml +new file mode 100644 +index 00000000..b0b8feef +--- /dev/null ++++ b/test/XInclude/issue1120/issue1120-1.xml +@@ -0,0 +1,6 @@ ++ ++ ++ ++ Network access is not allowed ++ ++ +diff --git a/test/XInclude/issue1120/issue1120-2.xml b/test/XInclude/issue1120/issue1120-2.xml +new file mode 100644 +index 00000000..b4c9fe5e +--- /dev/null ++++ b/test/XInclude/issue1120/issue1120-2.xml +@@ -0,0 +1,6 @@ ++ ++ ++ ++

Network access is not allowed

 ++ ++ +diff --git a/xinclude.c b/xinclude.c +index b6581558..0d57f5a1 100644 +--- a/xinclude.c ++++ b/xinclude.c +@@ -1688,6 +1688,11 @@ xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url, + * Load it. + */ + pctxt = xmlNewParserCtxt(); ++ if (pctxt == NULL) { ++ xmlXIncludeErrMemory(ctxt, ref->elem, NULL); ++ goto error; ++ } ++ xmlCtxtUseOptions(pctxt, ctxt->parseFlags); + inputStream = xmlLoadExternalEntity((const char*)URL, NULL, pctxt); + if(inputStream == NULL) + goto error; +@@ -2416,7 +2421,7 @@ xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) { + */ + int + xmlXIncludeProcess(xmlDocPtr doc) { +- return(xmlXIncludeProcessFlags(doc, 0)); ++ return(xmlXIncludeProcessFlags(doc, doc ? doc->parseFlags : 0)); + } + + /** +@@ -2461,7 +2466,7 @@ xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) { + */ + int + xmlXIncludeProcessTree(xmlNodePtr tree) { +- return(xmlXIncludeProcessTreeFlags(tree, 0)); ++ return(xmlXIncludeProcessTreeFlags(tree, (tree && tree->doc) ? tree->doc->parseFlags : 0)); + } + + /** diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb index 1363beba7a5..5e4cabbf5d9 100644 --- a/meta/recipes-core/libxml/libxml2_2.12.10.bb +++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb @@ -38,6 +38,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-86141.patch \ file://CVE-2026-86142.patch \ file://CVE-2026-86143.patch \ + file://CVE-2026-86144.patch \ " SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995" From patchwork Thu Oct 15 05:02:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100766 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46943CCA460 for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32825.1792040633812814912 for ; Wed, 14 Oct 2026 22:03:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=fo+4k98s; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4a02667ccebso34994915e9.0 for ; Wed, 14 Oct 2026 22:03:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040632; x=1792645432; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KymkPiEtd6Nu97UFpAiZ9rssq5aRW4WudneBSOAbko0=; b=fo+4k98s/tx2GoxQSoRtiqv/LGvrbUfh8B/+jsIe5KXxlAp+dB+ijpGwY3w6JPOt2C 2Hh5yHrPjQ03JCVF0T9zxNWMxPxaPaI+8ag7klR2Qu//srsA+wUeJ7eJ0HgCoNd1NTHl xIH6ZNStYkAUwEZTtTOr3gwSvYKC68uoKxD+A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040632; x=1792645432; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KymkPiEtd6Nu97UFpAiZ9rssq5aRW4WudneBSOAbko0=; b=VQim3b+n3wbwoeo+LWihbskVieN1TB8w13k9GKDF2tj8LLbdeluRulFMRaEt7rYN3X CZAY7vp/O/egWPo7nLHmvChMhk/7+8hW6SN27w/qnLpfVWjJvhJgUaUoaNHui72gJ9ks qrY6ymnG/oiawE6yr8fG4N5TsaHrBxSRKJeKX7I6TZvwiSvlki6kAxVGh596efNcZ+oA 0C0v/SYjoYRmA5zrpOQB0mRNA/aT2ehlTyF6LpWG6L5Tc55nFA+OIHnJwjHhFgMkfQI3 4McNyeK19FWbiG5CzZVS9aonz51dtiDjgPuo27AgIui7hdUwr/rIB3qw+hrTkHg3RVXi tXXw== X-Gm-Message-State: AFq9FYLmK21lIVVpqiSEM6qdvWb3J1mEphs3jI8kfA1mwIJSlkUdfXM8 ynjwFhww0YbhDmVGYk4SnaweoCzlKvEYCGmNDjIASPcaUFpdCUwz+uTwdZXvoDsUW+nUwJTB19e ofWDw+EU= X-Gm-Gg: AYBFou00A9Lthphqvkbz8zhOWGmu5MHgjCGDKMQk58zxkmrCwkyNFjXrKlzNkNsIttx lcKb/UxXbGLT/TQfyTOl95ku7BtXnQCEtmzCMd0BxuzNnsYse4ukn8LNRU/sRRAOrVTuNXyTpjA TRNC++DI1pyxiLcAzu/tuV32cqG6Mq7Sjxi9fn/q6CKDeDkX4ZrspnGCfVUWZjj03FX/7BvYgwD 6nEFeqwTN44fZIYUp6Q/AQwUEtCOBPv+CRQHBES3F8prEygqwualrlngADmG+u1VG9rvu0v6tuE mdQM7PaqkC350KtAAD9Gi8ljngQ4iq76p09yrib2KR++K7mq9/w6NiOFdOcMv1pokOsiR5FJp7h BsU/X4hdJWCxWQKkQBROdXVi1atJzvkJ+Ej9124l02q+zTYYUQR2eAkVXDyhl/XZofaGGF4Rwzc b2sQMSJluL4qM0jrj0McsApPRoYG/rB3uUZKNhpxsmJJUYgF+lPt1tompWW1PRrSh2ui2lgSmi0 jFkLxZ7T58PTKoEv9BT+NCbR1MeKzEVwAEsbUQk3NOTcdjqvO2OgVQVcV9xaTtkp8sVOLt99g== X-Received: by 2002:a05:600c:6388:b0:4a1:ac66:5ffe with SMTP id 5b1f17b1804b1-4a1ac666396mr145350855e9.15.1792040631846; Wed, 14 Oct 2026 22:03:51 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:51 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 22/55] libsolv: patch CVE-2026-48863 Date: Thu, 15 Oct 2026 07:02:45 +0200 Message-ID: <28c807ab8de3d274b04c2dffb271e050fb8270cd.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247820 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-48863 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../libsolv/libsolv/CVE-2026-48863.patch | 25 +++++++++++++++++++ .../libsolv/libsolv_0.7.28.bb | 1 + 2 files changed, 26 insertions(+) create mode 100644 meta/recipes-extended/libsolv/libsolv/CVE-2026-48863.patch diff --git a/meta/recipes-extended/libsolv/libsolv/CVE-2026-48863.patch b/meta/recipes-extended/libsolv/libsolv/CVE-2026-48863.patch new file mode 100644 index 00000000000..131d035b408 --- /dev/null +++ b/meta/recipes-extended/libsolv/libsolv/CVE-2026-48863.patch @@ -0,0 +1,25 @@ +From 44f8c085045b1f771641091bbb2b810d12cff9e8 Mon Sep 17 00:00:00 2001 +From: Michael Schroeder +Date: Tue, 26 May 2026 10:30:31 +0200 +Subject: [PATCH] Fix wrong variable being used in solv_pgpvrfy + +CVE: CVE-2026-48863 +Upstream-Status: Backport [https://github.com/openSUSE/libsolv/commit/44f8c085045b1f771641091bbb2b810d12cff9e8] +Signed-off-by: Peter Marko +--- + ext/solv_pgpvrfy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ext/solv_pgpvrfy.c b/ext/solv_pgpvrfy.c +index 9f1bd72e..9358558b 100644 +--- a/ext/solv_pgpvrfy.c ++++ b/ext/solv_pgpvrfy.c +@@ -589,7 +589,7 @@ solv_pgpvrfy(const unsigned char *pub, int publ, const unsigned char *sig, int s + if (rlen) + memcpy(sigdata + 32 - rlen, r, rlen); + if (slen) +- memcpy(sigdata + 64 - slen, s, rlen); ++ memcpy(sigdata + 64 - slen, s, slen); + res = mped25519(pub + 1 + 10 + 2 + 1, sigdata, sig + 2, hashl); + break; + } diff --git a/meta/recipes-extended/libsolv/libsolv_0.7.28.bb b/meta/recipes-extended/libsolv/libsolv_0.7.28.bb index 4ad8a20e2f4..827b6210a69 100644 --- a/meta/recipes-extended/libsolv/libsolv_0.7.28.bb +++ b/meta/recipes-extended/libsolv/libsolv_0.7.28.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/openSUSE/libsolv.git;branch=master;protocol=https \ file://0001-utils-Conside-musl-when-wrapping-qsort_r.patch \ file://CVE-2026-9150.patch \ file://CVE-2026-9149.patch \ + file://CVE-2026-48863.patch \ " SRCREV = "c8dbb3a77c86600ce09d4f80a504cf4e78a3c359" From patchwork Thu Oct 15 05:02:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100769 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A6D6CCA464 for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32826.1792040635964445779 for ; Wed, 14 Oct 2026 22:03:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Y0/MYFIS; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a020e65269so31226105e9.2 for ; Wed, 14 Oct 2026 22:03:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040634; x=1792645434; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5gG7Et9uPnCeX6lRaluTF0fSQ7mKVwIZFeuZCKBQaOM=; b=Y0/MYFIScIHbVy8A3AmC8ApjO5g6RE9ClVWDcmKG10NeNKUmd6GO6s/4U6fjGOhUAH rdE6XK4ZRR+WsyHK+bla4e6XbEJUKw2tvJ3cXls1XBLPrD8rcc0DfQ9FhFFfUsVs1i6H ue8n93IHTB9RWPZrCdEFui5L3vj1EvNlrQ9LQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040634; x=1792645434; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5gG7Et9uPnCeX6lRaluTF0fSQ7mKVwIZFeuZCKBQaOM=; b=uJfRkBMFlqMlLdXVYbiiHQ8XDvJkXFMqpJ/XvHgrZy9oGWbODLBHjx2DJq19XRA4tQ HAkjfxAgLm23J2p+IDDd4xUOKAV2fpmqmPofUgROMLe1au4pl0ookyGuqnFKf2k+DDdG PDGcuQ9dJZ8BRkk3XljW6xxcrm83K668wNWxhFD9FMKdyla4Evt/CglISLHe/iXpnNxN rpuK5YpPglo+L6CfrnOljFWmTISH0cWtoJe5xqwrljFMiQX5y/cKd6E6QQg08bEcg/+q dzkGwZLK+H8NMbi2RRTNAFteFDHRkKwmoqwbbw8o9xd72A88e+whp6ELunWwXOjG4zeW 1swg== X-Gm-Message-State: AFq9FYIEFbBRENSq0jKByPEULcbuYo60AaFAJkUg5Dc9qiNj8H6omK/T h+sYE4NHTqkdmwOMCtDQY8qw30xAmQnccPzrSrVnEsSDjtLsJtw+kgNsqZZXxaP7u4VpRAKQnic qNMoviTg= X-Gm-Gg: AYBFou0rTm0GG077+ms7kTNohwf1k8+qJSHvlCioNJTEvUHOa0a8hhExKG6giLwoJJw 7Di+/TMPqxCAhOMtzLjD18FGqYNud19+6FFnlQZTMGgI44BD1OUag5APjB/piDsy7KacNzlawQV /nv58G044W6r79GNANhqsVe0ty/RO96USGwTAo6WLVciGegTBaYF/tXAK4OiF7BkYm7/3lMhOuz cG1KIVaBLPP28BKJMxJllISNP6JJ+Puv4G5+TCYs35f/zCT+ZS3aqB1ZZwcoDd+7lPp1ExbBvdQ 73IJ5VxO05PUesv4Rm6Xg7gLc+prujS0VhrTz950mm0Ak0IAnhfJZVZDCCoVaJgn/wvqBo+vkar drPVyz7TyvZ2oVGJTAX3G+G0s5oRflR3uJ5pyBO0Xofr3jxO+AemvCSMaP3732+QtW673R5X4eg kM0H8GS3Y9E4nC2nSrenQ783YlggAhpMFF1y//IoGNKzYgR7UPvkmZDbSCsGV6nxSaO9U08Jzw7 GCNwrankSm9G9uLN8lCu6h/4d2yr8xjbsUgksqlPCj5Yskow5Z1W+2K+fKK+DGLb2iukiXxzQ== X-Received: by 2002:a05:600c:e549:20b0:4a1:96cd:2f6d with SMTP id 5b1f17b1804b1-4a196cd3280mr188826185e9.1.1792040632442; Wed, 14 Oct 2026 22:03:52 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:52 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 23/55] expat: patch CVE-2026-66046 and CVE-2026-76641 Date: Thu, 15 Oct 2026 07:02:46 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247821 From: Peter Marko Pick patches per [1] and [2]. (fix for CVE-2026-66046 introduces CVE-2026-76641) [1] https://security-tracker.debian.org/tracker/CVE-2026-66046 [2] https://security-tracker.debian.org/tracker/CVE-2026-76641 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed CVE: tags in CVE-2026-66046-{01,02}.patch ] --- .../expat/expat/CVE-2026-66046-01.patch | 107 ++++++++++++ .../expat/expat/CVE-2026-66046-02.patch | 90 ++++++++++ .../expat/expat/CVE-2026-76641.patch | 160 ++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 3 + 4 files changed, 360 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-66046-01.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-66046-02.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76641.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-66046-01.patch b/meta/recipes-core/expat/expat/CVE-2026-66046-01.patch new file mode 100644 index 00000000000..e7b3d467899 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-66046-01.patch @@ -0,0 +1,107 @@ +From 98f5acc146af76859cd7c345c0906e9e9e8ea656 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Thu, 13 Aug 2026 15:47:24 +0200 +Subject: [PATCH] lib: Rename hash table `defaultAttsNames` to + `defaultAttForName` + +It was previously used as a "set". This prepares for the upcoming +change to a true "dictionary". + +CVE: CVE-2026-66046 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/98f5acc146af76859cd7c345c0906e9e9e8ea656] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index e5242480..239dc6de 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -394,7 +394,7 @@ typedef struct { + size_t nDefaultAtts; + size_t allocDefaultAtts; + DEFAULT_ATTRIBUTE *defaultAtts; +- HASH_TABLE defaultAttsNames; ++ HASH_TABLE defaultAttForName; + } ELEMENT_TYPE; + + typedef struct { +@@ -3837,8 +3837,8 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + sizeof(ELEMENT_TYPE)); + if (! elementType) + return XML_ERROR_NO_MEMORY; +- if (! elementType->defaultAttsNames.parser) +- hashTableInit(&(elementType->defaultAttsNames), parser); ++ if (! elementType->defaultAttForName.parser) ++ hashTableInit(&(elementType->defaultAttForName), parser); + if (parser->m_ns && ! setElementTypePrefix(parser, elementType)) + return XML_ERROR_NO_MEMORY; + } +@@ -7239,7 +7239,7 @@ defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata, + /* The handling of default attributes gets messed up if we have + a default which duplicates a non-default. */ + NAMED *const nameFound +- = lookup(parser, &(type->defaultAttsNames), attId->name, 0); ++ = lookup(parser, &(type->defaultAttForName), attId->name, 0); + if (nameFound) + return 1; + if (isId && ! type->idAtt && ! attId->xmlns) +@@ -7276,7 +7276,7 @@ defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata, + attId->maybeTokenized = XML_TRUE; + + NAMED *const nameAddedOrFound +- = lookup(parser, &(type->defaultAttsNames), attId->name, sizeof(NAMED)); ++ = lookup(parser, &(type->defaultAttForName), attId->name, sizeof(NAMED)); + if (! nameAddedOrFound) + return 0; + +@@ -7597,7 +7597,7 @@ dtdReset(DTD *p, XML_Parser parser) { + ELEMENT_TYPE *e = (ELEMENT_TYPE *)hashTableIterNext(&iter); + if (! e) + break; +- hashTableDestroy(&(e->defaultAttsNames)); ++ hashTableDestroy(&(e->defaultAttForName)); + FREE(parser, e->defaultAtts); + } + hashTableClear(&(p->generalEntities)); +@@ -7639,7 +7639,7 @@ dtdDestroy(DTD *p, XML_Bool isDocEntity, XML_Parser parser) { + ELEMENT_TYPE *e = (ELEMENT_TYPE *)hashTableIterNext(&iter); + if (! e) + break; +- hashTableDestroy(&(e->defaultAttsNames)); ++ hashTableDestroy(&(e->defaultAttForName)); + FREE(parser, e->defaultAtts); + } + hashTableDestroy(&(p->generalEntities)); +@@ -7732,8 +7732,8 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd, + if (! newE) + return 0; + +- if (! newE->defaultAttsNames.parser) +- hashTableInit(&(newE->defaultAttsNames), parser); ++ if (! newE->defaultAttForName.parser) ++ hashTableInit(&(newE->defaultAttForName), parser); + + if (oldE->nDefaultAtts) { + /* Detect and prevent integer overflow. */ +@@ -7766,7 +7766,7 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd, + } else + newE->defaultAtts[i].value = NULL; + +- NAMED *const nameAddedOrFound = lookup(parser, &(newE->defaultAttsNames), ++ NAMED *const nameAddedOrFound = lookup(parser, &(newE->defaultAttForName), + attributeName, sizeof(NAMED)); + if (! nameAddedOrFound) { + return 0; +@@ -8535,8 +8535,8 @@ getElementType(XML_Parser parser, const ENCODING *enc, const char *ptr, + sizeof(ELEMENT_TYPE)); + if (! ret) + return NULL; +- if (! ret->defaultAttsNames.parser) +- hashTableInit(&(ret->defaultAttsNames), getRootParserOf(parser, NULL)); ++ if (! ret->defaultAttForName.parser) ++ hashTableInit(&(ret->defaultAttForName), getRootParserOf(parser, NULL)); + if (ret->name != name) + poolDiscard(&dtd->pool); + else { diff --git a/meta/recipes-core/expat/expat/CVE-2026-66046-02.patch b/meta/recipes-core/expat/expat/CVE-2026-66046-02.patch new file mode 100644 index 00000000000..90e10514b50 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-66046-02.patch @@ -0,0 +1,90 @@ +From f8f7c4ffd883e3c2c58f0ebb49416a6c1d248738 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Thu, 13 Aug 2026 16:39:35 +0200 +Subject: [PATCH] lib: Migrate .isCdata lookup from a linear loop to a hash + table lookup + +.. to resolve quadratic runtime + +CVE: CVE-2026-66046 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/f8f7c4ffd883e3c2c58f0ebb49416a6c1d248738] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 48 ++++++++++++++++++++++++++++++++++++++++-------- + 1 file changed, 40 insertions(+), 8 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 239dc6de..1cd20125 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -381,6 +381,22 @@ typedef struct { + const XML_Char *value; + } DEFAULT_ATTRIBUTE; + ++// This structure allows mapping attribute names to instances of ++// `DEFAULT_ATTRIBUTE`. ++typedef struct { ++ // Member `name` goes first to make this structure compatible with structure ++ // `NAMED` (further up), which is needed to support use of structure ++ // `NAME_AND_DEFAULT_ATTRIBUTE` in a hash table as implemented by function ++ // `lookup` (further down). ++ const XML_Char *name; ++ // We would store a `DEFAULT_ATTRIBUTE *` here but the backing array ++ // can be reallocated which would invalidate the pointer. Using an index ++ // into the array instead, avoids that problem. ++ size_t attIndex; ++ // This is set to `false` by function `lookup`. ++ bool initialized; ++} NAME_AND_DEFAULT_ATTRIBUTE; ++ + typedef struct { + unsigned long version; + unsigned long hash; +@@ -3951,11 +3967,14 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr, + + /* figure out whether declared as other than CDATA */ + if (attId->maybeTokenized) { +- for (size_t j = 0; j < nDefaultAtts; j++) { +- if (attId == elementType->defaultAtts[j].id) { +- isCdata = elementType->defaultAtts[j].isCdata; +- break; +- } ++ NAME_AND_DEFAULT_ATTRIBUTE *const nameAndDefaultAttribute ++ = (NAME_AND_DEFAULT_ATTRIBUTE *)lookup( ++ parser, &(elementType->defaultAttForName), attId->name, 0); ++ if (nameAndDefaultAttribute != NULL) { ++ assert(nameAndDefaultAttribute->attIndex < elementType->nDefaultAtts); ++ const DEFAULT_ATTRIBUTE *const att ++ = elementType->defaultAtts + nameAndDefaultAttribute->attIndex; ++ isCdata = att->isCdata; + } + } + +@@ -7275,11 +7294,24 @@ defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata, + if (! isCdata) + attId->maybeTokenized = XML_TRUE; + +- NAMED *const nameAddedOrFound +- = lookup(parser, &(type->defaultAttForName), attId->name, sizeof(NAMED)); +- if (! nameAddedOrFound) ++ NAME_AND_DEFAULT_ATTRIBUTE *const nameAndDefaultAttribute ++ = (NAME_AND_DEFAULT_ATTRIBUTE *)lookup( ++ parser, &(type->defaultAttForName), attId->name, ++ sizeof(NAME_AND_DEFAULT_ATTRIBUTE)); ++ if (! nameAndDefaultAttribute) + return 0; + ++ assert(nameAndDefaultAttribute->name == attId->name); ++ ++ // NOTE: The XML 1.0r4 spec says: ++ // "When more than one definition is provided for the same attribute of a ++ // given element type, the first declaration is binding and later ++ // declarations are ignored." ++ if (! nameAndDefaultAttribute->initialized) { ++ nameAndDefaultAttribute->attIndex = type->nDefaultAtts; ++ nameAndDefaultAttribute->initialized = true; ++ } ++ + type->nDefaultAtts += 1; + return 1; + } diff --git a/meta/recipes-core/expat/expat/CVE-2026-76641.patch b/meta/recipes-core/expat/expat/CVE-2026-76641.patch new file mode 100644 index 00000000000..26fa5704a6e --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-76641.patch @@ -0,0 +1,160 @@ +From 98599f6dcc2b460410881fe420f5f55d6bec63bf Mon Sep 17 00:00:00 2001 +From: Zeyou Liu +Date: Thu, 20 Aug 2026 20:29:56 +0800 +Subject: [PATCH] lib: Fix out-of-bounds read from hash table entries created + by dtdCopy + +Commit f8f7c4ff grew the entries of ELEMENT_TYPE member +.defaultAttForName from structure NAMED to the larger structure +NAME_AND_DEFAULT_ATTRIBUTE and adjusted function defineAttribute +accordingly, but function dtdCopy kept creating entries of size +sizeof(NAMED). Because function lookup allocates exactly createSize +bytes, function storeAtts reads member .attIndex past the end of those +entries whenever attributes are parsed by a parser that was created by +XML_ExternalEntityParserCreate. + +That out-of-bounds value is then used as an index into member +.defaultAtts, so the effects range from silently not normalizing +whitespace in attributes that are not of type CDATA, to dereferencing a +wild pointer: a release build of master segfaults in function storeAtts +on the document used by the new test. A zero-filled heap happens to +yield index 0, which is why the existing tests did not catch this. + +Member .attIndex is now stored the way function defineAttribute stores +it, i.e. keeping the index of the first declaration, so that a copied +DTD resolves attributes exactly like the DTD that it was copied from. + +This was found while backporting the fix for CVE-2026-66046 onto Expat +2.6.4 for the OpenCloudOS Stream distribution. Only master is affected, +no released version of Expat contains commit f8f7c4ff. + +CVE: CVE-2026-76641 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 17 +++++++-- + tests/basic_tests.c | 74 +++++++++++++++++++++++++++++++++++++++ + 2 files changed, 88 insertions(+), 3 deletions(-) + +diff --git a/lib/xmlparse.c b/expat/lib/xmlparse.c +index 10592ac3..e72c4570 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -7800,11 +7800,22 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd, + } else + newE->defaultAtts[i].value = NULL; + +- NAMED *const nameAddedOrFound = lookup(parser, &(newE->defaultAttForName), +- attributeName, sizeof(NAMED)); +- if (! nameAddedOrFound) { ++ NAME_AND_DEFAULT_ATTRIBUTE *const nameAndDefaultAttribute ++ = (NAME_AND_DEFAULT_ATTRIBUTE *)lookup( ++ parser, &(newE->defaultAttForName), attributeName, ++ sizeof(NAME_AND_DEFAULT_ATTRIBUTE)); ++ if (! nameAndDefaultAttribute) { + return 0; + } ++ ++ // NOTE: The XML 1.0r4 spec says: ++ // "When more than one definition is provided for the same attribute of a ++ // given element type, the first declaration is binding and later ++ // declarations are ignored." ++ if (! nameAndDefaultAttribute->initialized) { ++ nameAndDefaultAttribute->attIndex = i; ++ nameAndDefaultAttribute->initialized = true; ++ } + } + } + +diff --git a/tests/basic_tests.c b/expat/tests/basic_tests.c +index 308adf6c..6c2d3280 100644 +--- a/tests/basic_tests.c ++++ b/tests/basic_tests.c +@@ -2809,6 +2809,79 @@ START_TEST(test_duplicate_id_attribute_multiple_attlistdecl) { + } + END_TEST + ++static void XMLCALL ++check_second_attr_normalization(void *userData, const XML_Char *name, ++ const XML_Char **atts) { ++ int *const seen_second = userData; ++ UNUSED_P(name); ++ ++ for (size_t i = 0; atts[i] != NULL; i += 2) { ++ const XML_Char *const key = atts[i]; ++ const XML_Char *const value = atts[i + 1]; ++ if (xcstrcmp(key, XCS("second")) != 0) ++ continue; ++ *seen_second = 1; ++ /* Attribute "second" is not of type CDATA, so leading, trailing and ++ * repeated whitespace is to be normalized away. */ ++ if (xcstrcmp(value, XCS("a b")) != 0) ++ fail("Attribute of non-CDATA type was not whitespace-normalized"); ++ } ++} ++ ++static int XMLCALL ++external_entity_attr_checker(XML_Parser parser, const XML_Char *context, ++ const XML_Char *base, const XML_Char *systemId, ++ const XML_Char *publicId) { ++ const char *const text = ""; ++ UNUSED_P(base); ++ UNUSED_P(systemId); ++ UNUSED_P(publicId); ++ ++ XML_Parser ext_parser = XML_ExternalEntityParserCreate(parser, context, NULL); ++ if (ext_parser == NULL) ++ fail("Could not create external entity parser"); ++ ++ if (_XML_Parse_SINGLE_BYTES(ext_parser, text, (int)strlen(text), XML_TRUE) ++ != XML_STATUS_OK) ++ xml_failure(ext_parser); ++ ++ XML_ParserFree(ext_parser); ++ return XML_STATUS_OK; ++} ++ ++START_TEST(test_default_attr_index_after_dtd_copy) { ++ /* Function storeAtts resolves member .attIndex of structure ++ * NAME_AND_DEFAULT_ATTRIBUTE to tell whether an attribute value needs ++ * whitespace normalization, so function dtdCopy needs to carry that index ++ * over to the copy. Attribute "first" is declared before attribute ++ * "second" so that a mixed-up index resolves to the wrong declaration. ++ */ ++ const char *text = "\n" ++ " \n" ++ " \n" ++ " \n" ++ " \n" ++ "]>\n" ++ "&e;\n"; ++ int seen_second = 0; ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ assert_true(parser != NULL); ++ XML_SetUserData(parser, &seen_second); ++ XML_SetExternalEntityRefHandler(parser, external_entity_attr_checker); ++ XML_SetStartElementHandler(parser, check_second_attr_normalization); ++ ++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE) ++ != XML_STATUS_OK) ++ xml_failure(parser); ++ if (! seen_second) ++ fail("Attribute \"second\" has not been reported"); ++ ++ XML_ParserFree(parser); ++} ++END_TEST ++ + /* Test reset works correctly in the middle of processing an internal + * entity. Exercises some obscure code in XML_ParserReset(). + */ +@@ -6737,6 +6810,7 @@ make_basic_test_case(Suite *s) { + tcase_add_test(tc_basic, + test_duplicate_cdata_attribute_multiple_attlistdecl_3); + tcase_add_test(tc_basic, test_duplicate_id_attribute_multiple_attlistdecl); ++ tcase_add_test__if_xml_ge(tc_basic, test_default_attr_index_after_dtd_copy); + tcase_add_test__if_xml_ge(tc_basic, test_reset_in_entity); + tcase_add_test(tc_basic, test_resume_invalid_parse); + tcase_add_test(tc_basic, test_resume_resuspended); diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 79e8c15227a..5d30a844fa0 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -10,6 +10,9 @@ VERSION_TAG = "${@d.getVar('PV').replace('.', '_')}" SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://run-ptest \ + file://CVE-2026-66046-01.patch \ + file://CVE-2026-66046-02.patch \ + file://CVE-2026-76641.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Thu Oct 15 05:02:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100757 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95D61CC6B35 for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32441.1792040636262941806 for ; Wed, 14 Oct 2026 22:03:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=JAw3/y2M; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a1af482519so20313095e9.1 for ; Wed, 14 Oct 2026 22:03:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040634; x=1792645434; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Nh7UOtNWe5PyzALQ/UflpgcpJ7Ps7/WRN8jlHbzohwI=; b=JAw3/y2Mm/Qz6Uny2bA633WnoLSLvA4EKbyTFb1d8t8kqxpmznXx0NSii1rZ+C6xoR U6zxuqYiFYmoO1AOobhsknwUsICduRpb3CqaF94P+cQl0Y29tZIsSJ1goRCiGkswp3sq iNad6lTkBzmdDhF4ncQikgue0A5V/FC0Z74wk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040634; x=1792645434; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Nh7UOtNWe5PyzALQ/UflpgcpJ7Ps7/WRN8jlHbzohwI=; b=RxJGgdH/37eQ0bBBacal2kjKaS2RdIN7wk+z5+tElMVQn7D5d9sLoOHg68EYDmURDx Mfe+BaU/hhAVTFVE9qrEx8+YelTH8/wCjLcRQNBDpmcX18nLnNs6jxuFdpfAWVhYqszy tWNqiXzgEBKFJjMuSWaqD2F1sJSBN7fNSpxgDFR0l/GJdkUowFeMMAGu2hUMGmrs3D7x Qvoi+LDUiIz7NZY20qiEdc0ZaTa2q5zga5/7x3RHANHXY4Ga/eS/20YubVYlgK/Nb9nG jxludXnPEeV5PC0SjXfs7Gt0S4lzn4s3s87sx/FDEUxOhM18ltSzc9nNV3rXxVi+LtHc APkA== X-Gm-Message-State: AFq9FYJmAZ0nxNfi5DseVBMvJOkjDJssoCm7Vij9WcjjoWZEGlZHQz15 gvcu/HQskIXIi7ikk0939mtchio25AnrCmiIf2qRtXvid6/CrABzohfvnZ+7vGnKf8B5q9Kvqbb at+nnyA4= X-Gm-Gg: AYBFou2l2BXW5ue6Hm+/IcxbOLs14A862xkVsT3Gjgi4MJ3UON+bg4ezemQ5kGRUZVJ y4DdcXxtknGcxjwvHFjnP9GefWP4INv0Vhu+VhcJdcoikyu9o173KwEDAWFL602XWM3M/+oAImW toRodEy9kKuZl4e99H1wDDTw1eQZppZPsJAHUTJja2IfP080KPQnUI0mZU52qRMJcqA4MWpr5fo SGsfQP0FvUFMFC65LwYmp1sGsMUWTa9X2IiAVvIL/8RcRll+TeZ4QAi5Xhqc6ddkgB228Ariiv/ gCEOttcj6+6Efm+wME9u0jezu8Vpe21uHsGejvjffJqyNEMYw0dQdDOelhk2jHbEkNyL+YkafCJ h+vBGEkogiC9bIOzQQrMKkSwZdUvA5cC4tiroOUzTln5CZHB3+LX+BqpX6Gl1fiUwW5h9AkaqS4 oi0APJbQCHEXwiwbFhrYG3IAxtKGQRIuJs4KBzBsw664/xqQFBHBV06y5WHKZlzipovyH9IxK/I 4WnZGqDP+lv42bH/i38cYjjxwGKxhl3Jx69RPgr6Ms09oqrD3MPqZQ7tWMvkZ5+hwXi64GQdA== X-Received: by 2002:a05:600c:46ca:b0:4a1:7a1e:6910 with SMTP id 5b1f17b1804b1-4a18e48363amr359062665e9.4.1792040634290; Wed, 14 Oct 2026 22:03:54 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:53 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 24/55] expat: patch CVE-2026-76956 Date: Thu, 15 Oct 2026 07:02:47 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247822 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-76956 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../expat/expat/CVE-2026-76956.patch | 26 +++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 1 + 2 files changed, 27 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76956.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-76956.patch b/meta/recipes-core/expat/expat/CVE-2026-76956.patch new file mode 100644 index 00000000000..96d9b68ee7c --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-76956.patch @@ -0,0 +1,26 @@ +From 40daa9996d616e66a75dea41ed2b18f2c3901b9f Mon Sep 17 00:00:00 2001 +From: Sorrachat <32319737+Sorrashut-K@users.noreply.github.com> +Date: Fri, 14 Aug 2026 17:29:50 -0400 +Subject: [PATCH] lib: Fix inverted getentropy() return in + writeRandomBytes_getentropy + +CVE: CVE-2026-76956 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/40daa9996d616e66a75dea41ed2b18f2c3901b9f] +Signed-off-by: Peter Marko +--- + lib/random_getentropy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/random_getentropy.c b/expat/lib/random_getentropy.c +index d258df6a..ad8b1984 100644 +--- a/lib/random_getentropy.c ++++ b/lib/random_getentropy.c +@@ -54,7 +54,7 @@ + bool + writeRandomBytes_getentropy(void *target, size_t count) { + errno = 0; +- const bool success = getentropy(target, count); ++ const bool success = (getentropy(target, count) == 0); + // MSan does not understand `getentropy`, so explain its effects + if (success) + MSAN_UNPOISON(target, count); diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 5d30a844fa0..c3c9f738453 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -13,6 +13,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-66046-01.patch \ file://CVE-2026-66046-02.patch \ file://CVE-2026-76641.patch \ + file://CVE-2026-76956.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Thu Oct 15 05:02:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100760 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF1C2CC6B3A for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32827.1792040636725313565 for ; Wed, 14 Oct 2026 22:03:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=JsbIdl9X; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-49ff680331aso17741665e9.3 for ; Wed, 14 Oct 2026 22:03:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040635; x=1792645435; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=9Bkyt2khnodyEBG7zKiI+Jz44B9lsc08qb0A16lEuSo=; b=JsbIdl9X0PhBSfLvKQF9o09nDiOBdzsa6aklu4G2LMvMJdmnVqX2txEMUQyZp/yDn2 4S8D0oSQP+s9Ub3KjWcGRGN22hCjb3hJP3KomID84P18urUmRcJVfceMxayTuoeo47yD O5q8H+6QsW6WxTyaVyFaaMv58DXGiT2tf2CGo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040635; x=1792645435; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=9Bkyt2khnodyEBG7zKiI+Jz44B9lsc08qb0A16lEuSo=; b=GhrQOZOMht4DWC+2yOkQZfTxy7Q2dbhxrwqVQJvi0qa5pmD4kX2vjf7FU7wpLWeBib gs3Ge5905y/7NTFlKAX4fgfNOGYTjaEsq6Z68HQRmkQrfUwXk3tlMAlkOaAQs6s7U8mT A7iOT8MkgKvd8M9P0p+LDuyCBjgY/mZNW5D2D5HkYa/jsSYw4HSxic5Z317G2iyPKTbo EK7h4nogrl1M83jeu5VL3135En1XIXITIodxHZbK481Or1MXGdH3OcVscSczREscnSMz jpmOagD6JThI+ugRd+e7OsKC5M1ISlYMgXMTInYrE/KSZjDBynQxQ/o9B8J7ryn1VlLJ K7xg== X-Gm-Message-State: AFq9FYJCDdtyLvw7/ZcOGiPJw+yhwj1nnG2sIeJcnjUpOYpug5Z+CHQz b6TrRUpxbjhWQh4ihFknsey8U4D3v2FAxnjS2ST8bF/twJc5jOLqsMbPuSfFDG7FICPbMFnKr+2 tWP+YLa8= X-Gm-Gg: AYBFou0+FpERuiN+ihqXZfldORAzhHzceCg4Kh3N93m9rwFcpgeMfenzxCubzVCRxbm nFLp6DvJEqZH4LgkW0O/xlmpI+2MJB9Gd5NW23/euZ0lOY5kvjHNJVPYTeYVVNdNW4og69R6mgP 9IwXdLg5oQECswcbZDAaNAmghEvtBYcKIbvqo0OH+RUP7yrqkGffOO3tRZYoQM9DUs+BHskLI0e I8zCIjG1ihCOnkxn/ANB5D0T7dJOybci3r9avVP1akvh7TobApYKDtTNboMELSJd3fQB4wbg4eo BJ4n+MCIWCrU7BXqlpDYCrmjSJSxmzt4xDuzJdhBNWkxZmHJgJJjM+IQfoNxM4Wu6dr/poGBDHy UBQb1uVQbIfPhqAaTpeow9b70qxSBrE7z8Ft6wuuh8lZ1B7uzQkQP1PSiOobL1zSsCTRru0ruaf +CuUcs/dBMSLqN5kSSAL5+Lgyh2wonieXG//HG0VuxEpWmwtfAhlMnFdGqf/EAQIVaUqOqlUUIk xNMokGp/ecEPhlKiZN1FaR8d0VYSy1wXkIfUR3dqAg4V93DnWs/G/XBma/pniiA6pJnMj6dBA== X-Received: by 2002:a05:600c:871b:b0:4a1:a2f3:e6f7 with SMTP id 5b1f17b1804b1-4a1a2f3e8a9mr213782175e9.29.1792040634795; Wed, 14 Oct 2026 22:03:54 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:54 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 25/55] expat: patch CVE-2026-76957 Date: Thu, 15 Oct 2026 07:02:48 +0200 Message-ID: <51aa92d8ab453295bc6c6d9c92af12c2baa56c69.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247823 From: Peter Marko Pick patches per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-76957 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../expat/expat/CVE-2026-76957-01.patch | 121 ++++++++++++++++++ .../expat/expat/CVE-2026-76957-02.patch | 85 ++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 2 + 3 files changed, 208 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76957-01.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-76957-02.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-76957-01.patch b/meta/recipes-core/expat/expat/CVE-2026-76957-01.patch new file mode 100644 index 00000000000..fb7a8e0b022 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-76957-01.patch @@ -0,0 +1,121 @@ +From 127b7d4beb8fe7e5ce5cb021c2e56379c95863d0 Mon Sep 17 00:00:00 2001 +From: Darren Carreras +Date: Mon, 17 Aug 2026 21:16:00 -0400 +Subject: [PATCH] Protect custom encoding callbacks from parser reentry + +Co-authored-by: Sebastian Pipping + +CVE: CVE-2026-76957 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/127b7d4beb8fe7e5ce5cb021c2e56379c95863d0] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 49 ++++++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 40 insertions(+), 9 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index e5242480..4f9dcbb6 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -771,6 +771,8 @@ struct XML_ParserStruct { + void *m_unknownEncodingMem; + void *m_unknownEncodingData; + void *m_unknownEncodingHandlerData; ++ // Application callback invoked by callUnknownEncodingConvert. ++ int(XMLCALL *m_unknownEncodingConvert)(void *, const char *); + void(XMLCALL *m_unknownEncodingRelease)(void *); + PROLOG_STATE m_prologState; + Processor *m_processor; +@@ -1193,6 +1195,25 @@ isCalledFromInsideHandler(XML_Parser parser) { + return parser->m_handlerCallDepth > 0; + } + ++static void ++callUnknownEncodingRelease(XML_Parser parser) { ++ beforeHandler(parser); ++ parser->m_unknownEncodingRelease(parser->m_unknownEncodingData); ++ afterHandler(parser); ++ parser->m_unknownEncodingRelease = NULL; ++ parser->m_unknownEncodingData = NULL; ++} ++ ++static int XMLCALL ++callUnknownEncodingConvert(void *data, const char *p) { ++ XML_Parser parser = data; ++ beforeHandler(parser); ++ const int result ++ = parser->m_unknownEncodingConvert(parser->m_unknownEncodingData, p); ++ afterHandler(parser); ++ return result; ++} ++ + static enum XML_Error + callProcessor(XML_Parser parser, const char *start, const char *end, + const char **endPtr) { +@@ -1540,6 +1561,7 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) { + parser->m_inheritedBindings = NULL; + parser->m_nSpecifiedAtts = 0; + parser->m_unknownEncodingMem = NULL; ++ parser->m_unknownEncodingConvert = NULL; + parser->m_unknownEncodingRelease = NULL; + parser->m_unknownEncodingData = NULL; + parser->m_parsingStatus.parsing = XML_INITIALIZED; +@@ -1620,7 +1642,7 @@ XML_ParserReset(XML_Parser parser, const XML_Char *encodingName) { + moveToFreeBindingList(parser, parser->m_inheritedBindings); + FREE(parser, parser->m_unknownEncodingMem); + if (parser->m_unknownEncodingRelease) +- parser->m_unknownEncodingRelease(parser->m_unknownEncodingData); ++ callUnknownEncodingRelease(parser); + poolClear(&parser->m_tempPool); + poolClear(&parser->m_temp2Pool); + FREE(parser, (void *)parser->m_protocolEncodingName); +@@ -1931,7 +1953,7 @@ XML_ParserFree(XML_Parser parser) { + FREE(parser, parser->m_nsAtts); + FREE(parser, parser->m_unknownEncodingMem); + if (parser->m_unknownEncodingRelease) +- parser->m_unknownEncodingRelease(parser->m_unknownEncodingData); ++ callUnknownEncodingRelease(parser); + FREE(parser, parser); + } + +@@ -4965,25 +4987,34 @@ handleUnknownEncoding(XML_Parser parser, const XML_Char *encodingName) { + const int status = parser->m_unknownEncodingHandler( + parser->m_unknownEncodingHandlerData, encodingName, &info); + afterHandler(parser); ++ ++ parser->m_unknownEncodingRelease = info.release; ++ parser->m_unknownEncodingData = info.data; ++ + if (status) { + ENCODING *enc; + parser->m_unknownEncodingMem = MALLOC(parser, XmlSizeOfUnknownEncoding()); + if (! parser->m_unknownEncodingMem) { +- if (info.release) +- info.release(info.data); ++ if (parser->m_unknownEncodingRelease) ++ callUnknownEncodingRelease(parser); ++ else ++ parser->m_unknownEncodingData = NULL; + return XML_ERROR_NO_MEMORY; + } ++ parser->m_unknownEncodingConvert = info.convert; + enc = (parser->m_ns ? XmlInitUnknownEncodingNS : XmlInitUnknownEncoding)( +- parser->m_unknownEncodingMem, info.map, info.convert, info.data); ++ parser->m_unknownEncodingMem, info.map, ++ info.convert ? callUnknownEncodingConvert : NULL, parser); + if (enc) { +- parser->m_unknownEncodingData = info.data; +- parser->m_unknownEncodingRelease = info.release; + parser->m_encoding = enc; + return XML_ERROR_NONE; + } ++ parser->m_unknownEncodingConvert = NULL; + } +- if (info.release != NULL) +- info.release(info.data); ++ if (parser->m_unknownEncodingRelease != NULL) ++ callUnknownEncodingRelease(parser); ++ else ++ parser->m_unknownEncodingData = NULL; + } + return XML_ERROR_UNKNOWN_ENCODING; + } diff --git a/meta/recipes-core/expat/expat/CVE-2026-76957-02.patch b/meta/recipes-core/expat/expat/CVE-2026-76957-02.patch new file mode 100644 index 00000000000..827499958ac --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-76957-02.patch @@ -0,0 +1,85 @@ +From acbd2e1179c04fe9a8c3f3837701904d05de71fc Mon Sep 17 00:00:00 2001 +From: Darren Carreras +Date: Mon, 17 Aug 2026 21:19:12 -0400 +Subject: [PATCH] Test custom encoding callback reentry protection + +CVE: CVE-2026-76957 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/acbd2e1179c04fe9a8c3f3837701904d05de71fc] +Signed-off-by: Peter Marko +--- + tests/misc_tests.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 55 insertions(+) + +diff --git a/tests/misc_tests.c b/tests/misc_tests.c +index 82b4b54b..04538c25 100644 +--- a/tests/misc_tests.c ++++ b/tests/misc_tests.c +@@ -839,6 +839,60 @@ START_TEST(test_misc_resume_parser_forbidden_from_handler) { + } + END_TEST + ++typedef struct { ++ XML_Parser parser; ++ int converterCallCount; ++ int releaseCallCount; ++} EncodingCallbackData; ++ ++static int XMLCALL ++reentrant_encoding_converter(void *userData, const char *s) { ++ EncodingCallbackData *const data = userData; ++ UNUSED_P(s); ++ data->converterCallCount++; ++ forbidden_calls_character_handler(data->parser, NULL, 0); ++ return 'A'; ++} ++ ++static void XMLCALL ++reentrant_encoding_release(void *userData) { ++ EncodingCallbackData *const data = userData; ++ data->releaseCallCount++; ++ forbidden_calls_character_handler(data->parser, NULL, 0); ++} ++ ++static int XMLCALL ++reentrant_encoding_handler(void *userData, const XML_Char *name, ++ XML_Encoding *info) { ++ EncodingCallbackData *const data = userData; ++ UNUSED_P(name); ++ ++ for (int i = 0; i < 256; i++) ++ info->map[i] = i; ++ info->map[0x80] = -2; // Route byte 0x80 through the custom converter. ++ info->data = data; ++ info->convert = reentrant_encoding_converter; ++ info->release = reentrant_encoding_release; ++ return XML_STATUS_OK; ++} ++ ++START_TEST(test_misc_unknown_encoding_callbacks_protected) { ++ const char *const doc ++ = "\x80\x80"; ++ XML_Parser parser = XML_ParserCreate(NULL); ++ EncodingCallbackData data = {parser, 0, 0}; ++ XML_SetUnknownEncodingHandler(parser, reentrant_encoding_handler, &data); ++ ++ assert_true(XML_Parse(parser, doc, (int)strlen(doc), /*isFinal=*/XML_TRUE) ++ == XML_STATUS_OK); ++ assert_true(data.converterCallCount > 0); ++ assert_true(data.releaseCallCount == 0); // Released by XML_ParserFree below. ++ ++ XML_ParserFree(parser); ++ assert_true(data.releaseCallCount == 1); ++} ++END_TEST ++ + // General attack payload idea by Jason Kratzer of Mozilla + START_TEST(test_misc_low_surrogate_mozilla_bug_2053153) { + const char doc_before[] = "<\0!\0D\0O\0C\0T\0Y\0P\0E\0 \0d\0 \0[\0\n\0" +@@ -936,6 +990,7 @@ make_miscellaneous_test_case(Suite *s) { + tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161); + tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers); + tcase_add_test(tc_misc, test_misc_resume_parser_forbidden_from_handler); ++ tcase_add_test(tc_misc, test_misc_unknown_encoding_callbacks_protected); + tcase_add_test(tc_misc, test_misc_input_2gb); + tcase_add_test(tc_misc, test_misc_low_surrogate_mozilla_bug_2053153); + } diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index c3c9f738453..c9a1c9b18e3 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -14,6 +14,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-66046-02.patch \ file://CVE-2026-76641.patch \ file://CVE-2026-76956.patch \ + file://CVE-2026-76957-01.patch \ + file://CVE-2026-76957-02.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Thu Oct 15 05:02:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100762 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC455CC6B3D for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32442.1792040637595890026 for ; Wed, 14 Oct 2026 22:03:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ygHbwU6x; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4a0e1b0681bso34872925e9.3 for ; Wed, 14 Oct 2026 22:03:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040636; x=1792645436; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=IMtUr6QdYy46NyOdO6cO4WIrGcVkzBf4z6Wqq90h8VQ=; b=ygHbwU6xQ+oZIW+amaqIbMFkPi6D7mtht9963PjuE35c4gT4ALyKzWHiLmgnJQDzve z26gBqHqL7CHhEcYPHczZarNuoOJkSU3hASR/Xp78L+3GEnX8szYxYksGb5ZJo3bxNTp C1oY2ljfy9TEsbJeBOf27PySmZ49Tq6kNISAY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040636; x=1792645436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=IMtUr6QdYy46NyOdO6cO4WIrGcVkzBf4z6Wqq90h8VQ=; b=PnwblxyUIFCLqwvMJ6ZC+t3Ni1qz0ceTO8a+IQNYVuMX6S0q2Vg4JlVNTmO9AMBawg K4ubG541+IOVeq7FFSt6W9q6nLuC/iBqX03pgk19NZfo2fRejGv6YTHb4XW/AU/SXnUA y0MglLWul1o5ENwbfpsX005VmbqD/xJW0FVJZdhknL5ys+5304T9On9a6nIjoo4Fvhim yxq0+CSh0a1Ba5Jxik0/Cw4nJxPvkzHhUwVWWy5ZDuWjg/x7MOsF7ZAJl+HfH8t+AuW+ 3F7Dv5ayuoKV3DocqHV+5ykQ4xOHRdfYaJnqH5RXMiIyJoGKlY+2614FAdppBS9lCksZ q1rg== X-Gm-Message-State: AFq9FYI0Et/5TivVcZ2172Q+9ezJf9PWV/ZV4OtashNkT9ABet3+cgwC 3vsApr7JbcH6CPw81h+lBRPdB+7K+OKZTFZAu0XCelsMV3Ufo87ZfrHaEPpDbnpy1yktqWj7sJb tL+Co1gw= X-Gm-Gg: AYBFou0o1AI/KWtXDhmIoHKjEk395lru8XWXE6aDXVMX5/ew2nU7YnI8T9RDUewDrlR NH7RSrFWOdhjwV57OGN71gbenaKhPM9Bgl0e63S9CiUGZqgjcwn/hUtmpA+vniEFqqHrw1yvc3O L3lElEi9xNEWrPzExnNOETZR3eeN5f87aZCK0wVCiA5637W3gwdI0LV0SMkk1uiiDLS47NEyfU0 mEQ3m1IlkriHIoFjiF/81xTMRAFMDHu1ROSl+K2zn0sevJz/vBO2YecoylwmLZeTJ9kPrEFacT3 qHDmCvMuaEM4lel/JFcTB/HthzmsSXjk7lo2FXTRMvdeTRtK2icg6fUDeSQu4XO4wHQRYVfi8on jUJ6JsOs1nAoh+qh5ZMdfyPX8pOxNa8CRwcVC1WJePj2+ZxjGAN2YvQBobq/EN9JU+QVs+bXwYy rfErL9n1zLM30T/PAXpBo7S2IWbqVxRFSSn+eqfmQ+E4AamVm4JM4Qivt2x8Iwp7rsmckfFKzJK SuQ6uToglAM6k5bLw2tpbxdcu1qNpbKeuxNLke4B5yOp6yZnHTGyS3cZbsOO7ma9LfsDQLMKQ== X-Received: by 2002:a05:600c:698d:b0:4a1:97c6:d2b4 with SMTP id 5b1f17b1804b1-4a197c6d614mr283944075e9.15.1792040635393; Wed, 14 Oct 2026 22:03:55 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:54 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 26/55] expat: patch CVE-2026-93990 Date: Thu, 15 Oct 2026 07:02:49 +0200 Message-ID: <150e9f4b4d07607b5f56eaad8e14c2ab99afe8f7.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247824 From: Peter Marko Pick patches per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-93990 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../expat/expat/CVE-2026-93990-01.patch | 191 ++++++++++ .../expat/expat/CVE-2026-93990-02.patch | 328 ++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 2 + 3 files changed, 521 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-93990-01.patch create mode 100644 meta/recipes-core/expat/expat/CVE-2026-93990-02.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-93990-01.patch b/meta/recipes-core/expat/expat/CVE-2026-93990-01.patch new file mode 100644 index 00000000000..fde01b916ad --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-93990-01.patch @@ -0,0 +1,191 @@ +From 0cfd15bdf4b2c22d6b0df73610709dfb60921091 Mon Sep 17 00:00:00 2001 +From: Kartik Kenchi +Date: Tue, 23 Jun 2026 15:51:06 +0530 +Subject: [PATCH] lib: reject UTF-16 high surrogate not followed by a low + surrogate + +CVE: CVE-2026-93990 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/0cfd15bdf4b2c22d6b0df73610709dfb60921091] +Signed-off-by: Peter Marko +--- + lib/xmltok.c | 53 ++++++++++++++++++++++++++++++++++++++++------- + lib/xmltok_impl.c | 4 ---- + 2 files changed, 45 insertions(+), 12 deletions(-) + +diff --git a/lib/xmltok.c b/lib/xmltok.c +index 8abb145e..5f4e78ec 100644 +--- a/lib/xmltok.c ++++ b/lib/xmltok.c +@@ -232,6 +232,19 @@ struct normal_encoding { + /* isNmstrt2 */ NULL, /* isNmstrt3 */ NULL, /* isNmstrt4 */ NULL, \ + /* isInvalid2 */ NULL, /* isInvalid3 */ NULL, /* isInvalid4 */ NULL + ++/* Like NULL_VTABLE but with a real isInvalid4 so the UTF-16 encodings reject a ++ high surrogate that is not followed by a low surrogate. Only needed for the ++ XML_MIN_SIZE build, where the shared tokenizer dispatches through the vtable; ++ the regular build inlines the same check via IS_INVALID_CHAR. */ ++#ifdef XML_MIN_SIZE ++# define UTF16_NULL_VTABLE(E) \ ++ /* isName2 */ NULL, /* isName3 */ NULL, /* isName4 */ NULL, \ ++ /* isNmstrt2 */ NULL, /* isNmstrt3 */ NULL, /* isNmstrt4 */ NULL, \ ++ /* isInvalid2 */ NULL, /* isInvalid3 */ NULL, E##isInvalid4 ++#else ++# define UTF16_NULL_VTABLE(E) NULL_VTABLE ++#endif ++ + static int FASTCALL checkCharRefNumber(int result); + + #include "xmltok_impl.h" +@@ -749,6 +762,11 @@ DEFINE_UTF16_TO_UTF16(big2_) + UCS2_GET_NAMING(namePages, (unsigned char)p[1], (unsigned char)p[0]) + #define LITTLE2_IS_NMSTRT_CHAR_MINBPC(p) \ + UCS2_GET_NAMING(nmstrtPages, (unsigned char)p[1], (unsigned char)p[0]) ++/* A 4-byte UTF-16 character is a surrogate pair; byteType only reports BT_LEAD4 ++ for a high surrogate, so the pair is invalid unless the second unit is a low ++ surrogate (U+DC00..U+DFFF, i.e. high byte 0xDC..0xDF). */ ++#define LITTLE2_IS_INVALID_CHAR(p, n) \ ++ ((n) == 4 && ((unsigned char)(p)[3] & 0xFC) != 0xDC) + + #ifdef XML_MIN_SIZE + +@@ -781,6 +799,12 @@ little2_isNmstrtMin(const ENCODING *enc, const char *p) { + return LITTLE2_IS_NMSTRT_CHAR_MINBPC(p); + } + ++static int ++little2_isInvalid4(const ENCODING *enc, const char *p) { ++ UNUSED_P(enc); ++ return LITTLE2_IS_INVALID_CHAR(p, 4); ++} ++ + # undef VTABLE + # define VTABLE VTABLE1, little2_toUtf8, little2_toUtf16 + +@@ -797,6 +821,7 @@ little2_isNmstrtMin(const ENCODING *enc, const char *p) { + # define IS_NAME_CHAR_MINBPC(enc, p) LITTLE2_IS_NAME_CHAR_MINBPC(p) + # define IS_NMSTRT_CHAR(enc, p, n) (0) + # define IS_NMSTRT_CHAR_MINBPC(enc, p) LITTLE2_IS_NMSTRT_CHAR_MINBPC(p) ++# define IS_INVALID_CHAR(enc, p, n) LITTLE2_IS_INVALID_CHAR(p, n) + + # define XML_TOK_IMPL_C + # include "xmltok_impl.c" +@@ -828,7 +853,7 @@ static const struct normal_encoding little2_encoding_ns + # include "asciitab.h" + # include "latin1tab.h" + }, +- STANDARD_VTABLE(little2_) NULL_VTABLE}; ++ STANDARD_VTABLE(little2_) UTF16_NULL_VTABLE(little2_)}; + + #endif + +@@ -846,7 +871,7 @@ static const struct normal_encoding little2_encoding + #undef BT_COLON + #include "latin1tab.h" + }, +- STANDARD_VTABLE(little2_) NULL_VTABLE}; ++ STANDARD_VTABLE(little2_) UTF16_NULL_VTABLE(little2_)}; + + #if BYTEORDER != 4321 + +@@ -858,7 +883,7 @@ static const struct normal_encoding internal_little2_encoding_ns + # include "iasciitab.h" + # include "latin1tab.h" + }, +- STANDARD_VTABLE(little2_) NULL_VTABLE}; ++ STANDARD_VTABLE(little2_) UTF16_NULL_VTABLE(little2_)}; + + # endif + +@@ -870,7 +895,7 @@ static const struct normal_encoding internal_little2_encoding + # undef BT_COLON + # include "latin1tab.h" + }, +- STANDARD_VTABLE(little2_) NULL_VTABLE}; ++ STANDARD_VTABLE(little2_) UTF16_NULL_VTABLE(little2_)}; + + #endif + +@@ -882,6 +907,11 @@ static const struct normal_encoding internal_little2_encoding + UCS2_GET_NAMING(namePages, (unsigned char)p[0], (unsigned char)p[1]) + #define BIG2_IS_NMSTRT_CHAR_MINBPC(p) \ + UCS2_GET_NAMING(nmstrtPages, (unsigned char)p[0], (unsigned char)p[1]) ++/* A 4-byte UTF-16 character is a surrogate pair; byteType only reports BT_LEAD4 ++ for a high surrogate, so the pair is invalid unless the second unit is a low ++ surrogate (U+DC00..U+DFFF, i.e. high byte 0xDC..0xDF). */ ++#define BIG2_IS_INVALID_CHAR(p, n) \ ++ ((n) == 4 && ((unsigned char)(p)[2] & 0xFC) != 0xDC) + + #ifdef XML_MIN_SIZE + +@@ -914,6 +944,12 @@ big2_isNmstrtMin(const ENCODING *enc, const char *p) { + return BIG2_IS_NMSTRT_CHAR_MINBPC(p); + } + ++static int ++big2_isInvalid4(const ENCODING *enc, const char *p) { ++ UNUSED_P(enc); ++ return BIG2_IS_INVALID_CHAR(p, 4); ++} ++ + # undef VTABLE + # define VTABLE VTABLE1, big2_toUtf8, big2_toUtf16 + +@@ -930,6 +966,7 @@ big2_isNmstrtMin(const ENCODING *enc, const char *p) { + # define IS_NAME_CHAR_MINBPC(enc, p) BIG2_IS_NAME_CHAR_MINBPC(p) + # define IS_NMSTRT_CHAR(enc, p, n) (0) + # define IS_NMSTRT_CHAR_MINBPC(enc, p) BIG2_IS_NMSTRT_CHAR_MINBPC(p) ++# define IS_INVALID_CHAR(enc, p, n) BIG2_IS_INVALID_CHAR(p, n) + + # define XML_TOK_IMPL_C + # include "xmltok_impl.c" +@@ -961,7 +998,7 @@ static const struct normal_encoding big2_encoding_ns + # include "asciitab.h" + # include "latin1tab.h" + }, +- STANDARD_VTABLE(big2_) NULL_VTABLE}; ++ STANDARD_VTABLE(big2_) UTF16_NULL_VTABLE(big2_)}; + + #endif + +@@ -979,7 +1016,7 @@ static const struct normal_encoding big2_encoding + #undef BT_COLON + #include "latin1tab.h" + }, +- STANDARD_VTABLE(big2_) NULL_VTABLE}; ++ STANDARD_VTABLE(big2_) UTF16_NULL_VTABLE(big2_)}; + + #if BYTEORDER != 1234 + +@@ -991,7 +1028,7 @@ static const struct normal_encoding internal_big2_encoding_ns + # include "iasciitab.h" + # include "latin1tab.h" + }, +- STANDARD_VTABLE(big2_) NULL_VTABLE}; ++ STANDARD_VTABLE(big2_) UTF16_NULL_VTABLE(big2_)}; + + # endif + +@@ -1003,7 +1040,7 @@ static const struct normal_encoding internal_big2_encoding + # undef BT_COLON + # include "latin1tab.h" + }, +- STANDARD_VTABLE(big2_) NULL_VTABLE}; ++ STANDARD_VTABLE(big2_) UTF16_NULL_VTABLE(big2_)}; + + #endif + +diff --git a/lib/xmltok_impl.c b/lib/xmltok_impl.c +index b7a9b5eb..3cc9e5ab 100644 +--- a/lib/xmltok_impl.c ++++ b/lib/xmltok_impl.c +@@ -44,10 +44,6 @@ + + #ifdef XML_TOK_IMPL_C + +-# ifndef IS_INVALID_CHAR // i.e. for UTF-16 and XML_MIN_SIZE not defined +-# define IS_INVALID_CHAR(enc, ptr, n) (0) +-# endif +- + # define INVALID_LEAD_CASE(n, ptr, nextTokPtr) \ + case BT_LEAD##n: \ + if (end - ptr < n) \ diff --git a/meta/recipes-core/expat/expat/CVE-2026-93990-02.patch b/meta/recipes-core/expat/expat/CVE-2026-93990-02.patch new file mode 100644 index 00000000000..25e38e39565 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-93990-02.patch @@ -0,0 +1,328 @@ +From 28fcfba540f6933aa8904a1514c4811713d2ab72 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Thu, 17 Sep 2026 15:12:43 +0200 +Subject: [PATCH] tests: Cover UTF-16 decoding of surrogates + +Co-authored-by: Kartik Kenchi + +CVE: CVE-2026-93990 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/28fcfba540f6933aa8904a1514c4811713d2ab72] +Signed-off-by: Peter Marko +--- + tests/basic_tests.c | 296 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 296 insertions(+) + +diff --git a/tests/basic_tests.c b/tests/basic_tests.c +index dd0494ce..92172a27 100644 +--- a/tests/basic_tests.c ++++ b/tests/basic_tests.c +@@ -1845,6 +1845,301 @@ START_TEST(test_utf16_bad_surrogate_pair) { + } + END_TEST + ++// Helper that creates a UTF-16LE copy of UTF-16BE literal input and vice versa ++static char * ++utf16_dup_flipped(const char *text, size_t lenBytes) { ++ assert_true(lenBytes < SIZE_MAX); ++ assert_true(lenBytes % 2 == 0); ++ char *const buffer = malloc(lenBytes + 1); ++ assert_true(buffer != NULL); ++ ++ for (size_t i = 0; i < lenBytes; i++) { ++ // This maps 0 -> 1, 1 -> 0, 2 -> 3, 3 -> 2, 4 -> 5, .. ++ size_t j = i + ((i % 2 == 0) ? +1 : -1); ++ assert_true(j < lenBytes); ++ buffer[j] = text[i]; ++ } ++ ++ buffer[lenBytes] = '\0'; ++ ++ return buffer; ++} ++ ++/* Tests that invalid combinations of surrogates are detected when decoding ++ UTF-16, both little-endian and big-endian. ++ Previously, a high surrogate not followed by a low surrogate slipped ++ through. Without validation the high would consume the next ++ code unit as a fake low, hiding e.g. a following '<' from the ++ tokenizer. */ ++START_TEST(test_utf16_surrogate_pairs) { ++ struct TestCase { ++ const char *idea; ++ const char *content; ++ bool expectedSuccess; ++ }; ++ ++ struct TestCase testCases[] = { ++ // Group {smallest high - 1}{*} ++ {"{smallest high - 1}{smallest high - 1}", ++ "\0<\0a\0>" ++ "\xD7\xFF" ++ "\xD7\xFF" ++ "\0<\0/\0a\0>", ++ true}, ++ {"{smallest high - 1}{smallest high}", ++ "\0<\0a\0>" ++ "\xD7\xFF" ++ "\xD8\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest high - 1}{largest high}", ++ "\0<\0a\0>" ++ "\xD7\xFF" ++ "\xDB\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest high - 1}{smallest low}", ++ "\0<\0a\0>" ++ "\xD7\xFF" ++ "\xDC\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest high - 1}{largest low}", ++ "\0<\0a\0>" ++ "\xD7\xFF" ++ "\xDF\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest high - 1}{largest low + 1}", ++ "\0<\0a\0>" ++ "\xD7\xFF" ++ "\xE0\x00" ++ "\0<\0/\0a\0>", ++ true}, ++ // Group {smallest high}{*} ++ {"{smallest high}{smallest high - 1}", ++ "\0<\0a\0>" ++ "\xD8\x00" ++ "\xD7\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest high}{smallest high}", ++ "\0<\0a\0>" ++ "\xD8\x00" ++ "\xD8\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest high}{largest high}", ++ "\0<\0a\0>" ++ "\xD8\x00" ++ "\xDB\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest high}{smallest low}", ++ "\0<\0a\0>" ++ "\xD8\x00" ++ "\xDC\x00" ++ "\0<\0/\0a\0>", ++ true}, ++ {"{smallest high}{largest low}", ++ "\0<\0a\0>" ++ "\xD8\x00" ++ "\xDF\xFF" ++ "\0<\0/\0a\0>", ++ true}, ++ {"{smallest high}{largest low + 1}", ++ "\0<\0a\0>" ++ "\xD8\x00" ++ "\xE0\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ // Group {largest high}{*} ++ {"{largest high}{smallest high - 1}", ++ "\0<\0a\0>" ++ "\xDB\xFF" ++ "\xD7\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest high}{smallest high}", ++ "\0<\0a\0>" ++ "\xDB\xFF" ++ "\xD8\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest high}{largest high}", ++ "\0<\0a\0>" ++ "\xDB\xFF" ++ "\xDB\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest high}{smallest low}", ++ "\0<\0a\0>" ++ "\xDB\xFF" ++ "\xDC\x00" ++ "\0<\0/\0a\0>", ++ true}, ++ {"{largest high}{largest low}", ++ "\0<\0a\0>" ++ "\xDB\xFF" ++ "\xDF\xFF" ++ "\0<\0/\0a\0>", ++ true}, ++ {"{largest high}{largest low + 1}", ++ "\0<\0a\0>" ++ "\xDB\xFF" ++ "\xE0\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ // Group {smallest low}{*} ++ {"{smallest low}{smallest high - 1}", ++ "\0<\0a\0>" ++ "\xDC\x00" ++ "\xD7\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest low}{smallest high}", ++ "\0<\0a\0>" ++ "\xDC\x00" ++ "\xD8\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest low}{largest high}", ++ "\0<\0a\0>" ++ "\xDC\x00" ++ "\xDB\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest low}{smallest low}", ++ "\0<\0a\0>" ++ "\xDC\x00" ++ "\xDC\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest low}{largest low}", ++ "\0<\0a\0>" ++ "\xDC\x00" ++ "\xDF\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{smallest low}{largest low + 1}", ++ "\0<\0a\0>" ++ "\xDC\x00" ++ "\xE0\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ // Group {largest low}{*} ++ {"{largest low}{smallest high - 1}", ++ "\0<\0a\0>" ++ "\xDF\xFF" ++ "\xD7\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low}{smallest high}", ++ "\0<\0a\0>" ++ "\xDF\xFF" ++ "\xD8\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low}{largest high}", ++ "\0<\0a\0>" ++ "\xDF\xFF" ++ "\xDB\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low}{smallest low}", ++ "\0<\0a\0>" ++ "\xDF\xFF" ++ "\xDC\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low}{largest low}", ++ "\0<\0a\0>" ++ "\xDF\xFF" ++ "\xDF\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low}{largest low + 1}", ++ "\0<\0a\0>" ++ "\xDF\xFF" ++ "\xE0\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ // Group {largest low + 1}{*} ++ {"{largest low + 1}{smallest high - 1}", ++ "\0<\0a\0>" ++ "\xE0\x00" ++ "\xD7\xFF" ++ "\0<\0/\0a\0>", ++ true}, ++ {"{largest low + 1}{smallest high}", ++ "\0<\0a\0>" ++ "\xE0\x00" ++ "\xD8\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low + 1}{largest high}", ++ "\0<\0a\0>" ++ "\xE0\x00" ++ "\xDB\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low + 1}{smallest low}", ++ "\0<\0a\0>" ++ "\xE0\x00" ++ "\xDC\x00" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low + 1}{largest low}", ++ "\0<\0a\0>" ++ "\xE0\x00" ++ "\xDF\xFF" ++ "\0<\0/\0a\0>", ++ false}, ++ {"{largest low + 1}{largest low + 1}", ++ "\0<\0a\0>" ++ "\xE0\x00" ++ "\xE0\x00" ++ "\0<\0/\0a\0>", ++ true}, ++ }; ++ ++ for (size_t i = 0; i < sizeof(testCases) / sizeof(testCases[0]); i++) { ++ set_subtest("%s", testCases[i].idea); ++ ++ const int lenBytes = /**/ 6 + /*first*/ 2 + /*second*/ 2 + /**/ 8; ++ const bool expectedSuccess = testCases[i].expectedSuccess; ++ const enum XML_Status expectedStatus ++ = (expectedSuccess ? XML_STATUS_OK : XML_STATUS_ERROR); ++ ++ const char *const bigEndian = testCases[i].content; ++ char *const littleEndian = utf16_dup_flipped(bigEndian, lenBytes); ++ assert_true(littleEndian != NULL); ++ const char *endianCases[] = {bigEndian, littleEndian}; ++ ++ for (size_t j = 0; j < sizeof(endianCases) / sizeof(endianCases[0]); j++) { ++ const char *text = endianCases[j]; ++ ++ assert_true(text[lenBytes] == '\0'); // self-test ++ assert_true((text[0] == '\0') ++ != (text[lenBytes - 1] == '\0')); // self-test ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ assert_true(parser != NULL); ++ ++ assert_true(_XML_Parse_SINGLE_BYTES(parser, text, lenBytes, XML_TRUE) ++ == expectedStatus); ++ if (! expectedSuccess) { ++ assert_true(XML_GetErrorCode(parser) == XML_ERROR_INVALID_TOKEN); ++ } ++ ++ XML_ParserFree(parser); ++ } ++ ++ free(littleEndian); ++ } ++} ++END_TEST ++ + START_TEST(test_bad_cdata) { + struct CaseData { + const char *text; +@@ -6711,6 +7006,7 @@ make_basic_test_case(Suite *s) { + tcase_add_test(tc_basic, test_long_cdata_utf16); + tcase_add_test(tc_basic, test_multichar_cdata_utf16); + tcase_add_test(tc_basic, test_utf16_bad_surrogate_pair); ++ tcase_add_test(tc_basic, test_utf16_surrogate_pairs); + tcase_add_test(tc_basic, test_bad_cdata); + tcase_add_test(tc_basic, test_bad_cdata_utf16); + tcase_add_test(tc_basic, test_stop_parser_between_cdata_calls); diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index c9a1c9b18e3..6d08a3fd94b 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -16,6 +16,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-76956.patch \ file://CVE-2026-76957-01.patch \ file://CVE-2026-76957-02.patch \ + file://CVE-2026-93990-01.patch \ + file://CVE-2026-93990-02.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Thu Oct 15 05:02:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100758 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1112BCC6B3E for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32828.1792040637790476174 for ; Wed, 14 Oct 2026 22:03:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Lpyj0VWx; spf=pass (domain: smile.fr, ip: 209.85.221.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-48de72fc832so896077f8f.1 for ; Wed, 14 Oct 2026 22:03:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040636; x=1792645436; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=To1oMPf/6qa0YjgsOMK2GSAu8yh5rug3Nv7kqpgGD0U=; b=Lpyj0VWxTbE+zK2sX9B0yt430bL9PQYXJtfx3pYPB5mrDpTCf/1ZDx1RAkYAGUEYQp KFnz9urs3Rsvr35J65m04f6woX7/vwEks7Cuzk29oqH/oG4lKacnFw83lqpv+jiyf+Pv 6Wf+O9uDQxZGh0tjWubdxmEiAPfaPf4o7dhp4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040636; x=1792645436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=To1oMPf/6qa0YjgsOMK2GSAu8yh5rug3Nv7kqpgGD0U=; b=BLodN1t1i4+HEXB/8q14IEBad3URnTUQ+Di/533nyCDnKPbBZHx/GBi2D9Ndr3xrHa us6Tk+mome8ylq9mQI0qJCjA0tF5m3VI+xtLfIhj3rrmJXbGkGsF92asN/G12QqittqI bJ9OT6CbC8fbu7hEemvpF/skqDJJCPUnmjRYehlex7y9nW8xQ+FrskENImG3BSEnsprO YLPn910v+bqr/fNqOEH2sI9lQjpxYUJyXSNeQeVx4EeAdxx9pLDjqNQnTjrs+snqTk4h aF7VBKadk4EjNF7/81uJ/ubStQ9bTwy2p/uYSoQ/f/vWtKgBXfpmZCbG8oWu5jwLrKJ4 vf1Q== X-Gm-Message-State: AFq9FYLfH492Wk31d7sL9pbD+SXPzSJsSaMmy9sCGpzhCkr4L64v6+yq tn1VmUE0rBn2nDVfwcRBShy25LvEGd0WP8KPSKg9JEdIKWke5Ws2fcmhNf3RyBbsi0aPiN8yW3c SQ2oxNm4= X-Gm-Gg: AYBFou3PlQ069AdjKePXkd5Ftr+mOX6W67yQLtHS80cPwhwea7uJD2UfnNusJ7xfJc4 Os69Wc4h/DLwi+JK7c6CQYe5To1Z5mZHiWkzFLApidIPYbgHTWj6uTzXwg12BF/X6sAsFTTatNr 8FmWvuaUTu6ieoCQkjaF7kLfmzCBdHqBPVH2Ru42ktPM2GebiQnibxcMcP7RlHadomMhca+4SG1 SDtMzxLEvYMrFTW4BUoljWYuFj5DG8fZ042TMatrLtLSb2W2eWS2XKuzafn8uxm5qTYq/dg1c8J 31LBqn8wD716VTtxT4+L7ZEIOlBfktHQMZIzyEM1IiQyyrwA7Q85oPs/kySH0gOn25x7hjvqSyR d52hiIwna048SFIBLLUxlJCT97GR1CVCH5cm2gJh+NjAYFB6LQilYF+8uEabDNQDWfFfisIeaoi zouJ+aod+IShdBwCnaTOi8Behvyzz26oqq4YK16iMMLk73aBRFuOVhRqlVrKB732CJUfHIOSZXY lY/nJuTQmSA6CTxqR0zGoRsUQRkp+NtQ9APiNeIsL7sS2y/zBd/iKG7wcj8YaZve0/Lz/hEyw== X-Received: by 2002:a05:600c:a01:b0:49f:ce72:e931 with SMTP id 5b1f17b1804b1-4a18e4fe3e1mr371369895e9.35.1792040635940; Wed, 14 Oct 2026 22:03:55 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:55 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 27/55] vim: set CVE_STATUS for CVE-2026-51400 Date: Thu, 15 Oct 2026 07:02:50 +0200 Message-ID: <7851ee1883615e9d8610c44e97eeb51bafbe9f66.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247825 From: Hetvi Thakar Analysis: - The vulnerable code for CVE-2026-51400 is in src/os_vms.c. [1] - src/os_vms.c is VMS-specific and is not compiled for Linux builds. - Record the not-applicable-platform status; no source patch is required. [1] https://nvd.nist.gov/vuln/detail/CVE-2026-51400 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- meta/recipes-support/vim/vim.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index bd2ce2f6abb..d5fbdd0a590 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -68,6 +68,8 @@ UPSTREAM_CHECK_GITTAGREGEX = "(?P\d+\.\d+)\.0" # Ignore that the upstream version .z in x.y.z is always newer UPSTREAM_VERSION_UNKNOWN = "1" +CVE_STATUS[CVE-2026-51400] = "not-applicable-platform: Vulnerable code is in src/os_vms.c, which is not compiled for Linux builds." + S = "${WORKDIR}/git" VIMDIR = "vim${@d.getVar('PV').split('.')[0]}${@d.getVar('PV').split('.')[1]}" From patchwork Thu Oct 15 05:02:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100755 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6021CC6B3B for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32829.1792040638044184044 for ; Wed, 14 Oct 2026 22:03:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=uHX4ofxM; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a018792ab3so38966705e9.0 for ; Wed, 14 Oct 2026 22:03:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040636; x=1792645436; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=N4mb3exRhET/zlsVgYFdva03LbSPFF6299g8N0aMv3k=; b=uHX4ofxMMUmVT7JG8Bbg7GWh1h3UBhadqpgQ/ksv49FJz/HT0RZ9S8qj8dR8nypRDi K9H/N4xsU2T1X5UYm7uu+3zmVdOlhv7jdmuL4lyNSvoSGHd2mHpQDJ+Qrcc/DdU3N7Xy rpc3dVMRwkeZZ2gHWKVsD3oH/Pzm1R6gjcX9Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040636; x=1792645436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=N4mb3exRhET/zlsVgYFdva03LbSPFF6299g8N0aMv3k=; b=cXu3o7B/kO+yGW9xWSNoYHt/PFHkYyak8t2fw6n6Reg+lXNcdjHZ0oCgjdT2HDlkiS ywtwnx8cAfnoAu+b2NOyUq7huFSlInMy94mf9UmVxwquTJNPGdlVow/cSPUfo3a2Q2KK jtHFcq1gvod9RlviUonYUOWqaO4mBn5sPREnmouLwiQUwAlcoTiRn4XWNUQXpIEqkHlr J9QeHxglN81Fj8+YS23vv6RNSR79Jccve5FUO923+RQUuswAqwVkQaI1gMGZt7IPAwnX LHkL9hG/Qbk/qGSMBlrE1mb/r4N3ZzzSG67SbusOX92Ged2aRWtxMLwBTT2A/BOueBMx BKLw== X-Gm-Message-State: AFq9FYKP02rZ6fkfMxfPg+EgBrgSmQg8mcmsW2beBFS/pdqVfVEGRLVX m/muAeqZ43pe1QTZeAsYHemHLPgsVxiCguIPclYKfQFzG8G7FluYiY8eDfw1LhhtQ8JbIY2fQkY l1l9UNaI= X-Gm-Gg: AYBFou2SABrzkOYG8UaUq+MIc3oQOVBztdYYJT8uiNJCMjVXKof9mCMx30lrLywWcWu YLc0hhV+cJHC2CckNEcz/tDyGAJ0TqQwVsXLG1jv0pvEIKwrkzO0hNsltDmfxGhwlDLNvdztHHg MVXO7WZeETBZ2on9IypwA4NX/9ci288N49IQ1nwH4cLNAo8TxPzWGxnY6M03RR1C3/CHiB6wlif xmA5zrdc7EkdnxKFcOkQhfuDhNlNxaEycCh8F16m0BOZjN1k5qFHn0tCqlvuthfAHEjSMlVtgmD L14jzh6J5KHJb1QTCKWiwRhscW/d/9UpLp5r/jneSDhaek+V3y77zI5VGjNZZSYeN/DPKBZNLXH FWXJLJQtB7nmWaRzHEDrXF+/2bg2UZa2Cm0umPOyw4OeosTPxK/yy27vTsmaVTS2MUPB5cTdlae MYCkPDJXPEapBnVwjIUw8IL9bqf419zX5yQWpkKoc9WshxG1Bi+gSGlRyqB8RuKDY2EqKf6bJjO S5FGmee06w34VT0qJT2SHIRhbjLbHEiMGGljyjW0d1TnppU1bXxHGgXwulQFGJuxQkfNU+b0FI4 Niu+T1xP X-Received: by 2002:a05:600c:4e8a:b0:4a1:78dd:dd28 with SMTP id 5b1f17b1804b1-4a18e4d2b31mr362665665e9.27.1792040636307; Wed, 14 Oct 2026 22:03:56 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:56 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 28/55] vim: set CVE_STATUS for CVE-2026-51401 Date: Thu, 15 Oct 2026 07:02:51 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247826 From: Hetvi Thakar Analysis: - The vulnerable code for CVE-2026-51401 is in src/os_vms.c. [1] - src/os_vms.c is VMS-specific and is not compiled for Linux builds. - Record the not-applicable-platform status; no source patch is required. [1] https://nvd.nist.gov/vuln/detail/CVE-2026-51401 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- meta/recipes-support/vim/vim.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index d5fbdd0a590..f84d2a9688d 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -70,6 +70,8 @@ UPSTREAM_VERSION_UNKNOWN = "1" CVE_STATUS[CVE-2026-51400] = "not-applicable-platform: Vulnerable code is in src/os_vms.c, which is not compiled for Linux builds." +CVE_STATUS[CVE-2026-51401] = "not-applicable-platform: Vulnerable code is in src/os_vms.c, which is not compiled for Linux builds." + S = "${WORKDIR}/git" VIMDIR = "vim${@d.getVar('PV').split('.')[0]}${@d.getVar('PV').split('.')[1]}" From patchwork Thu Oct 15 05:02:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100764 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60598CCA462 for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32443.1792040638896639684 for ; Wed, 14 Oct 2026 22:03:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Dh3ZEwvO; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a172eb31f0so41258615e9.1 for ; Wed, 14 Oct 2026 22:03:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040637; x=1792645437; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ZwjP5jrqukmG+vsIzKxD1RuHLQGcHokvEKFQxJz55aY=; b=Dh3ZEwvOq+AoBTPiEA9hoBSQuL+P4IdPenLSk/ww2uFerU4eZUY0B8p92vpsjwqiz4 0t5nZ46PKVW2vGXvBUP32bby8FbqvKvohY41YYrmB7gKNGabVz2SVZXQljgPnr2Xfak1 41ADmB5tsr8gf+23bJxn17vvrW8F+lkygM1Lc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040637; x=1792645437; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=ZwjP5jrqukmG+vsIzKxD1RuHLQGcHokvEKFQxJz55aY=; b=iS1ldWwHr98mx3Fymau3p8swOkp5EDh+n33wTu39cB2uH0B5nkgIA5x7iT/pZdtMNN 4LQ6xUlALNoqSLYAduRcl2mc/HDDCAG8RZOXRd7bwtfPzHqzyrJseqG4EsMfVoJCaSkX gCILhisMQHEtk2I9LIXQTsrWbB9T8joDlGVCH8CPPzqObTP02nUrnUbnaUvpznMtr1Sq C+/DYA9eR++VuZdDWJi2YWeUb4ymGylgjKn5f1/E36YegM3kuE2kuahhuT0fdrSC3LQq UnNfOr1g3w/i08pV+gJ6Kwb1Be1u2Be45NykXaf+zo9e0m2D2OvWG/+8zEP/gvizLIjX FhZg== X-Gm-Message-State: AFq9FYKp5IUubTGBHmzI6TVi61T9eJs1IJUfqromsYG+ZJaJuOt4/s/w 0PA2D6ywPBa6ding8K9BqQxyytCaJ00Hq5veXfVdvL5aHk+Hw/83jwLkIv5WUsiJ/D3AcEMZ32P 6M3ugw1E= X-Gm-Gg: AYBFou1WvqOrbFRtM42sk3vpoOgwFStBmVagwO7LjTHr5/qno744iYMMGIyQ3xN6evF wJOGh14kY879XYI24jUJLsO12VczCpfBCI0BHKZk65kDZKi6tihCaljTmUuu1OgzUPz2g1aGTEa rXHBcNWkv/SwxX+7wKGfin82Bemi37FXVPLI2HzvqLpIK3NILQoNyD1ORXkaesbQdd8Zf/06F39 +RLwE8YmW25xQAFyltATHMoi14wKhF+a+S6OBw1iYTePSZYnmZDPki+G5PFkIQZPPYvNKPM29Wz uPE+b/idbJyFKp1x+c9SQJC+jCVL5V3mAiRhZNhrvtt9hlVs1iy0mF6KghWO+yyZaA+88c9AI8M uQ3v3V2gyuHtKh4pw9D4SMSac37iFDylNUsqcSfLSFa1ylvDybczp0zejueTdqYYI8STAyraStO SVQ0ldS9TZGPhVvb9MCnA8v1ZSHnSnmc0qHuDky8tgm8LU9Sgpiv79wPvuD+GHZAQVThmBrNhZ8 r0tOMMSe6tYWZtYXxjqEtc6ZjmNgDkBWTFxjm+TRoliYIW/+WpvQHkoi7PU6IFMhkp+IauA7g== X-Received: by 2002:a05:600c:8518:b0:49f:cbf3:551c with SMTP id 5b1f17b1804b1-4a18e4a8ca6mr322509355e9.12.1792040637041; Wed, 14 Oct 2026 22:03:57 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:56 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 29/55] curl: set CVE_STATUS for CVE-2026-9547 Date: Thu, 15 Oct 2026 07:02:52 +0200 Message-ID: <9953a743d91eb59b3a3932d3544e5c8119f1adbe.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247827 From: Devansh Patel Analysis: - CVE-2026-9547 is tied to the libssh backend. [1] - Scarthgap curl 8.7.1 does not enable or expose the libssh backend in the recipe. [2] - Hence mark this CVE as not-applicable-config for the default Scarthgap recipe configuration. Reference: [1] https://curl.se/docs/CVE-2026-9547.html [2] https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl_8.7.1.bb?h=scarthgap Signed-off-by: Devansh Patel Signed-off-by: Yoann Congal --- meta/recipes-support/curl/curl_8.7.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index ade637adf37..f3b1c32e933 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -59,6 +59,7 @@ CVE_STATUS[CVE-2025-5025] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'n CVE_STATUS[CVE-2025-10966] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}" CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}" CVE_STATUS[CVE-2026-8458] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotiate-auth', 'unpatched', 'not-applicable-config: applicable only with GSS-API-backed Negotiate authentication', d)}" +CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is not enabled by the recipe" CVE_STATUS[CVE-2026-82209] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl" inherit autotools pkgconfig binconfig multilib_header ptest From patchwork Thu Oct 15 05:02:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100756 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9495BCC6B39 for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32830.1792040639396385249 for ; Wed, 14 Oct 2026 22:03:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=eyJpaLMj; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a17baef589so14326655e9.0 for ; Wed, 14 Oct 2026 22:03:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040638; x=1792645438; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ig14qbGi7blEt3YBga/eJ4vrdZfnH14T7Ei9E3kFZl0=; b=eyJpaLMjM+D8aUZuh3VmsFvbOo2Yyi8bAFHTJn3lm7BWeys9vDgJMJX6sZedLxjUd6 UlGbNbbih6mdNOccGq94xAhx3JbLic8Tu7G5xouc8yMzvGK1Lrnj2JewpZEXYDzsTD7z LslKH+AyG7Rssd+MuC3bBak6GoqBV2v/E6n8c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040638; x=1792645438; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=ig14qbGi7blEt3YBga/eJ4vrdZfnH14T7Ei9E3kFZl0=; b=RXYfxOQaFIZ55m2FO8v9qwf21vEDCj+7PswrTthimCRs4w2ptwAmvdl9L9qbCZAGT1 HM5PkrIwJHkbu4w3bm75QwJp5NspKipsbo/T4rE3E/H3b1iXR2qCt7Xuffdb3aCjIytE 8zqtL7LcJLiDQX+wOkMC/jCTOma1qGl5xi93rV5fnmRyqv70Ne8t+0qXjuWjmyGLApYY VMo8ZzFUGajTdfKanYN3JajB7Pl4PhR88azXWafEaXnUESCAcpCXBnkW5ymj9VU3Nmsu egFPy46/6RcQogp1dmJMZrftqyCZaeOMip2F7BqmHPo6mP18XAkiJ3RdwTByaCe7RA+2 QLHA== X-Gm-Message-State: AFq9FYL8rBShbYIpjDdHS/PVN9OU3AVUpzFNnwEmnNM4+r52HE9ukvtA hovJb8ElfrmQsxdGC0d1JbQFbqMBuhuzYcAQQnB4HZbNJeSW8ms20P8Y8N/GYJgUDq6Pm490ik3 PBneFxFE= X-Gm-Gg: AYBFou3LN2yN5GPz536vUsEjJuDtTUs0gF5K1XbSAmMYjReVnhnrMXpa2mbAAek7mPO kUfzOAdw/iJkRHiaKWpdSWdyAGga/2hNIHHFMP2NyS/JVdRuft53ERPFl0yt8uGWWVdtJQ4wcnD QSE24/Xow/dEPas+PrzoCeDxsgtp+ElPlPuXv6M7W3uNDNMr4MD7584Qx+EOqkSX1jBebvCpglP rvA63skXD9Kr8vUWrzu86gsTsRtj+FXpBmJav6wfQsXXrISRf+FVnqhj9Boie8zJXYJ0KjRfatP OTqx4QwZikg37NILsdXc6Ywx0HGWbyc+PECsmg4Zfx8zE1Cm5IVRY2Uc6Fyxl6rOsDkgDQxBZch 0xwnXSu8EiwqlQBQWV4nq2C3qprt2KkRYgNsc37OvOty1i2rN7ZXLT3YH5T8gtSByufGnzvmhkv H4FNjUkQv+rODKpDTFlGTq1Ej6MjCbv5omKDAZgl0YtFCKDj0v4Pe0nhxa9EeCqRW8tYgxiJmkv RSkx2HzazzdPAbDYtcJjhnsMnA1+CkfYUND7kwJmuGKHk/1hIOGXmjdYNl6+J5bFvsEKK32qQ== X-Received: by 2002:a05:600c:3e8d:b0:4a1:825a:56fd with SMTP id 5b1f17b1804b1-4a18e4aecb2mr327714315e9.32.1792040637596; Wed, 14 Oct 2026 22:03:57 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:57 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 30/55] curl: set CVE_STATUS for CVE-2026-12064 Date: Thu, 15 Oct 2026 07:02:53 +0200 Message-ID: <52d3f4713db2c43479e40dbef76c30c4bf1d9777.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247828 From: Devansh Patel Analysis: - CVE-2026-12064 affects SCP and SFTP support with libssh2. [1] - Scarthgap keeps libssh2 optional and disables it by default. [2] - The status reports unpatched when libssh2 is explicitly enabled. - Hence deferring the CVE for now. Reference: [1] https://curl.se/docs/CVE-2026-12064.html [2] https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl_8.7.1.bb?h=scarthgap Signed-off-by: Devansh Patel Signed-off-by: Yoann Congal [YC: fixed commit title] --- meta/recipes-support/curl/curl_8.7.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index f3b1c32e933..ba2968fc6c4 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -61,6 +61,7 @@ CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', ' CVE_STATUS[CVE-2026-8458] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotiate-auth', 'unpatched', 'not-applicable-config: applicable only with GSS-API-backed Negotiate authentication', d)}" CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is not enabled by the recipe" CVE_STATUS[CVE-2026-82209] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl" +CVE_STATUS[CVE-2026-12064] = "${@bb.utils.contains('PACKAGECONFIG', 'libssh2', 'unpatched', 'not-applicable-config: SCP/SFTP support is not enabled in PACKAGECONFIG', d)}" inherit autotools pkgconfig binconfig multilib_header ptest From patchwork Thu Oct 15 05:02:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100761 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 888E1CC6B34 for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32831.1792040640011001419 for ; Wed, 14 Oct 2026 22:04:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=k5+MmZU3; spf=pass (domain: smile.fr, ip: 209.85.221.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-48df4f540ebso90864f8f.3 for ; Wed, 14 Oct 2026 22:03:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040638; x=1792645438; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=glyw5Xe3Xtc53xsckQm0QIXUZGH6KB3/Q7Ot9xrqPwI=; b=k5+MmZU3cs/ULGGW7Z7ycixhjjgie2JnJ14V49GbpjA9djylfBl1k5G3QNwmYPVd94 6BY/OznNtU+WxpdfG6hGM0XTacYOwxU3k37LbgWVTT5u4AC+sYcJ7yzizppYD3SD9iGu WZ2oAyYRpK0zV7eQsUMhcVnFB7OmNAXU9MeCA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040638; x=1792645438; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=glyw5Xe3Xtc53xsckQm0QIXUZGH6KB3/Q7Ot9xrqPwI=; b=Cv+9GsI3UWWdJGY8omZJ7Wv0JJHfk/+Q6VPV6bFU+ZcgbJE/yAGzStauVwlSg60rgW rA4nHxofGNzmsoVy0/ChGPPsK5TlOXuMNxed6SuPmsSehXCaXuofxrsE35X4SSMxLXiU opXvAvxlEfVEwZpCsHu2b7U05GHI8dryuH9olCCflcJhDyHnDydkgr3qs6ClOp2OhyBL dfsPwisA/bFPwuYAT3Fkg1DTEMLi6obukdPCEeAf5QH0eYB6ZskLVl0iFzF/fybbVO4I 3zmwi3vnfaTAqICXr22NQmrBIHxmnA74/vcYuyE49tvu2FLUlvWAvKqLF9nnF07uPx3a T2Eg== X-Gm-Message-State: AFq9FYIJ7za13NiNmDnN3pBsobu9FTSVNMQ2eD/xF/Fj26pLWf5sbgrb QrkOqrtEHVe8JSYVV63Gk+FKGGF8fA4DtB5XPDkrGeKTcPD4x3nzKzB+Sn+1iXmiHEFL/POXP4X H/cGIIM8= X-Gm-Gg: AYBFou1jFoYYqheJlOFGdElzJCXJvICib+XVsTlFcWdBj0+Y/oide+Y4kFJZ5wIsBjO 9pgvw8RiQAvPudUlExhCboV9ElSrJAs/U/lFRvUD42m1wPTDTAHjmQLUm4fqZaLsl6LxUUgHJyo dYdJWKUWRBW56hjoyNxH2/UEx96yPDZ/BHkb7LHdCOjsEJl67+9Z29eFN1jOXwrvRvRhDfIi6tx XpBp/wcEbek3BJHXDCoXiHi4rWZjr0+JZa4KX3Bx51fhDe17KpQ90GeH7tsmgtAKBbJTJ4cMTIv 2UD9Rr0VnGEC0u0V472gTK3iXx4+HedPK8ZmQkZOvndwBsvCfh+XkPhETLdBUHlpU11Y2dCqBJQ rQYFf4j1equVObeT7PbkHrkg03fuPuLom5idK+H8Zq5iH/gW3KltZiD5kgyozqCjI/wFnwUGe2a PXcJY7gbqR7Hu8T+4p9a2Rll+vxSTo64PYa8VgD25IN5EmDFuSIwwJvYtfS4dWTKDDunMNmzvfS 8njgbCswMgw/tY7nYxYLHhOCbtcxLeYMFYEVNCRTqsWtx8wBgZqAPUW1Oakhl9RbL2RRkO/JEOq kRY1dGGK X-Received: by 2002:a05:600c:4747:b0:4a1:80d8:aed0 with SMTP id 5b1f17b1804b1-4a18e4a9862mr364370595e9.15.1792040638195; Wed, 14 Oct 2026 22:03:58 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:57 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 31/55] curl: fix CVE-2026-8286 Date: Thu, 15 Oct 2026 07:02:54 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247829 From: Devansh Patel This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16 [2] https://curl.se/docs/CVE-2026-8286.html Signed-off-by: Devansh Patel Signed-off-by: Yoann Congal --- .../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch new file mode 100644 index 00000000000..f05d399eeed --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch @@ -0,0 +1,60 @@ +From 9fcd9cead5edb8638d4d767bd0077c405b0390be Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Thu, 7 May 2026 10:30:07 +0200 +Subject: [PATCH] url: fix connection reuse for starttls protocols + +When a connection is tested for reuse in a transfer that *may* upgrade +to TLS (commonly via STARTTLS), the SSL configuration must match the +existing connection. + +Reported-by: Andrew Nesbit +Closes #21522 + +CVE: CVE-2026-8286 +Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16] + +Backport Changes: +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream + may-TLS and require-TLS distinction in ConnectionExists() and keep + the upstream TLS configuration matching behavior. + +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16) +Signed-off-by: Devansh Patel +--- + lib/url.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +index dfcd6f4841..9e1ca0336c 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data, + /* plain HTTP with upgrade */ + bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) && + (needle->handler->protocol & CURLPROTO_HTTP); +- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; ++ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; ++ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE; + + *usethis = NULL; + *force_reuse = FALSE; +@@ -1054,7 +1055,7 @@ ConnectionExists(struct Curl_easy *data, + continue; + + if(!(needle->handler->flags & PROTOPT_SSL) && +- req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET)) ++ require_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET)) + continue; + + if(needle->bits.conn_to_host != check->bits.conn_to_host) +@@ -1202,8 +1203,8 @@ ConnectionExists(struct Curl_easy *data, + needle->remote_port != check->remote_port) + continue; + +- /* If talking TLS, check needs to use the same SSL options. */ +- if((needle->handler->flags & PROTOPT_SSL) && ++ /* If talking/upgrading to TLS, check needs the same SSL options. */ ++ if(((needle->handler->flags & PROTOPT_SSL) || may_tls) && + !Curl_ssl_conn_config_match(data, check, FALSE)) { + DEBUGF(infof(data, + "Connection #%" CURL_FORMAT_CURL_OFF_T diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index ba2968fc6c4..38083b58427 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -42,6 +42,7 @@ SRC_URI = " \ file://CVE-2026-6253.patch \ file://CVE-2026-4873.patch \ file://CVE-2026-13608.patch \ + file://CVE-2026-8286.patch \ " SRC_URI:append:class-nativesdk = " \ From patchwork Thu Oct 15 05:02:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100753 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79EA4CC6B2F for ; Thu, 15 Oct 2026 05:04:02 +0000 (UTC) Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32833.1792040640965798408 for ; Wed, 14 Oct 2026 22:04:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=35u5iIxa; spf=pass (domain: smile.fr, ip: 209.85.221.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-48afcd7ba9bso2673348f8f.3 for ; Wed, 14 Oct 2026 22:04:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040639; x=1792645439; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=aIFwYNc678KJnlkYbpRpisPcJb4ITS/94wBbHg57a4s=; b=35u5iIxa7cczfoUopOZkOr+VQkAoub/tJgFfT1n+4kNSydR69PUAyyh+fqwUGuTlmX 2BhYUOzHMUUcTHREyPkrxrBan12UZDz0NYG1UsaZTT1Dq28s5pH+B6hgchySty7scgVt +EgBvPS3WqJsBTrm53mC0PL1sjMyFwUUYj1g0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040639; x=1792645439; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=aIFwYNc678KJnlkYbpRpisPcJb4ITS/94wBbHg57a4s=; b=VqkwfBYOghZqFHF5TJfpKLpORTGEWKgirdaGkX9E0tZzuFljr3cWpKbQr2cjlOsD2E 20IIJnJo9KjuEaODNXkvYkORl0BOBSR16Fkb7sfK8TFDr75HrIPeZGOyuRO//DQcoeM4 Kljf0aFb6s6h7sO76Z5ht2eYwGhZrKtzQ8WJaJXH7/1avPScQKkAKGPhTmrJDQzzVFs6 KuxUrSNRz+PhgXRZxSJpmisVPJqgIY1Wj0rCT0/jrN9CTIMYSvJXmKVCXF7ty4CwbVi3 1ECdyUnl3ZRVfM6b0g2FsGs0z8lxbZWctekRSOzVico0o50Sb7lrZxsy89genNWBlZ1M gxpw== X-Gm-Message-State: AFq9FYLQ3GvgocnxJpvAlqhXnr0RfLBtle6T0fJ5C9WDs4aXWhIUEpPL qOmpd0wq51e5AUf1DQg4ewhZ4ge42GqxCS+GBjg7cx66mjV4XjNPU6dFagmYgl8zOBMnuHFzwyF aTjZfQhU= X-Gm-Gg: AYBFou0r+LaEQaL6DMoL7RVM7KLu3SUzGEW+dvy/RtHpFmu9jyXbxelNnwXgLKV+5/p +WFKVwRb8NnwhRckENZ8HeKxSYlv2yCQRUVnaXN4yF/tyFuqdZq5+pSV+pfmX5PzDLlpXLEHsc/ WqBjrXSj5+UGCWhN1PDPMvAOQw1dVwVtViGE60GIgN+BfCk102AQaFcm8yFEoVN2g59seUBqng0 ZWVZokC97uSt9ElcbwXBqQo46qOZsz/SF+gQ17L1/oD8rXv6BfV3PPnmftfPaPpPIjG2f+In9T/ E7D5JDLZHNoFt3+xP57v+BLIq7vpopc2ohlp9av5gK02sMvIK4asVeSt/+q0Nx+Iwj48WNfsBWI LmjVdlLsKpqYOjSFf3bWgI1Bsrqh65ZSTIJJ2/vAJdyozkvRQBmETfn4qniS2AxZFLeKnazuebx 0fA3dUcdwuK9KOYetM23yZjU5BjEO4TyoxM4eyzWy0QVdPeU7NfmNxIcgbVUJrkmQvmKmyQlzQI 3dOtWrbX6wztKfJ/ENnCWLJ1ydydtCRg4ZFMubq8cmOQkh6svdx1nc/xR/io+qZ+BO2+bbz3w== X-Received: by 2002:a05:600d:4452:20b0:4a1:90d7:88a8 with SMTP id 5b1f17b1804b1-4a190d7891emr253140075e9.25.1792040639105; Wed, 14 Oct 2026 22:03:59 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:58 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 32/55] curl: ignore CVE-2026-8924 Date: Thu, 15 Oct 2026 07:02:55 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247830 From: Devansh Patel Analysis: - curl identifies commit 51beed175dbfc37da3113f6acce60c630c070ce8 as the fix for trailing-dot domains bypassing the PSL cookie check. [1] - The upstream fix changes is_public_suffix() and adds a regression test that requires PSL support. [2] - Scarthgap curl 8.7.1 is configured with --without-libpsl, so the PSL check addressed by this fix is not built. [3] - curl notes that builds without PSL cannot protect against overly broad cookies; this status describes the absent PSL check path. [1] - Hence ignoring the CVE for now. Reference: [1] https://curl.se/docs/CVE-2026-8924.html [2] https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8 [3] https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl_8.7.1.bb?h=scarthgap Signed-off-by: Devansh Patel Signed-off-by: Yoann Congal --- meta/recipes-support/curl/curl_8.7.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 38083b58427..e361e6d6b13 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -58,6 +58,7 @@ CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on go CVE_STATUS[CVE-2025-0725] = "not-applicable-config: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older" CVE_STATUS[CVE-2025-5025] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}" CVE_STATUS[CVE-2025-10966] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}" +CVE_STATUS[CVE-2026-8924] = "not-applicable-config: public suffix list support is disabled by the recipe with --without-libpsl" CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}" CVE_STATUS[CVE-2026-8458] = "${@bb.utils.contains('PACKAGECONFIG', 'krb5 negotiate-auth', 'unpatched', 'not-applicable-config: applicable only with GSS-API-backed Negotiate authentication', d)}" CVE_STATUS[CVE-2026-9547] = "not-applicable-config: vulnerable libssh backend is not enabled by the recipe" From patchwork Thu Oct 15 05:02:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100763 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3570ACCA461 for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32445.1792040641584469087 for ; Wed, 14 Oct 2026 22:04:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=M+zx+CES; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4956869750eso32390475e9.2 for ; Wed, 14 Oct 2026 22:04:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040640; x=1792645440; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=1EOrEU/DWCxwmqTT6LGVfk4MGyEKQUtFlBH3N9pHPp4=; b=M+zx+CES3jP9WdTWz8u/L8laT7UMR+gtWjRcopXxxiljGfIO3LDjLwO9onlMpn6B9D odBYwT6z/KoUDa6g9t3FBiDp12SuXIQdWCgp6wyEWcMMuIEtqW1COvfk2PxDrp5nEiup oXr9PpBxQ8Me6UjiuN52EWb+YzoXHLu4GWnoo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040640; x=1792645440; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=1EOrEU/DWCxwmqTT6LGVfk4MGyEKQUtFlBH3N9pHPp4=; b=QR/YwroxIbk/FiuFx6T8iUBT4GFW3gMy8iCbs62KS5iUVtMUOvt163cbUI5IwvzZTV Ic+kfkv4jpcbt76v5oEMIq9oo7GvQ5mOGuE3ARi9yA9EMX1Jgfqnn6uV2daAhQ/4OkOU S1LvnM0eTZSjs/rKoVZvatGIn+1n8f25qsaLEaerLjikIoKbqLvaMRhGKA5g45PacyaQ a2qg8JDB51d8KyrR8bYjgYddJeREqJ4QIB7SacGyr0/LwW09WUDaSS6vMPfrljOg0yA8 wbrGAJGpmEP7egj5iah1VLQRdR/tIvMHL0D17MWli05b+s/yHzdxWcH3GTGG3OpEpRpb kYLg== X-Gm-Message-State: AFq9FYKAclX9ZuWaWqIUxu1FjYOSZSAsXpsh4Ql5lj/hyvco/hrlWTAp LRCCTVPrWULbNZczEAzIvoINcW5UGlwaNcq712speomtztN3/cm91aOvQ6lgXJyx5XkNnWRiDBN AtsW+XW0= X-Gm-Gg: AYBFou0wIjbvI13Bcq9UHczrANHRp5v+98w/1IGFI/1pd3Z0rpGJHg9IajDHh6yuYqn RlJZkRlTnBZnXNUdXuq2cZVWRbH6vpYBfnsBbLjY0qjCsG31+kFwH2FiG3yEO5u/lvD0lvHBEr6 HHAEphreOb2WCrqX51Jh0vp3eI/YRJpqPcplIHTramfg3OMHwOsYWI7bgPwzQXpIjVTzOQy00dH UbDsz8KsWSNUw8jiiOmOI4pdGCyc9NmdmWKLl0G1GGoyiaWgL4Ynf/g0LSCTiXMdzlbSTqHrV+6 a1W5yDGm85DFNvWPk7lNyRrpFhVth/YrTZHcGmiv6oNlxv1+CqtIH1ahVWKJFNFyPG/QYvKRZ3p 9RXzJNKxagSfrLb7UsyoMVYElJ2nJ83hLvLGa1xx3SlLE3c8PrxfmYw4yoCYeExdZ+eE7GYAwoO B08JxRIoLPzSyvfEdro78M6GSgeftmL4qju2Nf/py6wBB9OFLqE/s7Je9b8O0AbVA+aatfBVF8j 5eFxTiEv6gmTM+5539qGvvNarAu735SD4yLbJ6JPocQigsxEnHzN+/VYR6+jHcJa2qSo+k4hg== X-Received: by 2002:a05:600c:6207:b0:49f:ff73:9971 with SMTP id 5b1f17b1804b1-4a18e4aff66mr347529345e9.18.1792040639783; Wed, 14 Oct 2026 22:03:59 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.03.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:03:59 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 33/55] python3: upgrade 3.12.14 -> 3.12.15 Date: Thu, 15 Oct 2026 07:02:56 +0200 Message-ID: <2efb745f229c0ca0083c705373436fd77a175e1a.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247831 From: Vijay Anusuri Release information: * https://www.python.org/downloads/release/python-31215/ * The release you're looking at is Python 3.12.15, a security bugfix release for the legacy 3.12 series. Handles CVE-2026-19445 CVE-2026-19553 CVE-2026-82049 CVE-2026-15310 CVE-2026-19672 CVE-2026-15806 CVE-2026-17084 CVE-2026-87910 Changelog: https://docs.python.org/release/3.12.15/whatsnew/changelog.html#python-3-12-15 Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal --- .../python/{python3_3.12.14.bb => python3_3.12.15.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-devtools/python/{python3_3.12.14.bb => python3_3.12.15.bb} (99%) diff --git a/meta/recipes-devtools/python/python3_3.12.14.bb b/meta/recipes-devtools/python/python3_3.12.15.bb similarity index 99% rename from meta/recipes-devtools/python/python3_3.12.14.bb rename to meta/recipes-devtools/python/python3_3.12.15.bb index 14be125180b..6c6289b0e69 100644 --- a/meta/recipes-devtools/python/python3_3.12.14.bb +++ b/meta/recipes-devtools/python/python3_3.12.15.bb @@ -42,7 +42,7 @@ SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a" +SRC_URI[sha256sum] = "c2c4321961fab0fb999d66e0cecf521c2ab3994c7992873ea99e306c1094fd5a" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" From patchwork Thu Oct 15 05:02:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100767 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 892B8CCA463 for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32834.1792040642290758602 for ; Wed, 14 Oct 2026 22:04:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=dTcVCkbF; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a16aaf2067so20493915e9.0 for ; Wed, 14 Oct 2026 22:04:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040640; x=1792645440; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=IknFW2GZ2te9C8//Rgn9BDI0lvQROQsCyF3BxpZtWk4=; b=dTcVCkbFso+AnEABI/ZeibsXDA/Ak8Cb3XIQ3VS671Fn7ZxhLKqJuDVWVg7djSGkwG TZ5P6XKQggUmAvugXCcyg0pDbyo2lSkEh6Eo5P37BF2Kw8FFKiJ7wEEuPnbEb5ed+LMl qvzF3gZbkYj6dB9M+u2RFTdWvQUimD/blTmss= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040640; x=1792645440; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=IknFW2GZ2te9C8//Rgn9BDI0lvQROQsCyF3BxpZtWk4=; b=0MQ5sr1LsArX/491ZVXPiG0twzFu521Brdpnl9FFkd6GE17avgywnAq8CuIyyM40IE 1ckfKDZvAnGNRTyUFgwVhKMtfFLUVhyujssIpbSr7Wm42sLtsLIVEI6GDrF7dacq2JEu rIZXcjS8TxwI1eQhROw769YkCkWEKBIRL1tCz31tBeCF+/jtfQUdkCp3VRXB4o3bDSqL rlpDZUkR8YrV8TuCK8g2+xUEpuwNRBmIQHaO0PlSBj1B/eFdyhkk2lJdsFH9t9yRNZoB bt7obwTiDvC57ZZWSyzePYPL/l5brhuJqnV4df+KYB73bW/iHDWdtdGhRFcgPwZntKnu HgLg== X-Gm-Message-State: AFq9FYI9rEJdtusR3eluNFSzo6i4vpNBl0WG5lm6Ix5XeINx+VE170ud JfO8ThOp6ncsyMG8EFUxfyN8QolAWcah+sTaJ4vzdtmGkbsNA2oUDwbUeRPBZKvQHryH7BEfvLQ zdCgbKXI= X-Gm-Gg: AYBFou0i96fdAb1czwTTuUbjjs7SDeGEV1JvMUBG8mJROr0FZnpGS8uBEcTaGKTxrxX WxidOJBZCKdrXLvQz8/Vx+ZhMl5cDoGQtBXNdLxR0EfS4vB8xtNIIx6giZ1iIwu6nJVp8pW7vh2 1rTKlH5gz+p7UBE2M9Gos8tiVFyb/ImtM0Y7HpdghuAxau+jczj1pYAWuoS3mQaZF7Ck0Sp4MsI BH5P5U9a+sRgQJGNRpMPC2wXLRoyVRnANncVh+Kn1nt2mtmT3dA2PnA+7AMfuPnjajhagJyfAg6 D3wSBW02LAWkSxKEbR1bIs7G7yY7K52vlDCT2W3uJVogKBxzL7RCCgpsGJe3oDINdYPDZhR1+iy VUUwhdMYpYM11ycIvUejUwdk126SJKjPvxTZFC4BupdiLHJugawAIMesu4ko2EDHKmjwCH4fC8B jLNOU4C33Dx7yaUysYF530A4qXzN3H7GDLYyrOvUIMYWN1OjOyRbujntLf5e1qW7qDp/tVmpflU U5VoOFm/De9cLN5cPOTDh4jYPaZ6kbLd2MBEryz6qWtU2VoisOXxLe6QUt9rxnUCD9Jl1f4qjAZ cOtFhw8v X-Received: by 2002:a05:600c:a11c:b0:4a1:97c6:d2e8 with SMTP id 5b1f17b1804b1-4a197c6d902mr212126445e9.32.1792040640399; Wed, 14 Oct 2026 22:04:00 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:00 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 34/55] openssh: fix CVE-2026-73283 Date: Thu, 15 Oct 2026 07:02:57 +0200 Message-ID: <9eafc35227e70fc4a0979e99b77a804684ef9bf1.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247832 From: Hetvi Thakar This patch applies the upstream fix that makes the authorized_keys restrict keyword apply to tunnel forwarding. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/d322f2ccf7da095ce94d1d99cb563246f61487b [2] https://www.cve.org/CVERecord?id=CVE-2026-73283 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../openssh/openssh/CVE-2026-73283.patch | 42 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 43 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-73283.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-73283.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-73283.patch new file mode 100644 index 00000000000..c9acb8dd137 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-73283.patch @@ -0,0 +1,42 @@ +From d322f2ccf7da095ce94d1d99cb563246f61487b0 Mon Sep 17 00:00:00 2001 +From: djm@openbsd.org +Date: Tue, 14 Jul 2026 01:05:05 +0000 +Subject: [PATCH] upstream: make authorized_keys "restrict" keyword apply + correctly + +to tunnel forwarding (which is administratively disabled by default). + +Reported by Erichen, Institute of Computing Technology, +Chinese Academy of Sciences + +OpenBSD-Commit-ID: 5b3cc987a64749c94b20e12755db32a83f8f01e6 + +CVE: CVE-2026-73283 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d322f2ccf7da095ce94d1d99cb563246f61487b0] + +Backport Changes: +- Omitted the upstream OpenBSD RCS revision header update because it does + not apply to the OpenSSH 9.6p1 source revision. + +(cherry picked from commit d322f2ccf7da095ce94d1d99cb563246f61487b0) +Signed-off-by: Hetvi Thakar +--- + serverloop.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/serverloop.c b/serverloop.c +index c1fe99d1..56d8be75 100644 +--- a/serverloop.c ++++ b/serverloop.c +@@ -531,7 +531,8 @@ server_request_tun(struct ssh *ssh) + ssh_packet_send_debug(ssh, "Unsupported tunnel device mode."); + return NULL; + } +- if ((options.permit_tun & mode) == 0 || options.disable_forwarding) { ++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding || ++ auth_opts->restricted) { + ssh_packet_send_debug(ssh, "Server has rejected tunnel device " + "forwarding"); + return NULL; +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index b48e262c725..f660e78dba7 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -44,6 +44,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-60001.patch \ file://CVE-2026-60002.patch \ file://CVE-2026-60000.patch \ + file://CVE-2026-73283.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Thu Oct 15 05:02:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100765 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2985CCA465 for ; Thu, 15 Oct 2026 05:04:03 +0000 (UTC) Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32446.1792040642836321483 for ; Wed, 14 Oct 2026 22:04:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=SKZaIq8L; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4a1688d7769so14138235e9.0 for ; Wed, 14 Oct 2026 22:04:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040641; x=1792645441; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=xA6psFZy7cpXR9SgU01YypdkBCI0O+r2QXAQk8P3ImA=; b=SKZaIq8LMpfRn46ewrgMEyLYB8KaOUstx3rYDjtvkmgfRpOJCfDCCgJXrvlB35mdAH X+69zVjFlXnFYYA4ptC5P3iDlt0z7kuvcyQaegVNqJZkdDp4sJ8qTgkvcdA62WE9fQpd fkYt9Sdq5cp5lrvKAxLi5VmN9oODyCCHJr7oQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040641; x=1792645441; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=xA6psFZy7cpXR9SgU01YypdkBCI0O+r2QXAQk8P3ImA=; b=J662R1xuILOQJF6qnO7a6yARewSukAPMoSQBTKxUieitjcKt7n4DSZYxc0tlFdAr/t OLqK3j6S/bU7NnDRZPUn7yPu1ee1WFouqAzqVFkSCAWLUylV6I8u1bruXOZBRyWAKk1G gYpOxq+JZhRJpwWHyv3uhuIo4NTqqKNQK1txzFlJZOwDGiOO1x3jZz5pgRtsQ6wMhYvT gVKozTBL774dKbGD7KP+lWrLi8acXNCe09FOOlZJtx649dBpF//+5FWd67bRSMBVKpz6 Y1sj0n4KUEh/AVdKa8Nu7Clf4rlzv19eFhcFRu0Dt6K1mRAkuZBszsV8mvknkt/puQtl bEJg== X-Gm-Message-State: AFq9FYLc1PL6xnAkVDOGPF6183jLQvuRlNGmYU88XHgIdW/hvcFdWEXZ 8nBD5xJSrPvZUd3rH7G9xxlfww3l/W7gAMvi/tXNCoseIVJYJbW0DMlFqPT3mLtrjhivCJTyKAS M7JHPsV8= X-Gm-Gg: AYBFou3OG+KN+yaN4E6dPEjtpoX/HWxPLlBAIpX5K42S8vVhkIKHJXzDAW94WMmcOi2 Z27Uo1r3A0in6KBkfjoDmY8WcUYSB984MMnk3lrUa6jYIjumZ6dJ4wmodaWpFDkjXxwftp8Weax kz1fiKJ2nleeAJEdUzW8TGdtvOsGDazKlV345O5zn2RIyBldKNfanCPaVK4scs4e0ghsFetKSbC u7WMCbh/UNFEsmh0hNpTuYmFiCB3SGWAqm3dFj0X+Zah+GDxYG3Ns5RjVTLsUUmSt7z4aHOuLWf BOGvWgz0zTeze5YARAAFaXRMkRTT0ZfwrXlaGojUxsnLAuajNi+Dz4wYhvAehIUh285G3Qxd5Bi nvl+yKTL7fUeR1vfbykvNwhbGuA8Y9K4WGPwonPZOVMKcVQYSZEkBVhV0qenLDbfnSKrJbvZlk4 JwVxQRX5Iar1+CZHehqJUYuOGKDOXlJ27XZKs+2PHGsfXDGDBC8GipsvaUWg8kJ3YtGax2X5biI +u7d+XitXcfCcix/tCJ9ygITkyqWhvh6iHOKD1xzYl5yFAO/4YXU2B3EmorQTTFFGxSUS3nau7C AtIFk/pZ X-Received: by 2002:a05:600c:83c7:b0:4a1:7733:5102 with SMTP id 5b1f17b1804b1-4a18e4a3fc8mr339880445e9.15.1792040640968; Wed, 14 Oct 2026 22:04:00 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:00 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 35/55] openssh: fix CVE-2026-73282 Date: Thu, 15 Oct 2026 07:02:58 +0200 Message-ID: <45a22c1327d92b9fbe7533770345a40692e98b49.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247833 From: Hetvi Thakar This patch applies the upstream fix that tracks pending remote-forward requests by index instead of retaining a pointer that realloc may invalidate. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/9910d5ef53124ce1157d57bc11e222658aa41299 [2] https://www.cve.org/CVERecord?id=CVE-2026-73282 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../openssh/openssh/CVE-2026-73282.patch | 80 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 81 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-73282.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-73282.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-73282.patch new file mode 100644 index 00000000000..a527cca7626 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-73282.patch @@ -0,0 +1,80 @@ +From 9910d5ef53124ce1157d57bc11e222658aa41299 Mon Sep 17 00:00:00 2001 +From: djm@openbsd.org +Date: Fri, 7 Aug 2026 05:03:56 +0000 +Subject: [PATCH] upstream: avoid potential realloc use-after-free in the + client if a + +remote forwarding is added via the local session multiplexing socket while a +remote forwarding open request is pending with the server. + +Report and fix from Brian Mingus of Cognatory + +OpenBSD-Commit-ID: c7888d566576386d0e96859f9ec7310a1e2d3609 + +CVE: CVE-2026-73282 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/9910d5ef53124ce1157d57bc11e222658aa41299] + +Backport Changes: +- Omitted the upstream OpenBSD RCS revision header update because it does + not apply to the OpenSSH 9.6p1 source revision. + +(cherry picked from commit 9910d5ef53124ce1157d57bc11e222658aa41299) +Signed-off-by: Hetvi Thakar +--- + ssh.c | 19 +++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/ssh.c b/ssh.c +index aecdb79e..2d2837d4 100644 +--- a/ssh.c ++++ b/ssh.c +@@ -1867,14 +1867,24 @@ forwarding_success(void) + } + } + ++struct rfwd_confirm_ctx { ++ int fid; ++}; ++ + /* Callback for remote forward global requests */ + static void + ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt) + { +- struct Forward *rfwd = (struct Forward *)ctxt; ++ struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt; ++ struct Forward *rfwd; + u_int port; + int r; + ++ if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards) ++ fatal_f("invalid forwarding ID %d", rctx->fid); ++ rfwd = &options.remote_forwards[rctx->fid]; ++ freezero(rctx, sizeof(*rctx)); ++ + /* XXX verbose() on failure? */ + debug("remote forward %s for: listen %s%s%d, connect %s:%d", + type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure", +@@ -2052,6 +2062,8 @@ ssh_init_forwarding(struct ssh *ssh, char **ifname) + + /* Initiate remote TCP/IP port forwardings. */ + for (i = 0; i < options.num_remote_forwards; i++) { ++ struct rfwd_confirm_ctx *rctx; ++ + debug("Remote connections from %.200s:%d forwarded to " + "local address %.200s:%d", + (options.remote_forwards[i].listen_path != NULL) ? +@@ -2066,9 +2078,10 @@ ssh_init_forwarding(struct ssh *ssh, char **ifname) + if ((options.remote_forwards[i].handle = + channel_request_remote_forwarding(ssh, + &options.remote_forwards[i])) >= 0) { ++ rctx = xcalloc(1, sizeof(*rctx)); ++ rctx->fid = i; + client_register_global_confirm( +- ssh_confirm_remote_forward, +- &options.remote_forwards[i]); ++ ssh_confirm_remote_forward, rctx); + forward_confirms_pending++; + } else if (options.exit_on_forward_failure) + fatal("Could not request remote forwarding."); +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index f660e78dba7..651b7437a6f 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -45,6 +45,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-60002.patch \ file://CVE-2026-60000.patch \ file://CVE-2026-73283.patch \ + file://CVE-2026-73282.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Thu Oct 15 05:02:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100770 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7C8BCC6B34 for ; Thu, 15 Oct 2026 05:04:13 +0000 (UTC) Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32447.1792040643326234965 for ; Wed, 14 Oct 2026 22:04:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=PrvTztPS; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-49d0da752ffso13555035e9.3 for ; Wed, 14 Oct 2026 22:04:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040641; x=1792645441; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5qlT/tMAzTBIfqcwnHsy+j7CCn63tTfsj4vZyQ/3Hhg=; b=PrvTztPS0+0d5Y8YBYiMzc0N5bg/md6Auwe2DdRgs70upoUKGafaYQaGLcAmLkp3qn So4fFt/4RE9sEY9NLtiQEcQURIbovSSpbqcO6n7QxLZhClbmF3rg7O/Eu6hJgYmDWRI+ za8QvEFrA45qN3q1yOy9+on8d+heHCysAYtkY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040641; x=1792645441; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5qlT/tMAzTBIfqcwnHsy+j7CCn63tTfsj4vZyQ/3Hhg=; b=tBB1FjYa/iUgefmY35nw95NFF7Nfpb6ATLLDecjqazKWHKjfd/eWPO8pgkUrvj2vyh XUE1DsDRlwJwTeNd070exH8Yic3rKrIcILrthSnDaHqxnKQB5DiVLx9HXrznDOT9wC+n Yk6d5qajnvd2qxGTQOZIYj8jUsHMGEcNF/bmurtKA4z+88vlumHNAmfemHNni0wdhUCW BNf/OeUa9wN9o8v8iIdo5R6eOsVEJ4TpawypXDFRixC9PAXnxviA/2UmzxagWfMH0WBi BNOfA6Bis6eHS5XD9egnhkY1jRTmOfW3lRu43T8niD5tir4lnF8EgSUw8vqhbiMIxN4/ vWPA== X-Gm-Message-State: AFq9FYKf4hqRqwI3CI7ihFzbQDfxRaVdntzA9O4WIuE0tmQTbYTVyWEU iaSth2iJI2bVtbYf5vNvvb4g/g8IGSB3EIGNZXKyZqq50xv56ApCQz9epvfbpKLBg6LM28R9pXl LeHRTH80= X-Gm-Gg: AYBFou0rwVCISudM5pwRMJZna7+3baVCIhKJRwIRdgfAy3DG3Ho5+UJnQ61rjhIAdRo urUpSyN50au59PESjWhI+DtIVlmP7sN892KYj17Em3NmVNzzHTgwFCSiCTAchyxrblixmDOJSqA CqavTjrkaTATpb3pvhrApB1LFCdJ48AE4re2qWlgXAuwRR5JF8ac+2U9jvpMoHdKiFgJL9rMIWc 5PzqqpOx1OvDWTzJ0CLFXwplkMsRQYijBTfnszvfTxySiD0yux5OowsUGjm0Zr2waOvbovqShyF vHYqtnN65fOQzZ2IqwbSBGr8oTPsm56vnvffi1v/Km/UV/J9aUnXgBlpXv6oAl0rk2UI9sWMmMF RB3Qwcwj0XniPy41N0G6qLfqoq4f7hPTpMJl5jGb8A6v5f7K5JTecxo7+z1VU7L7pLR55Z8ADDu vRXuoJz2waqpZygB2/D8Zovzb0IZFPl7EXohEMr70D/pFxtgUtUYW10Ks5wk6SyRGQ2Ot7FTHIt 4LjoSkZYuB3KFurdUQ2397agqCs8R8eYgjba8kyq3RJWeOXVKBO1lWCYczHdcelwMH+l3GQZNY= X-Received: by 2002:a05:600c:870e:b0:4a1:6dca:51e3 with SMTP id 5b1f17b1804b1-4a18e4487ccmr356890205e9.3.1792040641498; Wed, 14 Oct 2026 22:04:01 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:01 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 36/55] openssh: fix CVE-2026-73281 Date: Thu, 15 Oct 2026 07:02:59 +0200 Message-ID: <10542c0b4e71d6371062799d6aaa42a6e266b88b.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247834 From: Hetvi Thakar This patch applies the upstream fix that permits session-bind requests while the agent is locked so forwarded sessions remain classified as remote. The upstream fix commit is referenced in [1], and the public CVE advisory is referenced in [2]. [1] https://github.com/openssh/openssh-portable/commit/6a57081dc35acf3ee298108d4bc3580489608d5 [2] https://www.cve.org/CVERecord?id=CVE-2026-73281 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../openssh/openssh/CVE-2026-73281.patch | 76 +++++++++++++++++++ .../openssh/openssh_9.6p1.bb | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-73281.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-73281.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-73281.patch new file mode 100644 index 00000000000..9f017ece17b --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-73281.patch @@ -0,0 +1,76 @@ +From df8fe9ebecc57c486f2d1ea5b1a5c34b22858bcb Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Fri, 7 Aug 2026 05:18:05 +0000 +Subject: [PATCH] upstream: Allow session-bind@openssh.com requests when the + agent is + +locked, otherwise forwarding sessions established with an agent was locked +will be treated as local, rather than remote. + +Reported by sn0x-sharma + +OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7 + +CVE: CVE-2026-73281 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6a57081dc35acf3ee298108d4bc3580489608d5f] + +Backport Changes: +- Omitted the upstream OpenBSD RCS revision header update because it does + not apply to the OpenSSH 9.6p1 source revision. +- OpenSSH 9.6p1 lacks the later query extension and replied/generic_fail + dispatch, so locked non-session-bind extensions retain the 9.6p1 + success=false response path. + +(cherry picked from commit 6a57081dc35acf3ee298108d4bc3580489608d5f) +Signed-off-by: Hetvi Thakar +--- + ssh-agent.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/ssh-agent.c b/ssh-agent.c +index 2d2c6fcc..f1c35fd2 100644 +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -1778,10 +1778,19 @@ process_extension(SocketEntry *e) + error_fr(r, "parse"); + goto send; + } +- if (strcmp(name, "session-bind@openssh.com") == 0) ++ /* ++ * This function can be called while the agent is locked to allow ++ * session binds to be processed for new channels. ++ * Other operations should be refused when locked. ++ */ ++ ++ if (strcmp(name, "session-bind@openssh.com") == 0) { + success = process_ext_session_bind(e); +- else ++ } else if (locked) { ++ debug_f("attempt to use extension \"%s\" while locked", name); ++ } else { + debug_f("unsupported extension \"%s\"", name); ++ } + free(name); + send: + send_status(e, success); +@@ -1831,16 +1840,19 @@ process_message(u_int socknum) + + /* check whether agent is locked */ + if (locked && type != SSH_AGENTC_UNLOCK) { +- sshbuf_reset(e->request); + switch (type) { + case SSH2_AGENTC_REQUEST_IDENTITIES: + /* send empty lists */ + no_identities(e); + break; ++ case SSH_AGENTC_EXTENSION: ++ process_extension(e); ++ break; + default: + /* send a fail message for all other request types */ + send_status(e, 0); + } ++ sshbuf_reset(e->request); + return 1; + } + diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 651b7437a6f..572a614380d 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -46,6 +46,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar file://CVE-2026-60000.patch \ file://CVE-2026-73283.patch \ file://CVE-2026-73282.patch \ + file://CVE-2026-73281.patch \ " SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c" From patchwork Thu Oct 15 05:03:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100780 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25FE7CC6B3B for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32838.1792040645299275780 for ; Wed, 14 Oct 2026 22:04:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=FBhUSjdZ; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-49fbb2acc90so40831595e9.2 for ; Wed, 14 Oct 2026 22:04:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040643; x=1792645443; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=guC4wuT0x14EZMykszn96l0oupYraMnCG6Fw+jREhaI=; b=FBhUSjdZt9cDSYKWUboLPeyFEzRLXd1492np+NXB/9BA+PG/XTfaPgzOHharn3x3cJ k53ZVEPR9DEWegq8U12HZmNKxsf6idjVTdTGnlGIp7BfWRFSpXtT4Lj0NZ0DKD6zxOzO k2rUVIEydFDLlksOUQfUHAo6dftK8j+1DvjGk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040643; x=1792645443; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=guC4wuT0x14EZMykszn96l0oupYraMnCG6Fw+jREhaI=; b=fGKasUgX2GvXvrFNxDnj/aT995tBUtMSaVQ3s0WvvZhaxgBQgnD+z+sARVRU8JzRt+ LclCVB76s8HwagZqLKxuu8EDeUD244yujCSf5FuarR3TVIUt2e6Sg4KA3gZFmtpIwxgY 6TLhnpZkDVaYDuk4q6LqL0kfFhSHXBChG6ywgMb+ALNyR2KWU2nJQxnX9TKf1P9to3fS CgjZcha0LFRqgGLlVbymqkrpv9cUOlTKOsJaEDmVCcz08M/MT1aurqg4ZVnCi/bYkk66 49wRjKYz848w3+S4NhQG1jwmj4RY+e3zPj06zpskbqHpGBcVXZlfm6k8R2Ls1PObbkS8 FkLw== X-Gm-Message-State: AFq9FYLw1u+M1QF8wrdEgi96WcGInD4pDnsvfUtoXXowQFBs3PNnGEQP xSIcliDGlNjjg1Z7SGecNfw27WfujuOoA9e3ldp0y7mwGjPHgkLQlN0dLeJdseNy3tvsUDI+THM sggiW4ns= X-Gm-Gg: AYBFou2iM/WgnnLTQIbbJIPhm1wY6BT0sHyxT+27799SKny/8/vbk8IFGzPHhRrxOtu SfdOTnNfX4oC4xQ/BhNHcBBnTC/zmM1OBeEgVqPDU6T0V++CVOv1yQsWK+bw6QlxLjlyVkZa9IP EtmTjK6XH1VHUiiBn5CNkcVp04humBXqhO8ToUDfNYPIscJtRrqQsW1RQiBcJ2a38YDYchVUb7s LPVJecdIlhYDclxnkogpJxRZIMpBa3kXPJTKHXqNeTOwfaLL0bfzwzYnF727vsYZbxWyIucSwFH hiin2OKhR0UOoEe3JinRA2wksqSsbtZAirRSVmcQj4HCrqFjXqA0si1sHPXaqzh5i+X7sAqzhhD QAl5XcbuksYkIxsevVyxxtw6l+AbG5/sqZI0g4uLs6Xw1K5mmKpIZl0tsXCnvpjpZ7OTgYWTul3 ifNsiPTis8OKypHfxVgPInBW32z7uDZMYzUncAcWDreBzwEuGRfMSrdY/KasiBWwUCtnFfrcUFV wJArgNr4xplmGEkEO8qcJ3loR06g5962n8IrnLgD18f3+BPG5sMdMeKHZkMmwXdBLlSSZjQNtCa QaNujZ7s X-Received: by 2002:a05:600c:8519:b0:49d:4ef:bf70 with SMTP id 5b1f17b1804b1-4a18e4a16femr341636625e9.10.1792040642002; Wed, 14 Oct 2026 22:04:02 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:01 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 37/55] openssh: set status for CVE-2026-55653 Date: Thu, 15 Oct 2026 07:03:00 +0200 Message-ID: <8c6f092cd98deb49db7c6ee8db18a3c679705786.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247835 From: Peter Marko Per [1] "Only an issue with FIPS patch which is not in Debian/upstream". [1] https://security-tracker.debian.org/tracker/CVE-2026-55653 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: aabb2b44eba6cbf658eec7850e1ca3a806e0ad9a) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-connectivity/openssh/openssh_9.6p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 572a614380d..06d28d8a40a 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -61,6 +61,7 @@ CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distr CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1." CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh." CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}" +CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches." PAM_SRC_URI = "file://sshd" From patchwork Thu Oct 15 05:03:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100779 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61F55CC6B3F for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32839.1792040646209823983 for ; Wed, 14 Oct 2026 22:04:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=d+At2Y36; spf=pass (domain: smile.fr, ip: 209.85.221.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-48de72fc832so896150f8f.1 for ; Wed, 14 Oct 2026 22:04:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040644; x=1792645444; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5PNZWwOQrCKU9n6Hh+EboSqLWRLZrsBp7aHVnQiKy2g=; b=d+At2Y36FWfsJikvvavDeRWM+GOTUf3BHewtf10BFipR3rw7MPRe0oAnaM/ebfzVtd IrLHxk3VCmWus4bsYTuRYFGSdgc+7THzkACYBpb8htaTD6bUMR6+EVbKNhVrqeElj08W NprCeJpFVXNS3+tgbNGtE5Ensraun5iH9A7+w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040644; x=1792645444; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5PNZWwOQrCKU9n6Hh+EboSqLWRLZrsBp7aHVnQiKy2g=; b=RufMeViyPtHuEsyMnhuDZs8i3W7zfcq7xuG9QEreXW2ROkTNHAPXlbm0z+OfcRRRTf EDk4MtXM+OCPd8XEm+7BOdDjuB5/zmSPzToM1r8g0MQ5gkN5KAkGnmxmd9GL3IAJC7CR X+kzYVWbeodXyrYBAeGXuTQj75rMAq5G7N2zyp2Lw6cVN+Sihxdt6wqHluFvfiXJ7DJr ZycnaYrBV8LELgUvLaSNgQpCEtn7nVGtUEVbXzWPYvi9chMCgy40m2KiULu9koec+Ol0 9E8ACD9a5dvuxvcmz1hVxWuABB+6E4m0M8w1RYfCPco2fpPIc2a8/sWmvPOj3b5bOhLi K3Vg== X-Gm-Message-State: AFq9FYIF1TaoAosuO5vb0B2vT4qpl7YAz3IxqWqimWowhriJQjL8Vpmd 463gRcN0MZYUOTrSKC4MVinb/K4U1RBYbfJ4lkR0Ugki4vFhq7bUUCqx2usdbeMK5JpVS24OCDE CEWNuSaE= X-Gm-Gg: AYBFou3byxuY2Hh0+gL9p3oDi+vdH6kpyncz35HcuDgmSEFWlbgQ4CmXDEh4sLnXz77 9v90R8uwQJM51QuRYoo+Pr+hXEiyrVe5fseLmopsDs3SEGX433V+pndBS5uu/CGzYfCCXy+0IAP MU//uP1Fh9a1Lbm0kDNTVGPuk0UTBIg1K+nAgCtbtHs1m5JCK42hlxzU0dXpR/nizVqeKaJw6H7 5N0hbhJgigkalzfJBiZ+1StRbqtguc3C2Ger5usCLuMVCDFtZmTNutqZN9O1OmxynTljX/ePQox MxuSuJcQdvsntQCXabnyxGSMFu0vJrsuTbpU8wyUEj0PkXmpaLnZaDeLnvw7vhY2n9GjZbOqraZ QbYdFjTk7CpAR17oWVm480Qs6uDOlrFxVXNEL2H+UoQe60CKfvkaNJxUVt+l8rl2dJegD4aAsej s7d7N7J+ln+6vJilCJSig2XvSvfZjeMVDX6wU8rvQ+uoigKtyhu8Bqftq9cKogzOAnopV+lU9Yk ZkqtF+PHumM/QwOLSRSCTg9ZqxuySBiI1ekX4FXChXQOUL5WrAHhmaWfe1wtQ2CBtdCsKZ2gA== X-Received: by 2002:a05:600c:3b2a:b0:4a0:2540:b46 with SMTP id 5b1f17b1804b1-4a18e4aca94mr331666905e9.12.1792040644346; Wed, 14 Oct 2026 22:04:04 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.03 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:03 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 38/55] openssh: set status for CVE-2026-55655 Date: Thu, 15 Oct 2026 07:03:01 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247836 From: Peter Marko Per [1] and [2] this this is only problem in RedHet patches. [1] https://security-tracker.debian.org/tracker/CVE-2026-55655 [2] https://ubuntu.com/security/CVE-2026-55655 Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 9ea8649149e711668b85c7e35cb7c259437e8c0e) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-connectivity/openssh/openssh_9.6p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 06d28d8a40a..3c74e3ef4c2 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -62,6 +62,7 @@ CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh." CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}" CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches." +CVE_STATUS[CVE-2026-55655] = "not-applicable-platform: Only applies to RHEL patches." PAM_SRC_URI = "file://sshd" From patchwork Thu Oct 15 05:03:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100777 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CC1ECC6B3E for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32449.1792040646589126224 for ; Wed, 14 Oct 2026 22:04:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=0cAOmY0n; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4a02718da81so38470285e9.1 for ; Wed, 14 Oct 2026 22:04:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040645; x=1792645445; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=DzBfJhzV12qzBJNcaQXx4J70RNRhN7KKoyzLtvNtC0o=; b=0cAOmY0nepr5GVs4eKg+moWmtt8R2ff4LTilbi+Y6qz5C/nR+wNt+hUFKuhdP6hlAo Aqxs6WLeoZWJU97LMdWUDpwj8oxH6tCMo1JfDc9BFa7OP1V2yDQnnL/u1+Fz2KmoOps0 rl1sWV29HM6Tpypuda5TIxRWVi2CmPnNtBqCE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040645; x=1792645445; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=DzBfJhzV12qzBJNcaQXx4J70RNRhN7KKoyzLtvNtC0o=; b=bVP0tq4/40l9157KDuWQHpL6PRqVMTLnlXkJesUTBOV6+4BU4GIB33Goz5Afvnd8BO 0Edt76xJpWXxKR8w6XJ9juOcnMC7GagV7TBzbMoE53Qwd5/ON6s0PEEw3LgOnDd7tdv1 5xvevo1tHhsX83glNOwjztlNM1dK+uGTl1pnfkGqVAogxtpT4WMRZPGYv90JFKPBNUkU WEMiu42ubbyUzlMbrZO78BiFLR/flw68ijPe+qTW4P1pE5XecT91bTfj1/KMeNoAf9UM SJNbDliKUGupMb7pKmiW5HJe6WvTx3CE7X7dbzQ927GXfuNqCerch3Vt8O+59xPU9zGB tyBQ== X-Gm-Message-State: AFq9FYKmbURXYzzOibTQmNhawSZXCiUZwjtLmOCYoHDimxGvJcR71/5j HhoXyd+c6CqBw5Mn4Ila2sUZemhI17lTbgm3ZldfdP7zfsycpQl8Xx1LwnfXqIT7Dc24Sj/pV2R zap527u4= X-Gm-Gg: AYBFou3Axqx9xPJd1n6ByZTnOy8IAgOfNge0vhuLnCry3snEubqYAebpbK6ntZQm3rB bzkssUUum9BCxenrxQmgH/GKKjTEJgvgE4z0Y7MIO//XXQ/4anf4hk0VAdQmX2zfH/eJcXwuy9x ztToEy9AVusFqWmUPmHWrIF91GtAAT8svvqxfjglpePkBzIVFnJtAPkGpkdV314bncKb2S/A5EB RDACDy3i4OKypDLBEVZNtI7EO97QSRgqRdRuSvf/Y3NnQaBO3OQUoIFib5u8dL2tKf9sZXp1jaB HBbQbbTlzAkmij8YYnno15tqWndV4922zq95Cn4KVWJl6ehhbGnQ2sMCPiRqPTBQTI2+D+z1faF 0iBu3dRFYmUKmXMQqNAOo+8j3vZxjhAvQdMabOuyYDgpYTwDaUBqbz5GPLZHciZounWloxKu0M+ mxXrYt12yGBOBDkAf5XjZCrIvTbg0o6F/tey3AK30n84HcfeOxXFq16t10K4bhKLGcKdyRjGPdd +pKM0+9o2HLDEWBnVUxZc3iZYybu6flGMWSKPcPaMlhl4lcm7t7auqKEJnhdzIV8nybo2zdgg== X-Received: by 2002:a05:600c:548e:b0:49f:f9d1:e618 with SMTP id 5b1f17b1804b1-4a18e4aa057mr361590205e9.17.1792040644846; Wed, 14 Oct 2026 22:04:04 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 39/55] openssh: set status for CVE-2026-55654 Date: Thu, 15 Oct 2026 07:03:02 +0200 Message-ID: <31ef209e08556e37ca3706da4508c66a60b5e94e.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247837 From: Peter Marko Per desctiption in [1] (which is different than description in [2]), this is RedHat patches. Also [3] suggests this. [1] https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/55xxx/CVE-2026-55654.json [2] https://security-tracker.debian.org/tracker/CVE-2026-55654 [3] https://ubuntu.com/security/CVE-2026-55654 Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 389919ea7927962a61a5aaa7b641c5b60af560e0) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-connectivity/openssh/openssh_9.6p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb index 3c74e3ef4c2..6c8138ddd8a 100644 --- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb @@ -62,6 +62,7 @@ CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh." CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}" CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches." +CVE_STATUS[CVE-2026-55654] = "not-applicable-platform: Only applies to RHEL patches." CVE_STATUS[CVE-2026-55655] = "not-applicable-platform: Only applies to RHEL patches." PAM_SRC_URI = "file://sshd" From patchwork Thu Oct 15 05:03:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100781 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A84B4CCA461 for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32840.1792040647143252023 for ; Wed, 14 Oct 2026 22:04:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=l/0QcdX1; spf=pass (domain: smile.fr, ip: 209.85.221.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-48c4207ac26so4442621f8f.0 for ; Wed, 14 Oct 2026 22:04:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040645; x=1792645445; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+G/sg1u6DqSts40kpqZbvyCFJBNyfcRtb7j8ot10PXE=; b=l/0QcdX1onL/JgNjYLLo5Fvenukpo917RyAETlgqE3JierP6XmoVrTjlxNjNUD/F2R uTTpi2+Wl8rkL1OI8KjtMeSjQkvtpI0zCjXbjd7F6YA43zbnQdA9KgDHys38XPl+a9ST rXX1IF2iJ/h2TTrZ1M6Pi3taji684pLnXUcqQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040645; x=1792645445; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+G/sg1u6DqSts40kpqZbvyCFJBNyfcRtb7j8ot10PXE=; b=GAE2cVbPry6ucC5XwAnTYsqA4pLsrAIRsmopPWYC5b/gTxM/mN4r0YHaZh+pqyr8Dt 94NzKx+rxsC58y90uHs93M8jZjzzB33J+c4py80Yf6WdWYTHAZfA3A5/sEdUzrYsfx9k Q5GeS5YHnf7sYitiBdcWjPQDkV7ebyekh1cDacRp0vHn8oEdvHWATUEV0lBjZuzfE8TI EIIxnviBUFQ6AvKsmwMwR/UV7iEXZZCcOw5x6VldBALGXMqnZvgybilVijftAl5f3tGi VGg/msUamGZLhIwtYqc7aIWnJ/iV6+WERTGCFKENLKf5BMzh3UU/KIG/Xj1rcRcSDML3 ZnIA== X-Gm-Message-State: AFq9FYLuuqt9kCp6eULsLkmK3xaro3XPOvkx4TWuUFxmJAqF4ULKiQZm WfEZUYid/z0PzST3emknfLT6mpIiueW1DhXY8GjWrPu4Q5d4MbCZb1rMEh9RiPBIasIcJ+A6Eqb Ob44e7/s= X-Gm-Gg: AYBFou10IFKj0Ds7bDDjzgnu5YZx7xbMcDVo1s0pyGxI3nUM5swQQtlWNX0MyNu05st YS3YHAOTfnb+n7CJlIX6JzO4nZeLAX4MvYd8NXVI+jfa1/f9zSkU2bZto3ah9hgo7TdxQuWITXe jH3f+3yJLznKIb+6Bx5ZUXhX5n1UWZzFSr5F9c6ddlOTirCdRj2GrWi0vxV4KNDLl33Ov4XxH4/ Agrq7cEKophevDd6Tnj5ydrQunwUjtwjwycyfm6RXNVY1a3S3WjFb4a6Bf7yYeLrerJgyAtS3f+ NQuX9w4CXFzL8CigBO5QcdEmrB9H0mX1plF8F2snblpIckqoSGHPT1VgYnCusiJwpMRrncFK5uo hbrcNhlcukT7FefJq/qfCk+I7tIiLd270Cl08yGRlHuOXo87CpvmqPerlh+jQyb/nDK15odZsMF B58tdB4Hg+tC598IzxyJkgR1hhzwCXaLdyj57BIfhYUDx8HREP3HnDGy4nNuUZQVF0lsxfyejvT D/zpC7cYxOKCGtkQjmAKtH53c+Qww7s2coWcBt/ssD/NHc98Fa9ONhrmTVlKX4JbKPlxLbk+Q== X-Received: by 2002:a05:600c:4ecd:b0:4a1:96cd:2f60 with SMTP id 5b1f17b1804b1-4a19ecf4c20mr230109475e9.3.1792040645278; Wed, 14 Oct 2026 22:04:05 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 40/55] tzdata/tzcode-native: upgrade 2026c -> 2026d Date: Thu, 15 Oct 2026 07:03:03 +0200 Message-ID: <82a02ea55b0e4a3e8ea9e7ce0df71a08bdac2491.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247838 From: Vijay Anusuri Briefly: Canadaโ€™s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent settings like TZ="EST5EDT" now conform better to POSIX. Fix security, performance and porting bugs in zic and localtime. Changes to future timestamps Canadaโ€™s Northwest Territories will not fall back on 2026-11-01 and will stay on -06 year-round, matching Albertaโ€™s recent change. Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see โ€œNOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADAโ€ below.) This affects only America/Inuvik as the rest of the territory is covered by America/Edmonton, for which the equivalent change was released in 2026c. Changes to past timestamps Colombiaโ€™s 1992-05-02 spring forward was at 00:00, not 24:00. Iranโ€™s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.) The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now conform better to POSIX. For example, EST5EDT now always uses the abbreviation "EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight saving time, whereas it formerly had different UT offsets before standard time was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all contrary to POSIX. Also, though not required by POSIX these names now use US federal rules rather than rules of places like New York, reverting to 2024a behavior. This change affects only timestamps before 1966-10-30 at 01:00 standard time. Other data changes The temporary hacks used for North American timekeeping changes now work around a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug 124851. This data change does not affect TZif files or timestamps. The change does not work around the related but less serious GCC bugs 116110 and 124513. These GCC bugs are all fixed in GCC 16.2. Changes to code zic now rejects Link targets that would have invalid names, and more efficiently processes Expires, Leap and Rule lines with years far in the past or future. (Thanks to Darren Carreras.) zic now ports to systems that report lack of link support via EINVAL, ENOSYS or EPERM errno values. (Thanks to Tom Lane.) When tzset and related functions encounter a TZif file that is too large for them, they now consistently fail instead of sometimes silently ignoring excess parts of the file. localtime-related functions no longer mishandle extreme timestamps when given TZif files holding some unlikely timezone histories. (Problem reported by David Sarkisyan.) localtime-related functions no longer check the values of TZif filesโ€™ standard/wall and UT/local indicators, which these functions have not used since 2026aโ€™s removal of the old posixrules feature. tzcode has been ported to Haiku. localtime.c now works again by default on AIX and DragonFly BSD. zic now rejects โ€˜:โ€™ and โ€˜\โ€™ in Zone and Link names when running on Microsoft Windows. (Problem reported by David Diaz.) Changes to documentation URLs for release tarballs in tz-link.html have been updated to reflect their new canonical URLs on data.iana.org. Ref: https://www.iana.org/time-zones/releases/2026d Signed-off-by: Vijay Anusuri Signed-off-by: Antonin Godard Signed-off-by: Richard Purdie (cherry picked from commit 400938b8ca41654fbda6c34c6eb8c12aec1f43b0) Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal --- meta/recipes-extended/timezone/timezone.inc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc index 4271b306486..441dc9be998 100644 --- a/meta/recipes-extended/timezone/timezone.inc +++ b/meta/recipes-extended/timezone/timezone.inc @@ -6,7 +6,7 @@ SECTION = "base" LICENSE = "PD & BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba" -PV = "2026c" +PV = "2026d" SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \ http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \ @@ -16,5 +16,5 @@ S = "${WORKDIR}/tz" UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones" -SRC_URI[tzcode.sha256sum] = "b1cffc3ace4c4c7cd0efba2f7add86ec3d0b79da48bcf03582671fd3c8feace8" -SRC_URI[tzdata.sha256sum] = "e4a178a4477f3d0ea77cc31828ff72aa38feff8d61aa13e7e99e142e9d902be4" +SRC_URI[tzcode.sha256sum] = "2f5c9f7fe29e6b8cb863583667884b8ce17b0a485355a054b591c6bdfcd81791" +SRC_URI[tzdata.sha256sum] = "0cb2aa8e333c3dc049badc42a0c61f21987b8cd44e107fa900bad764aacc7767" From patchwork Thu Oct 15 05:03:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100772 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF8ACCC6B35 for ; Thu, 15 Oct 2026 05:04:13 +0000 (UTC) Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32842.1792040647465381194 for ; Wed, 14 Oct 2026 22:04:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=129erlRy; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a180fbeef5so43564175e9.1 for ; Wed, 14 Oct 2026 22:04:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040646; x=1792645446; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=wT1nsHvQMAUBfgqZmm8Dhh3i0eGX6wmoe79WdUGokts=; b=129erlRyIdbNS86n8yYKXJXTdzuz9yNxATVGmAngCBIHcBFdUPS5oA3p51GA5GBo2M siA0+RJhsERRaxoYhDjHzPTdlbz/ArfSigfuVe11GHSA1e4qS8oNVSNQJzNmorakev2w pVMMaWpoxHKM3A73URxpcIRruNQ5GXfkFKsGQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040646; x=1792645446; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=wT1nsHvQMAUBfgqZmm8Dhh3i0eGX6wmoe79WdUGokts=; b=ypA3kzg00ZE8a4zf6dwG/cNM9Ohyq0e/WdvqCD35FE7zQgmElsOedO456MJnOpRnbg Kx2HCUWErB8jkjnHKHkaHqJcMHCOpslg0rOgM0RoyJd9r15zhDlI8o9KxdRk6KShHqCH 7ZXK7pGNr36SIxhoAu23LTDby5JEeh9Ciq1WZdOLgfXord+AHvZleRXH31jgvDETq4ho E2bh302JSyH9GmOXMoYgdS2R3QDEWU5rSdCxdS/c3joSu7r/SqLlGEwA/Ow4gbK5U+OJ hFsYMyVn0DKsWd3rs/uJIoKpIB4MJxmGcoVoezEf4jonbFiTuu16rAJLUKovk4qDnjbN qauw== X-Gm-Message-State: AFq9FYIAdBcObLVMrgDcR5fpDEzmxjVxXyanZ5vuzjXUrnPWCaSi82PT amyj2OQfThBaEyBnKCnoQrCinQ4Xr1ov3+X9hTUZ3OciwEIGg5vZjM24zKQDBqd1Qvcs/M2iUNB /QObM488= X-Gm-Gg: AYBFou124e8Eaz7bnhCQn94g7KJR33xLYO7++3Z2YCS586UqMZRI4oEqWZgzk9in7ow OVM1XZwsaEDp+ROP9PSD2smbQA5IvZKxHt8WmUJ2TkpPg873xmV3WP2HOzoo/KHj0hkNHIdF7jG XHPcaBMjbVIt/z+c7zL1sA2PAIhheHAjr5Q9glxhoFUcr2p5X+jwKm/OfVM0lV6D3iKgUSXqEcR Vr7bS1e20rX+SU9t6eM/DXij2BVrtyOS0KOjs/p75PLgmB8c5kEu9ks57CPlMRO2viFRVDG5gO1 BBXLEJOWOqROEX6H2jjWiYYTd3eFnnSp/nbKPSRqf1nSI//mbRCoGeB+dfyc/6LZuczoK2rXdgI 28meOcKSthcDu470s8aEEjTxjzBJfLuvNngeH/kqteXL2xwQWiHWadi0E/A/0Lzuv8GlRZo5PG8 aLaMrw42FsoDTB5eQA8CFjS8vLuECyJ59VnrePQmnnOfY9jnJJvdojn8COh+vhzOvSHFRtFAL7W h7r99dCpFpyxqlW8Vh8rMRDViZY8KPc4zdvylzCX2g6m/6nSsLnQtN06sJW6z6hklBwkhnNrTL7 Drh11qmO X-Received: by 2002:a05:600c:548f:b0:4a1:a39b:e71e with SMTP id 5b1f17b1804b1-4a1a39becefmr211205525e9.5.1792040645631; Wed, 14 Oct 2026 22:04:05 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:05 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 41/55] alsa-lib: patch CVE-2026-90781 Date: Thu, 15 Oct 2026 07:03:04 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247839 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-90781 Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 37d0e17fbb7848340169ba00ca8dee2567a68462) Signed-off-by: Yoann Congal --- .../alsa/alsa-lib/CVE-2026-90781.patch | 41 +++++++++++++++++++ .../alsa/alsa-lib_1.2.11.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-90781.patch diff --git a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-90781.patch b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-90781.patch new file mode 100644 index 00000000000..b2b2ce84cff --- /dev/null +++ b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-90781.patch @@ -0,0 +1,41 @@ +From f84cd4ced7b36fddb8e4ee24404cf7c091d27020 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Sun, 30 Aug 2026 20:20:30 +0200 +Subject: [PATCH] control: ctlparse - another fix for one-byte overrrun in + __snd_ctl_ascii_elem_id_parse + +Follows 1e27d63ef6d1dcf7d1f1a1e1eca3ea779e7de377 . + +Link: https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/ +Reported-by: Harsh Raj Singhania +Signed-off-by: Jaroslav Kysela + +CVE: CVE-2026-90781 +Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020] +Signed-off-by: Peter Marko +--- + src/control/ctlparse.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/control/ctlparse.c b/src/control/ctlparse.c +index c40de2bd..7132210e 100644 +--- a/src/control/ctlparse.c ++++ b/src/control/ctlparse.c +@@ -207,7 +207,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str, + if (*str == '\'' || *str == '\"') { + c = *str++; + while (*str && *str != c) { +- if (size < (int)sizeof(buf)) { ++ if (size < (int)sizeof(buf) - 1) { + *ptr++ = *str; + size++; + } +@@ -217,7 +217,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str, + str++; + } else { + while (*str && *str != ',') { +- if (size < (int)sizeof(buf)) { ++ if (size < (int)sizeof(buf) - 1) { + *ptr++ = *str; + size++; + } diff --git a/meta/recipes-multimedia/alsa/alsa-lib_1.2.11.bb b/meta/recipes-multimedia/alsa/alsa-lib_1.2.11.bb index 068a727c67a..5b67d1cc426 100644 --- a/meta/recipes-multimedia/alsa/alsa-lib_1.2.11.bb +++ b/meta/recipes-multimedia/alsa/alsa-lib_1.2.11.bb @@ -13,6 +13,7 @@ SRC_URI = "https://www.alsa-project.org/files/pub/lib/${BP}.tar.bz2 \ file://0001-topology-correct-version-script-path.patch \ file://CVE-2026-25068.patch \ file://CVE-2026-56109.patch \ + file://CVE-2026-90781.patch \ " SRC_URI[sha256sum] = "9f3f2f69b995f9ad37359072fbc69a3a88bfba081fc83e9be30e14662795bb4d" From patchwork Thu Oct 15 05:03:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100773 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 044E6CC6B3A for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32844.1792040648098877134 for ; Wed, 14 Oct 2026 22:04:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=c4AMOjpx; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a1b07c3c5fso14743595e9.1 for ; Wed, 14 Oct 2026 22:04:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040646; x=1792645446; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=QE1ePBcHWgbo47U7xlPB6ZRfPi9VOSJ7fOE/tIKj3I8=; b=c4AMOjpx6/dzj9PQMudClQ8lozhMWsVf1Rn/2DRlVEjbOWVStJdmw0dZiOH3bPQO1e 1j267zO2FyL86vYeubOy/zySGwIUSTPH8VBaeFGPimyXnTxjs+uGTBsVKh0TpJqC8b29 PzD+aQ4fdKz6NiCjKydjef/zrvhSb7u7umDM4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040646; x=1792645446; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=QE1ePBcHWgbo47U7xlPB6ZRfPi9VOSJ7fOE/tIKj3I8=; b=1khhoS/rEEVIuQoteLdhDOyiVgI1JXZaITJf175kapHykDSHOqEwje1M9yLxNNDyOg 2ECpkhHto4G0D7T7XC+MiJjbEeM1Qb++kB+xoXx1xeWYQCyaNNQmi6rlOX2Hi5I1EyKG 6o1Rv0+NeCYs275EFX0+yfCYNL4+VJN9I3OaXZwsgzNVIfK7jZ9JGZ6vMOlo1El1EmRg QT3+QzeabkxVlWEkGSCy0cUy/JJe9bwhA6Mb33wNAihg0USpoONZhlOl4yVkkrJGNI9S Q6AP/ATXzcoOqFs8VukA4oZycZvw2iR9qoo9btvGM2+EYLfCRmJPpMTrsEIeL6lBLkLa k89g== X-Gm-Message-State: AFq9FYIhu/oEZOyzX9VZLLihweMmWDjjeI7Yl43oHlxouu14QKT2GIXL IHVEAr2yi3qsYA7uxms9fKOGr0L1nFfi3537VxX8A/6ae0oqMLjj1O15xE0Y4zNGvUj7r3ZNCzd azsBt0GU= X-Gm-Gg: AYBFou25CqXIf7IpB/SDawRL+wYAPCwPnq8vUkFrrbg18UwgjqSTJXOrpbNI9viRFvT Tbdpw4mA6eIpUWhpexR5/A/VOsRDYM5xM94j5TlwPSiYhF+JK4T8aDByjTQ1cp86oTi9t1wTxV8 lPioL+/8G18MXzbgeG405ZHT/A1M9ZZV4gapZq9Wh3a3vSaNG0bx1RMjFsmvXtthA8M6vlupZ47 tvYDE7m+wgUUUMFwUur3O6GP6JomgKn2x9QVRzX8cNvChnGXLWpUM+1+TD4+QU1oEhJd8YDX8WV XOVFDIfxYLL3kK20hS7ezlheaePSb3mTfDztj+hjfECQFKsvZtT5cAxJJIUsBbzePVkvTJ4zg1W Bsx0aVe5Wqm6MuQMIrdh7pdq5pvO+pUpy/zXQxzHUEYdLA/RL08D+hWS63uzTu39SO6yj4zX/pR C7NgGk3vnGOvKRCiyHXlZ7lq/h/uGjAyBfSqxsUkjcf0APP/mN8bKw6MbLHozppnJkQ9mpcoosB No87kTikMVLE1PYPy59i39zBilUGsbqcx2Vc5umyiGMkBXyI5CvU8FYyrX7kTw96VMjan8O6g== X-Received: by 2002:a05:600c:8105:b0:4a1:83f0:7c8a with SMTP id 5b1f17b1804b1-4a18e4433d6mr356696825e9.1.1792040646193; Wed, 14 Oct 2026 22:04:06 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:05 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 42/55] openssl: upgrade 3.5.8 -> 3.5.9 Date: Thu, 15 Oct 2026 07:03:05 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247840 From: Peter Marko Release information [1]: OpenSSL 3.5.9 is a security patch release. The most severe CVE fixed in this release is High. This release incorporates the following bug fixes and mitigations: * Fixed DTLS retransmissions of handshake messages from a stale buffer offset. (CVE-2026-84782) * Fixed excessive memory allocation in relative CRLDP processing. (CVE-2026-35189) * Fixed QUIC unvalidated amplification credit may be over-accounted. (CVE-2026-35191) * Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC. (CVE-2026-42772) * Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves. (CVE-2026-54872) * Fixed QUIC STREAM fragment metadata DoS. (CVE-2026-54873) * Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V. (CVE-2026-54875) * Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake. (CVE-2026-72897) * Fixed QUIC connection-level flow control was not enforced for streams. (CVE-2026-75804) * Fixed a NULL pointer dereference in CMP client revocation response handling. (CVE-2026-75805) * Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS. (CVE-2026-75806) * Fixed a timing side-channel in SM2 signature generation. (CVE-2026-77696) * Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack implementation. (CVE-2026-84784) * Fixed a bug where EVP_DecryptFinal() incorrectly reported a stale success on AES-SIV authentication failure. [1] https://github.com/openssl/openssl/blob/openssl-3.5/NEWS.md#major-changes-between-openssl-358-and-openssl-359-29-sep-2026 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../openssl/{openssl_3.5.8.bb => openssl_3.5.9.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-connectivity/openssl/{openssl_3.5.8.bb => openssl_3.5.9.bb} (99%) diff --git a/meta/recipes-connectivity/openssl/openssl_3.5.8.bb b/meta/recipes-connectivity/openssl/openssl_3.5.9.bb similarity index 99% rename from meta/recipes-connectivity/openssl/openssl_3.5.8.bb rename to meta/recipes-connectivity/openssl/openssl_3.5.9.bb index be52e228f10..ef806d0d984 100644 --- a/meta/recipes-connectivity/openssl/openssl_3.5.8.bb +++ b/meta/recipes-connectivity/openssl/openssl_3.5.9.bb @@ -19,7 +19,7 @@ SRC_URI:append:class-nativesdk = " \ file://environment.d-openssl.sh \ " -SRC_URI[sha256sum] = "a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2" +SRC_URI[sha256sum] = "603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a" inherit lib_package multilib_header multilib_script ptest perlnative manpages MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash" From patchwork Thu Oct 15 05:03:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100774 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1855FCC6B3C for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32845.1792040648685496584 for ; Wed, 14 Oct 2026 22:04:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=jO6dNatW; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a19cba5c14so42865645e9.3 for ; Wed, 14 Oct 2026 22:04:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040647; x=1792645447; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KBM56g3cjBRPOd3iTU5k8JsVu932aoPpfS8OmJRVH/o=; b=jO6dNatWFkpHzf3s4tLCstDdY6PBxzbNdAfbFTYF9VEbgQQZlcQqdKLhjtfGvJFyNt 9ybt12p3mjsS3fqtliy9u5cLsXCBmS3HD7yW7/dgZteAJ/QU61HxTtgBx+U6f0T7GN1i Oxd3M/C709FC6hpRxnUuhUHdBB7OxVUydUv7Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040647; x=1792645447; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KBM56g3cjBRPOd3iTU5k8JsVu932aoPpfS8OmJRVH/o=; b=YiaUIhnsdsPxrfK/Naf0s2K/mZZ+D6eDVJP6WTOiA9GI9Syh2aiYpfqXy/hREbxMuP MDb8F7HI45wPrlobUtrzYiYhHD3I3PILwswzwxyXr2PAgGGG8dibX1jHJRKNsXC2fZC5 fmqv0d1Ns1AJqNNKfAD5WOtFtraJp9BfH9dgHdhrQ+DZYYsoaqzl14jFW43QS9g9eq77 fWtGUx4vBkYJHVyX+75cQWZQV3FMmK8PELvS3yWxiYkpkdD6bG9yzFtOYsE74j8s9uaQ 6KoJTmKD/83Bku7su6oARydL7fpJyNlKfsKcibJmtCz5uXlEK5F6f8II7wiYJQkp6uUR YF9Q== X-Gm-Message-State: AFq9FYKByU3qB8KBl1uhEs+3aJ+VyUo0U7J+Ai90bkVzLT/rRS+RmBNd btzsHcA8BYf+mvFhvZNLn/lkma7Lgs8+W6tNAiJ1CeOxLxC5IMQCXv7LmqkZfpb3EnGhiDoSsxB fn4sgmDM= X-Gm-Gg: AYBFou0FmNAJgf46W3KG2TxvXveX/XaXr6x2w6JUDhuEIT4UEllHRSGRy9xROWx90ZW kvmgnK1/8UTivkW7QDBQmAHdXAGDILVWBG7l3nRCSx+dA6fYElawrcC9wpMF42on6Mwkb1rkLCW qtSTuvFpkAip6StV1a7QEoj76KwOXbhaVONM8gwVmudCWIAuQeyb4YZ7HVD5l4IkCTZVRShmWmW Y96s2YrG/eDc5FPGz76rMwyNECRGj7QaBfanK0vJR64pyiNPqtl2Dsv2/NbvVREIg/bvNN2KaHy w14Dl24J9WjR215Nt2yMnfWuvtW9mQBhfqFK0AEJF7bziN/hKKWpTdV3kSX4memMnjMaaSRofGG w4BByiny0w2bWHXdmibabgqUU38zngCXTZ/jS8gy9ynRMnK5sJO5szV4y4tKhKmU1rFs29AVbWD WjauIcB/QExzW5bUZmW+i/7vO1x0n1xniziDYqifJacXncBaIdG0wvz3a6HMRXaUp0RCBszkESQ K1XTeru1B/9dlNesYYloLNY2BUeAy8jJfZ+XltgO9TNeX+iOQvPBwQoA80ntI2bfEBBpgvPfw== X-Received: by 2002:a05:600c:820c:b0:49c:fa21:1c81 with SMTP id 5b1f17b1804b1-4a18e4d5563mr338446345e9.22.1792040646994; Wed, 14 Oct 2026 22:04:06 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:06 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 43/55] connman: fix syslog identity with glibc Date: Thu, 15 Oct 2026 07:03:06 +0200 Message-ID: <507c75cb27bdd59cb0f372f7cd4d22abba9861b0.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247841 From: Gaรซl PORTAY The patch 0001-src-log.c-Include-libgen.h-for-basename-API.patch changes how the syslog's ident string is handled to fix a build issue with musl. It passes a locally allocated string to openlog(), which introduces a regression with glibc, as glibc does not make an internal copy of the ident string[1], unlike musl[2]. As documented in the syslog(3) man page[3], the ident string passed to openlog() may be stored as-is. Modifying the string or allowing it to cease to exist can therefore lead to unexpected behavior or undefined results. This removes 0001-src-log.c-Include-libgen.h-for-basename-API.patch from SRC_URI for glibc by moving it to the libc-musl override, ensuring that it is applied only when building with musl. Note: The patch was submitted upstream to connman but was never merged[4]. It was also removed from oe-core when connman was upgraded to version 1.43[5]. Fixes: Sep 7 06:10:36 qemux86-64 daemon.info ^A[776]: Connection Manager version 1.42 This fixes commit d0139bcbe0 (connman: Fix build with musl). [1]: https://sourceware.org/git/?p=glibc.git;a=blob;f=misc/syslog.c;h=b7414e7b43a510342273bece335b4258e8754905;hb=47dd7e0dacf50c740b04c78d3f85fbf983d53aba#l338 [2]: https://git.musl-libc.org/cgit/musl/tree/src/misc/syslog.c?h=v1.2.4#n64 [3]: https://linux.die.net/man/3/syslog [4]: https://lore.kernel.org/connman/0caf957f-e046-4453-a8ae-fd6c994ac95d@gmail.com/ [5]: https://github.com/openembedded/openembedded-core/commit/467d28f5d243d821722cf8dcdbb9675a2820cd4f Signed-off-by: Gaรซl PORTAY Signed-off-by: Yoann Congal --- meta/recipes-connectivity/connman/connman_1.42.bb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/meta/recipes-connectivity/connman/connman_1.42.bb b/meta/recipes-connectivity/connman/connman_1.42.bb index 9b3abbe2583..4fb7bf6a350 100644 --- a/meta/recipes-connectivity/connman/connman_1.42.bb +++ b/meta/recipes-connectivity/connman/connman_1.42.bb @@ -6,12 +6,13 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \ file://connman \ file://no-version-scripts.patch \ file://0001-vpn-Adding-support-for-latest-pppd-2.5.0-release.patch \ - file://0001-src-log.c-Include-libgen.h-for-basename-API.patch \ file://CVE-2025-32743.patch \ file://CVE-2025-32366.patch \ " -SRC_URI:append:libc-musl = " file://0002-resolve-musl-does-not-implement-res_ninit.patch" +SRC_URI:append:libc-musl = " file://0001-src-log.c-Include-libgen.h-for-basename-API.patch \ + file://0002-resolve-musl-does-not-implement-res_ninit.patch \ + " SRC_URI[sha256sum] = "a3e6bae46fc081ef2e9dae3caa4f7649de892c3de622c20283ac0ca81423c2aa" From patchwork Thu Oct 15 05:03:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100778 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32E13CC6B3D for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32847.1792040650836795597 for ; Wed, 14 Oct 2026 22:04:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=HCVHrLRR; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a018dc1f98so38668945e9.3 for ; Wed, 14 Oct 2026 22:04:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040649; x=1792645449; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=aXl+HBhqmQf9ZN1CIhCQfojMTMy0xECyOdPzzFQ1f8A=; b=HCVHrLRRgOTJtCrmqgOF97R1CdR81tN6B6gtNX1gGl7BylOzDveFmcFgFiXw7kMzjh Gp76NKnBjSlmPKThPMb4XlWGrbXMS4dfFy9O6kZxJF73YBYU9o3fg6jZ8SznYkctYQ9U uIOlryiuA6XAluQiFku+I2A9zzdxb5keeF+r0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040649; x=1792645449; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=aXl+HBhqmQf9ZN1CIhCQfojMTMy0xECyOdPzzFQ1f8A=; b=11Zhju9ByNmrG2Zxed0jiUYRrItPlDdjv2Tnf5O6q/mE8RWDlRipbhp01kTQ8rAy6D sgwrj/E921j44pI0229kvKUoJtXcsjC8UYYcRhNZEtaS160aAsBLxioQohlou4Yjne77 xmloG/FEGh5YibnNAZPNmoDMd36T+ra/Dlol8wX9KO7dyMFruhwly5OgOqIKxiv5b1kH kUNFeGAXSSGDaSH/uJSVcP4qdZ31viz/K5ytuPDcqD5NNJKrb/bvOyk4QfnpE2/R4uCv c4tYjl+HtmuI3cWIM3paMSCLEteUgXbyV/q+HyymySlrUyOOJkrXUHf3Wo0BAmJ3FHE4 TTew== X-Gm-Message-State: AFq9FYKjzA9DJRWmNvZ7EZfJXwisBlM65nKXTOTbEiVbtsKjuzKOEe4+ XQOwZ4+96z5ZeXYspDgWNQ8Y9xT3Pdav4Vb4KfTAR/0f/KWsz46I1SF4SbXHbkQT4LvJv9HZ+Ib R7CdHRsw= X-Gm-Gg: AYBFou1dgCqfV6uraIWO5zm3WC9ilz0+Mxx/K6vaSgzjE3mmlLT3rCYnD96oxFy/m6D 6VgpQwLAIVoZdjGwXYGSs6pecRuDc3UeLwMPJMN6GlzcOSAbkCqz7Z12Cxp+9P3lm3z1pRYIcfD dR+6O6XHCiR0SDuY3k1MSs1592+8bRikbDoAkuFsL9gF8tWeiNfjHfdkO7VEu7jpQAuS6yfUP8M 9LsTED8W0ksTLRXbYhnAFG8yWt/TLwiu47LCndwYMXgWv5pgtRc8ZTYsSGIGRC3fAHgCNdiW5UX ugukv9bGMjt0ELj56X8H8xbD7jT3i7HFmG/42tL/C7fRuFiOSUysEF7EEtBj8yQl/rvV7xLUMia 3qFBCatDfBU5X3u0eDusEnhZHBLKXBZLVBuLxQSQZfNu0btR5BaJccdPFgXK025TM4TjWCBLo4/ xgjwLlYk2yiP1oaWpLWNMIXfPiWmqNFAqpIOpR3+UFEWXF3YNOtGFv55pi+a8YDgsKTi0HBPbsR 4g5Xk0m9wqakLQIfDRv54fBun8OtahGKEhmWB8PHLHh1AI9WZouCkamkQqXP4pb8PzQ4nwN1g== X-Received: by 2002:a05:600c:8b58:b0:49f:bcce:13f5 with SMTP id 5b1f17b1804b1-4a18e4ca287mr326402365e9.24.1792040647653; Wed, 14 Oct 2026 22:04:07 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:07 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 44/55] systemd: replace a bunch of assert() with friendlier checks Date: Thu, 15 Oct 2026 07:03:07 +0200 Message-ID: <5a949112ac0d8baecc3da1ef7b20c3af9da4d1db.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247842 From: Suresh H A Backport a patch that replaces a bunch of assert() with friendlier checks Fix is already available since systemd v258-rc1. Journal file contents can change or be inconsistent on disk, so they must not be checked with assert(). We hit this on systemd 255.21, where dlt-system aborted in sd-journal: dlt-system[1284]: Assertion 'd->object.type == OBJECT_DATA' failed at src/libsystemd/sd-journal/journal-file.c:3237, function generic_array_bisect_for_data(). Aborting. generic_array_bisect_for_data() received a data object whose object.type was not OBJECT_DATA, and the assert aborted the whole process. The patch replaces these asserts with "if (type != expected) return -EBADMSG;" in bump_entry_array(), generic_array_bisect_for_data() and the journal_file_move_to_entry_*_for_data() functions. A bad object is then reported as an error to the caller instead of aborting it. Signed-off-by: Suresh H A Signed-off-by: Yoann Congal --- ...a-bunch-of-assert-with-friendlier-ch.patch | 108 ++++++++++++++++++ meta/recipes-core/systemd/systemd_255.22.bb | 1 + 2 files changed, 109 insertions(+) create mode 100644 meta/recipes-core/systemd/systemd/0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch diff --git a/meta/recipes-core/systemd/systemd/0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch b/meta/recipes-core/systemd/systemd/0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch new file mode 100644 index 00000000000..aa78f4d797d --- /dev/null +++ b/meta/recipes-core/systemd/systemd/0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch @@ -0,0 +1,108 @@ +From 5ee8b3edb385b216eb4f3316323ae1287824971a Mon Sep 17 00:00:00 2001 +From: Lennart Poettering +Date: Thu, 5 Jun 2025 22:26:03 +0200 +Subject: [PATCH] journal: replace a bunch of assert() with friendlier checks + +We should not rely that data stored in the journal files remains +entirely untouched at all times. Because we unallocate files, data might +go away any time. Hence, never assert() on any expectations on what the +file contains. Instead, handle it more gracefully as a corruption issue, +and return EBADMSG. + +Fixes: #35229 #32436 + +Upstream-Status: Backport [https://github.com/systemd/systemd/pull/37757/commits/5ee8b3edb385b216eb4f3316323ae1287824971a] + +Signed-off-by: Suresh H A +--- + src/libsystemd/sd-journal/journal-file.c | 28 ++++++++++++++++++------ + 1 file changed, 21 insertions(+), 7 deletions(-) + +diff --git a/src/libsystemd/sd-journal/journal-file.c b/src/libsystemd/sd-journal/journal-file.c +index fecddb932f..acceea7770 100644 +--- a/src/libsystemd/sd-journal/journal-file.c ++++ b/src/libsystemd/sd-journal/journal-file.c +@@ -2740,7 +2740,9 @@ static int bump_entry_array( + + if (direction == DIRECTION_DOWN) { + assert(o); +- assert(o->object.type == OBJECT_ENTRY_ARRAY); ++ ++ if (o->object.type != OBJECT_ENTRY_ARRAY) ++ return -EBADMSG; + + *ret = le64toh(o->entry_array.next_entry_array_offset); + } else { +@@ -3241,9 +3243,11 @@ static int generic_array_bisect_for_data( + + assert(f); + assert(d); +- assert(d->object.type == OBJECT_DATA); + assert(test_object); + ++ if (d->object.type != OBJECT_DATA) ++ return -EBADMSG; ++ + n = le64toh(d->data.n_entries); + if (n <= 0) + return 0; +@@ -3609,9 +3613,11 @@ int journal_file_move_to_entry_for_data( + + assert(f); + assert(d); +- assert(d->object.type == OBJECT_DATA); + assert(IN_SET(direction, DIRECTION_DOWN, DIRECTION_UP)); + ++ if (d->object.type != OBJECT_DATA) ++ return -EBADMSG; ++ + /* FIXME: fix return value assignment. */ + + /* This returns the first (when the direction is down, otherwise the last) entry linked to the +@@ -3671,7 +3677,9 @@ int journal_file_move_to_entry_by_offset_for_data( + + assert(f); + assert(d); +- assert(d->object.type == OBJECT_DATA); ++ ++ if (d->object.type != OBJECT_DATA) ++ return -EBADMSG; + + return generic_array_bisect_for_data( + f, +@@ -3697,7 +3705,9 @@ int journal_file_move_to_entry_by_monotonic_for_data( + + assert(f); + assert(d); +- assert(d->object.type == OBJECT_DATA); ++ ++ if (d->object.type != OBJECT_DATA) ++ return -EBADMSG; + + /* First, pin the given data object, before reading the _BOOT_ID= data object below. */ + r = journal_file_pin_object(f, d); +@@ -3763,7 +3773,9 @@ int journal_file_move_to_entry_by_seqnum_for_data( + + assert(f); + assert(d); +- assert(d->object.type == OBJECT_DATA); ++ ++ if (d->object.type != OBJECT_DATA) ++ return -EBADMSG; + + return generic_array_bisect_for_data( + f, +@@ -3783,7 +3795,9 @@ int journal_file_move_to_entry_by_realtime_for_data( + + assert(f); + assert(d); +- assert(d->object.type == OBJECT_DATA); ++ ++ if (d->object.type != OBJECT_DATA) ++ return -EBADMSG; + + return generic_array_bisect_for_data( + f, +-- +2.43.0 + diff --git a/meta/recipes-core/systemd/systemd_255.22.bb b/meta/recipes-core/systemd/systemd_255.22.bb index 3c5e59542bf..84d41a86c9b 100644 --- a/meta/recipes-core/systemd/systemd_255.22.bb +++ b/meta/recipes-core/systemd/systemd_255.22.bb @@ -38,6 +38,7 @@ SRC_URI += " \ file://CVE-2026-29111-03.patch \ file://CVE-2026-29111-04.patch \ file://CVE-2026-4105.patch \ + file://0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch \ " # patches needed by musl From patchwork Thu Oct 15 05:03:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100775 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E168ECC6B39 for ; Thu, 15 Oct 2026 05:04:13 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32848.1792040651568378917 for ; Wed, 14 Oct 2026 22:04:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=fn6OwRMG; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4a021c809e3so45975615e9.0 for ; Wed, 14 Oct 2026 22:04:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040650; x=1792645450; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=/E+9PGS7p6M/GA8sNJgyj2KOv/LpTLbQRy5ibDLtb5k=; b=fn6OwRMGSw/43HhDooWv2nn62P1u1dhvWpG+oSY3X9so/A8ax6a0qr+AxVfgAzw+Ff /22TUjlk4J1o3XdjRwFAHWv19ikDu/Q+H4gupE+hM797C8bc/Co4y35dcpLqwxl8jAYI IL5Kbo6K6vGX+YVinP0SaceQ2CbClVMsU7SXw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040650; x=1792645450; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=/E+9PGS7p6M/GA8sNJgyj2KOv/LpTLbQRy5ibDLtb5k=; b=W/oVY09HQaTW/hfjIKctw+M4ktMbAuhgnD/jMdviVm0tCKwMJPC7QbzT8YemeoY9MO VdLcS2PGd5NT4uSr2n+PPhxhzgNdQgyRivEGgONJb3tvjy8t9GDzbSf7f3fc55nuhYAI fYDaDEZmYGDyj+XTSsA4lN3zJVyVmqgoNFIXN4Te8skzi7yZ9tC6MVFcIMhZQW8dh9jm ma2kDKJ4xIWxm3nVMbbtFbXTdAtrUcSDJInI5r5vvkP4Ifn0N71N8yOzEedCGaLvJTPW KdU4C9iMD8yRBkt9UfLoj8wc6QR+ST64WvuFcN2ujGPbr5juA4mwLw1wRLv9cSp8+t/i TkMQ== X-Gm-Message-State: AFq9FYIDT1VMRtsZQAh5IZe9BrNDHIRzyf+SDagvv+e+GZoFkXIJNCld 3KbwYXE+nqE/kxeTbj10XRfXegKnLAU1hBHfxUyU+FXx1oEblyMionVaL+CmbPFBkWjNBx+BlKP 9MJDrzB4= X-Gm-Gg: AYBFou1S9JW4cxPyvDk0h7ePgi1J4xvdo0wJ+NiwoA0R/WYtTUk0d3kdeIXShmPqreM QcKz2eYxolXtkPEjX7ZA3F/HUR3Xy6wNym2jUHnZu8csR7TZE86tUkry3SWQz+f3BS84DzQloVh BFdXyoZKFxwwkb3xZYhEAIum7n953WDuF0OfDYSWUxrVkP2P7YT5grFIyiDkH2PKrtmm43iJsvV SI6t0142IkgkVHUAhBMqz/5PwV1AOGjpbkw91csutouQv+mOPKlXAqcdyQQIXKjlVxuPCU6pXTo 6fZ5FFiC3sDc4ODSHEvLN7jHl3Ym5RdA8gkAx6RjwgP31Cr0z/P92rACodpY1zru3OLvb0yCULV mwWQSM7Lw8rk5BLbD0UmOI7k0YYQeNXdzLL5lbLlT+gGf7KV0zV5cGIEjUbJVjTBFI16LkU+Cg1 d5YTLT6WbnABzk/t4Ao2eLItR8Numontk3wHhI97wUw/OPwttVOESMsxWqnbaVLBpKFOu3hQgcX VooxDf/5T6BrUJc3MlXjekppisbMMYYtPK8BBQDFyQ6c10g9pfFc6PO8e54qLHx5VZSQ5t5YA== X-Received: by 2002:a05:600c:46cf:b0:499:b65e:49c9 with SMTP id 5b1f17b1804b1-4a18e47ad5fmr391992755e9.10.1792040649577; Wed, 14 Oct 2026 22:04:09 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:09 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 45/55] qemu: restore 64-bit file lock handling for 32-bit guests Date: Thu, 15 Oct 2026 07:03:08 +0200 Message-ID: <81c4b64e499d4f90ed0d76ec9fbe05b75f9ec74d.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247843 From: Babanpreet Singh 0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch removes the TARGET_F_GETLK64, TARGET_F_SETLK64 and TARGET_F_SETLKW64 cases from target_to_host_fcntl_cmd(), along with the struct target_flock64 conversions. So every 32-bit guest calling fcntl64() to lock a file gets -TARGET_EINVAL. [YOCTO #16326] AI-Generated: Uses Claude (claude-fable-5-1) Signed-off-by: Babanpreet Singh Reviewed-by: Daniel R. Slater Tested-by: Daniel R. Slater Signed-off-by: Yoann Congal --- meta/recipes-devtools/qemu/qemu.inc | 3 +- ...all.c-drop-64-suffix-from-flock64-Co.patch | 225 +++++++++++ ...ce-use-of-lfs64-related-functions-an.patch | 355 ------------------ ...-eliminate-other-explicit-LFS-usages.patch | 107 ++++++ 4 files changed, 334 insertions(+), 356 deletions(-) create mode 100644 meta/recipes-devtools/qemu/qemu/0001-linux-user-syscall.c-drop-64-suffix-from-flock64-Co.patch delete mode 100644 meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch create mode 100644 meta/recipes-devtools/qemu/qemu/0002-linux-user-syscall.c-eliminate-other-explicit-LFS-usages.patch diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index 46cc7cb5cb0..1f510cbcb98 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc @@ -30,7 +30,8 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://0008-tests-meson.build-use-relative-path-to-refer-to-file.patch \ file://0009-Define-MAP_SYNC-and-MAP_SHARED_VALIDATE-on-needed-li.patch \ file://0010-hw-pvrdma-Protect-against-buggy-or-malicious-guest-d.patch \ - file://0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch \ + file://0001-linux-user-syscall.c-drop-64-suffix-from-flock64-Co.patch \ + file://0002-linux-user-syscall.c-eliminate-other-explicit-LFS-usages.patch \ file://fixedmeson.patch \ file://no-pip.patch \ file://4a8579ad8629b57a43daa62e46cc7af6e1078116.patch \ diff --git a/meta/recipes-devtools/qemu/qemu/0001-linux-user-syscall.c-drop-64-suffix-from-flock64-Co.patch b/meta/recipes-devtools/qemu/qemu/0001-linux-user-syscall.c-drop-64-suffix-from-flock64-Co.patch new file mode 100644 index 00000000000..6ebe2b895db --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0001-linux-user-syscall.c-drop-64-suffix-from-flock64-Co.patch @@ -0,0 +1,225 @@ +From ac1bbe8ca46c550b3ad99c85744119a3ace7b4f4 Mon Sep 17 00:00:00 2001 +From: Michael Tokarev +Date: Thu, 29 Aug 2024 09:39:50 +0300 +Subject: [PATCH] linux-user/syscall.c: drop 64 suffix from flock64 &Co + +Since we are always building with LFS enabled, in particular +with -D_FILE_OFFSET_BITS=64, we should always have struct flock +mapped to the 64bit variant (with off64_t), and F_GETLK mapped +to F_GETLK64 etc, automatically. + +So there should be no need to explicitly use the "64" suffix +for these things anymore. + +Also fix a misleading comment near safe_fcntl telling us to +always use flock64 (since v2.6.0-1311-g435da5e7092a "linux-user: +Use safe_syscall wrapper for fcntl"). + +Reference: https://gitlab.com/qemu-project/qemu/-/issues/2215 +Signed-off-by: Michael Tokarev +Reviewed-by: Richard Henderson + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/ac1bbe8ca46c550b3ad99c85744119a3ace7b4f4] +--- + linux-user/syscall.c | 92 ++++++++++++++++++++-------------------------------- + 1 file changed, 40 insertions(+), 52 deletions(-) + +--- a/linux-user/syscall.c ++++ b/linux-user/syscall.c +@@ -758,10 +758,8 @@ + * the libc function. + */ + #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__) +-/* Similarly for fcntl. Note that callers must always: +- * pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK +- * use the flock64 struct rather than unsuffixed flock +- * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts. ++/* Similarly for fcntl. Since we always build with LFS enabled, ++ * we should be using the 64-bit structures automatically. + */ + #ifdef __NR_fcntl64 + #define safe_fcntl(...) safe_syscall(__NR_fcntl64, __VA_ARGS__) +@@ -6720,13 +6718,13 @@ + ret = cmd; + break; + case TARGET_F_GETLK: +- ret = F_GETLK64; ++ ret = F_GETLK; + break; + case TARGET_F_SETLK: +- ret = F_SETLK64; ++ ret = F_SETLK; + break; + case TARGET_F_SETLKW: +- ret = F_SETLKW64; ++ ret = F_SETLKW; + break; + case TARGET_F_GETOWN: + ret = F_GETOWN; +@@ -6742,13 +6740,13 @@ + break; + #if TARGET_ABI_BITS == 32 + case TARGET_F_GETLK64: +- ret = F_GETLK64; ++ ret = F_GETLK; + break; + case TARGET_F_SETLK64: +- ret = F_SETLK64; ++ ret = F_SETLK; + break; + case TARGET_F_SETLKW64: +- ret = F_SETLKW64; ++ ret = F_SETLKW; + break; + #endif + case TARGET_F_SETLEASE: +@@ -6802,8 +6800,8 @@ + * them to 5, 6 and 7 before making the syscall(). Since we make the + * syscall directly, adjust to what is supported by the kernel. + */ +- if (ret >= F_GETLK64 && ret <= F_SETLKW64) { +- ret -= F_GETLK64 - 5; ++ if (ret >= F_GETLK && ret <= F_SETLKW) { ++ ret -= F_GETLK - 5; + } + #endif + +@@ -6836,7 +6834,7 @@ + return type; + } + +-static inline abi_long copy_from_user_flock(struct flock64 *fl, ++static inline abi_long copy_from_user_flock(struct flock *fl, + abi_ulong target_flock_addr) + { + struct target_flock *target_fl; +@@ -6861,7 +6859,7 @@ + } + + static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr, +- const struct flock64 *fl) ++ const struct flock *fl) + { + struct target_flock *target_fl; + short l_type; +@@ -6880,8 +6878,8 @@ + return 0; + } + +-typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr); +-typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl); ++typedef abi_long from_flock64_fn(struct flock *fl, abi_ulong target_addr); ++typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock *fl); + + #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32 + struct target_oabi_flock64 { +@@ -6892,7 +6890,7 @@ + abi_int l_pid; + } QEMU_PACKED; + +-static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl, ++static inline abi_long copy_from_user_oabi_flock64(struct flock *fl, + abi_ulong target_flock_addr) + { + struct target_oabi_flock64 *target_fl; +@@ -6917,7 +6915,7 @@ + } + + static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr, +- const struct flock64 *fl) ++ const struct flock *fl) + { + struct target_oabi_flock64 *target_fl; + short l_type; +@@ -6937,7 +6935,7 @@ + } + #endif + +-static inline abi_long copy_from_user_flock64(struct flock64 *fl, ++static inline abi_long copy_from_user_flock64(struct flock *fl, + abi_ulong target_flock_addr) + { + struct target_flock64 *target_fl; +@@ -6962,7 +6960,7 @@ + } + + static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr, +- const struct flock64 *fl) ++ const struct flock *fl) + { + struct target_flock64 *target_fl; + short l_type; +@@ -6983,7 +6981,7 @@ + + static abi_long do_fcntl(int fd, int cmd, abi_ulong arg) + { +- struct flock64 fl64; ++ struct flock fl; + #ifdef F_GETOWN_EX + struct f_owner_ex fox; + struct target_f_owner_ex *target_fox; +@@ -6996,45 +6994,45 @@ + + switch(cmd) { + case TARGET_F_GETLK: +- ret = copy_from_user_flock(&fl64, arg); ++ ret = copy_from_user_flock(&fl, arg); + if (ret) { + return ret; + } +- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64)); ++ ret = get_errno(safe_fcntl(fd, host_cmd, &fl)); + if (ret == 0) { +- ret = copy_to_user_flock(arg, &fl64); ++ ret = copy_to_user_flock(arg, &fl); + } + break; + + case TARGET_F_SETLK: + case TARGET_F_SETLKW: +- ret = copy_from_user_flock(&fl64, arg); ++ ret = copy_from_user_flock(&fl, arg); + if (ret) { + return ret; + } +- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64)); ++ ret = get_errno(safe_fcntl(fd, host_cmd, &fl)); + break; + + case TARGET_F_GETLK64: + case TARGET_F_OFD_GETLK: +- ret = copy_from_user_flock64(&fl64, arg); ++ ret = copy_from_user_flock64(&fl, arg); + if (ret) { + return ret; + } +- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64)); ++ ret = get_errno(safe_fcntl(fd, host_cmd, &fl)); + if (ret == 0) { +- ret = copy_to_user_flock64(arg, &fl64); ++ ret = copy_to_user_flock64(arg, &fl); + } + break; + case TARGET_F_SETLK64: + case TARGET_F_SETLKW64: + case TARGET_F_OFD_SETLK: + case TARGET_F_OFD_SETLKW: +- ret = copy_from_user_flock64(&fl64, arg); ++ ret = copy_from_user_flock64(&fl, arg); + if (ret) { + return ret; + } +- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64)); ++ ret = get_errno(safe_fcntl(fd, host_cmd, &fl)); + break; + + case TARGET_F_GETFL: +@@ -12301,7 +12299,7 @@ + case TARGET_NR_fcntl64: + { + int cmd; +- struct flock64 fl; ++ struct flock fl; + from_flock64_fn *copyfrom = copy_from_user_flock64; + to_flock64_fn *copyto = copy_to_user_flock64; + diff --git a/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch b/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch deleted file mode 100644 index ceae67be644..00000000000 --- a/meta/recipes-devtools/qemu/qemu/0002-linux-user-Replace-use-of-lfs64-related-functions-an.patch +++ /dev/null @@ -1,355 +0,0 @@ -From 71f14902256e3c3529710b713e1ea43100bf4c40 Mon Sep 17 00:00:00 2001 -From: Khem Raj -Date: Sat, 17 Dec 2022 08:37:46 -0800 -Subject: [PATCH 2/2] linux-user: Replace use of lfs64 related functions and - macros - -Builds defines -D_FILE_OFFSET_BITS=64 which makes the original functions -anf macros behave same as their 64 suffixed counterparts. This also -helps in compiling with latest musl C library, where these macros and -functions are no more available under _GNU_SOURCE feature macro - -Upstream-Status: Submitted [https://lists.gnu.org/archive/html/qemu-devel/2022-12/msg02841.html] -Signed-off-by: Khem Raj -Cc: Laurent Vivier ---- - linux-user/syscall.c | 153 +++++++++++-------------------------------- - 1 file changed, 39 insertions(+), 114 deletions(-) - -Index: qemu-8.0.0/linux-user/syscall.c -=================================================================== ---- qemu-8.0.0.orig/linux-user/syscall.c -+++ qemu-8.0.0/linux-user/syscall.c -@@ -761,8 +761,8 @@ safe_syscall6(ssize_t, copy_file_range, - */ - #define safe_ioctl(...) safe_syscall(__NR_ioctl, __VA_ARGS__) - /* Similarly for fcntl. Note that callers must always: -- * pass the F_GETLK64 etc constants rather than the unsuffixed F_GETLK -- * use the flock64 struct rather than unsuffixed flock -+ * pass the F_GETLK etc constants rather than the unsuffixed F_GETLK -+ * use the flock struct rather than unsuffixed flock - * This will then work and use a 64-bit offset for both 32-bit and 64-bit hosts. - */ - #ifdef __NR_fcntl64 -@@ -6813,13 +6813,13 @@ static int target_to_host_fcntl_cmd(int - ret = cmd; - break; - case TARGET_F_GETLK: -- ret = F_GETLK64; -+ ret = F_GETLK; - break; - case TARGET_F_SETLK: -- ret = F_SETLK64; -+ ret = F_SETLK; - break; - case TARGET_F_SETLKW: -- ret = F_SETLKW64; -+ ret = F_SETLKW; - break; - case TARGET_F_GETOWN: - ret = F_GETOWN; -@@ -6833,17 +6833,6 @@ static int target_to_host_fcntl_cmd(int - case TARGET_F_SETSIG: - ret = F_SETSIG; - break; --#if TARGET_ABI_BITS == 32 -- case TARGET_F_GETLK64: -- ret = F_GETLK64; -- break; -- case TARGET_F_SETLK64: -- ret = F_SETLK64; -- break; -- case TARGET_F_SETLKW64: -- ret = F_SETLKW64; -- break; --#endif - case TARGET_F_SETLEASE: - ret = F_SETLEASE; - break; -@@ -6895,8 +6884,8 @@ static int target_to_host_fcntl_cmd(int - * them to 5, 6 and 7 before making the syscall(). Since we make the - * syscall directly, adjust to what is supported by the kernel. - */ -- if (ret >= F_GETLK64 && ret <= F_SETLKW64) { -- ret -= F_GETLK64 - 5; -+ if (ret >= F_GETLK && ret <= F_SETLKW) { -+ ret -= F_GETLK - 5; - } - #endif - -@@ -6929,55 +6918,11 @@ static int host_to_target_flock(int type - return type; - } - --static inline abi_long copy_from_user_flock(struct flock64 *fl, -- abi_ulong target_flock_addr) --{ -- struct target_flock *target_fl; -- int l_type; -- -- if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) { -- return -TARGET_EFAULT; -- } -- -- __get_user(l_type, &target_fl->l_type); -- l_type = target_to_host_flock(l_type); -- if (l_type < 0) { -- return l_type; -- } -- fl->l_type = l_type; -- __get_user(fl->l_whence, &target_fl->l_whence); -- __get_user(fl->l_start, &target_fl->l_start); -- __get_user(fl->l_len, &target_fl->l_len); -- __get_user(fl->l_pid, &target_fl->l_pid); -- unlock_user_struct(target_fl, target_flock_addr, 0); -- return 0; --} -- --static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr, -- const struct flock64 *fl) --{ -- struct target_flock *target_fl; -- short l_type; -- -- if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) { -- return -TARGET_EFAULT; -- } -- -- l_type = host_to_target_flock(fl->l_type); -- __put_user(l_type, &target_fl->l_type); -- __put_user(fl->l_whence, &target_fl->l_whence); -- __put_user(fl->l_start, &target_fl->l_start); -- __put_user(fl->l_len, &target_fl->l_len); -- __put_user(fl->l_pid, &target_fl->l_pid); -- unlock_user_struct(target_fl, target_flock_addr, 1); -- return 0; --} -- --typedef abi_long from_flock64_fn(struct flock64 *fl, abi_ulong target_addr); --typedef abi_long to_flock64_fn(abi_ulong target_addr, const struct flock64 *fl); -+typedef abi_long from_flock_fn(struct flock *fl, abi_ulong target_addr); -+typedef abi_long to_flock_fn(abi_ulong target_addr, const struct flock *fl); - - #if defined(TARGET_ARM) && TARGET_ABI_BITS == 32 --struct target_oabi_flock64 { -+struct target_oabi_flock { - abi_short l_type; - abi_short l_whence; - abi_llong l_start; -@@ -6985,10 +6930,10 @@ struct target_oabi_flock64 { - abi_int l_pid; - } QEMU_PACKED; - --static inline abi_long copy_from_user_oabi_flock64(struct flock64 *fl, -+static inline abi_long copy_from_user_oabi_flock(struct flock *fl, - abi_ulong target_flock_addr) - { -- struct target_oabi_flock64 *target_fl; -+ struct target_oabi_flock *target_fl; - int l_type; - - if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) { -@@ -7009,10 +6954,10 @@ static inline abi_long copy_from_user_oa - return 0; - } - --static inline abi_long copy_to_user_oabi_flock64(abi_ulong target_flock_addr, -- const struct flock64 *fl) -+static inline abi_long copy_to_user_oabi_flock(abi_ulong target_flock_addr, -+ const struct flock *fl) - { -- struct target_oabi_flock64 *target_fl; -+ struct target_oabi_flock *target_fl; - short l_type; - - if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) { -@@ -7030,10 +6975,10 @@ static inline abi_long copy_to_user_oabi - } - #endif - --static inline abi_long copy_from_user_flock64(struct flock64 *fl, -+static inline abi_long copy_from_user_flock(struct flock *fl, - abi_ulong target_flock_addr) - { -- struct target_flock64 *target_fl; -+ struct target_flock *target_fl; - int l_type; - - if (!lock_user_struct(VERIFY_READ, target_fl, target_flock_addr, 1)) { -@@ -7054,10 +6999,10 @@ static inline abi_long copy_from_user_fl - return 0; - } - --static inline abi_long copy_to_user_flock64(abi_ulong target_flock_addr, -- const struct flock64 *fl) -+static inline abi_long copy_to_user_flock(abi_ulong target_flock_addr, -+ const struct flock *fl) - { -- struct target_flock64 *target_fl; -+ struct target_flock *target_fl; - short l_type; - - if (!lock_user_struct(VERIFY_WRITE, target_fl, target_flock_addr, 0)) { -@@ -7076,7 +7021,7 @@ static inline abi_long copy_to_user_floc - - static abi_long do_fcntl(int fd, int cmd, abi_ulong arg) - { -- struct flock64 fl64; -+ struct flock fl64; - #ifdef F_GETOWN_EX - struct f_owner_ex fox; - struct target_f_owner_ex *target_fox; -@@ -7089,6 +7034,7 @@ static abi_long do_fcntl(int fd, int cmd - - switch(cmd) { - case TARGET_F_GETLK: -+ case TARGET_F_OFD_GETLK: - ret = copy_from_user_flock(&fl64, arg); - if (ret) { - return ret; -@@ -7098,32 +7044,11 @@ static abi_long do_fcntl(int fd, int cmd - ret = copy_to_user_flock(arg, &fl64); - } - break; -- - case TARGET_F_SETLK: - case TARGET_F_SETLKW: -- ret = copy_from_user_flock(&fl64, arg); -- if (ret) { -- return ret; -- } -- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64)); -- break; -- -- case TARGET_F_GETLK64: -- case TARGET_F_OFD_GETLK: -- ret = copy_from_user_flock64(&fl64, arg); -- if (ret) { -- return ret; -- } -- ret = get_errno(safe_fcntl(fd, host_cmd, &fl64)); -- if (ret == 0) { -- ret = copy_to_user_flock64(arg, &fl64); -- } -- break; -- case TARGET_F_SETLK64: -- case TARGET_F_SETLKW64: - case TARGET_F_OFD_SETLK: - case TARGET_F_OFD_SETLKW: -- ret = copy_from_user_flock64(&fl64, arg); -+ ret = copy_from_user_flock(&fl64, arg); - if (ret) { - return ret; - } -@@ -7348,7 +7273,7 @@ static inline abi_long target_truncate64 - arg2 = arg3; - arg3 = arg4; - } -- return get_errno(truncate64(arg1, target_offset64(arg2, arg3))); -+ return get_errno(truncate(arg1, target_offset64(arg2, arg3))); - } - #endif - -@@ -7362,7 +7287,7 @@ static inline abi_long target_ftruncate6 - arg2 = arg3; - arg3 = arg4; - } -- return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3))); -+ return get_errno(ftruncate(arg1, target_offset64(arg2, arg3))); - } - #endif - -@@ -8598,7 +8523,7 @@ static int do_getdents(abi_long dirfd, a - void *tdirp; - int hlen, hoff, toff; - int hreclen, treclen; -- off64_t prev_diroff = 0; -+ off_t prev_diroff = 0; - - hdirp = g_try_malloc(count); - if (!hdirp) { -@@ -8651,7 +8576,7 @@ static int do_getdents(abi_long dirfd, a - * Return what we have, resetting the file pointer to the - * location of the first record not returned. - */ -- lseek64(dirfd, prev_diroff, SEEK_SET); -+ lseek(dirfd, prev_diroff, SEEK_SET); - break; - } - -@@ -8685,7 +8610,7 @@ static int do_getdents64(abi_long dirfd, - void *tdirp; - int hlen, hoff, toff; - int hreclen, treclen; -- off64_t prev_diroff = 0; -+ off_t prev_diroff = 0; - - hdirp = g_try_malloc(count); - if (!hdirp) { -@@ -8727,7 +8652,7 @@ static int do_getdents64(abi_long dirfd, - * Return what we have, resetting the file pointer to the - * location of the first record not returned. - */ -- lseek64(dirfd, prev_diroff, SEEK_SET); -+ lseek(dirfd, prev_diroff, SEEK_SET); - break; - } - -@@ -11158,7 +11083,7 @@ static abi_long do_syscall1(CPUArchState - return -TARGET_EFAULT; - } - } -- ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5))); -+ ret = get_errno(pread(arg1, p, arg3, target_offset64(arg4, arg5))); - unlock_user(p, arg2, ret); - return ret; - case TARGET_NR_pwrite64: -@@ -11175,7 +11100,7 @@ static abi_long do_syscall1(CPUArchState - return -TARGET_EFAULT; - } - } -- ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5))); -+ ret = get_errno(pwrite(arg1, p, arg3, target_offset64(arg4, arg5))); - unlock_user(p, arg2, 0); - return ret; - #endif -@@ -11998,14 +11923,14 @@ static abi_long do_syscall1(CPUArchState - case TARGET_NR_fcntl64: - { - int cmd; -- struct flock64 fl; -- from_flock64_fn *copyfrom = copy_from_user_flock64; -- to_flock64_fn *copyto = copy_to_user_flock64; -+ struct flock fl; -+ from_flock_fn *copyfrom = copy_from_user_flock; -+ to_flock_fn *copyto = copy_to_user_flock; - - #ifdef TARGET_ARM - if (!cpu_env->eabi) { -- copyfrom = copy_from_user_oabi_flock64; -- copyto = copy_to_user_oabi_flock64; -+ copyfrom = copy_from_user_oabi_flock; -+ copyto = copy_to_user_oabi_flock; - } - #endif - -@@ -12015,7 +11940,7 @@ static abi_long do_syscall1(CPUArchState - } - - switch(arg2) { -- case TARGET_F_GETLK64: -+ case TARGET_F_GETLK: - ret = copyfrom(&fl, arg3); - if (ret) { - break; -@@ -12026,8 +11951,8 @@ static abi_long do_syscall1(CPUArchState - } - break; - -- case TARGET_F_SETLK64: -- case TARGET_F_SETLKW64: -+ case TARGET_F_SETLK: -+ case TARGET_F_SETLKW: - ret = copyfrom(&fl, arg3); - if (ret) { - break; diff --git a/meta/recipes-devtools/qemu/qemu/0002-linux-user-syscall.c-eliminate-other-explicit-LFS-usages.patch b/meta/recipes-devtools/qemu/qemu/0002-linux-user-syscall.c-eliminate-other-explicit-LFS-usages.patch new file mode 100644 index 00000000000..435ce519464 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/0002-linux-user-syscall.c-eliminate-other-explicit-LFS-usages.patch @@ -0,0 +1,107 @@ +From 99174ce39e86ec6aea7bb7ce326b16e3eed9e3da Mon Sep 17 00:00:00 2001 +From: Michael Tokarev +Date: Thu, 29 Aug 2024 09:59:51 +0300 +Subject: [PATCH] linux-user/syscall.c: eliminate other explicit LFS usages + +Since we alwasy build with LFS enabled, and with -D_FILE_OFFSET_BITS=64 +in particular, there is no need to use 64bit versions of various system +calls and constants, regular ones will do just fine. Eliminate a few +last uses of the following constructs in linux-user/syscall.c: + off64_t + ftruncate64() + lseek64() + pread64() + pwrite64() + +This way it can be built on systems where the 64bit variants of +everything is not defined (since the system always uses 64bit +variants), such as on recent MUSL. + +Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2215 +Signed-off-by: Michael Tokarev +Reviewed-by: Richard Henderson + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/99174ce39e86ec6aea7bb7ce326b16e3eed9e3da] +--- + linux-user/syscall.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/linux-user/syscall.c b/linux-user/syscall.c +index 48c459e515..a666986189 100644 +--- a/linux-user/syscall.c ++++ b/linux-user/syscall.c +@@ -7265,7 +7265,7 @@ static inline abi_long target_truncate64(CPUArchState *cpu_env, const char *arg1 + arg2 = arg3; + arg3 = arg4; + } +- return get_errno(truncate64(arg1, target_offset64(arg2, arg3))); ++ return get_errno(truncate(arg1, target_offset64(arg2, arg3))); + } + #endif + +@@ -7279,7 +7279,7 @@ static inline abi_long target_ftruncate64(CPUArchState *cpu_env, abi_long arg1, + arg2 = arg3; + arg3 = arg4; + } +- return get_errno(ftruncate64(arg1, target_offset64(arg2, arg3))); ++ return get_errno(ftruncate(arg1, target_offset64(arg2, arg3))); + } + #endif + +@@ -8664,7 +8664,7 @@ static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count) + void *tdirp; + int hlen, hoff, toff; + int hreclen, treclen; +- off64_t prev_diroff = 0; ++ off_t prev_diroff = 0; + + hdirp = g_try_malloc(count); + if (!hdirp) { +@@ -8717,7 +8717,7 @@ static int do_getdents(abi_long dirfd, abi_long arg2, abi_long count) + * Return what we have, resetting the file pointer to the + * location of the first record not returned. + */ +- lseek64(dirfd, prev_diroff, SEEK_SET); ++ lseek(dirfd, prev_diroff, SEEK_SET); + break; + } + +@@ -8751,7 +8751,7 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count) + void *tdirp; + int hlen, hoff, toff; + int hreclen, treclen; +- off64_t prev_diroff = 0; ++ off_t prev_diroff = 0; + + hdirp = g_try_malloc(count); + if (!hdirp) { +@@ -8793,7 +8793,7 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count) + * Return what we have, resetting the file pointer to the + * location of the first record not returned. + */ +- lseek64(dirfd, prev_diroff, SEEK_SET); ++ lseek(dirfd, prev_diroff, SEEK_SET); + break; + } + +@@ -11524,7 +11524,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, + return -TARGET_EFAULT; + } + } +- ret = get_errno(pread64(arg1, p, arg3, target_offset64(arg4, arg5))); ++ ret = get_errno(pread(arg1, p, arg3, target_offset64(arg4, arg5))); + unlock_user(p, arg2, ret); + return ret; + case TARGET_NR_pwrite64: +@@ -11541,7 +11541,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, + return -TARGET_EFAULT; + } + } +- ret = get_errno(pwrite64(arg1, p, arg3, target_offset64(arg4, arg5))); ++ ret = get_errno(pwrite(arg1, p, arg3, target_offset64(arg4, arg5))); + unlock_user(p, arg2, 0); + return ret; + #endif +-- +2.43.0 + From patchwork Thu Oct 15 05:03:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100782 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89975CCA460 for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32849.1792040652070953748 for ; Wed, 14 Oct 2026 22:04:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=PLTDPwkV; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a018792ab3so38967595e9.0 for ; Wed, 14 Oct 2026 22:04:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040650; x=1792645450; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=0r7jayP/irf7gquJzMkLKBxq0+l/bPsZu3j/bH5Gpyk=; b=PLTDPwkVcLb6zaGr2gTbDDf0ps6iSwz+RSONcW6f0RPKdHiHj1pFLEIHKfD2Yk8Y0O bavU7f6eKzdjcY1497Ne3OOSCPYvbUqcDHyHlfoE+PTNxQi18ELDhYrrddG3IT2jYgwO j5YM0BQXqQL4Pm3dGRfbDzA/hNM0Wp5C6Bf6A= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040650; x=1792645450; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=0r7jayP/irf7gquJzMkLKBxq0+l/bPsZu3j/bH5Gpyk=; b=EsdJv2kmP4XM6NgKOSKAVE2g6Lq9bogikEuRRsTV9He4ehUeUvxClZSbmTaGTrHz+w 94d/8vKwHk/RTy1wrwamotg0X1AGNvF16tM44rXueY75NJjmz4coeNb4PshVZQFk8j4N Bqufmd2jyxOIXqJL4X3zbCwxIikwaNFaWEb0roPP9yajbmGl836d4QIYoofcZo73nkOR kQnLHaHEByjFKQYtSErMnNVZqqaAdHmZzpaqQTbKLwh32m3MhXhnO9pwgscvff+BC8uz ug7aYdqibdhRQ6og7JURvrhGVruVY6PgjDxEmjijgroK+kIZYRymYZVofTFgvdcjGJcY vXCw== X-Gm-Message-State: AFq9FYI6JuXgurv14D5PAt60uktlyE9tfQ1EnqYZUT8sdxwpxc7hjOWr 0DJ6O+1pFYnj23QsFWXfLpg1DSjo1ZqcEYTTZHJBnvmWgyAgeVLLchIH6wM8MPeOlZciTOpwS+a PSfSpK+8= X-Gm-Gg: AYBFou0DFaNHSVxqOljA4ZS9YlKzyBAXptoM9lxUfaDnrInEWYQYOGuguG5dlEcgpVP ALHs2PEqO49NNxqFOsMXqFYBb85T57hYqxtL1HkrDOTuetvRLMN5ld+0q9Eb6ZjaLV6QcHNpP4j PiUqAK6ax1JYyD/S1BFZBqi+if03iqhVLb3dYqUfiMcMInXl7GA2F2T0z6Q1GoSn8PTjCXrOZvj EtWulyNKhXVQ7T9j1OVunWy/MxJCV45Urgwe76T7748aFScGu3XWi1+MebuHFRIRwyspJMxz9ij FoHKNVJNtUCmp6IUiY0ZmPS6Cl262axMd1Dp8gSQKcbtqsureqJ8oHGIZE4vZ0tk1wpQ8GMt9sL 7I2tRF/AL15ht9aNZ7Kjs986B3tNiucOn4a+EC/Tr7ZIWkqejSYXTUhNd2X2AE51NRgoZQmBB1/ 3/KHdNfSNvWFpcxxBobvOclVB9POvRwqOwo4Bz/5P7I1qsVHCHdiKmxaQ4T+ES5Qhcvy2sMHQT9 CXKgA1T5VsIusmrJk4FaQeZDkscRVabInodElVitnWnOz4D5MRdCHCNNtM7W7J6lWBzeZm9970Z oySMXoJd X-Received: by 2002:a05:600c:8b11:b0:4a1:ac85:9696 with SMTP id 5b1f17b1804b1-4a1ac859a48mr141136685e9.17.1792040650113; Wed, 14 Oct 2026 22:04:10 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:09 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 46/55] libpcap: Fix CVE-2026-0799 Date: Thu, 15 Oct 2026 07:03:09 +0200 Message-ID: <2f99d027a326fcef62013c3d8bd2464e67809af7.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247844 From: Jaipaul Cheernam NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0799 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7 Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../libpcap/libpcap/01-CVE-2026-0799.patch | 67 +++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/01-CVE-2026-0799.patch diff --git a/meta/recipes-connectivity/libpcap/libpcap/01-CVE-2026-0799.patch b/meta/recipes-connectivity/libpcap/libpcap/01-CVE-2026-0799.patch new file mode 100644 index 00000000000..a4dfea42361 --- /dev/null +++ b/meta/recipes-connectivity/libpcap/libpcap/01-CVE-2026-0799.patch @@ -0,0 +1,67 @@ +From 48e8960a7108e9e828f9d7bdc7e97bdab841aec7 Mon Sep 17 00:00:00 2001 +From: Denis Ovsienko +Date: Thu, 30 Jul 2026 13:33:41 +0100 +Subject: [PATCH] CVE-2026-0799: Access M[] safely in the BPF interpreter. + +Include Security identified and reported this problem as a potential +vulnerability in 2018 (case reference "I7"). Their work was sponsored +by Mozilla under the Secure Open Source program. The vulnerability has +been independently confirmed only recently. + +The current revision of pcapint_filter_with_aux_data() can, but does not +check whether a scratch memory register index is valid in the "ld M[k]", +"ldx M[k]", "st M[k]" and "stx M[k]" BPF instructions, and assumes this +is always the case. This holds for programs that have been generated or +validated by libpcap. + +However, this does not necessarily hold for programs that come via +pcap_offline_filter() or [deprecated] bpf_filter() from an external +source and have not been explicitly validated. If the interpreter +executes such a program with an invalid index, it will read/write the +process memory at arbitrary locations starting at the current stack +frame. Depending on the address, the memory layout and the OS, this can +result in stack buffer overflow, SIGSEGV, SIGBUS or other effects. To +fix this, in the interpreter reject the packet if the index is invalid. + +(backported from commit 569f8fd3524192acbabf93c9cd704471bb38f84a) + +(cherry picked from commit 48e8960a7108e9e828f9d7bdc7e97bdab841aec7) + +Notes on backporting to 1.10.4: + - The upstream CHANGES/changelog hunk is not backported. + +Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7] +CVE: CVE-2026-0799 +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/bpf_filter.c b/bpf_filter.c +index 8691d0d1..fa82d1d0 100644 +--- a/bpf_filter.c ++++ b/bpf_filter.c +@@ -219,18 +219,26 @@ DIAG_ON_DEFAULT_ONLY_SWITCH + continue; + + case BPF_LD|BPF_MEM: ++ if (pc->k >= BPF_MEMWORDS) ++ return 0; + A = mem[pc->k]; + continue; + + case BPF_LDX|BPF_MEM: ++ if (pc->k >= BPF_MEMWORDS) ++ return 0; + X = mem[pc->k]; + continue; + + case BPF_ST: ++ if (pc->k >= BPF_MEMWORDS) ++ return 0; + mem[pc->k] = A; + continue; + + case BPF_STX: ++ if (pc->k >= BPF_MEMWORDS) ++ return 0; + mem[pc->k] = X; + continue; + diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb index ee7d7540f67..692fdf606c0 100644 --- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb +++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb @@ -17,6 +17,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \ file://CVE-2025-11961-01.patch \ file://CVE-2025-11961-02.patch \ file://CVE-2025-11964.patch \ + file://01-CVE-2026-0799.patch \ " SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f" From patchwork Thu Oct 15 05:03:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100776 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B30B5CC6B2E for ; Thu, 15 Oct 2026 05:04:13 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32850.1792040652918454246 for ; Wed, 14 Oct 2026 22:04:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=DN2X13nD; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-49fbb2acc90so40831935e9.2 for ; Wed, 14 Oct 2026 22:04:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040651; x=1792645451; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=kxKVBr572UE8tkQcJYkI89STiRjYUqqNfcfZ4OyrO8M=; b=DN2X13nDUE8vDWadAFghFJgSl404/E0MkgSYJGlOedvj/kX2oODWhAq0YcJW74Ofnl BTuIszqxlH4cDY9OPj2ebedpKx70Xljr6OEoLRHw1oS7RXhFAK/JkBN2fBZORMXmlRaR xzhDoLr3hst7I+H+qOtdtD0ceJ2jj0AeJIei8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040651; x=1792645451; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=kxKVBr572UE8tkQcJYkI89STiRjYUqqNfcfZ4OyrO8M=; b=m/YOe7Rtx1/PnF/ayUjx82eAGICxhI2SYvAA10Ad2O9t2MZNQ3dTsizuFmqwMcuiJS imCd3OoE08sAYXWGkP6oLJMDqItb9bUpnwWiLR2uUmaNLkQELr5WbHTi0N8s7sqxnQdr 1/e3q0msSjCMTWu8kpecit4C/LnStOBUqCkRW//jxZafN9vy5xILN66e3pbexS0chyFp YrL1HTA7WIZlGurEB1gb+RMLbuLxnSCT5Qy7CA600HI+BWZXmAfU7yYTBNTf0zxWs5zn d0fBaKovGqNu66zDu1TgDdyhaxf+IpUy8h3Ho869aNQHZL6wTelaYjTB9DYDlbFMqTsI WCxw== X-Gm-Message-State: AFq9FYIR31JHntxfnXY6X6HnoLnVG8yZjJBdRWSc3q4bgkQ6Gl9YaZ8O AGZUvWb4a7yQtAdm3CAslSWBFpP2hRcrf7uzD/CNRIbFt1wDAy7dxPwnj48W9cdNBQTOpDHiVad wHEHTOrU= X-Gm-Gg: AYBFou2gV7SMKJZ/R2Idutv9MbK+2uNbChw0HXty0/zNjI/CZoNibiiIoJiMMu0kkAk vn0Uu0DWEAKZv30fYGXsoJfwhmpmrCltF7vubEi8/6ymaO+D2KeI1UVwyy7acRqyZkQX9ilc1K9 ggc4w4WY3MSKGasrd1DG0f066Max8DJshhjfq8EiflYf2wPwQW5WGWMMttWAFOEHuv3VU27ndXt hd7jmJXIDXxGUaHbOcMvD5mwCCsz9LlSPDWYJPCtSx/sMN5p8/5wBJj+tqdIl4XvcVaO3Tfup9g /ImRmoCCFc5pZD2WSSCOCLtzBsUTlPtDMw5SidBE6YuroNdfeeoB4570oWI4G5IWBJueIfoy1Ts IatIbLDXnsdDhCiqrZxfXOpoM2GTwyebZr2RchjLBGSdGbsKkZBVwYrigXZYqv8hAUJIKv3XDYA 7bg0fW9Nlpe7pRWzHjo7AbewQoIf3qPvO2Tj65ugNAGyMnppD5cOaRb+t26tZXI7p9ODyCtNhK6 wVlbQqLlmnDnHVRmpW7QNOM6+Agpl0M0Jr7scG2j/h/RUGawcZfeMNevAFYVASvXap3H6Me1A== X-Received: by 2002:a05:600c:4e4f:b0:4a1:ad27:e797 with SMTP id 5b1f17b1804b1-4a1ad27e79cmr153776715e9.6.1792040650808; Wed, 14 Oct 2026 22:04:10 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:10 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 47/55] libpcap: Fix CVE-2026-31912 Date: Thu, 15 Oct 2026 07:03:10 +0200 Message-ID: <5fde7b713549a84f2e5bb3988032f24bf91779c2.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247845 From: Jaipaul Cheernam NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31912 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9 Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../libpcap/libpcap/02-CVE-2026-31912.patch | 591 ++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 592 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch diff --git a/meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch b/meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch new file mode 100644 index 00000000000..11182870409 --- /dev/null +++ b/meta/recipes-connectivity/libpcap/libpcap/02-CVE-2026-31912.patch @@ -0,0 +1,591 @@ +From d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9 Mon Sep 17 00:00:00 2001 +From: Denis Ovsienko +Date: Thu, 30 Jul 2026 13:33:55 +0100 +Subject: [PATCH] CVE-2026-31912: Mind the program bounds in pcap_offline_filter(). + +The current revision of pcapint_filter_with_aux_data() does not know the +number of instructions in the filter program, it assumes the program +counter always remains within the bounds of the provided filter program +and always reaches a return instruction. This holds for programs that +have been generated or validated by libpcap. + +However, this does not necessarily hold for programs that come from an +external source via pcap_offline_filter() or [deprecated] bpf_filter() +and have not been explicitly validated. If the interpreter executes +such a program and advances the program counter beyond the last +instruction, it will be interpreting memory space after the filter +program as BPF instructions, which in the current implementation will +eventually cause either abort() (another commit addresses that) or +SIGSEGV. + +To fix the latter problem, in pcapint_filter_with_aux_data() add a +parameter for the number of instructions in the program and reject the +packet as soon as (or just before) the program counter goes out of +bounds. Update all incoming code paths to specify the length; also in +pcap_offline_filter(3PCAP) make it clear the function now requires the +'bf_len' member to be set correctly and uses it. + +(backported from commit d1209988c74dd9330659898d3b676ee6bbe1c551) + +(cherry picked from commit d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9) + +Notes on backporting to 1.10.4: + - Adapted to the 1.10.4 pcap_filter*() names (renamed to pcapint_*() + after 1.10.4). + - The upstream pcap-haiku.c hunk is applied to pcap-haiku.cpp instead + (the Haiku module was rewritten from C++ to C after 1.10.4). + - The upstream CHANGES/changelog hunk is not backported. + +Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9] +CVE: CVE-2026-31912 +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/bpf_filter.c b/bpf_filter.c +index fa82d1d0..dec336ea 100644 +--- a/bpf_filter.c ++++ b/bpf_filter.c +@@ -72,6 +72,24 @@ enum { + BPF_S_ANC_VLAN_TAG_PRESENT, + }; + ++/* ++ * Kernel BPF implementations tend to define BPF_MAXINSNS to 512 or 4096, the ++ * userland interpreter in libpcap is meant to support much longer filter ++ * programs. In the latter case it is important that BPF_MAXINSNS does not ++ * interfere with the safety checks in the validator and the interpreter: ++ * (BPF_MAXINSNS + UINT8_MAX) * sizeof(struct bpf_insn) < UINT32_MAX ++ * It makes the most sense to be able to interpret as many instructions as ++ * pcap_compile() can produce, without optimization, for a valid filter ++ * expression before it consumes as much memory as the current definitions of ++ * NCHUNKS and CHUNKSIZE() allow. For some expressions this can be almost ++ * 1.53 million instructions on a 64-bit machine and twice as many on a 32-bit ++ * machine. ++ */ ++#ifdef BPF_MAXINSNS ++#undef BPF_MAXINSNS ++#endif ++#define BPF_MAXINSNS 3060000U ++ + /* + * Execute the filter program starting at pc on the packet p + * wirelen is the length of the original packet +@@ -86,12 +104,14 @@ enum { + */ + #if defined(SKF_AD_VLAN_TAG_PRESENT) + u_int +-pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p, +- u_int wirelen, u_int buflen, const struct pcap_bpf_aux_data *aux_data) ++pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen, ++ const u_char *p, const u_int wirelen, const u_int buflen, ++ const struct pcap_bpf_aux_data *aux_data) + #else + u_int +-pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p, +- u_int wirelen, u_int buflen, const struct pcap_bpf_aux_data *aux_data _U_) ++pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen, ++ const u_char *p, const u_int wirelen, const u_int buflen, ++ const struct pcap_bpf_aux_data *aux_data _U_) + #endif + { + register uint32_t A, X; +@@ -101,13 +121,36 @@ pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_char *p, + if (pc == 0) + /* + * No filter means accept all. ++ * In this case the value of 'proglen' is irrelevant. + */ + return (u_int)-1; ++ if (proglen < 1 || proglen > BPF_MAXINSNS) ++ return 0; ++ ++ /* ++ * Require the current instruction pointer not to overflow for both the ++ * filter program (where the pointer will be dereferenced) and an ++ * immediately following margin (where it will be not). So long as the ++ * margin is large enough to represent the destination of any single ++ * conditional [forward] jump from within the filter program, a single ++ * guard prevents all filter program over-read attempts that result ++ * from the program running out of instructions before a BPF_RET or a ++ * conditional jump directing the interpreter beyond the program end. ++ * Unconditional jumps mean a larger problem space, which the BPF_JA ++ * case below addresses separately. ++ */ ++ const struct bpf_insn *pcend = pc + proglen; ++ if (pcend + UINT8_MAX < pc) ++ return 0; ++ + A = 0; + X = 0; ++ const struct bpf_insn *pc0 = pc; + --pc; + for (;;) { + ++pc; ++ if (pc >= pcend) ++ return 0; + switch (pc->code) { + + default: +@@ -243,6 +286,40 @@ DIAG_ON_DEFAULT_ONLY_SWITCH + continue; + + case BPF_JMP|BPF_JA: ++ /* ++ * The pointer (pc) decrements and increments in units ++ * of sizeof(struct bpf_insn) == 8 bytes. The number ++ * of units is in the [INT32_MIN, INT32_MAX] interval, ++ * hence the result can point before the beginning or ++ * beyond the end of the filter program and can under- ++ * or overflow; also on 32-bit architectures it can ++ * under- or overflow more than once and can test ++ * negative for underflow, overflow and out-of-range ++ * conditions after under- or overflowing at least ++ * once. ++ * ++ * However, it has been verified above that the program ++ * length is sufficiently small and the pointer does ++ * not wrap within the bounds of the filter program, so ++ * there is a one-to-one correspondence between BPF ++ * program counter values [0, proglen) and all valid ++ * values of the pointer. In other words, after this ++ * unconditional jump the pointer arithmetic result ++ * will be valid iff BPF program counter value will be ++ * valid. For the latter problem the solution is ++ * almost the same as in the validator. ++ * ++ * The main difference is that here the current value ++ * of BPF program counter is not a 32-bit unsigned ++ * variable, but a ptrdiff_t expression, which is ++ * 64-bit signed on 64-bit architectures and 32-bit ++ * signed on 32-bit architectures. However, the cast ++ * to 32-bit unsigned is safe in both cases because: ++ * pc0 <= pc < pc0 + proglen, therefore: ++ * 0 <= pc - pc0 < proglen <= BPF_MAXINSNS < INT32_MAX ++ */ ++ if ((bpf_u_int32)(pc - pc0) + 1 + pc->k >= proglen) ++ return 0; + /* + * XXX - we currently implement "ip6 protochain" + * with backward jumps, so sign-extend pc->k. +@@ -396,10 +473,10 @@ DIAG_ON_DEFAULT_ONLY_SWITCH + } + + u_int +-pcap_filter(const struct bpf_insn *pc, const u_char *p, u_int wirelen, +- u_int buflen) ++pcap_filter(const struct bpf_insn *pc, const u_int proglen, const u_char *p, ++ u_int wirelen, u_int buflen) + { +- return pcap_filter_with_aux_data(pc, p, wirelen, buflen, NULL); ++ return pcap_filter_with_aux_data(pc, proglen, p, wirelen, buflen, NULL); + } + + /* +@@ -419,7 +496,7 @@ pcap_validate_filter(const struct bpf_insn *f, int len) + u_int i, from; + const struct bpf_insn *p; + +- if (len < 1) ++ if (len < 1 || (u_int)len > BPF_MAXINSNS || f + len < f) + return 0; + + for (i = 0; i < (u_int)len; ++i) { +@@ -485,33 +562,45 @@ pcap_validate_filter(const struct bpf_insn *f, int len) + case BPF_JMP: + /* + * Check that jumps are within the code block, +- * and that unconditional branches don't go +- * backwards as a result of an overflow. ++ * regardless of the direction. libpcap uses ++ * backward jumps to implement the "protochain" ++ * primitive. All offsets that mean a backward ++ * jump in libpcap (whether in-range or not) in ++ * kernel BPF implementations mean out-of-range ++ * or overflow forward jumps -- kernel ++ * implementations must reject that. ++ * + * Unconditional branches have a 32-bit offset, + * so they could overflow; we check to make + * sure they don't. Conditional branches have + * an 8-bit offset, and the from address is <= +- * BPF_MAXINSNS, and we assume that BPF_MAXINSNS ++ * BPF_MAXINSNS, and we know that BPF_MAXINSNS + * is sufficiently small that adding 255 to it + * won't overflow. + * + * We know that len is <= BPF_MAXINSNS, and we +- * assume that BPF_MAXINSNS is < the maximum size ++ * know that BPF_MAXINSNS is < the maximum value + * of a u_int, so that i + 1 doesn't overflow. +- * +- * For userland, we don't know that the from +- * or len are <= BPF_MAXINSNS, but we know that +- * from <= len, and, except on a 64-bit system, +- * it's unlikely that len, if it truly reflects +- * the size of the program we've been handed, +- * will be anywhere near the maximum size of +- * a u_int. We also don't check for backward +- * branches, as we currently support them in +- * userland for the protochain operation. + */ + from = i + 1; + switch (BPF_OP(p->code)) { + case BPF_JA: ++ /* ++ * So long as both 'from' and bpf_insn.k are ++ * 32-bit unsigned, this check rejects any jump ++ * offset that points outside of the valid BPF ++ * address space of the filter program no ++ * matter whether signed interpretation of the ++ * offset is positive or negative. ++ * ++ * Note that this condition is necessary, but ++ * not sufficient to get correct results from ++ * respective pointer arithmetic in the process ++ * address space. Other necessary conditions ++ * are that BPF_MAXINSNS is correctly defined ++ * and enforced, and that the pointer does not ++ * overflow. ++ */ + if (from + p->k >= (u_int)len) + return 0; + break; +@@ -539,12 +628,14 @@ pcap_validate_filter(const struct bpf_insn *f, int len) + + /* + * Exported because older versions of libpcap exported them. ++ * This function is deprecated and unsafe, use pcap_offline_filter() instead. + */ + u_int + bpf_filter(const struct bpf_insn *pc, const u_char *p, u_int wirelen, + u_int buflen) + { +- return pcap_filter(pc, p, wirelen, buflen); ++ // The actual length of the filter program is not known. ++ return pcap_filter(pc, BPF_MAXINSNS, p, wirelen, buflen); + } + + int +diff --git a/dlpisubs.c b/dlpisubs.c +index 6815b0ec..790acf28 100644 +--- a/dlpisubs.c ++++ b/dlpisubs.c +@@ -195,7 +195,8 @@ pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user, + bufp += caplen; + #endif + ++pd->stat.ps_recv; +- if (pcap_filter(p->fcode.bf_insns, pk, origlen, caplen)) { ++ if (pcap_filter(p->fcode.bf_insns, p->fcode.bf_len, ++ pk, origlen, caplen)) { + #ifdef HAVE_SYS_BUFMOD_H + pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec; + pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec; +diff --git a/pcap-bpf.c b/pcap-bpf.c +index 2898e598..04b5620d 100644 +--- a/pcap-bpf.c ++++ b/pcap-bpf.c +@@ -1255,7 +1255,8 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user) + #endif + */ + if (pb->filtering_in_kernel || +- pcap_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) { ++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len, ++ datap, bhp->bh_datalen, caplen)) { + struct pcap_pkthdr pkthdr; + #ifdef BIOCSTSTAMP + struct bintime bt; +diff --git a/pcap-bt-linux.c b/pcap-bt-linux.c +index c7bfef1d..dcf3b575 100644 +--- a/pcap-bt-linux.c ++++ b/pcap-bt-linux.c +@@ -394,7 +394,8 @@ bt_read_linux(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char + pkth.caplen+=sizeof(pcap_bluetooth_h4_header); + pkth.len = pkth.caplen; + if (handle->fcode.bf_insns == NULL || +- pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) { ++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ pktd, pkth.len, pkth.caplen)) { + callback(user, &pkth, pktd); + return 1; + } +diff --git a/pcap-bt-monitor-linux.c b/pcap-bt-monitor-linux.c +index 206e65b5..3f9d5b49 100644 +--- a/pcap-bt-monitor-linux.c ++++ b/pcap-bt-monitor-linux.c +@@ -151,7 +151,8 @@ bt_monitor_read(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_ch + bthdr->opcode = htons(hdr.opcode); + + if (handle->fcode.bf_insns == NULL || +- pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) { ++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ pktd, pkth.len, pkth.caplen)) { + callback(user, &pkth, pktd); + return 1; + } +diff --git a/pcap-dag.c b/pcap-dag.c +index f261ead0..c3fe1dbd 100644 +--- a/pcap-dag.c ++++ b/pcap-dag.c +@@ -668,8 +668,9 @@ dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) + caplen = p->snapshot; + + /* Run the packet filter if there is one. */ +- if ((p->fcode.bf_insns == NULL) || pcap_filter(p->fcode.bf_insns, dp, packet_len, caplen)) { +- ++ if (p->fcode.bf_insns == NULL || ++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len, ++ dp, packet_len, caplen)) { + /* convert between timestamp formats */ + register unsigned long long ts; + +diff --git a/pcap-dbus.c b/pcap-dbus.c +index 506f150f..760bb9ba 100644 +--- a/pcap-dbus.c ++++ b/pcap-dbus.c +@@ -91,7 +91,8 @@ dbus_read(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char *us + + gettimeofday(&pkth.ts, NULL); + if (handle->fcode.bf_insns == NULL || +- pcap_filter(handle->fcode.bf_insns, (u_char *)raw_msg, pkth.len, pkth.caplen)) { ++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ (u_char *)raw_msg, pkth.len, pkth.caplen)) { + handlep->packets_read++; + callback(user, &pkth, (u_char *)raw_msg); + count++; +diff --git a/pcap-dpdk.c b/pcap-dpdk.c +index 025a6748..cc31d2f2 100644 +--- a/pcap-dpdk.c ++++ b/pcap-dpdk.c +@@ -407,7 +407,9 @@ static int pcap_dpdk_dispatch(pcap_t *p, int max_cnt, pcap_handler cb, u_char *c + + } + if (bp){ +- if (p->fcode.bf_insns==NULL || pcap_filter(p->fcode.bf_insns, bp, pcap_header.len, pcap_header.caplen)){ ++ if (p->fcode.bf_insns==NULL || ++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len, ++ bp, pcap_header.len, pcap_header.caplen)){ + cb(cb_arg, &pcap_header, bp); + }else{ + pd->bpf_drop++; +diff --git a/pcap-haiku.cpp b/pcap-haiku.cpp +index 8ae9119c..3d34220c 100644 +--- a/pcap-haiku.cpp ++++ b/pcap-haiku.cpp +@@ -85,8 +85,8 @@ pcap_read_haiku(pcap_t* handle, int maxPackets _U_, pcap_handler callback, + + // run the packet filter + if (handle->fcode.bf_insns) { +- if (pcap_filter(handle->fcode.bf_insns, buffer, bytesReceived, +- captureLength) == 0) { ++ if (pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ buffer, bytesReceived, captureLength) == 0) { + // packet got rejected + return 0; + } +diff --git a/pcap-int.h b/pcap-int.h +index 894e74af..11ca3c56 100644 +--- a/pcap-int.h ++++ b/pcap-int.h +@@ -619,13 +619,15 @@ struct pcap_bpf_aux_data { + * Filtering routine that takes the auxiliary data as an additional + * argument. + */ +-u_int pcap_filter_with_aux_data(const struct bpf_insn *, +- const u_char *, u_int, u_int, const struct pcap_bpf_aux_data *); ++u_int pcap_filter_with_aux_data(const struct bpf_insn *, const u_int, ++ const u_char *, const u_int, const u_int, ++ const struct pcap_bpf_aux_data *); + + /* + * Filtering routine that doesn't. + */ +-u_int pcap_filter(const struct bpf_insn *, const u_char *, u_int, u_int); ++u_int pcap_filter(const struct bpf_insn *, const u_int, const u_char *, ++ u_int, u_int); + + /* + * Routine to validate a BPF program. +diff --git a/pcap-linux.c b/pcap-linux.c +index 13bd8529..b2b2ca70 100644 +--- a/pcap-linux.c ++++ b/pcap-linux.c +@@ -3993,6 +3993,7 @@ static int pcap_handle_packet_mmap( + aux_data.vlan_tag = tp_vlan_tci & 0x0fff; + + if (pcap_filter_with_aux_data(handle->fcode.bf_insns, ++ handle->fcode.bf_len, + bp, + tp_len, + snaplen, +diff --git a/pcap-netfilter-linux.c b/pcap-netfilter-linux.c +index 2eb0fc8c..5b5f5c18 100644 +--- a/pcap-netfilter-linux.c ++++ b/pcap-netfilter-linux.c +@@ -259,8 +259,8 @@ netfilter_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_c + + gettimeofday(&pkth.ts, NULL); + if (handle->fcode.bf_insns == NULL || +- pcap_filter(handle->fcode.bf_insns, payload, pkth.len, pkth.caplen)) +- { ++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ payload, pkth.len, pkth.caplen)) { + handlep->packets_read++; + callback(user, &pkth, payload); + count++; +diff --git a/pcap-netmap.c b/pcap-netmap.c +index 27d36e5b..bcfd6e93 100644 +--- a/pcap-netmap.c ++++ b/pcap-netmap.c +@@ -81,7 +81,8 @@ pcap_netmap_filter(u_char *arg, struct pcap_pkthdr *h, const u_char *buf) + const struct bpf_insn *pc = p->fcode.bf_insns; + + ++pn->rx_pkts; +- if (pc == NULL || pcap_filter(pc, buf, h->len, h->caplen)) ++ if (pc == NULL || ++ pcap_filter(pc, p->fcode.bf_len, buf, h->len, h->caplen)) + pn->cb(pn->cb_arg, h, buf); + } + +diff --git a/pcap-npf.c b/pcap-npf.c +index 99b5981e..a4364353 100644 +--- a/pcap-npf.c ++++ b/pcap-npf.c +@@ -682,7 +682,8 @@ pcap_read_npf(pcap_t *p, int cnt, pcap_handler callback, u_char *user) + */ + if (pw->filtering_in_kernel || + p->fcode.bf_insns == NULL || +- pcap_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) { ++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len, ++ datap, bhp->bh_datalen, caplen)) { + #ifdef ENABLE_REMOTE + switch (p->rmt_samp.method) { + +diff --git a/pcap-rdmasniff.c b/pcap-rdmasniff.c +index d63ca898..c8763b33 100644 +--- a/pcap-rdmasniff.c ++++ b/pcap-rdmasniff.c +@@ -172,7 +172,8 @@ rdmasniff_read(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u + pktd = (u_char *) handle->buffer + wc.wr_id * RDMASNIFF_RECEIVE_SIZE; + + if (handle->fcode.bf_insns == NULL || +- pcap_filter(handle->fcode.bf_insns, pktd, pkth.len, pkth.caplen)) { ++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ pktd, pkth.len, pkth.caplen)) { + callback(user, &pkth, pktd); + ++priv->packets_recv; + ++count; +diff --git a/pcap-snf.c b/pcap-snf.c +index fe9cc9c8..16ce9c8e 100644 +--- a/pcap-snf.c ++++ b/pcap-snf.c +@@ -192,7 +192,8 @@ snf_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) + caplen = p->snapshot; + + if ((p->fcode.bf_insns == NULL) || +- pcap_filter(p->fcode.bf_insns, req.pkt_addr, req.length, caplen)) { ++ pcap_filter(p->fcode.bf_insns, p->fcode.bf_len, ++ req.pkt_addr, req.length, caplen)) { + hdr.ts = snf_timestamp_to_timeval(req.timestamp, p->opt.tstamp_precision); + hdr.caplen = caplen; + hdr.len = req.length; +diff --git a/pcap-usb-linux.c b/pcap-usb-linux.c +index 726e4a8a..44b2bf30 100644 +--- a/pcap-usb-linux.c ++++ b/pcap-usb-linux.c +@@ -735,8 +735,8 @@ usb_read_linux_bin(pcap_t *handle, int max_packets _U_, pcap_handler callback, u + pkth.ts.tv_usec = info.hdr->ts_usec; + + if (handle->fcode.bf_insns == NULL || +- pcap_filter(handle->fcode.bf_insns, handle->buffer, +- pkth.len, pkth.caplen)) { ++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ handle->buffer, pkth.len, pkth.caplen)) { + handlep->packets_read++; + callback(user, &pkth, handle->buffer); + return 1; +@@ -904,8 +904,8 @@ usb_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, u_ch + pkth.ts.tv_usec = hdr->ts_usec; + + if (handle->fcode.bf_insns == NULL || +- pcap_filter(handle->fcode.bf_insns, (u_char*) hdr, +- pkth.len, pkth.caplen)) { ++ pcap_filter(handle->fcode.bf_insns, handle->fcode.bf_len, ++ (u_char*) hdr, pkth.len, pkth.caplen)) { + handlep->packets_read++; + callback(user, &pkth, (u_char*) hdr); + packets++; +diff --git a/pcap.c b/pcap.c +index ef1bbb71..9ee83f98 100644 +--- a/pcap.c ++++ b/pcap.c +@@ -4179,7 +4179,7 @@ pcap_offline_filter(const struct bpf_program *fp, const struct pcap_pkthdr *h, + const struct bpf_insn *fcode = fp->bf_insns; + + if (fcode != NULL) +- return (pcap_filter(fcode, pkt, h->len, h->caplen)); ++ return (pcap_filter(fcode, fp->bf_len, pkt, h->len, h->caplen)); + else + return (0); + } +diff --git a/pcap_offline_filter.3pcap b/pcap_offline_filter.3pcap +index dbb6e966..406604dc 100644 +--- a/pcap_offline_filter.3pcap ++++ b/pcap_offline_filter.3pcap +@@ -17,7 +17,7 @@ + .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF + .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. + .\" +-.TH PCAP_OFFLINE_FILTER 3PCAP "7 April 2014" ++.TH PCAP_OFFLINE_FILTER 3PCAP "12 March 2026" + .SH NAME + pcap_offline_filter \- check whether a filter matches a packet + .SH SYNOPSIS +@@ -46,10 +46,35 @@ points to the + structure for the packet, and + .I pkt + points to the data in the packet. ++.PP ++In the ++.B \%bpf_program ++structure the ++.B \%bf_insns ++member is either ++.B NULL ++(which means to reject all packets) or points to an array of one or more ++.B \%struct bpf_insn ++elements, in which case the ++.B \%bf_len ++member must be set to the number of elements (this is what ++.BR \%pcap_compile () ++produces). ++.PP ++The filter program must have been compiled for a link-layer header type ++that matches the packet data; also on Linux the filter must not use ++BPF extensions, see ++.BR \%pcap_compile () ++for more information. + .SH RETURN VALUE + .BR pcap_offline_filter () + returns the return value of the filter program. This will be zero if + the packet doesn't match the filter and non-zero if the packet matches + the filter. ++.SH BACKWARD COMPATIBILITY ++.PP ++In libpcap releases before 1.10.7 this function ignored the provided ++.B \%bf_len ++value. + .SH SEE ALSO + .BR pcap (3PCAP) +diff --git a/savefile.c b/savefile.c +index db8a3aa0..e9708b23 100644 +--- a/savefile.c ++++ b/savefile.c +@@ -687,7 +687,8 @@ pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) + * and, if it passes, process it. + */ + if ((fcode = p->fcode.bf_insns) == NULL || +- pcap_filter(fcode, data, h.len, h.caplen)) { ++ pcap_filter(fcode, p->fcode.bf_len, ++ data, h.len, h.caplen)) { + (*callback)(user, &h, data); + n++; /* count the packet */ + if (n >= cnt) diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb index 692fdf606c0..323cca3d985 100644 --- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb +++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb @@ -18,6 +18,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \ file://CVE-2025-11961-02.patch \ file://CVE-2025-11964.patch \ file://01-CVE-2026-0799.patch \ + file://02-CVE-2026-31912.patch \ " SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f" From patchwork Thu Oct 15 05:03:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100771 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A3E3CC6B2F for ; Thu, 15 Oct 2026 05:04:13 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32450.1792040653163515905 for ; Wed, 14 Oct 2026 22:04:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ItHVquzX; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-49e73611928so42321005e9.1 for ; Wed, 14 Oct 2026 22:04:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040651; x=1792645451; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=oZ1WQX319rCpvCbCo6Ea5aQcv9MvKfbZt/OVup5jlCs=; b=ItHVquzXT7rEaQ5m/qVeTjQpIr53DdXY6uOp0YSOryLZA5W5HAXaMzMsT7YtlUN9rM l9NRyskU+rV63cXUpJV73swYijoc92i088fdDSF/tyMe4G9w7BrtWKKKw7GQqlGSdWwG bz9V3ClTVs6mzXTZORwwIJg0Nsz9uxo8efuTQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040651; x=1792645451; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=oZ1WQX319rCpvCbCo6Ea5aQcv9MvKfbZt/OVup5jlCs=; b=mbWmLlsOmhQH28SmT4cQgUjEOwo7EhEUr4uaS1lupZqfNIODTiYuWan/0apzn+Cjv7 6VGraYpkczduPBoDdkWlr838yXmVzOFvfC5Z2AYv3e70vQ6HZn5vLNcxMMXDIaqEHv8e SFZD2jaiAC/pJH8B5k/ZTF5DoUE8s6ebtlJtdx1jWNDKm3V0r1AEMbWJTfKmwQSWEf+d fT6I7gyHBIC6z4/zVXz3Gmf/ideQs0YywSoF7y24gmxcR8Q2LuipGwql46umm+b8O54C SZ6/tFvvVCxQoiNcyuQJPamvcwseF3ZcyYEO8oinruL23JCRTuJvSWjxNY1ygUFfuOSU QmJg== X-Gm-Message-State: AFq9FYIK619sbKPv/WnxHl+IVN2u6gpxhV/D9pp1BC/8D9hU3eTTNyis sKSLkrf8/mk3P5a33bK7AXiWl7aw4vhgZOOCiKQlMDLzHc9Sw5kAVpMrQBTSI7uEMnfX4TL7018 jmF4Vj9g= X-Gm-Gg: AYBFou1T7vAcws28wxYTiEA0vzlt60Bc/GaucTPviNoW508QcCXeEPBAi4N/MUQ+mRt RsoOP5yj2JE6knQkYe3cPE+1+MeUD2oNS3MQti/gdQXlJJ8ozEYdWuvSphEzNt9gCf4vn2qajYK CFUIARpVwRVxARfz3A38oAj8CukzfTijj7jNEGRJ3VI9+XTJTLbMMynfH60XIUXG8Vgk/mt73+n waWXnBO433Aa6YN4+wW8l4sD55sWCHZ5Bc+YxSxC99yJpIYnWqnoJh7Tx7O9SBKg1zVOMtbsGlZ QhqFDxQucqxVYHfxibJsbe1e0jbzOpzPD4WXiodKsHQS4zSfYkUTkiyYJKkLf0s3JB3v2mvZj/H pKtsc7V4WTwyYPyQAgg0kfifLNuh3pLdEEDNJu/CI70MyCjrQuELl8NEXlVefAQxfoX1h5VrYZZ eA61ptTgzwzRwxDWEuxImC3p402F+jl7x6HOlRgYYi+7GYwCV5N+Of8IreV8uzlejXjXWrnO0aZ G0O1Zu0Qis2I/HxH88MSUZIhlbyEUNL8s3IlKWS/aFc9yBNOpV8XJjPsKG+pNnxJD+uPr9nBw== X-Received: by 2002:a05:600c:8b78:b0:49e:65f2:db64 with SMTP id 5b1f17b1804b1-4a18e4837f2mr344099935e9.5.1792040651240; Wed, 14 Oct 2026 22:04:11 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:10 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 48/55] libpcap: Fix CVE-2026-31911 Date: Thu, 15 Oct 2026 07:03:11 +0200 Message-ID: <26ada8f7dd521e6b472078b2dac57e0e0f635048.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247846 From: Jaipaul Cheernam NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-31911 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/a715bcdde830299cba4171514385cb17ec19b6e9 Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../libpcap/libpcap/03-CVE-2026-31911.patch | 47 +++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/03-CVE-2026-31911.patch diff --git a/meta/recipes-connectivity/libpcap/libpcap/03-CVE-2026-31911.patch b/meta/recipes-connectivity/libpcap/libpcap/03-CVE-2026-31911.patch new file mode 100644 index 00000000000..fc35ada86a3 --- /dev/null +++ b/meta/recipes-connectivity/libpcap/libpcap/03-CVE-2026-31911.patch @@ -0,0 +1,47 @@ +From a715bcdde830299cba4171514385cb17ec19b6e9 Mon Sep 17 00:00:00 2001 +From: Denis Ovsienko +Date: Thu, 30 Jul 2026 13:34:08 +0100 +Subject: [PATCH] CVE-2026-31911: Fail opcodes safely in the BPF interpreter. + +This vulnerability has been discovered by FuzzAnything Organization. + +The current revision of pcapint_filter_with_aux_data() calls abort() if +the current instruction opcode is invalid, and assumes this never to be +the case. This holds for programs that have been generated by libpcap. + +However, this does not necessarily hold for programs that come from an +external source via pcap_offline_filter() or [deprecated] bpf_filter(). +Furthermore, this does not necessarily hold for programs that have been +validated by libpcap because the current revision of the validator has +gaps in the checks and accepts a number of invalid opcodes (another +commit addresses that). + +Thus in pcapint_filter_with_aux_data(), when the instruction opcode is +invalid, just reject the packet. + +(backported from commit 4ccb54bf4946d31a248ec93bdbeaabd97fb9d8f7) + +(cherry picked from commit a715bcdde830299cba4171514385cb17ec19b6e9) + +Notes on backporting to 1.10.4: + - Adapted to the 1.10.4 pcap_filter*() names (renamed to pcapint_*() + after 1.10.4). + - The upstream CHANGES/changelog hunk is not backported. + +Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/a715bcdde830299cba4171514385cb17ec19b6e9] +CVE: CVE-2026-31911 +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/bpf_filter.c b/bpf_filter.c +index 2ea11d46..d6e4b019 100644 +--- a/bpf_filter.c ++++ b/bpf_filter.c +@@ -146,7 +146,7 @@ pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen, + switch (pc->code) { + + default: +- abort(); ++ return 0; + case BPF_RET|BPF_K: + return (u_int)pc->k; + diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb index 323cca3d985..5b97c14e855 100644 --- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb +++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb @@ -19,6 +19,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \ file://CVE-2025-11964.patch \ file://01-CVE-2026-0799.patch \ file://02-CVE-2026-31912.patch \ + file://03-CVE-2026-31911.patch \ " SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f" From patchwork Thu Oct 15 05:03:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100783 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B56C5CCA463 for ; Thu, 15 Oct 2026 05:04:14 +0000 (UTC) Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32851.1792040653857940470 for ; Wed, 14 Oct 2026 22:04:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=rJ7fcWyU; spf=pass (domain: smile.fr, ip: 209.85.221.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-48c14a06c95so3879187f8f.1 for ; Wed, 14 Oct 2026 22:04:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040652; x=1792645452; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=eDTOA8KEyqAwNMFFI5Xt9hC9ONyj0E5R5ltQR2Wovfo=; b=rJ7fcWyUGPKdbQPYupJvh6Epu1O27GWpsLRatPrc23fqtrNX0bCwaMTMOf324zxOln 2oge+kGZjTHs3SFrv/wpF2zVxaBvcExSaw3amEBhXNsBQJycuYPlLXe2WmCYa/pWhVam kT/+Bl69ljt3lOyH1wGbw0+mLEWTO4HnQXCtA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040652; x=1792645452; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=eDTOA8KEyqAwNMFFI5Xt9hC9ONyj0E5R5ltQR2Wovfo=; b=tDxQOCcIK0+Xv0SsE/JQHChQBF8YmX/3QolghfUvP/ieH8UArv2jweOURuGJCAcfv3 f10FsU4U5Q7bj7obG3TU6ZN5f5HSlWRnsDwTkKCRyPZNtJyNwTAYk6YucM9hdvdAvZSG TS2t0Aim8898wbAiyscMcdtKZjIuregDHlnvQ3x5W4odAdLvMmd5U0i6dLkKT8d5pjSI JdGsFjP5PMYqlh68cufnKmQFpUetyIqZx7j+o7CUpepnKuzWMRw9XQ0Xcxct5eNifC0y uEnCmhpPETj6SGL2zQ/rkY3ZG+Nj8JzF85S2m3cj0uYHntbkEKHcXcxQcy9Dfs6I/oOF 8eIw== X-Gm-Message-State: AFq9FYIiYWW+BnkuMud1OE8mTX7LivTUpRoBDDlIpYi+i0AOBj7W5wmf mDA3So7Ut7IXJZoA5d8kF/LscDV0NTNHZiwtwCjARn85+64c8KBLsDI2ATUrgnmP+mKO9lMjCS8 fuHJ/eZw= X-Gm-Gg: AYBFou2E4DUW0XDdJs7IGbb1VVaO1pTTOVmsKkEbfvpH04MQGL2T3mni8Vg/mhh3XX/ Yi+gNRkP3KXYDot/fqSq+GIVxNqVnjKvNAchUNahmf9e0svBKyd51EUeCRks8QbsqqFcXdmKr8x uJ8BK0aYcAoqnRxudlUaaoFhOHchuuwKa2HpKr/cjjJk5HrxcJEvzxABPKJLOoAjEIvDO+zH3sy o0Kom0TGPn1Y0ghsQYqsWfiec0Ush16/BCphy2LDSIyvBkkjlOCz5pHrYFkpmxj+oazD2KCepZo OhwsO90D/Xud+zIQ7tbEAMXH34bqv2a54+RN++LZEEhjYPa8cUWaC67qGU/Lbh8NUhC5KgQk8IM tJeXJuk7CYNkbc0yh9ayx5EIuOyx+3Obfp6rzqKgLtd1T/Xgxhb4/F/VPTi9u8orUhNtBqaQChD I6Cu4jIyxwpGYxPjw8ZKqFUVpBsCPtJkhq3lGWnexweBnxW3yrriSH2I5oON0s/Kvhv2dYC1vzR RcNIEeCmoMBU68Rb2iWgm9n6Fxoix5f6jMZtssSWbOZMVwo1lyB8stTUmVjtfn+kfAaDq6kxQ== X-Received: by 2002:a05:600c:4e11:b0:4a1:7f41:b9dc with SMTP id 5b1f17b1804b1-4a18e4d67famr352236415e9.23.1792040652076; Wed, 14 Oct 2026 22:04:12 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:11 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 49/55] libpcap: Fix CVE-2026-6244 Date: Thu, 15 Oct 2026 07:03:12 +0200 Message-ID: <19127ab88cace8da29f70441528474b326a0af4c.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247847 From: Jaipaul Cheernam NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-6244 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/98bb921b141aa642faedbf2ac510541c76499a19 Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../libpcap/libpcap/04-CVE-2026-6244.patch | 49 +++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/04-CVE-2026-6244.patch diff --git a/meta/recipes-connectivity/libpcap/libpcap/04-CVE-2026-6244.patch b/meta/recipes-connectivity/libpcap/libpcap/04-CVE-2026-6244.patch new file mode 100644 index 00000000000..5215b12ffb0 --- /dev/null +++ b/meta/recipes-connectivity/libpcap/libpcap/04-CVE-2026-6244.patch @@ -0,0 +1,49 @@ +From 98bb921b141aa642faedbf2ac510541c76499a19 Mon Sep 17 00:00:00 2001 +From: Denis Ovsienko +Date: Thu, 30 Jul 2026 13:34:21 +0100 +Subject: [PATCH] CVE-2026-6244: Avoid division by zero via pcap_offline_filter(). + +The current revision of pcapint_filter_with_aux_data() for "div x" and +"mod x" correctly rejects the packet if X is zero, but for "div #k" and +"mod #k" it assumes that k is never zero. This holds for programs that +have been generated or validated by libpcap. + +However, this does not necessarily hold for programs that come from an +external source via pcap_offline_filter() or [deprecated] bpf_filter() +and have not been explicitly validated. If the interpreter executes +such a program, it can attempt a division by zero, which will typically +terminate the process via SIGFPE. + +To fix this problem, in pcapint_filter_with_aux_data() treat "div #k" +and "mod #k" the same way as "div x" and "mod x". + +(backported from commit 0b2b1ad4a1796513613ff68e9dc09049cc8e0af4) + +(cherry picked from commit 98bb921b141aa642faedbf2ac510541c76499a19) + +Notes on backporting to 1.10.4: + - The upstream CHANGES/changelog hunk is not backported. + +Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/98bb921b141aa642faedbf2ac510541c76499a19] +CVE: CVE-2026-6244 +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/bpf_filter.c b/bpf_filter.c +index 497b1586..df92c433 100644 +--- a/bpf_filter.c ++++ b/bpf_filter.c +@@ -422,10 +422,14 @@ DIAG_ON_DEFAULT_ONLY_SWITCH + continue; + + case BPF_ALU|BPF_DIV|BPF_K: ++ if (pc->k == 0) ++ return 0; + A /= pc->k; + continue; + + case BPF_ALU|BPF_MOD|BPF_K: ++ if (pc->k == 0) ++ return 0; + A %= pc->k; + continue; + diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb index 5b97c14e855..d23a018a953 100644 --- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb +++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb @@ -20,6 +20,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \ file://01-CVE-2026-0799.patch \ file://02-CVE-2026-31912.patch \ file://03-CVE-2026-31911.patch \ + file://04-CVE-2026-6244.patch \ " SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f" From patchwork Thu Oct 15 05:03:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100787 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2288CC6B39 for ; Thu, 15 Oct 2026 05:04:24 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32852.1792040654801672096 for ; Wed, 14 Oct 2026 22:04:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=bLo4poPH; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a021c809e3so45975805e9.0 for ; Wed, 14 Oct 2026 22:04:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040653; x=1792645453; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Bs118gol+uNLBEYHsqJd1MO11ml4StiXpwHTQxseP5c=; b=bLo4poPH3XDmLZCTlRM3lBV3BgYWifnZe1CsIsF2+n8a1eNLFyicamc+3M+BVfJC0v GBFz9cxjr8MHfABq5DXPJh3LJqCRmRHFZ2q8ItswxAFk5yZ5IJfPYHkOhACxWamBIVBZ QNRIPuW9SR/qMulR+eJ+qHwcVXX53zinIuAhU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040653; x=1792645453; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Bs118gol+uNLBEYHsqJd1MO11ml4StiXpwHTQxseP5c=; b=I2jwqQw9HazwgXuxfKf8xfdmtDyT3UU4UXW/8E3w5/DQND35fbxzE20OjZOXzUp+9U zJLksuBEFSjpIKsdNwJnM8eegeSOj+6I95c8yhyjB8UcvGkx/jSsj5M/0dQ3MYwf/zDR YMdXcefAaAl2QkwbluCrB0FUYHra9nTKW+zKaQKbiiDRyEx9NH5LCFYT97c5GqAxfBVK rL1jYrTKEMlDwLIBbzA/9J/tP1m9awEQ5iNc1BUfML/hvHosj92XC88Yn6/t6LeKJ9v8 Q/VcSkF9KQuSQDV7xjAYgG8M+u/mgCEKA4jvJfWRyqo1qDlFb+uVrPsFs3/TX/RMfO40 Taug== X-Gm-Message-State: AFq9FYIox0bZpGhvfWjI8pfxwIBkIyvYszd3La8FqgeAQWMGNOFAOsrr PuBqsTBTjnCqcom2J3O2VjRUT0iYvy9OWvK5eGOfXxP29CMB+G5BATFm4BIQCu6LnUmfGM09tq3 MYv7LmcQ= X-Gm-Gg: AYBFou0Ivr9pCARYw1N62g0AgDrhGprMlKRARkl4QQz0lgeSzhC3VdrQ+gCloSl/RW3 ha3JFm045mJDgmcfvnon7Nm+I0ocZlgwWn7r303mjq8Ns2PLmp5UFNbsZec5Sc0d1nUmS0kY5Gm Kw12hEuBdoJsKXOpj1civvgKs4/8yLUrAJe+2Ty0Cq5hU+KvqmdxeM3kZfHXfG3QpVPsDC7ztC6 sqf9bNkvPJXoS4NUAkIMo89m6S/haL50oVFXkUrDEPtcOYW1GxbqMTdrO7vPhc1O00ceOqPDRUp xBU0tF/LqaAXppMZ4ajnCrWLa24rjvizxQ0TxDXjIUPIVo/gekAh/KUiMKvpg3QzTI93TpO+g2A qv5x2swPT25XODzMVSQw48FNSyzzOerfEHsoCVaHv8DDBOC7OsnHYccLoJvkOptKgzowBMwK10O QL6sNDDPD809rH0ADebg5e1o+orfx8HV+jKCuyXVTnjW6D0Fsxa+fzwfKVHh+JhbECzC7uiSJaW 58aiKhdh9fkgkQwvJMap6OY5dQJ/KqP3L6+IyneunU1aYRNNffzDTu0mZXD1enzC46988wiZfY= X-Received: by 2002:a05:600c:8105:b0:49f:fdca:c361 with SMTP id 5b1f17b1804b1-4a18e483818mr380346295e9.12.1792040653050; Wed, 14 Oct 2026 22:04:13 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:12 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 50/55] libpcap: Fix CVE-2026-6554 Date: Thu, 15 Oct 2026 07:03:13 +0200 Message-ID: <97da4c723262d570d42ef66d281f7add017c72f5.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247848 From: Jaipaul Cheernam NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-6554 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../libpcap/libpcap/05-CVE-2026-6554.patch | 92 +++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 93 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/05-CVE-2026-6554.patch diff --git a/meta/recipes-connectivity/libpcap/libpcap/05-CVE-2026-6554.patch b/meta/recipes-connectivity/libpcap/libpcap/05-CVE-2026-6554.patch new file mode 100644 index 00000000000..9c44294d1f9 --- /dev/null +++ b/meta/recipes-connectivity/libpcap/libpcap/05-CVE-2026-6554.patch @@ -0,0 +1,92 @@ +From ff3c83475ac303c6b681c52ad0b6e14795a8e0ce Mon Sep 17 00:00:00 2001 +From: Denis Ovsienko +Date: Thu, 30 Jul 2026 13:34:33 +0100 +Subject: [PATCH] CVE-2026-6554: Limit "ja L" looping in pcap_offline_filter(). + +This vulnerability has been discovered by Kaixuan LI. + +The current revision of pcapint_filter_with_aux_data() assumes that any +"ja L" instruction in a filter program does not jump to itself or to a +prior instruction that is guaranteed to reach the same "ja L" again. +This holds for programs that have been generated by libpcap. + +However, this does not necessarily hold for programs that come from an +external source via pcap_offline_filter() or [deprecated] bpf_filter(). +If the interpreter executes such a program, upon reaching such an +instruction it will begin looping infinitely. + +To mitigate this problem, in pcapint_filter_with_aux_data() enforce a +hard-coded limit on the number of backward jumps per packet. Ibid., and +in pcapint_validate_filter() as well, reject the only immediately +detectable case of an infinite loop. + +(backported from commit 63c005c25aeabf1404968add49fc885da3e127e0) + +(cherry picked from commit ff3c83475ac303c6b681c52ad0b6e14795a8e0ce) + +Notes on backporting to 1.10.4: + - Adapted to the 1.10.4 pcap_filter*() names (renamed to pcapint_*() + after 1.10.4). + - The upstream CHANGES/changelog hunk is not backported. + +Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/ff3c83475ac303c6b681c52ad0b6e14795a8e0ce] +CVE: CVE-2026-6554 +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/bpf_filter.c b/bpf_filter.c +index df92c433..ae8a3a36 100644 +--- a/bpf_filter.c ++++ b/bpf_filter.c +@@ -72,6 +72,8 @@ enum { + BPF_S_ANC_VLAN_TAG_PRESENT, + }; + ++#define MAX_BACKWARD_JUMPS 64U ++ + /* + * Kernel BPF implementations tend to define BPF_MAXINSNS to 512 or 4096, the + * userland interpreter in libpcap is meant to support much longer filter +@@ -146,6 +148,7 @@ pcap_filter_with_aux_data(const struct bpf_insn *pc, const u_int proglen, + A = 0; + X = 0; + const struct bpf_insn *pc0 = pc; ++ unsigned backward_jumps = 0; + --pc; + for (;;) { + ++pc; +@@ -320,6 +323,17 @@ DIAG_ON_DEFAULT_ONLY_SWITCH + */ + if ((bpf_u_int32)(pc - pc0) + 1 + pc->k >= proglen) + return 0; ++ /* ++ * Terminate the program if this is a non-forward jump ++ * and is: ++ * - a guaranteed infinite loop because it jumps to ++ * itself (exactly the same as in the validator), or ++ * - a backward jump after many enough backward jumps ++ * already made for this packet. ++ */ ++ if ((bpf_int32)pc->k < 0 && ((bpf_int32)pc->k == -1 || ++ backward_jumps++ >= MAX_BACKWARD_JUMPS)) ++ return 0; + /* + * XXX - we currently implement "ip6 protochain" + * with backward jumps, so sign-extend pc->k. +@@ -607,6 +621,17 @@ pcap_validate_filter(const struct bpf_insn *f, int len) + */ + if (from + p->k >= (u_int)len) + return 0; ++ /* ++ * The only type of infinite loop that can be ++ * detected in this function is a "ja L" that ++ * jumps to itself. For this only k == -1 ++ * needs to be tested because the check above ++ * has already rejected all other values that ++ * would wrap the pointer equivalently on ++ * 32-bit architectures. ++ */ ++ if ((bpf_int32)p->k == -1) ++ return 0; + break; + case BPF_JEQ: + case BPF_JGT: diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb index d23a018a953..f7ba1bf3eac 100644 --- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb +++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb @@ -21,6 +21,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \ file://02-CVE-2026-31912.patch \ file://03-CVE-2026-31911.patch \ file://04-CVE-2026-6244.patch \ + file://05-CVE-2026-6554.patch \ " SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f" From patchwork Thu Oct 15 05:03:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100788 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B27BCC6B3B for ; Thu, 15 Oct 2026 05:04:25 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32452.1792040656060358100 for ; Wed, 14 Oct 2026 22:04:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=MngprPur; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a171b677d2so30091615e9.0 for ; Wed, 14 Oct 2026 22:04:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040654; x=1792645454; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=51K8GYXHEZ40M1ytDhdNb3Guo28JsMvpTXf+8AZ9wJQ=; b=MngprPurNS7EF2Yt5a5b/7FeQ242mf33+HklJlA21nUz32vw9HkB1gCHfaKNvGCGf/ CiKxlRfbbq4hULlMEIpZ1ptFc4AYA2eMR+tA2YylRkqSrS5WMwVV64jEZ4fDk+BTkssm rsBsjY5aKr4OobndmSmUaoj/rH1TJWDeCyQBY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040654; x=1792645454; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=51K8GYXHEZ40M1ytDhdNb3Guo28JsMvpTXf+8AZ9wJQ=; b=DYW+Wkw8czAKVSmfzqQ+METXMC7R0GZUzqt7nAi/1ap/Cfy3qRLcpHGv8idsZ+Dcio 6BNNc7UyF7TAGDmHD2O4GWqh2ACfSP8GoqsOgIarLFXrv6VZWbX9NrAiyRIuRLWZnvaa d2w+JnavQb9FJJroatTB0vDAtWhIGcGdjyih/JnQUW+kVPK/Q6G9HQ1+L8PLV6WXK2Dp /vnQinZ26Aw/o3M/230vxJANBRUYmENHjWj95kU2mKeWQwrjEKCcxWxvHmOVMi5YO1ps is/2y1wTccqr1kzMLEiOR8pS4INBeFF2PesI5UoNaXmA3EcOU5jqVw1HwZ6qhL6wc2qj n23w== X-Gm-Message-State: AFq9FYLRr7OgFNRe8ZbN/YuTx7Upkj8ILUB80bBgE49oyWXDo1MxA3Bn HEIYzjnXZmhV2D0hy7ikQaIvQhKA/UDg69yDFr9qkNu7ABeJrM+Cyz0ddPwtQX+oLY8WmBt+Ttx Dg/l/z3g= X-Gm-Gg: AYBFou2cEdkVTqAE7dIPS7+i2U+KwKCPS9dkcda6ZWvrDTakjJHkcNRw7rtNlHmdm49 RX9X3f60eVqQc4mJzdaeCNY7tmJUCeHfwr9ZUhEGVra21tiEkCr6/lOUPZYVoDE51g2AN8ffdcp OokdUGOoQOyHwg8CFiSQEzO4cCzdisGKOoEeKMGYItzFlczuDg0sfM5br8SDW7lbyf08L01Ncxi 8FnWrLCbnQisZmZDaqskMqjd6VJbY4hwSG6o9lSm71u7n1UrlE+t6s3uWsokJHtBYfZcWAEQAID KBuOZOm7PM4cCjj4xbjfuTeNHEkljcdDg4M+r98FaO2bl/WjN/jTM6BUXeDk7+OJEgFGwUddgpq GvHAGVCbDJDxtBfSE/ngYbhnsy/eYVzDVF8VE+x83KGWtnqH5w7WibHVU1kX3PpBFsrp4ZZiwTC z33VWPzZbEBcnGuWvpSaEwqIhrF5VHiNYtJJ94I0Lx8ahZUUEj0RfbIwbAQRyUrphkZkxOZp4C6 agPYvALUyO7SY1o4eHZHUo0FjeyrC752fK5F5uad2RjQwIWH01sJGcO7x2f5Adf0sjOXub6eFBg 4BTvUqW+ X-Received: by 2002:a05:600c:34d4:b0:4a0:108:3b54 with SMTP id 5b1f17b1804b1-4a18e4d67d6mr341417235e9.32.1792040654280; Wed, 14 Oct 2026 22:04:14 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:13 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 51/55] libpcap: Fix CVE-2026-18313 Date: Thu, 15 Oct 2026 07:03:14 +0200 Message-ID: <6cdcaaf4c347a32d5408653f8eb343c8e4fb04ff.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247849 From: Jaipaul Cheernam NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18313 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e6b48f1be10ac7 Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../libpcap/libpcap/06-CVE-2026-18313.patch | 84 +++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 85 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/06-CVE-2026-18313.patch diff --git a/meta/recipes-connectivity/libpcap/libpcap/06-CVE-2026-18313.patch b/meta/recipes-connectivity/libpcap/libpcap/06-CVE-2026-18313.patch new file mode 100644 index 00000000000..2a9df12e2aa --- /dev/null +++ b/meta/recipes-connectivity/libpcap/libpcap/06-CVE-2026-18313.patch @@ -0,0 +1,84 @@ +From f9775af1a0ec76db60c7213241e6b48f1be10ac7 Mon Sep 17 00:00:00 2001 +From: Denis Ovsienko +Date: Sat, 1 Aug 2026 18:24:48 +0100 +Subject: [PATCH] CVE-2026-18313: Fix a memory leak in rpcapd. + +This vulnerability was originally reported publicly, hence no credit is +given. + +daemon_unpackapplyfilter() can allocate a temporary buffer for up to +RPCAP_BPF_MAXINSNS (8192) BPF instructions (65536 bytes) per each +received RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message. +It never frees the memory, so repeated messages from a client will +eventually leak enough memory on the server to cause problems. This +holds for all connections that pass the validation and some connections +that do not. + +48 bytes in 1 blocks are definitely lost in loss record 2 of 2 + at 0x4844818: malloc (vg_replace_malloc.c:446) + by 0x111AAB: daemon_unpackapplyfilter (daemon.c:2372) + by 0x113279: daemon_msg_startcap_req.constprop.0 (daemon.c:2139) + by 0x114808: daemon_serviceloop (daemon.c:901) + by 0x115BC7: accept_connection (rpcapd.c:1321) + by 0x115BC7: accept_connections (rpcapd.c:1118) + by 0x115BC7: main_startup (rpcapd.c:709) + by 0x1112BD: main (rpcapd.c:567) + +To fix this, after a successful malloc() return exactly once, after the +free() call. + +(backported from commit 26a1c75702b105ac8788014f35f1b5c57fa6043b) + +(cherry picked from commit f9775af1a0ec76db60c7213241e6b48f1be10ac7) + +Notes on backporting to 1.10.4: + - The upstream CHANGES/changelog hunk is not backported. + +Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e6b48f1be10ac7] +CVE: CVE-2026-18313 +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/rpcapd/daemon.c b/rpcapd/daemon.c +index 9b0f8285..b0268688 100644 +--- a/rpcapd/daemon.c ++++ b/rpcapd/daemon.c +@@ -2378,14 +2378,8 @@ daemon_unpackapplyfilter(SOCKET sockctrl, SSL *ctrl_ssl, struct session *session + { + status = rpcapd_recv(sockctrl, ctrl_ssl, (char *) &insn, + sizeof(struct rpcap_filterbpf_insn), plenp, errmsgbuf); +- if (status == -1) +- { +- return -1; +- } +- if (status == -2) +- { +- return -2; +- } ++ if (status == -1 || status == -2) ++ goto free_and_return_status; + + bf_insn->code = ntohs(insn.code); + bf_insn->jf = insn.jf; +@@ -2401,16 +2395,19 @@ daemon_unpackapplyfilter(SOCKET sockctrl, SSL *ctrl_ssl, struct session *session + if (bpf_validate(bf_prog.bf_insns, bf_prog.bf_len) == 0) + { + snprintf(errmsgbuf, PCAP_ERRBUF_SIZE, "The filter contains bogus instructions"); +- return -2; ++ status = -2; ++ goto free_and_return_status; + } + + if (pcap_setfilter(session->fp, &bf_prog)) + { + snprintf(errmsgbuf, PCAP_ERRBUF_SIZE, "RPCAP error: %s", pcap_geterr(session->fp)); +- return -2; ++ status = -2; + } + +- return 0; ++free_and_return_status: ++ free(bf_prog.bf_insns); ++ return status; + } + + static int diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb index f7ba1bf3eac..5f1506f8fc9 100644 --- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb +++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb @@ -22,6 +22,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \ file://03-CVE-2026-31911.patch \ file://04-CVE-2026-6244.patch \ file://05-CVE-2026-6554.patch \ + file://06-CVE-2026-18313.patch \ " SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f" From patchwork Thu Oct 15 05:03:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100789 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45C03CC6B3C for ; Thu, 15 Oct 2026 05:04:25 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32855.1792040656745067296 for ; Wed, 14 Oct 2026 22:04:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=FrGCO7I+; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a020e65269so31227415e9.2 for ; Wed, 14 Oct 2026 22:04:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040655; x=1792645455; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Ka55WP5UG2fczh2eLqHUHHjq0Ob1WRXHPs+hpbOjzgQ=; b=FrGCO7I+u2ibOiKp1XRzVRTayZQ/8H6jKADv2bK6ui+ETkWrowNnfM9riMUMyMjkmB zcgSfpuw+A4ZuiWdoOoRYwozDYhwqZuK56oRdvy2xbLa/f+cSo8PFdK1TXmKxlFrZlDb UrKVTZPWR3v4gVxZ0yZCMQ4nAOcTunMHVVr58= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040655; x=1792645455; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Ka55WP5UG2fczh2eLqHUHHjq0Ob1WRXHPs+hpbOjzgQ=; b=EmV/uCAwCIIphvc1X45AO4OhM8M2p4uETE4W0CnXIQ/tyvmMeSuHM8QKVaR98wDLgI Yt0CWIgbMTYogdn0a0wfyLIQKCBaezLdx5vaWyLtop5Vp4LLGNT0b5que9TpjLzKcjLb TuquB1EZrBwRRsqNPAFeeVTLeudJZMN4Nk98XxdWzNrB7hEcb7zsMSAQwEqjs0s7LwcS a+1wBIjltbgodiYdg4CSG8ROTKDZXjp1OdbS/MZw4viUtk7f8Kc7L4rsk9Tp5OUfm4i6 f9PbNuN2epTvo4SYOXi7jC+6a3DAEyDB1PK2XgbJ1XEDZ0QbbeGXVAg/ym539dG2XUGC RyTg== X-Gm-Message-State: AFq9FYL/kL4ZQwS5w8CoZ2LzAaNnUni0kwo0Bx0ip0SqW/pUp4xzi9iz 4ELQeEUO+eQDyQrm2uqlV+4C3Pf9qLl2MiIfa6JKcHd2q2aUi4QEHkeE30GVNtppFktT7LvlKti WyySBoWY= X-Gm-Gg: AYBFou2MpgKC9KHuN7aY8C++zKYkrNxO7Gk28St9X0HkaSaYSPmUqWJjxfybPPX1kJd YsVZimvmJVvDyho+TgZQL941X57x+W/FoqrrmJGCgugYmaWYRFjs6Ct9ryBFvgWFScfDF/NTfiO I9EnNOaIOR10QyIwwdHZIwaaegqjmrpLGt8CFNGv0eVrHw5F78p6pZKxudSYY74XOJVC3r7mJDT R8Uoep5vFc+V4o2lMl+nFWiN5lwja6rBrW1OdWfT6yZ6KFrpi0NGlYwwb7v4id/TAiTjvpwECse wh177teC47QY1fKGa9XTKH62nGCwqLtEbfBCvWgp6BDmhgINSmEiCnN6X8XmoeBXfP82stf016v uj3BshhAurpueWtc3Jo5IknoRLHVC4hfLJxS5K9pjvaeVU6a7cH+1s2DJ2r4yHdE/yidpmTMTro owuD7IBg+pvx61pJ7Ri8gKXs9fT19fzbPQG7G5dVmwBnfKBBJ3Xiv+kRSGK9Z++6IQGdWKwzK3x U9ZDnWkKfoyH19atYuBaN4MS26Nq0+1VMWQ0ejmqZWyqR7uQ6Q1W3Ti4G65MKZ1ko3Est0bxQ== X-Received: by 2002:a05:600c:6990:b0:4a0:1ea1:477a with SMTP id 5b1f17b1804b1-4a18e4d8bbamr313734115e9.27.1792040654844; Wed, 14 Oct 2026 22:04:14 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:14 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 52/55] libpcap: Fix CVE-2026-18238 Date: Thu, 15 Oct 2026 07:03:15 +0200 Message-ID: <940dee79d02890b06b91bb394ba51b933e3a1dbb.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247850 From: Jaipaul Cheernam NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18238 Upstream-commit: https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473 Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../libpcap/libpcap/07-CVE-2026-18238.patch | 222 ++++++++++++++++++ .../libpcap/libpcap_1.10.4.bb | 1 + 2 files changed, 223 insertions(+) create mode 100644 meta/recipes-connectivity/libpcap/libpcap/07-CVE-2026-18238.patch diff --git a/meta/recipes-connectivity/libpcap/libpcap/07-CVE-2026-18238.patch b/meta/recipes-connectivity/libpcap/libpcap/07-CVE-2026-18238.patch new file mode 100644 index 00000000000..36f80c483f6 --- /dev/null +++ b/meta/recipes-connectivity/libpcap/libpcap/07-CVE-2026-18238.patch @@ -0,0 +1,222 @@ +From b9590d482986d64673712460aae1d48d11fa0473 Mon Sep 17 00:00:00 2001 +From: Denis Ovsienko +Date: Sat, 8 Aug 2026 00:31:10 +0100 +Subject: [PATCH] CVE-2026-18238: Fix RPCAP_MSG_PACKET validation. + +This vulnerability was originally reported publicly, hence no credit is +given. + +When pcap_read_nocb_remote() validates a received message, it does not +verify that there is a complete RPCAP_MSG_PACKET header in the rpcap +general payload, also it uses an incorrect value to validate the length +declared in the RPCAP_MSG_PACKET header. The latter can lead the +protocol client to over-read the message buffer by 20 bytes, which in at +least one scenario can cause a SIGSEGV. + +Fix this problem, as well as a potential integer overflow in the UDP +code path on 32-bit architectures. To make message encoding and +validation easier to follow, re-jig a few variables and update comments. + +(backported from commit 2d67e814e8d3791a8b508c359f94688c5669cce9) + +(cherry picked from commit b9590d482986d64673712460aae1d48d11fa0473) + +Notes on backporting to 1.10.4: + - The upstream CHANGES/changelog hunk is not backported. + +Upstream-Status: Backport [https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473] +CVE: CVE-2026-18238 +Signed-off-by: Jaipaul Cheernam +--- +diff --git a/pcap-rpcap.c b/pcap-rpcap.c +index 22fc7363..30fbd6d6 100644 +--- a/pcap-rpcap.c ++++ b/pcap-rpcap.c +@@ -388,10 +388,9 @@ rpcap_deseraddr(struct rpcap_sockaddr *sockaddrin, struct sockaddr_storage **soc + static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr *pkt_header, u_char **pkt_data) + { + struct pcap_rpcap *pr = p->priv; /* structure used when doing a remote live capture */ +- struct rpcap_header *header; /* general header according to the RPCAP format */ +- struct rpcap_pkthdr *net_pkt_header; /* header of the packet, from the message */ ++ struct rpcap_header *gen_header; /* rpcap general header */ ++ struct rpcap_pkthdr *net_pkt_header; /* RPCAP_MSG_PACKET header */ + u_char *net_pkt_data; /* packet data from the message */ +- uint32 plen; + int retval = 0; /* generic return value */ + int msglen; + +@@ -448,13 +447,35 @@ static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr *pkt_header, u_ch + return 0; + + /* +- * We have to define 'header' as a pointer to a larger buffer, +- * because in case of UDP we have to read all the message within a single call ++ * pcap_startcapture_remote() has pointed p->buffer to a buffer large ++ * enough to contain all of the following data at once: ++ * ++ * - a fixed-size rpcap general header ++ * - a fixed-size RPCAP_MSG_PACKET header ++ * - p->snapshot worth of bytes of a captured packet ++ * ++ * This is sufficient for all code paths below. + */ +- header = (struct rpcap_header *) p->buffer; ++ gen_header = (struct rpcap_header *)p->buffer; + net_pkt_header = (struct rpcap_pkthdr *) ((char *)p->buffer + sizeof(struct rpcap_header)); + net_pkt_data = (u_char *)p->buffer + sizeof(struct rpcap_header) + sizeof(struct rpcap_pkthdr); + ++ /* ++ * Step 1: to receive a message that does not immediately look ++ * malformed, consider it as a fixed-size rpcap general header followed ++ * by a variable-size rpcap general payload and require: ++ * ++ * - a complete rpcap general header to land in the buffer, and ++ * - the header to declare an rpcap general payload length that fits ++ * in the buffer after the header, and ++ * - the complete declared payload to land in the buffer after the ++ * header. ++ * ++ * Since this step loosely corresponds to rpcap_process_msg_header(), ++ * which among other things converts rpcap_header.plen to host byte ++ * order, mimic that as well to produce a valid argument for ++ * rpcap_check_msg_ver() later on. ++ */ + if (pr->rmt_flags & PCAP_OPENFLAG_DATATX_UDP) + { + /* Read the entire message from the network */ +@@ -470,6 +491,8 @@ static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr *pkt_header, u_ch + /* Interrupted receive. */ + return 0; + } ++ ++ // Require a complete rpcap general header to be present. + if ((size_t)msglen < sizeof(struct rpcap_header)) + { + /* +@@ -479,8 +502,18 @@ static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr *pkt_header, u_ch + "UDP packet message is shorter than an rpcap header"); + return -1; + } +- plen = ntohl(header->plen); +- if ((size_t)msglen < sizeof(struct rpcap_header) + plen) ++ gen_header->plen = ntohl(gen_header->plen); ++ ++ /* ++ * Validate the rpcap general payload length declared in the ++ * rpcap general header. Use subtraction to avoid an integer ++ * overflow: ++ * ++ * 0 <= gen_header->plen <= UINT32_MAX ++ * sizeof(struct rpcap_header) <= msglen <= p->bufsize ++ * p->bufsize is significantly less than UINT32_MAX ++ */ ++ if (gen_header->plen > (size_t)msglen - sizeof(struct rpcap_header)) + { + /* + * Message is shorter than the header claims it +@@ -495,6 +528,7 @@ static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr *pkt_header, u_ch + { + int status; + ++ // Receive a complete rpcap general header from the network. + if ((size_t)p->cc < sizeof(struct rpcap_header)) + { + /* +@@ -514,27 +548,35 @@ static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr *pkt_header, u_ch + return 0; + } + } ++ gen_header->plen = ntohl(gen_header->plen); + + /* +- * We have the header, so we know how long the +- * message payload is. The size we should get +- * is the size of the packet header plus the +- * size of the payload. ++ * Validate the rpcap general payload length declared in the ++ * rpcap general header. Use subtraction to avoid an integer ++ * overflow: ++ * ++ * 0 <= gen_header->plen <= UINT32_MAX ++ * sizeof(struct rpcap_header) < p->bufsize ++ * p->bufsize is significantly less than UINT32_MAX + */ +- plen = ntohl(header->plen); +- if (plen > p->bufsize - sizeof(struct rpcap_header)) ++ if (gen_header->plen > p->bufsize - sizeof(struct rpcap_header)) + { + /* + * This is bigger than the largest +- * record we'd expect. (We do it by +- * subtracting in order to avoid an +- * overflow.) ++ * record we'd expect. + */ + snprintf(p->errbuf, PCAP_ERRBUF_SIZE, + "Server sent us a message larger than the largest expected packet message"); + return -1; + } +- status = rpcap_read_packet_msg(pr, p, sizeof(struct rpcap_header) + plen); ++ ++ /* ++ * Receive the declared rpcap general payload from the network. ++ * ++ * p->cc == sizeof(struct rpcap_header) ++ * p->bp == p->buffer + sizeof(struct rpcap_header) ++ */ ++ status = rpcap_read_packet_msg(pr, p, sizeof(struct rpcap_header) + gen_header->plen); + if (status == -1) + { + /* Network error. */ +@@ -557,27 +599,36 @@ static int pcap_read_nocb_remote(pcap_t *p, struct pcap_pkthdr *pkt_header, u_ch + + /* + * We have the entire message. +- */ +- header->plen = plen; +- +- /* +- * Did the server specify the version we negotiated? ++ * Step 2: to validate the received message further, require: ++ * ++ * - the rpcap general header to have the correct version and type, and ++ * - the rpcap general payload to be large enough to contain at least a ++ * complete RPCAP_MSG_PACKET header, and ++ * - the RPCAP_MSG_PACKET header to declare an RPCAP_MSG_PACKET payload ++ * (i.e. the captured packet) length that fits in the rpcap general ++ * payload (not the entire buffer) after the RPCAP_MSG_PACKET header. + */ + if (rpcap_check_msg_ver(pr->rmt_sockdata, pr->data_ssl, pr->protocol_version, +- header, p->errbuf) == -1) +- { ++ gen_header, p->errbuf) == -1) ++ return 0; /* Return 'no packets received' */ ++ if (gen_header->type != RPCAP_MSG_PACKET) + return 0; /* Return 'no packets received' */ ++ if (gen_header->plen < sizeof(struct rpcap_pkthdr)) ++ { ++ snprintf(p->errbuf, PCAP_ERRBUF_SIZE, ++ "Received an incomplete RPCAP_MSG_PACKET header."); ++ return -1; + } +- + /* +- * Is this a RPCAP_MSG_PACKET message? ++ * Validate the RPCAP_MSG_PACKET payload length declared in the ++ * RPCAP_MSG_PACKET header. Use subtraction to avoid an integer ++ * overflow: ++ * ++ * 0 <= ntohl(net_pkt_header->caplen) <= UINT32_MAX ++ * sizeof(struct rpcap_pkthdr) <= gen_header->plen ++ * gen_header->plen is significantly less than UINT32_MAX + */ +- if (header->type != RPCAP_MSG_PACKET) +- { +- return 0; /* Return 'no packets received' */ +- } +- +- if (ntohl(net_pkt_header->caplen) > plen) ++ if (ntohl(net_pkt_header->caplen) > gen_header->plen - sizeof(struct rpcap_pkthdr)) + { + snprintf(p->errbuf, PCAP_ERRBUF_SIZE, + "Packet's captured data goes past the end of the received packet message."); diff --git a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb index 5f1506f8fc9..3892454a400 100644 --- a/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb +++ b/meta/recipes-connectivity/libpcap/libpcap_1.10.4.bb @@ -23,6 +23,7 @@ SRC_URI = "https://www.tcpdump.org/release/${BP}.tar.gz \ file://04-CVE-2026-6244.patch \ file://05-CVE-2026-6554.patch \ file://06-CVE-2026-18313.patch \ + file://07-CVE-2026-18238.patch \ " SRC_URI[sha256sum] = "ed19a0383fad72e3ad435fd239d7cd80d64916b87269550159d20e47160ebe5f" From patchwork Thu Oct 15 05:03:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100786 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6991CC6B2F for ; Thu, 15 Oct 2026 05:04:24 +0000 (UTC) Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32453.1792040657039960979 for ; Wed, 14 Oct 2026 22:04:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=WNBWzl20; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a02667ccebso34996175e9.0 for ; Wed, 14 Oct 2026 22:04:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040655; x=1792645455; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=kFxVFOhMjwr3Pa6lPFaOLqtvAhPsZZoWRpqH9R1Si98=; b=WNBWzl206BxwIN7C9JRSIaFvbX3AmVdBsat5MstMUgZP/ROo3D5HLTMOqywkET18Vk DxQtR0lpsXyGZv7OEYIfZq85Bx64A0VrSeUJPFZ3y02gC+KubWMD2Td5+3/OfdFEhLSS js9vEIlKxVS6GVU0psY58Pk43e79MyNLWFZu4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040655; x=1792645455; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=kFxVFOhMjwr3Pa6lPFaOLqtvAhPsZZoWRpqH9R1Si98=; b=gZl/CCYq7rDdIA0WymTNRr/aIcXbuXtvCdFSwU1CAw6OOM22NJRG8WovRqqZ66cdoF R5+iL2rv05OMJ+4HNiA/jqxNtkprzN8ozBKgcFlT4CbkUAXKDjJx93jblCfHu/T6R2BF PkPtzSc1ekzl34lL3fxvDBkfjHDYZEdSwKhzab+RcqlXOoW6lMYkpnIuZOA+yvTWPCnd b6YI85PDc4USMJyKgUGaXM3lb8ukzCcmG/S6ZCuNQUUaRDWbo+FftDDwACWqYvmGNZaE JuP+UUmQXn/skx6PjHS3gnVjYyACZwauaO29rYrEFGkiCnZ/SRzp2TO24Z8f/Z1riUIn omoA== X-Gm-Message-State: AFq9FYKgPsSwqDA1IaZwkA8Dd1FidWpI83fSMlFKPFgbRhmXZJwjryGj b494/kU6jlVzC8jc1D7L4RCQWdW4jc7QOpNPWiAZMOLbJeu9VF5mLW0KRVywNQ3GdzrvQWEaz5C vOpl6ZRA= X-Gm-Gg: AYBFou1f+tZh4UeKD5uGEIugAoLJmFEyjl54utftnXXiayHiBXSYbl18o8Z4fJU2Lbb /Ij7MubB1EQ8MYP7D0CRe9kijANWoO+9s/I1KUJQAeBya4dXUiX6xYrt/HMVasLqCOaNvG+s9U4 8gPpviVFMOKNJ9oe+iwuCWNfj2GRsxk5lq3AIcuWWuDlGytdxlVZTuyZDLoRGS8MwfJh8XxuTLx JU70/RTtTb6vLhFzj06MLddgd2/3rBWuGCZOIwryuVAATd5uBnzxrYw2hjg39TQ4Clm3r5NjA9R zd7IxDfpZyuiSCM0+5VUoHawWzNoY6JQ8z6b/h94uJxme4SFptazxDsPy0Y3p4esssCnHeoUgQc +3mUDU8JzLlOygp3jw5Vtaf21qFemtnESrQaRaYI0F8ouxlQGPaAj8eOABqeE3gnfXfXOMlGmM9 PcuXd1nDIij1/pSujhGedgM9Kp4S5WL40xUk8cU3XnA7PvTbCgiBbxKFBD67zov01n/RukOWqyn rp3pCIz+bWnXum+vTthohviSYkvQ/ec7DyBFnsPOcax5j59ZEOxtvOh5CUgitrakXirWS7n8/3q h5rv25no X-Received: by 2002:a05:600c:6215:b0:4a0:eae0:b30e with SMTP id 5b1f17b1804b1-4a18e4ca157mr321547885e9.22.1792040655309; Wed, 14 Oct 2026 22:04:15 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:14 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 53/55] python3-py: correct CVE_PRODUCT mapping Date: Thu, 15 Oct 2026 07:03:16 +0200 Message-ID: <936d774b3cf1958c210d3fbb78b91fdafcf5fe15.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247851 From: Devansh Patel The product-only "py" mapping generates a wildcard-vendor identity instead of the exact NVD identity for the packaged pytest-dev py source. Use "pytest:py" for its NVD dictionary CPE and configuration matches. This changes the generated product identity. With sbom-cve-check 1.3.3, the current CVE report is unchanged using the pinned database snapshots; both mappings report CVE-2020-29651 and CVE-2022-42969. Signed-off-by: Devansh Patel Signed-off-by: Khem Raj (cherry picked from commit 26fa8b053b71d1f3f8da359abaef578c671c692f) Signed-off-by: Darsh Kelaiya Signed-off-by: Yoann Congal [YC: This is a cherry-pick from meta-openembedded] --- meta/recipes-devtools/python/python3-py_1.11.0.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-devtools/python/python3-py_1.11.0.bb b/meta/recipes-devtools/python/python3-py_1.11.0.bb index a75b9c2b142..906410e9bb9 100644 --- a/meta/recipes-devtools/python/python3-py_1.11.0.bb +++ b/meta/recipes-devtools/python/python3-py_1.11.0.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a6bb0320b04a0a503f12f69fea479de9" SRC_URI[sha256sum] = "51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719" -CVE_PRODUCT = "py" +CVE_PRODUCT = "pytest:py" DEPENDS += "python3-setuptools-scm-native" From patchwork Thu Oct 15 05:03:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100785 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7EFBCC6B35 for ; Thu, 15 Oct 2026 05:04:24 +0000 (UTC) Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.32856.1792040657578679204 for ; Wed, 14 Oct 2026 22:04:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=iBEf05CG; spf=pass (domain: smile.fr, ip: 209.85.221.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-487049569b6so3292042f8f.1 for ; Wed, 14 Oct 2026 22:04:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040656; x=1792645456; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=icRBYlCaQ/qWBUOLdhuUp/7k6huOAaiSaCF1Edw0fmA=; b=iBEf05CGe89Egd42i5cfDZIoom8H7cN2UJ7w1fj9/xjiaNvb1/8Dw0tTrGQIOBdJKQ 9IhPagL+GN8TicxuQ5EKRL+gJ7G4pxKEspLr6pzoTs//Ddni0zm6zuR7aIiVmQzIvr3J ijKF45nzS6kn4MrsKJuC+QQi/06iVLKGB6ay4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040656; x=1792645456; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=icRBYlCaQ/qWBUOLdhuUp/7k6huOAaiSaCF1Edw0fmA=; b=n0QOoiNNCzW2uEwYZLLqWclSmM7tyPw0W+QYhKTVSx/bdivfOCf+nlxjX/52J5IRaB QQ7aB70qxpNHU/gy//qZ6+WmY3TbP7/tfaBOVmLSb6p3Y30cDP9dJWkRD/pc4iNPixVN P/DPW/gSeVcCI0d7LRFm7PqETYTnvILUV8HrOp46YTtWk4goP/uHRi8CZgWTx1caluQK 8fGBNraXbUMaj+XwVhZ0fg3Tj1AHxXpgKsFTjGGgNOiTeqENyp9s3mfDyErxW8ovP2Rk gyobZUxHOXR8SrpzsuPlELoqKgRV6LbrNtVXw78mUnS5kaMNkRsZ1mGle8BAAMA9jAdx A8aA== X-Gm-Message-State: AFq9FYKJgKn4LU/egs3azuUM0jJmg1BJfQGkhDCLfWJLX7C9BtKOEjMx pZ67ZPx/uIaETmLUaPxP9MndHoeGcscXWoNks7AGYvK1h7IKxx3ZrDy6wpC5hB8YdtP0hVbve0Y qSs+n5qo= X-Gm-Gg: AYBFou2hG4ixTIas6dtjQdFivyU4AlcMP93rA9gZ4qtRcmWvD7vpR/87lcEH51rQxiQ Fdc2gHu8XiH8wvab2oUZJCjjI5Pfx+bBnkXaihppAjyOjB4upa0FC+GuPd/ZmaNDoQKPIiB9g+w vqGa+ITBmzdcm6tBcT190TTHig4+yy3QMCgkVQ8rweWQLYgChEInU6xEyvcHXtBqwXvUt8U4bZW nErtwKBnXd2bkeZMuihuxE2ZxdDQ4G/L5hNvZ5+644l/RCPvjt8+jVJJiAIQI/VgLdJKpsV0uQi Dz8pM3bSpdxrsbF7KP8GpF5jkS8b/pbZOXE+Jfl9pXqwQ3emQ5cz/uB0P6/TnD0AlAfoJ/wF7jY jbPgY+mkER3bqUtblJBF55HeJyMEgxQ/uTSINQqyW1gI9b/kQt1jjhEnQ46RgBwIx1J7sELC8+x C+xe1YsMfaJZU3YzpIgkTlKEX678C45Py10+fAUx4oqlXPdzNMw7Cu2+HHotNCbCxbncJYaDSws r70witV3ATIWA38S8LuJBKUHHPkRxvbGgUqJ8HezijzcuIG6/IoeBNStPCTzHr1MRZHdoeeY0Hh FLwhsCjq X-Received: by 2002:a05:600c:e549:20b0:4a1:96cd:2f6d with SMTP id 5b1f17b1804b1-4a196cd3280mr188840085e9.1.1792040655772; Wed, 14 Oct 2026 22:04:15 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:15 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 54/55] python3-py: ignore CVE-2022-42969 Date: Thu, 15 Oct 2026 07:03:17 +0200 Message-ID: <5281b17760632d24f650703854bbbaa540aa598d.1792020605.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247852 From: Darsh Kelaiya Analysis: - NVD marks CVE-2022-42969 as disputed because multiple parties could not reproduce it and argue that it is not a valid vulnerability [1]. - GitHub withdrew the advisory because the available evidence does not show a valid, reproducible vulnerability [2]. - Wrynose and master use the same python3-py version and carry the same disputed CVE status, so that disposition applies to Scarthgap [3]. - Hence ignoring the CVE for now. Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2022-42969 [2] https://github.com/advisories/GHSA-w596-4wvx-j9j6 [3] https://git.openembedded.org/meta-openembedded/commit/?id=91f6b85b36316d5940ee194b1d195caf3ac040b1 Signed-off-by: Darsh Kelaiya Signed-off-by: Yoann Congal --- meta/recipes-devtools/python/python3-py_1.11.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/python/python3-py_1.11.0.bb b/meta/recipes-devtools/python/python3-py_1.11.0.bb index 906410e9bb9..f850be1163c 100644 --- a/meta/recipes-devtools/python/python3-py_1.11.0.bb +++ b/meta/recipes-devtools/python/python3-py_1.11.0.bb @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a6bb0320b04a0a503f12f69fea479de9" SRC_URI[sha256sum] = "51c75c4126074b472f746a24399ad32f6053d1b34b68d2fa41e558e6f4a98719" CVE_PRODUCT = "pytest:py" +CVE_STATUS[CVE-2022-42969] = "disputed: upstream could not reproduce it and GitHub withdrew the advisory" DEPENDS += "python3-setuptools-scm-native" From patchwork Thu Oct 15 05:03:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 100784 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B123ECC6B34 for ; Thu, 15 Oct 2026 05:04:24 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32454.1792040658130676372 for ; Wed, 14 Oct 2026 22:04:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=WtEUZ4yF; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a19cba5c14so42866335e9.3 for ; Wed, 14 Oct 2026 22:04:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1792040656; x=1792645456; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=A8Gox/IHV1qIE11dJtkPSv7NSR0EBiYYlZP9+2O9uk8=; b=WtEUZ4yF9zhqM+Ht+6CSke13o+m0NYCNcJMR2nv6koV6P1MCFFIPUOR21q6N7A8hdX XsyoJ9evPvsHp/pp9XL2EStaJ3Dt/8NqSRtVsXEZJXO1/0XP5rTAz3WV4KgP0XasThFM sS80Xzd8iQ9xfOOQm132nXh3H9xiMkfdFB9vQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792040656; x=1792645456; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=A8Gox/IHV1qIE11dJtkPSv7NSR0EBiYYlZP9+2O9uk8=; b=dwmkwKDdKr0CA2ab6gJZhhXpI5/Qqi0oj6UAgjWpVvqLlguj8MN7GzyVLkvqU/B6RI HJlrqQJQFChp/XS4s4YW6pNKs/Vz4qsUUhkJpNzLRZpUspUdL/39OGbksR72hOoremqL xivXez8A7D+qv3DSiGRnhUg1B0Dlr4t7BswguNQ9gkKYugHjM5wh3rCTK3aMqORt7Oa6 1wMvDF0Th4b+RgcUTt9LYXR1SJDgb3sBq46+WEg3U7WF4LoIjw1Q2SKmrgWuJhbeSXjY VA2vkKNtutkEWfXOburcqgh73A71USCy9/+tftdf+Y6sC8FZT+QTsGzYS5AbgBMgMaSo 1tAg== X-Gm-Message-State: AFq9FYJyDURK62t1Uuv5RMzVlsKvny3XHvKZyqKfaDkqBySPMejb0+Zv v0OOigOngc6otwJJHYaRfIVW5kNvM4qX9wGn2y36yr/kbAPIGjjNdJqyuTwf434tGgwGhsXolyi hKA/9eLo= X-Gm-Gg: AYBFou1XI3QJQh94mLHq8mMQ2AY3kbDhVRl84kzV6hbmf1+QQFu8rj3jtRpu6iU2akg +s/IdonqWjpxcbSZuLRMjpwORmsnOAi/aDSqjKGaBBoRwtaKfQM4IJea1Iw7KbBp8PETK/8rpCe wkw8xCAdCBGX8Kgy+E3DJCVJPjlYMyhmW5eM6dAwCwTkpZ7GIGwW9KcAsITu7OriQSS3DXbd2gI qBPqt/GUPiBwOhub9fGnqHC0kj+joS/Dzb5Z1vG6Arq6Llr9nMtQbKCJPZgHAYAapbDv3eBAv0V tLHPPpkC0QXfq7rejUL8ev31VZfX/yhdL9ofiH8OHpEjHyKX5sPSTC4oTW7GC+ZN48pOeEZFcit GfNsLGtjAw3Kp8T80KrDOZkKTpzJLK/3usydPpFT9zDC8bYAbj0YF4Um32V0RUUr4jSp6LRMBOz wYAs5hW4/bJQ6q6v5EgoPTg1uZSLil/UVZHd8685lcZ1BeNFLBa+8wvPbWPPNooMhjlxRy/M3d3 N/wn/4HZoqepBAIb7cY/QQN3vrIKPZQjXnp8bZONZ0kETofA9X6iw3zz17H2o4gb35Vw2M24g== X-Received: by 2002:a05:600c:c16f:b0:49f:ed8c:6cad with SMTP id 5b1f17b1804b1-4a18e4ca869mr328609435e9.19.1792040656253; Wed, 14 Oct 2026 22:04:16 -0700 (PDT) Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1bd972aebsm46376245e9.1.2026.10.14.22.04.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:04:15 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 55/55] python3-click: fix CVE-2026-7246 Date: Thu, 15 Oct 2026 07:03:18 +0200 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:04:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247853 From: Darsh Kelaiya This backports the click.edit() hardening identified as the fix in the public advisory [2], using upstream commit [1]. Upstream follow-up commit [3] adds regression-test coverage for editor command parsing and clarifies the related source comments. It does not change runtime behavior or provide an additional security fix. Carry it as a separate patch to preserve the upstream commit boundaries. [1] https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494ebee4aef8f42 [2] https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw [3] https://github.com/pallets/click/commit/b55294797ef32e22eb41e7d9657edb8faefa4976 Signed-off-by: Darsh Kelaiya Signed-off-by: Yoann Congal --- .../CVE-2026-7246-regression.patch | 124 +++++++++++ .../python/python3-click/CVE-2026-7246.patch | 201 ++++++++++++++++++ .../python/python3-click_8.1.7.bb | 6 +- 3 files changed, 330 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-devtools/python/python3-click/CVE-2026-7246-regression.patch create mode 100644 meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch diff --git a/meta/recipes-devtools/python/python3-click/CVE-2026-7246-regression.patch b/meta/recipes-devtools/python/python3-click/CVE-2026-7246-regression.patch new file mode 100644 index 00000000000..213982a8bb5 --- /dev/null +++ b/meta/recipes-devtools/python/python3-click/CVE-2026-7246-regression.patch @@ -0,0 +1,124 @@ +From e3173ef521c287be53f1976b28c2fee28b6de5c7 Mon Sep 17 00:00:00 2001 +From: Kevin Deldycke +Date: Fri, 10 Apr 2026 18:12:24 +0200 +Subject: [PATCH] Add path normalization edge-cases, verify `shlex.split` + behavior + +Also move to Python comments details relevant to developers instead of docstrings +Follow up to #3245 + +CVE: CVE-2026-7246 +Upstream-Status: Backport [https://github.com/pallets/click/commit/b55294797ef32e22eb41e7d9657edb8faefa4976] + +Backport Changes: +- Click 8.1.7 uses Editor.edit_file(filename), not the newer + Editor.edit_files(filenames) API. Apply the editor comment + follow-up and edge-case tests to the single-file API. +- Omit pager changes and pager-only follow-up tests because + Click 8.1.7 uses older pager APIs and CVE-2026-7246 affects + click.edit(), not pager execution. +- Omit cosmetic editor test ID renames. + +(cherry picked from commit b55294797ef32e22eb41e7d9657edb8faefa4976) +Signed-off-by: Darsh Kelaiya +--- + src/click/_termui_impl.py | 12 ++++------ + tests/test_termui.py | 48 +++++++++++++++++++++++++++++++++++++++ + 2 files changed, 52 insertions(+), 8 deletions(-) + +diff --git a/src/click/_termui_impl.py b/src/click/_termui_impl.py +index c50b37b..3589160 100644 +--- a/src/click/_termui_impl.py ++++ b/src/click/_termui_impl.py +@@ -501,14 +501,7 @@ class Editor: + return "vi" + + def edit_file(self, filename: str) -> None: +- """Open a file in the user's editor. +- +- The editor command is split into an ``argv`` list with +- :func:`shlex.split` in POSIX mode; see :func:`pager` for rationale. +- +- .. seealso:: +- :issue:`1026` and :pr:`1477`. +- """ ++ """Open a file in the user's editor.""" + import shlex + import subprocess + +@@ -520,6 +513,9 @@ class Editor: + environ.update(self.env) + + try: ++ # Split in POSIX mode (the default) for the same reasons as ++ # upstream pager(): strips quotes from tokens and preserves ++ # quoted Windows paths. See issue #1026 and PR #1477. + c = subprocess.Popen( + args=shlex.split(editor) + [filename], + env=environ, +diff --git a/tests/test_termui.py b/tests/test_termui.py +index 7cea338..eda9a80 100644 +--- a/tests/test_termui.py ++++ b/tests/test_termui.py +@@ -421,6 +421,48 @@ def test_fast_edit(runner): + ["/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl", "f.txt"], + id="escaped space in unix path (issue 1026)", + ), ++ pytest.param( ++ " vim ", ++ "f.txt", ++ ["vim", "f.txt"], ++ id="leading and trailing whitespace", ++ ), ++ pytest.param( ++ "vim\t--clean", ++ "f.txt", ++ ["vim", "--clean", "f.txt"], ++ id="tab-separated tokens", ++ ), ++ pytest.param( ++ "'/Applications/My Editor.app/Contents/MacOS/editor'", ++ "f.txt", ++ ["/Applications/My Editor.app/Contents/MacOS/editor", "f.txt"], ++ id="single-quoted path with spaces", ++ ), ++ pytest.param( ++ '"my editor" --wait --new-window', ++ "file 1.txt", ++ ["my editor", "--wait", "--new-window", "file 1.txt"], ++ id="quoted editor with flags and filename with spaces", ++ ), ++ pytest.param( ++ "vim -u NONE -N", ++ "f.txt", ++ ["vim", "-u", "NONE", "-N", "f.txt"], ++ id="multiple short flags", ++ ), ++ pytest.param( ++ "editor", ++ 'file"name.txt', ++ ["editor", 'file"name.txt'], ++ id="filename with double quote", ++ ), ++ pytest.param( ++ "editor", ++ "file'name.txt", ++ ["editor", "file'name.txt"], ++ id="filename with single quote", ++ ), + ], + ) + def test_editor_path_normalization(editor_cmd, filename, expected_args): +@@ -484,6 +526,12 @@ def test_editor_nonexistent_exception(): + Editor(editor="nonexistent").edit_file("f.txt") + + ++def test_editor_unclosed_quote(): ++ """An unclosed quote in the editor command raises ValueError.""" ++ with pytest.raises(ValueError, match="No closing quotation"): ++ Editor(editor='"unclosed').edit_file("f.txt") ++ ++ + @pytest.mark.parametrize( + ("prompt_required", "required", "args", "expect"), + [ diff --git a/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch new file mode 100644 index 00000000000..411b138ba0e --- /dev/null +++ b/meta/recipes-devtools/python/python3-click/CVE-2026-7246.patch @@ -0,0 +1,201 @@ +From 1ad206945a88122e121f850b4942eff473e31cf5 Mon Sep 17 00:00:00 2001 +From: Kevin Deldycke +Date: Wed, 4 Mar 2026 14:51:58 +0400 +Subject: [PATCH] Document and fix command string sanitizing with `shlex.split` + +Removes last use of `shell=True` use for command invokation for defense-in-depth. +Refs: #1026, #1477 and #2775 + +CVE: CVE-2026-7246 +Upstream-Status: Backport [https://github.com/pallets/click/commit/b96c2601af4e01341b4d2c0db494ebee4aef8f42] + +Backport Changes: +- Click 8.1.7 uses Editor.edit_file(filename), not the newer + Editor.edit_files(filenames) API. Apply the argv-list change + to one filename without adding the multi-file API. +- Adapt editor tests from b96c2601 to the single-file API. Keep + portable normalization, quoting, failure, environment, and + Windows cases. +- Omit CHANGES.rst because release notes are not needed for + the source backport. +- Omit pager changes and pager-only tests because Click 8.1.7 + uses older pager APIs and CVE-2026-7246 affects click.edit(), + not pager execution. +- Omit the unrelated _translate_ch_to_exc() return cleanup. + +(cherry picked from commit b96c2601af4e01341b4d2c0db494ebee4aef8f42) +Signed-off-by: Darsh Kelaiya +--- + src/click/_termui_impl.py | 14 ++++- + tests/test_termui.py | 115 ++++++++++++++++++++++++++++++++++++++ + 2 files changed, 128 insertions(+), 1 deletion(-) + +diff --git a/src/click/_termui_impl.py b/src/click/_termui_impl.py +index f744657..c50b37b 100644 +--- a/src/click/_termui_impl.py ++++ b/src/click/_termui_impl.py +@@ -501,6 +501,15 @@ class Editor: + return "vi" + + def edit_file(self, filename: str) -> None: ++ """Open a file in the user's editor. ++ ++ The editor command is split into an ``argv`` list with ++ :func:`shlex.split` in POSIX mode; see :func:`pager` for rationale. ++ ++ .. seealso:: ++ :issue:`1026` and :pr:`1477`. ++ """ ++ import shlex + import subprocess + + editor = self.get_editor() +@@ -511,7 +520,10 @@ class Editor: + environ.update(self.env) + + try: +- c = subprocess.Popen(f'{editor} "{filename}"', env=environ, shell=True) ++ c = subprocess.Popen( ++ args=shlex.split(editor) + [filename], ++ env=environ, ++ ) + exit_code = c.wait() + if exit_code != 0: + raise ClickException( +diff --git a/tests/test_termui.py b/tests/test_termui.py +index 7cfa939..7cea338 100644 +--- a/tests/test_termui.py ++++ b/tests/test_termui.py +@@ -1,10 +1,12 @@ + import platform + import time ++from unittest.mock import patch + + import pytest + + import click._termui_impl + from click._compat import WIN ++from click._termui_impl import Editor + + + class FakeClock: +@@ -369,6 +371,119 @@ def test_fast_edit(runner): + assert result == "aTest\nbTest\n" + + ++@pytest.mark.parametrize( ++ ("editor_cmd", "filename", "expected_args"), ++ [ ++ pytest.param( ++ "myeditor --wait --flag", ++ "file1.txt", ++ ["myeditor", "--wait", "--flag", "file1.txt"], ++ id="editor with args", ++ ), ++ pytest.param( ++ "vi", ++ 'file"; rm -rf / ; echo "', ++ ["vi", 'file"; rm -rf / ; echo "'], ++ id="shell metacharacters in filename", ++ ), ++ # Issue #1026: editor path with spaces must be quoted. ++ pytest.param( ++ '"C:\\Program Files\\Sublime Text 3\\sublime_text.exe"', ++ "f.txt", ++ ["C:\\Program Files\\Sublime Text 3\\sublime_text.exe", "f.txt"], ++ id="quoted windows path with spaces (issue 1026)", ++ ), ++ # PR #1477: pager/editor command with flags, like ``less -FRSX``. ++ pytest.param( ++ "less -FRSX", ++ "f.txt", ++ ["less", "-FRSX", "f.txt"], ++ id="command with flags (pr 1477)", ++ ), ++ # Issue #1026: quoted command with ``--wait`` flag. ++ pytest.param( ++ '"my command" --option value arg', ++ "f.txt", ++ ["my command", "--option", "value", "arg", "f.txt"], ++ id="quoted command with args (issue 1026)", ++ ), ++ # PR #1477: unquoted Unix path. ++ pytest.param( ++ "/usr/bin/vim", ++ "f.txt", ++ ["/usr/bin/vim", "f.txt"], ++ id="unix absolute path", ++ ), ++ # Issue #1026: macOS path with escaped space. ++ pytest.param( ++ "/Applications/Sublime\\ Text.app/Contents/SharedSupport/bin/subl", ++ "f.txt", ++ ["/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl", "f.txt"], ++ id="escaped space in unix path (issue 1026)", ++ ), ++ ], ++) ++def test_editor_path_normalization(editor_cmd, filename, expected_args): ++ with patch("subprocess.Popen") as mock_popen: ++ mock_popen.return_value.wait.return_value = 0 ++ Editor(editor=editor_cmd).edit_file(filename) ++ ++ mock_popen.assert_called_once() ++ args = mock_popen.call_args[1].get("args") or mock_popen.call_args[0][0] ++ assert args == expected_args ++ assert mock_popen.call_args[1].get("shell") is None ++ ++ ++@pytest.mark.skipif(not WIN, reason="Windows-specific editor paths") ++@pytest.mark.parametrize( ++ ("editor_cmd", "expected_cmd"), ++ [ ++ pytest.param( ++ "notepad", ++ ["notepad"], ++ id="plain notepad", ++ ), ++ pytest.param( ++ '"C:\\Program Files\\Sublime Text 3\\sublime_text.exe" --wait', ++ ["C:\\Program Files\\Sublime Text 3\\sublime_text.exe", "--wait"], ++ id="quoted path with flag", ++ ), ++ ], ++) ++def test_editor_windows_path_normalization(editor_cmd, expected_cmd): ++ """Verify that Popen receives unquoted Windows editor paths.""" ++ with patch("subprocess.Popen") as mock_popen: ++ mock_popen.return_value.wait.return_value = 0 ++ Editor(editor=editor_cmd).edit_file("f.txt") ++ ++ args = mock_popen.call_args[1].get("args") or mock_popen.call_args[0][0] ++ assert args == expected_cmd + ["f.txt"] ++ assert mock_popen.call_args[1].get("shell") is None ++ ++ ++def test_editor_env_passed_through(): ++ with patch("subprocess.Popen") as mock_popen: ++ mock_popen.return_value.wait.return_value = 0 ++ Editor(editor="vi", env={"MY_VAR": "1"}).edit_file("f.txt") ++ ++ env = mock_popen.call_args[1].get("env") ++ assert env is not None ++ assert env["MY_VAR"] == "1" ++ ++ ++def test_editor_failure_exception(): ++ with patch("subprocess.Popen") as mock_popen: ++ mock_popen.return_value.wait.return_value = 1 ++ with pytest.raises(click.ClickException, match="Editing failed"): ++ Editor(editor="vi").edit_file("f.txt") ++ ++ ++def test_editor_nonexistent_exception(): ++ with patch("subprocess.Popen", side_effect=OSError("not found")): ++ with pytest.raises(click.ClickException, match="not found"): ++ Editor(editor="nonexistent").edit_file("f.txt") ++ ++ + @pytest.mark.parametrize( + ("prompt_required", "required", "args", "expect"), + [ diff --git a/meta/recipes-devtools/python/python3-click_8.1.7.bb b/meta/recipes-devtools/python/python3-click_8.1.7.bb index b75d9108893..8a077f48c7c 100644 --- a/meta/recipes-devtools/python/python3-click_8.1.7.bb +++ b/meta/recipes-devtools/python/python3-click_8.1.7.bb @@ -12,7 +12,10 @@ SRC_URI[sha256sum] = "ca9853ad459e787e2192211578cc907e7594e294c7ccc834310722b41b inherit pypi setuptools3 ptest -SRC_URI += "file://run-ptest" +SRC_URI += "file://run-ptest \ + file://CVE-2026-7246.patch \ + file://CVE-2026-7246-regression.patch \ + " CVE_PRODUCT = "palletsprojects:click" @@ -36,6 +39,7 @@ CLEANBROKEN = "1" RDEPENDS:${PN} += "\ python3-io \ python3-threading \ + python3-shell \ " BBCLASSEXTEND = "native nativesdk"