From patchwork Sat Oct 31 00:14:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102523 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3722.1793405745368731196 for ; Fri, 30 Oct 2026 17:15:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=jwcWHwtD; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a2167bd087so10155525e9.3 for ; Fri, 30 Oct 2026 17:15:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405744; x=1794010544; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=GhzQq20hDoGDDs7hMeXH99a3kdjWOo9os2Se3IBuYwo=; b=jwcWHwtDDGKFrmAzsJmdpMRLt180nvXybiBsXw6XDjOSapur35rbe6GGrZg95xfDGS aFnRcK+t/DO1J1sxexWILHvGJk77jNbQNJJhictXMT4BVqjUlc//ob6vlC5GPqfJLht+ Afs+S2Vf3iMqc9WSdMG7RUgiH0gU/jCsG6lSP15bwxkSKYGufmHCTyvTi8F8R8P/Porz 6qzKnWauu1nENSih91r/Rhh8rmQNh/9E9p0Bc9eSoMTcLB5UOu8SmuL4XgvBh3qbJm+R 0eLnvhIyTn49amYfhksmRwAHhyfmZOFS/HFHVI4PmkFKUzhe8jxsDNB6SEzhDtmcMS+m O7TQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405744; x=1794010544; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=GhzQq20hDoGDDs7hMeXH99a3kdjWOo9os2Se3IBuYwo=; b=qhr+DSv4t7CWzflDj3Gn1pTJgPPYVbi5VbKuvNiqxM8jP8p/hsF6YOBhrW5b3dq4qg 8HDF7eo+JU5QuYS64bOFayeZFgn4i640u7hguYRDa7uwP7v5B4j50SC7Z8ARSBdrFx+y dCGx5MQvMepV3s3RHsf0Z4TCR3h2HbpjH5IOa/DiRwY7X6CrYfgBLQRmf5vadhLGP3ee iZEyBtYIbp9mdYpu8mloQ+rVnG6lpt9/ZbYcM9aSJX06EdsesEacdPmDDZzKNkym4LD/ DtJ+o1ofEEPbKkmmPQa1vpld7KNx4EBCwduLWC2dlcCuiSnTMFUF8dK0MiW8yDOrk60d 076A== X-Gm-Message-State: AFq9FYKFhMnMnGu421Yz8WB2TzfbRQS5AcYFPXsmVVKLfwXPv754wqko hVpTFRXzGzID1JHR1gnhLpotSutUESacXO4wVVnpuL48qpVytPuZIjJUo5CW5SAkhjGczWIiO9B 01lazPC8= X-Gm-Gg: AYBFou3jvPWEfSNoYTjBEBk1k/AmoYLZUqKnlAXoYvcI/nXhOFLTiLXlwoGrn8opS7U G8mbRnOLCpgQi18WSNoOOFOdjTwOe0lX/AiPm4Dt1q4WNjZIS7lO+GKpYGcdUZLNR+t4Uqpcp6j QNUcF+yWIQg6in4cVE+Ng/oifh7NmXvRIxf0uOZHJBCntdhSewHUeF5NXmCFep+f6iWWS4Yinxq 6MtPafsn0eEzxa/ZrQVT5mu4edNc2aBLbjPprg++wM76mk+PhXhkx/yXdEA7+swIXkuWqS1hPO0 +8Yn32Z43GxvJigCjmhteWUfNdWsIMkJl5cdZt4NnM0ykSPdZtn3CiBdg/CJIAIjrE6Rw3JBhnx yKbDO2PDix74d7MVxrj7ViCD7pycM6x7qYlYj2FV/hcmSPiq/CoPaEh0MJytG/jIoDj8M2V/1EW t60NGWAY66mw6/H0UUgc3UB3lOr0NlQ5CEGqdKQCtw0YVjXi7T29Ov6IP2U5OY9a6NV079AMx/A AlRu1UvU/Qdr/Byy2AWpamz8EUdS9tP0zUiV0ZMGgFp9h8tyRBxmh/40eh/CsjRAGyscuBcl7uM SP5XnHGsGhND2Cz1u6yASp6d45d+MfF8r9/mAD5ThpTqoWDdVvG8xYoTyKk1nKu5YVLdmR97y1z 4/LddYS61C/bYKJ76qbi1V6KeqYxW X-Received: by 2002:a05:600c:1c06:b0:4a2:fe11:9a8a with SMTP id 5b1f17b1804b1-4ac121940c8mr112451065e9.0.1793405743716; Fri, 30 Oct 2026 17:15:43 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:43 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 01/55] scripts/install-buildtools: Update to 5.0.21 Date: Sat, 31 Oct 2026 01:14:22 +0100 Message-ID: <7474522691c0cc9e520f2b9004013b183c87e328.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249075 From: Yoann Congal Update to the 5.0.21 release of the 5.0 series for buildtools Signed-off-by: Yoann Congal --- scripts/install-buildtools | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/install-buildtools b/scripts/install-buildtools index f33f192e468..0094f7c3a8e 100755 --- a/scripts/install-buildtools +++ b/scripts/install-buildtools @@ -57,8 +57,8 @@ logger = scriptutils.logger_create(PROGNAME, stream=sys.stdout) DEFAULT_INSTALL_DIR = os.path.join(os.path.split(scripts_path)[0],'buildtools') DEFAULT_BASE_URL = 'https://downloads.yoctoproject.org/releases/yocto' -DEFAULT_RELEASE = 'yocto-5.0.20' -DEFAULT_INSTALLER_VERSION = '5.0.20' +DEFAULT_RELEASE = 'yocto-5.0.21' +DEFAULT_INSTALLER_VERSION = '5.0.21' DEFAULT_BUILDDATE = '202110XX' # Python version sanity check From patchwork Sat Oct 31 00:14:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102518 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3723.1793405745883464534 for ; Fri, 30 Oct 2026 17:15:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=NGRwrmS1; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4a59100fa83so11378345e9.0 for ; Fri, 30 Oct 2026 17:15:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405744; x=1794010544; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=lOsfezwNPMZF+DiZVgvm4tc01NDE01t3GU9IHt7KIgc=; b=NGRwrmS1gIwR+GydzhPqlKJLWQ89G3dY+phGF7ej09x1TRvz9Oe6x9T0D62YpSbWpe 38jbWY8J4b1ajTuSKupthcAJkM2n51I1CWRrlHFB2hDFi0G09P/07SIKmtYxC7WSoBVq x+RAETuVals96dkW99qb75tfOfsZjdgsKAvzN0ZNcBMAKcqr5SJEEYaXVuUi9umzp1CR MNDoZlmBu4hTBk9ImE0BBvyXSkXPPotO8/lNLld8z4GupvMddLKjMbbXJPsXnY1ARyKk qGLQD5o3/b3HiuxfomcIaagBxYIWpIq+aujPbk107+Nessuqf+VnAY4GRB4sBClIFE2u EKPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405744; x=1794010544; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=lOsfezwNPMZF+DiZVgvm4tc01NDE01t3GU9IHt7KIgc=; b=q7PWW4tp1viYNbuPuwsBml9UpeSaaINt/RwJLMikGUy9MDYsv+bmFQ5ZK7ACH62wFm 9TPSEKYNuCvqK+utBwgoWN21BDwbQu+wzder8XmZ2ojfraPKG4j+RyYtWcKXGfEjBfIC uV7VyKsv9lurL19kPPkEUnvWyw2hAowwREJWXxn1jqvnGkN7t30v9TBUtND034xBzcJ5 h1NPPCxTLOQ/0wzowGBj9O+UFm5rgl74UB5lkBRqDKoDsSZT339f6vX0YYUkU+OPTf9x CP1v715XJrA4MFSkqmVRXhHz9utT4m/ZAeAjTDwtKxlSwGUOdiv2mt67l1zFYGAiTXdZ 4dwA== X-Gm-Message-State: AFq9FYLDdaWWgZxoJLhsunpoqVsSbIFEOC01Z69V9n4qc2/1hGUT+L0/ p1XkaiYx0svz8IfU8tgVMO+22f6a/OxiRkm47hmcugoPrUQ0+5GXM+v2I8LBFyGVxpvR3+XnhPv 7bplfaGw= X-Gm-Gg: AYBFou0Tzka1//lwRwUnWSX/gNf/5XC7i/cOokhTa40VKojihXBNBYRVv6oYZXcOzbv E2J9aKHsQbcRtfkoyGunaHvitpHEMCu06fc9wZsZNeG/D3uyvGFTt5zWfZW8l3npofxaeW7tTBS S+KCm19f+TgblxFgVjUz25MAsrKBcvEkA72rmHSEyRq7SMh7hIgf/FdUalPjm0S1lSLI8xz1Doz UpT0sR698NUk9o3PVm7/D+qu9udQ3YkhKyfrND64bAvOOz3lVUoGGdOLbV4Wk0WUatVnqsd+ovR w+f7pzIfVZINVV8uu5gL4U+1GZxDMNliOoDCwlRcB/JH1vzlzTFKiMZWfbJC/VS51P1NnV7YUut UADECxQHGnoITJt42fRFGkznx2jiCVvvDW32C6ysHRUtiTlsce04SlR+u+ONn7p5tVk/EdO3fqr uBES/KUuGkPB9dWt3X7bQAzoTIOZl3oYjvYBstEXIWyDz1llhDpwIavfOavaOYSihmQNPYClYMW qa+nwswb9tJfXFdVAHbKB8Pwuxcv/9d3BLuTF/VnWMktffoaKOQSarow816t2dSvXvDUrIm1QZn g50tVSL8qvEyHYQgxbXmgxmLnU3klcYowjOQ8VMZ6VjcS/RLvZpl6/Thr2eGpnqOWnNcfjieZX9 Gx+ynR9ru7+qsQj35qRvT5MkOUxSd X-Received: by 2002:a05:600c:8b0a:b0:4a2:e0c:2b0a with SMTP id 5b1f17b1804b1-4ac1709a200mr88523395e9.16.1793405744114; Fri, 30 Oct 2026 17:15:44 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:43 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 02/55] util-linux: patch CVE-2026-53614 Date: Sat, 31 Oct 2026 01:14:23 +0100 Message-ID: <0f1a1abb8a1f12a0be625a22010dfaace330bb1d.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249077 From: Peter Marko Pick patch referencing this CVE from 2.41.5 release. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/util-linux/util-linux.inc | 1 + .../util-linux/CVE-2026-53614.patch | 83 +++++++++++++++++++ 2 files changed, 84 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index f651dc2dab4..70acf6dfec3 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -49,6 +49,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://CVE-2026-27456.patch \ file://CVE-2026-13595.patch \ file://CVE-2026-3184.patch \ + file://CVE-2026-53614.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch new file mode 100644 index 00000000000..f1dd4ae5d74 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch @@ -0,0 +1,83 @@ +From cc81bbcec598cb91f0eb8456282f33eed820ed5f Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Tue, 16 Jun 2026 10:58:32 +0200 +Subject: [PATCH] libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and + legacy mount path + +Use safe_getenv() for LIBMOUNT_FORCE_MOUNT2 to ignore the variable +in SUID context, consistent with LIBMOUNT_FSTAB and other sensitive +environment variables. + +Additionally, refuse multi-step mount(2) sequences (bind+remount and +propagation) for restricted (non-root) users in the legacy mount path. +The two-step approach has a window between syscalls where security +flags (nosuid, noexec, ...) are not yet applied. The new mount API +handles this atomically. + +CVE-2026-53614 + +Reported-by: Xinyao Hu +Signed-off-by: Karel Zak +(cherry picked from commit 9cbfb823500f510b34767edabd3ffd5b436987b4) + +CVE: CVE-2026-53614 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f] +Signed-off-by: Peter Marko +--- + libmount/src/hook_mount.c | 3 ++- + libmount/src/hook_mount_legacy.c | 8 ++++++++ + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/libmount/src/hook_mount.c b/libmount/src/hook_mount.c +index 1ffd19e83..37179fb59 100644 +--- a/libmount/src/hook_mount.c ++++ b/libmount/src/hook_mount.c +@@ -44,6 +44,7 @@ + */ + + #include "mountP.h" ++#include "env.h" + #include "fileutils.h" /* statx() fallback */ + #include "strutils.h" + #include "mount-api-utils.h" +@@ -627,7 +628,7 @@ fail: + + static int force_classic_mount(struct libmnt_context *cxt) + { +- const char *env = getenv("LIBMOUNT_FORCE_MOUNT2"); ++ const char *env = safe_getenv("LIBMOUNT_FORCE_MOUNT2"); + + if (env) { + if (strcmp(env, "always") == 0) +diff --git a/libmount/src/hook_mount_legacy.c b/libmount/src/hook_mount_legacy.c +index 18b7a0066..94a8fc685 100644 +--- a/libmount/src/hook_mount_legacy.c ++++ b/libmount/src/hook_mount_legacy.c +@@ -282,6 +282,8 @@ static int hook_prepare(struct libmnt_context *cxt, + + /* add extra mount(2) calls for each propagation flag */ + if (flags & MS_PROPAGATION) { ++ if (mnt_context_is_restricted(cxt)) ++ goto eperm; + rc = prepare_propagation(cxt, hs); + if (rc) + return rc; +@@ -291,12 +293,18 @@ static int hook_prepare(struct libmnt_context *cxt, + if ((flags & MS_BIND) + && (flags & MNT_BIND_SETTABLE) + && !(flags & MS_REMOUNT)) { ++ if (mnt_context_is_restricted(cxt)) ++ goto eperm; + rc = prepare_bindremount(cxt, hs); + if (rc) + return rc; + } + + return rc; ++eperm: ++ DBG(HOOK, ul_debugobj(hs, ++ "multi-step mount(2) refused for non-root user")); ++ return -EPERM; + } + + const struct libmnt_hookset hookset_mount_legacy = From patchwork Sat Oct 31 00:14:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102519 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3723.1793405746698026124 for ; Fri, 30 Oct 2026 17:15:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=aIHNLZU5; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a214c5c4c0so10743955e9.3 for ; Fri, 30 Oct 2026 17:15:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405745; x=1794010545; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fDFy4E7V4XV+deCI+JoOGBrs2rOzSMso4E6QgQvXnm4=; b=aIHNLZU56Ep+YynE5JXmFGf2JvHLEJeWSqb+OlY7095O/9s8D/vEkL2SFWJMC8w5VZ BLfH6UzbhGTbmbV1SKasDoVTci5V+x1dKCDqyial6aHoZd1M6RnnZOdeQvtsrI/1W0mp sj0BZWjQr+bqVd8wGGXwo5d/+PhYeCzE6DtJchy5H0dau1GbLAJUaAl4Nl0DnTYPUJO1 1Hcj8FBUasUQHG0vvyd76EvMcVcNMGsMNjOG2/I/NqSPH8Q1RtJM1xz72vuZv+z7KIgT pZZfe4UDxVWcbTXLohthBL8PVqFUIVmyOyVTWB2EfG3AmJHQqGlKfED3nCpRV7uiaY16 bOlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405745; x=1794010545; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=fDFy4E7V4XV+deCI+JoOGBrs2rOzSMso4E6QgQvXnm4=; b=qgrY4eokcpniBZML/eRprPfWrYlwDFbpiRtTNQEDgI7Lg3QaDGfP9ApCf9ct90Alu1 /cTKkbTexMeWSl6Y+JgxQeqG84mvL/0aNyLtZN/jm/OWBEcznsHGSv9Em6cU4dFzwQ+Z Bx8/dCZ+yKSOyA3kvk/BeUF7SElbvjqYyzRC2tya960LVDo7fC+W7UPabuCvDxzA8bJ0 a+KpWPNLipmti/yM5LtsSCLKMA/3E45BRlsAPIXKkIZk49LSZGdDGJSHKMKKWMtruhrX Ebroi2303CEGUDTH//CorjhdRkdyopNJWrm80Ni0CEwGIxLZ1UUimNQVxdge6h5xrarI DbdQ== X-Gm-Message-State: AFq9FYICiBtiRLCKtMFF833EAqYrzt2x/p5GsufKKJJ4XKsYMT7dkALw 8J1tqLTAz3sjcYrCrHvCG2Z9riJXhJCaBSqyhrw+gX5+an+ge3WVg0CLaxoY2SNIfX+uRBIChPN 5js2N1+Q= X-Gm-Gg: AYBFou0aYB2aJs52RLtl3AW08vhGN7jteKr2DW0z0TEVIYePCatYvpYHkPLFxhPlDxF JBECXUsNBElwA+3/B7AIRGAz3tmqzoalO+FWqKd84VTQ9BsxB8+dbfpwCE0dpGypZ28EhxdITYq DF7fk348o1vXO4LRkuqIt07fpy3R7QwWdNaLP4yFMw5w5NeL28tM+MrGfIeIqG459sNF6+FiaMp eEoNLWGHYlqlfQe9dBSNC/0uhAHvCC3Oa5n61AMG+HMqA/i+kl0bpOElGvV+tWf/W9dd5jTu09V hYt8TecmaqgS0rZA5YPSY5kPzx5s0GcEYMz801FStyL29hIljray5eDn9qP0EuaW1MXxYNBD0kY w/ciAuslLHCWEzXcfSI7T6ja7zY8vNO9MK3xAnWMqcCCfhgCaOT1ns1oSfVTaP+XBt1Lv83PaLU E88xp2XBaf6Vho8/S9+QLCyyfP5Mwlpi59MwgBwnHytk3ZO90ecdDSqwnCKdHM8PlhpHm9jSnXa m0RG15xnKWJW4eXWPNct+0PJx6DWfbu+8ovBz0R4JD83N0Z0txlUiLmqghx6VAmz91cg2iGgu3j OcZA8YgVhDhtQQdJUhWHpkEeYbTBSnPs601Tcx+hyMkvfK6jayAfxK82WtdvCDAqYySFB9HNPpS BhJVfUGSOcdPzjAzyQdHOiFxqAipf X-Received: by 2002:a05:600c:4e13:b0:49c:d019:70c5 with SMTP id 5b1f17b1804b1-4ac1228978cmr81719675e9.0.1793405744738; Fri, 30 Oct 2026 17:15:44 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:44 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 03/55] util-linux: patch CVE-2026-53613 Date: Sat, 31 Oct 2026 01:14:24 +0100 Message-ID: <4d49bc54b206084373ee59c47fea26122975cf4d.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249078 From: Peter Marko Pick patch referencing this CVE from 2.41.5 release. Also pick patches implementing used helper functions and fixing consequent build errors. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/util-linux/util-linux.inc | 5 + ...ib-fileutils-add-ul_open_no_symlinks.patch | 98 +++++++++ ...dd-ul_openat_resolve-openat2-wrapper.patch | 85 ++++++++ ...x-RESOLVE_NO_SYMLINKS-fallback-value.patch | 71 +++++++ ...x-unused-parameter-warnings-without-.patch | 64 ++++++ .../util-linux/CVE-2026-53613.patch | 192 ++++++++++++++++++ 6 files changed, 515 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index 70acf6dfec3..db698ef9367 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -50,6 +50,11 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://CVE-2026-13595.patch \ file://CVE-2026-3184.patch \ file://CVE-2026-53614.patch \ + file://0001-lib-fileutils-add-ul_open_no_symlinks.patch \ + file://0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch \ + file://0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch \ + file://0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch \ + file://CVE-2026-53613.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch new file mode 100644 index 00000000000..d795e32087f --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch @@ -0,0 +1,98 @@ +From b639bf5c4277b7f828b3fcbdbf94bad5a4d20060 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Wed, 27 May 2026 10:35:39 +0200 +Subject: [PATCH] lib/fileutils: add ul_open_no_symlinks() + +Add a helper that opens a path rejecting symlinks at any component, +not just the last one. Uses openat2(RESOLVE_NO_SYMLINKS) when +available (Linux >= 5.6), falls back to open(O_NOFOLLOW). + +Signed-off-by: Karel Zak +(cherry picked from commit e01e38b24346a21f1d01498c265486a12c009e61) + +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/b639bf5c4277b7f828b3fcbdbf94bad5a4d20060] +Signed-off-by: Peter Marko +--- + configure.ac | 1 + + include/fileutils.h | 2 ++ + lib/fileutils.c | 24 ++++++++++++++++++++++++ + meson.build | 1 + + 4 files changed, 28 insertions(+) + +diff --git a/configure.ac b/configure.ac +index 3bbc94488..2d9388a3c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -316,6 +316,7 @@ AC_CHECK_HEADERS([ \ + linux/kcmp.h \ + linux/net_namespace.h \ + linux/nsfs.h \ ++ linux/openat2.h \ + linux/pr.h \ + linux/raw.h \ + linux/securebits.h \ +diff --git a/include/fileutils.h b/include/fileutils.h +index 6fc93d0db..996e18322 100644 +--- a/include/fileutils.h ++++ b/include/fileutils.h +@@ -61,6 +61,8 @@ static inline int is_same_inode(const int fd, const struct stat *st) + return 1; + } + ++extern int ul_open_no_symlinks(const char *path, int flags, mode_t mode); ++ + extern int dup_fd_cloexec(int oldfd, int lowfd); + extern unsigned int get_fd_tabsize(void); + +diff --git a/lib/fileutils.c b/lib/fileutils.c +index b7acae430..a9c2022be 100644 +--- a/lib/fileutils.c ++++ b/lib/fileutils.c +@@ -11,7 +11,14 @@ + #include + #include + #include ++#include + #include ++#include ++#include ++ ++#ifdef HAVE_LINUX_OPENAT2_H ++# include ++#endif + + #include "c.h" + #include "all-io.h" +@@ -311,3 +318,20 @@ int ul_reopen(int fd, int flags) + + return open(buf, flags); + } ++ ++int ul_open_no_symlinks(const char *path, int flags, mode_t mode) ++{ ++#if defined(SYS_openat2) && defined(RESOLVE_NO_SYMLINKS) ++ struct open_how how = { ++ .flags = (__u64) flags, ++ .mode = (__u64) mode, ++ .resolve = RESOLVE_NO_SYMLINKS, ++ }; ++ int fd = syscall(SYS_openat2, AT_FDCWD, path, &how, sizeof(how)); ++ ++ /* only fall back to O_NOFOLLOW if the syscall is unavailable */ ++ if (fd >= 0 || errno != ENOSYS) ++ return fd; ++#endif ++ return open(path, flags | O_NOFOLLOW, mode); ++} +diff --git a/meson.build b/meson.build +index c79939c05..7b2b9ee71 100644 +--- a/meson.build ++++ b/meson.build +@@ -177,6 +177,7 @@ headers = ''' + linux/kcmp.h + linux/net_namespace.h + linux/nsfs.h ++ linux/openat2.h + linux/mount.h + linux/pr.h + linux/securebits.h diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch new file mode 100644 index 00000000000..f8320ae82d5 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch @@ -0,0 +1,85 @@ +From 4cccf4edc256507734e3484cfaedf5980945c2fa Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Mon, 20 Jul 2026 14:36:16 +0200 +Subject: [PATCH] lib/fileutils: add ul_openat_resolve() openat2 wrapper + +Add ul_openat_resolve() as a generic openat2(2) wrapper with +caller-specified resolve flags. No fallback to weaker alternatives -- +returns -1/ENOSYS if openat2 is unavailable. + +Rewrite ul_open_no_symlinks() to use ul_openat_resolve() with +RESOLVE_NO_SYMLINKS, dropping the unsafe O_NOFOLLOW fallback that +only protected the final path component. + +Add fallback defines for RESOLVE_NO_SYMLINKS and RESOLVE_BENEATH +in fileutils.h. + +Signed-off-by: Karel Zak +(cherry picked from commit b9e07ce6f5ad54c38cf3ebc7100101e487be91bd) +(cherry picked from commit 1426aa06ff2f6a21cba9102c35e3577641b356ff) + +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/4cccf4edc256507734e3484cfaedf5980945c2fa] +Signed-off-by: Peter Marko +--- + include/fileutils.h | 9 +++++++++ + lib/fileutils.c | 22 ++++++++++++++-------- + 2 files changed, 23 insertions(+), 8 deletions(-) + +diff --git a/include/fileutils.h b/include/fileutils.h +index 996e18322..09395620a 100644 +--- a/include/fileutils.h ++++ b/include/fileutils.h +@@ -62,6 +62,15 @@ static inline int is_same_inode(const int fd, const struct stat *st) + } + + extern int ul_open_no_symlinks(const char *path, int flags, mode_t mode); ++extern int ul_openat_resolve(int dirfd, const char *path, int flags, ++ mode_t mode, unsigned long long resolve); ++ ++#ifndef RESOLVE_NO_SYMLINKS ++# define RESOLVE_NO_SYMLINKS 0x02 ++#endif ++#ifndef RESOLVE_BENEATH ++# define RESOLVE_BENEATH 0x08 ++#endif + + extern int dup_fd_cloexec(int oldfd, int lowfd); + extern unsigned int get_fd_tabsize(void); +diff --git a/lib/fileutils.c b/lib/fileutils.c +index a9c2022be..c60070855 100644 +--- a/lib/fileutils.c ++++ b/lib/fileutils.c +@@ -319,19 +319,25 @@ int ul_reopen(int fd, int flags) + return open(buf, flags); + } + +-int ul_open_no_symlinks(const char *path, int flags, mode_t mode) ++int ul_openat_resolve(int dirfd, const char *path, int flags, ++ mode_t mode, unsigned long long resolve) + { +-#if defined(SYS_openat2) && defined(RESOLVE_NO_SYMLINKS) ++#if defined(SYS_openat2) + struct open_how how = { + .flags = (__u64) flags, + .mode = (__u64) mode, +- .resolve = RESOLVE_NO_SYMLINKS, ++ .resolve = resolve, + }; +- int fd = syscall(SYS_openat2, AT_FDCWD, path, &how, sizeof(how)); + +- /* only fall back to O_NOFOLLOW if the syscall is unavailable */ +- if (fd >= 0 || errno != ENOSYS) +- return fd; ++ return syscall(SYS_openat2, dirfd, path, &how, sizeof(how)); ++#else ++ errno = ENOSYS; ++ return -1; + #endif +- return open(path, flags | O_NOFOLLOW, mode); ++} ++ ++int ul_open_no_symlinks(const char *path, int flags, mode_t mode) ++{ ++ return ul_openat_resolve(AT_FDCWD, path, flags, mode, ++ RESOLVE_NO_SYMLINKS); + } diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch new file mode 100644 index 00000000000..440b513f4b5 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch @@ -0,0 +1,71 @@ +From ba905a1874959c70fd706aa7d49df61076864e0a Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Tue, 8 Sep 2026 10:26:38 +0200 +Subject: [PATCH] lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value + +The fallback #define used 0x02, but that is RESOLVE_NO_MAGICLINKS. +The correct value, as used by the kernel and glibc, is 0x04. + +The fallback is not dead code: no libmount source includes +, and glibc provides the RESOLVE_* macros only via +, which is a recent addition. On older glibc libmount +then asks openat2() to block magic-links instead of symlinks. The +syscall succeeds and follows the symlink, so the protection in +mnt_context_open_tree(), hook_mount.c and hook_idmap.c is silently +ineffective. + +Move the include from lib/fileutils.c to +include/fileutils.h so all users get the kernel values, and correct +the fallback. + +Fixes: b9e07ce6f ("lib/fileutils: add ul_openat_resolve() openat2 wrapper") +Addresses: https://github.com/util-linux/util-linux/issues/4606 +Signed-off-by: Karel Zak +(cherry picked from commit 20361d66df4d3f32d5e137fe61a55cdf156c91f0) + +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/ba905a1874959c70fd706aa7d49df61076864e0a] +Signed-off-by: Peter Marko +--- + include/fileutils.h | 6 +++++- + lib/fileutils.c | 4 ---- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/include/fileutils.h b/include/fileutils.h +index 09395620a..0b36104be 100644 +--- a/include/fileutils.h ++++ b/include/fileutils.h +@@ -11,6 +11,10 @@ + #include + #include + ++#ifdef HAVE_LINUX_OPENAT2_H ++# include ++#endif ++ + #include "c.h" + + extern int mkstemp_cloexec(char *template); +@@ -66,7 +70,7 @@ extern int ul_openat_resolve(int dirfd, const char *path, int flags, + mode_t mode, unsigned long long resolve); + + #ifndef RESOLVE_NO_SYMLINKS +-# define RESOLVE_NO_SYMLINKS 0x02 ++# define RESOLVE_NO_SYMLINKS 0x04 + #endif + #ifndef RESOLVE_BENEATH + # define RESOLVE_BENEATH 0x08 +diff --git a/lib/fileutils.c b/lib/fileutils.c +index 1142febb0..8ca2c0aae 100644 +--- a/lib/fileutils.c ++++ b/lib/fileutils.c +@@ -16,10 +16,6 @@ + #include + #include + +-#ifdef HAVE_LINUX_OPENAT2_H +-# include +-#endif +- + #include "c.h" + #include "all-io.h" + #include "fileutils.h" diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch new file mode 100644 index 00000000000..fe14fcae9f0 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch @@ -0,0 +1,64 @@ +From 339ff352b7b8b868367d2370ed077675326c3bca Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 09:45:29 +0200 +Subject: [PATCH] lib/fileutils: fix unused parameter warnings without + SYS_openat2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +On systems without SYS_openat2 (older kernels), ul_openat_resolve() +is a stub that returns -ENOSYS, making all parameters unused. With +-Werror=unused-parameter this breaks the build. + +Move the #ifdef around the whole function so each branch has its own +declaration — the SYS_openat2 branch uses all parameters normally, +the fallback branch marks them __unused__. + +Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users") +Signed-off-by: Karel Zak +(cherry picked from commit a471b62e732a491f1abe42450352fb0f9b5b43ea) + +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/339ff352b7b8b868367d2370ed077675326c3bca] +Signed-off-by: Peter Marko +--- + lib/fileutils.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/fileutils.c b/lib/fileutils.c +index c60070855..1142febb0 100644 +--- a/lib/fileutils.c ++++ b/lib/fileutils.c +@@ -319,10 +319,10 @@ int ul_reopen(int fd, int flags) + return open(buf, flags); + } + ++#if defined(SYS_openat2) + int ul_openat_resolve(int dirfd, const char *path, int flags, + mode_t mode, unsigned long long resolve) + { +-#if defined(SYS_openat2) + struct open_how how = { + .flags = (__u64) flags, + .mode = (__u64) mode, +@@ -330,11 +330,19 @@ int ul_openat_resolve(int dirfd, const char *path, int flags, + }; + + return syscall(SYS_openat2, dirfd, path, &how, sizeof(how)); ++} + #else ++int ul_openat_resolve( ++ int dirfd __attribute__((__unused__)), ++ const char *path __attribute__((__unused__)), ++ int flags __attribute__((__unused__)), ++ mode_t mode __attribute__((__unused__)), ++ unsigned long long resolve __attribute__((__unused__))) ++{ + errno = ENOSYS; + return -1; +-#endif + } ++#endif + + int ul_open_no_symlinks(const char *path, int flags, mode_t mode) + { diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch new file mode 100644 index 00000000000..0fb313d3db2 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch @@ -0,0 +1,192 @@ +From 2c002044d1be71ebf45c24571f1a4532a408d0d7 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Tue, 16 Jun 2026 11:13:54 +0200 +Subject: [PATCH 07/15] libmount: add fd_target to context for TOCTOU + prevention + +Add a pinned O_PATH target fd to libmnt_context with lazy-open getter +mnt_context_get_target_fd() and mnt_context_close_target_fd(). + +The fd is opened via ul_open_no_symlinks() (RESOLVE_NO_SYMLINKS) to +reject symlinks at any path component. The fd is closed on context +reset. + +CVE-2026-53613 + +Signed-off-by: Karel Zak +(cherry picked from commit 78a860982e036f38fe9c0b3344998df5ac2c2ff5) + +CVE: CVE-2026-53613 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2] +Signed-off-by: Peter Marko +--- + libmount/src/context.c | 43 ++++++++++++++++++++++++++++++++ + libmount/src/context_mount.c | 7 ++++++ + libmount/src/hook_mount.c | 18 ++++++++++++- + libmount/src/hook_mount_legacy.c | 3 +++ + libmount/src/mountP.h | 7 ++++++ + 5 files changed, 77 insertions(+), 1 deletion(-) + +diff --git a/libmount/src/context.c b/libmount/src/context.c +index 0cd320190..3055c63df 100644 +--- a/libmount/src/context.c ++++ b/libmount/src/context.c +@@ -37,6 +37,7 @@ + */ + + #include "mountP.h" ++#include "fileutils.h" + #include "strutils.h" + #include "namespace.h" + #include "match.h" +@@ -65,6 +66,7 @@ struct libmnt_context *mnt_new_context(void) + cxt->ns_orig.fd = -1; + cxt->ns_tgt.fd = -1; + cxt->ns_cur = &cxt->ns_orig; ++ cxt->fd_target = -1; + + cxt->map_linux = mnt_get_builtin_optmap(MNT_LINUX_MAP); + cxt->map_userspace = mnt_get_builtin_optmap(MNT_USERSPACE_MAP); +@@ -171,6 +173,7 @@ int mnt_reset_context(struct libmnt_context *cxt) + cxt->map_userspace = mnt_get_builtin_optmap(MNT_USERSPACE_MAP); + + mnt_context_reset_status(cxt); ++ mnt_context_close_target_fd(cxt); + mnt_context_deinit_hooksets(cxt); + + if (cxt->table_fltrcb) +@@ -395,6 +398,46 @@ int mnt_context_is_restricted(struct libmnt_context *cxt) + return cxt->restricted; + } + ++int mnt_context_target_fd_required(struct libmnt_context *cxt) ++{ ++ return mnt_context_is_restricted(cxt); ++} ++ ++int mnt_context_reopen_target_fd(struct libmnt_context *cxt) ++{ ++ assert(cxt); ++ ++ if (!mnt_context_target_fd_required(cxt)) ++ return 0; ++ mnt_context_close_target_fd(cxt); ++ if (mnt_context_get_target_fd(cxt) < 0) ++ return -errno; ++ return 0; ++} ++ ++int mnt_context_get_target_fd(struct libmnt_context *cxt) ++{ ++ assert(cxt); ++ ++ if (cxt->fd_target < 0) { ++ const char *target = mnt_fs_get_target(cxt->fs); ++ ++ if (target) ++ cxt->fd_target = ul_open_no_symlinks(target, ++ O_PATH | O_CLOEXEC, 0); ++ } ++ return cxt->fd_target; ++} ++ ++void mnt_context_close_target_fd(struct libmnt_context *cxt) ++{ ++ assert(cxt); ++ ++ if (cxt->fd_target >= 0) ++ close(cxt->fd_target); ++ cxt->fd_target = -1; ++} ++ + /** + * mnt_context_force_unrestricted: + * @cxt: mount context +diff --git a/libmount/src/context_mount.c b/libmount/src/context_mount.c +index 41986e74b..dd46bf053 100644 +--- a/libmount/src/context_mount.c ++++ b/libmount/src/context_mount.c +@@ -726,6 +726,13 @@ static int prepare_target(struct libmnt_context *cxt) + if (rc == 0) + rc = mnt_context_call_hooks(cxt, MNT_STAGE_PREP_TARGET); + ++ if (rc == 0 ++ && mnt_context_target_fd_required(cxt) ++ && mnt_context_get_target_fd(cxt) < 0) { ++ DBG(CXT, ul_debugobj(cxt, "failed to pin target")); ++ rc = -errno; ++ } ++ + if (!mnt_context_switch_ns(cxt, ns_old)) + return -MNT_ERR_NAMESPACE; + +diff --git a/libmount/src/hook_mount.c b/libmount/src/hook_mount.c +index 593111168..a34b2d4bd 100644 +--- a/libmount/src/hook_mount.c ++++ b/libmount/src/hook_mount.c +@@ -527,9 +527,25 @@ static int hook_attach_target(struct libmnt_context *cxt, + umount2(target, MNT_DETACH); + } + +- rc = move_mount(api->fd_tree, "", AT_FDCWD, target, MOVE_MOUNT_F_EMPTY_PATH); ++ /* fd_target is open in restricted mode (see prepare_target()) */ ++ if (mnt_context_target_fd_required(cxt)) { ++ int fd = mnt_context_get_target_fd(cxt); ++ ++ if (fd < 0) ++ return -errno; ++ rc = move_mount(api->fd_tree, "", fd, "", ++ MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_T_EMPTY_PATH); ++ } else ++ rc = move_mount(api->fd_tree, "", AT_FDCWD, target, ++ MOVE_MOUNT_F_EMPTY_PATH); ++ + set_syscall_status(cxt, "move_mount", rc == 0); + ++ if (rc == 0) { ++ /* re-open to point to the mounted filesystem root */ ++ rc = mnt_context_reopen_target_fd(cxt); ++ } ++ + return rc == 0 ? 0 : -errno; + } + +diff --git a/libmount/src/hook_mount_legacy.c b/libmount/src/hook_mount_legacy.c +index 56e92b05d..b7882a108 100644 +--- a/libmount/src/hook_mount_legacy.c ++++ b/libmount/src/hook_mount_legacy.c +@@ -248,6 +248,9 @@ static int hook_mount(struct libmnt_context *cxt, + return rc; + } + ++ /* re-open to point to the mounted filesystem root */ ++ rc = mnt_context_reopen_target_fd(cxt); ++ + cxt->syscall_status = 0; + return rc; + } +diff --git a/libmount/src/mountP.h b/libmount/src/mountP.h +index 339e2761a..37a00e571 100644 +--- a/libmount/src/mountP.h ++++ b/libmount/src/mountP.h +@@ -442,6 +442,8 @@ struct libmnt_context + unsigned int has_selinux_opt : 1; /* temporary for broken fsconfig() syscall */ + unsigned int force_clone : 1; /* OPEN_TREE_CLONE */ + ++ int fd_target; /* pinned target fd (RESOLVE_NO_SYMLINKS) */ ++ + struct list_head hooksets_datas; /* global hooksets data */ + struct list_head hooksets_hooks; /* global hooksets data */ + }; +@@ -630,6 +632,11 @@ extern int mnt_context_prepare_update(struct libmnt_context *cxt); + extern int mnt_context_merge_mflags(struct libmnt_context *cxt); + extern int mnt_context_update_tabs(struct libmnt_context *cxt); + ++extern int mnt_context_target_fd_required(struct libmnt_context *cxt); ++extern int mnt_context_get_target_fd(struct libmnt_context *cxt); ++extern void mnt_context_close_target_fd(struct libmnt_context *cxt); ++extern int mnt_context_reopen_target_fd(struct libmnt_context *cxt); ++ + extern int mnt_context_umount_setopt(struct libmnt_context *cxt, int c, char *arg); + extern int mnt_context_mount_setopt(struct libmnt_context *cxt, int c, char *arg); + From patchwork Sat Oct 31 00:14:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102520 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3724.1793405746976668281 for ; Fri, 30 Oct 2026 17:15:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=IXAQcBrC; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a210470b49so9958465e9.2 for ; Fri, 30 Oct 2026 17:15:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405745; x=1794010545; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=gro7YVOmSTMk1FQlHeqI4FeiqgBAYYNJ524iEqunZrE=; b=IXAQcBrCQx20bVAKN0V7cW6P0NqkU5BFaupAFEvAkBmfa6159I6hyxjaduAt38JduL QxByLh2sBNplDJUqN5vxMcU7lJyqQDRb9YYwUEWNvKQ3NVzUDl3rG3uz5XSjd3wLrmZN Q72mxkHVnc7IAEWJpQRs9R5v+r/ms4Ym8BH9qzt6MgkUkLbbFwAcjKFS81bd7kes34zQ woC8FfrvVyOphAwL9DmhTcau4juipC6nI2GPQEvPofsz5yT/+clSU8OCYJFfMuNAtJxy xmHdEmSq1YT4GSpK1Fd/CCZ8PEIq8Tv9dYbKRRKO42uqKWQoIVSV5I7Onw1sQux1IQxF 3agA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405745; x=1794010545; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=gro7YVOmSTMk1FQlHeqI4FeiqgBAYYNJ524iEqunZrE=; b=VbVmVir6vGrISwOs+5MJ07MxAKXkO7ADU6dbyNhLv2fGDwlyyMQg8yYggIkt4YJHdH efiWy/qkwuLWzfAbAqhwQ+gtESp8EeUr1uwxmX9UDx8SYZ8Fx2C43PTW4cNNlPCA/RWl v5025wBb/6SQs5CnDFTXYkgQu0GiBfvCVLijN8QFNDxh3aQ1aAmIaM82h6S7RAwWJjsG vIzvaroZNvXwcTRN7OYJhyi5BLaTtUvs9io9sja46pJp0peZYP+GygCjF8fuDp/XsEB3 dS2Tg0SxrU2PkwAjMkA12eBcfBibM0lApWiMV+/BbRkJZRQRLN01MYD4MY0BShmtPXf3 +gPQ== X-Gm-Message-State: AFq9FYIjGiW1yXKf2pbvPh9qLjtkNsJv2l4Utf/N0LnLenu+hVSnq4yM kit5CyctEO0BjfvN+Sx6vNflMfECPlqmsbfqeKRm5qxII7MqKusgq0fK9Ah2+j+f6YnakTLqqR3 QFCeUudQ= X-Gm-Gg: AYBFou2X2RQ5zoC3mZjCoVQAHjHflyePMfhJTFAeyR4GdgRQ+AMcJ83vrmvKs4qlNY5 FvyHayrhG86DGqrX7hnFRk1JyKo9giSdBi4qRdhKtYHLaf7ihT8lOj3y5Xxt3828lYwHgnQ0RNt Dyio4TEnwcwtyovEWwC3b44yNzQffp9/SNeFAed5gS3wkmt2BTudfkqaVO86cBJsGQYExZFy332 okzN3sdew7uXlHjt4A2bmewPa+4WPYuGVlCyTv69WpOE/PvcIq09AIIQ0OgJEfNH/x4i7I0oWZV aRdEk262fke/SpFvjV31GbD9+B7tDk7cR7SZ4roRRAI3a2E2YlPX4PeWktWRqalh3fISqmK+Le7 CRzBdnCES7uIgR36JAXeiVF8vKXNCKJoz8+3YsjKK973++28yYgUog7lbTFm7TfuV8JYRaKb93R R76T6NpsVZ1iaXFQYrJtBa1wOiV2KuotDkH+GM9HCyWn5baZwwwats7NEYwn7nRCwmD4llPdAqS aIaCA39AsWoKtMPGfzvu2wryjiKeKSeSEIyY2cZb1JJM2qF79ctsJuwEVP58LLMXHxHGWqmdayU KHl6v3ZdG+cSZK+PUT+wiMLHWzq4dL7v2PQYoVM8f0Ck750G6jdsAYSKQ/5gqSR+McdkFinRh5w QXpsKlmRB+Br1+w7G2ykvTJIdAxuw X-Received: by 2002:a05:600c:6215:b0:4a1:a45a:88f with SMTP id 5b1f17b1804b1-4ac187a6c3amr82036415e9.20.1793405745182; Fri, 30 Oct 2026 17:15:45 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.44 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:44 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 04/55] util-linux: patch CVE-2026-53612 Date: Sat, 31 Oct 2026 01:14:25 +0100 Message-ID: <592e23f18dc64e80d62696c530e8e04fe4b6c4e1.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249079 From: Peter Marko Pick patch referencing this CVE from 2.41.5 release. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/util-linux/util-linux.inc | 1 + .../util-linux/CVE-2026-53612.patch | 92 +++++++++++++++++++ 2 files changed, 93 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index db698ef9367..4b889927c80 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -55,6 +55,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch \ file://0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch \ file://CVE-2026-53613.patch \ + file://CVE-2026-53612.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch new file mode 100644 index 00000000000..94a70c6159c --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch @@ -0,0 +1,92 @@ +From 897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Tue, 16 Jun 2026 11:15:19 +0200 +Subject: [PATCH] libmount: use fd-based fchownat/chmod in hook_owner + +Replace path-based lchown()/chmod() with fd-based operations in the +X-mount.{owner,group,mode} post-mount hook. + +For restricted users the fd_target is pinned in prepare_target() and +re-opened after mount in hook_attach_target() to point to the mounted +filesystem root. For root a local O_PATH fd is opened. Ownership is +changed via fchownat(fd, "", ..., AT_EMPTY_PATH), mode via +/proc/self/fd/N. + +This prevents TOCTOU attacks where an ancestor directory is swapped +between mount and the chmod/chown operations. + +CVE-2026-53612 + +Reported-by: Xinyao Hu +Signed-off-by: Karel Zak +(cherry picked from commit 24da33905c7115c4cbccd0afb2a469804e96467a) + +CVE: CVE-2026-53612 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c] +Signed-off-by: Peter Marko +--- + libmount/src/hook_owner.c | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +diff --git a/libmount/src/hook_owner.c b/libmount/src/hook_owner.c +index 11b238c89..99f0e705d 100644 +--- a/libmount/src/hook_owner.c ++++ b/libmount/src/hook_owner.c +@@ -17,6 +17,7 @@ + #include + + #include "mountP.h" ++#include "pathnames.h" + #include "fileutils.h" + + struct hook_data { +@@ -48,7 +49,7 @@ static int hook_post( + { + struct hook_data *hd = (struct hook_data *) data; + const char *target; +- int rc = 0; ++ int rc = 0, fd; + + assert(cxt); + +@@ -59,18 +60,33 @@ static int hook_post( + if (!target) + return 0; + ++ /* fd_target is pinned in restricted mode (see prepare_target()), ++ * for root open it here to keep chmod/chown fd-based too */ ++ if (mnt_context_target_fd_required(cxt)) ++ fd = mnt_context_get_target_fd(cxt); ++ else ++ fd = open(target, O_PATH | O_CLOEXEC); ++ ++ if (fd < 0) ++ return -MNT_ERR_CHMOD; ++ + if (hd->owner != (uid_t) -1 || hd->group != (uid_t) -1) { +- DBG(CXT, ul_debugobj(cxt, " lchown(%s, %u, %u)", target, hd->owner, hd->group)); +- if (lchown(target, hd->owner, hd->group) == -1) +- return -MNT_ERR_CHOWN; ++ DBG(CXT, ul_debugobj(cxt, " fchownat(%s, %u, %u)", target, hd->owner, hd->group)); ++ if (fchownat(fd, "", hd->owner, hd->group, AT_EMPTY_PATH) == -1) ++ rc = -MNT_ERR_CHOWN; + } + +- if (hd->mode != (mode_t) -1) { +- DBG(CXT, ul_debugobj(cxt, " chmod(%s, %04o)", target, hd->mode)); +- if (chmod(target, hd->mode) == -1) +- return -MNT_ERR_CHMOD; ++ if (!rc && hd->mode != (mode_t) -1) { ++ char buf[sizeof(_PATH_PROC_FDDIR) + 1 + sizeof(stringify_value(INT_MAX))]; ++ ++ snprintf(buf, sizeof(buf), _PATH_PROC_FDDIR "/%d", fd); ++ DBG(CXT, ul_debugobj(cxt, " chmod(%s, %04o)", buf, hd->mode)); ++ if (chmod(buf, hd->mode) == -1) ++ rc = -MNT_ERR_CHMOD; + } + ++ if (!mnt_context_target_fd_required(cxt)) ++ close(fd); + return rc; + } + From patchwork Sat Oct 31 00:14:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102517 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3724.1793405747426523394 for ; Fri, 30 Oct 2026 17:15:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=lbhXekNF; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a140e7405dso13070825e9.3 for ; Fri, 30 Oct 2026 17:15:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405746; x=1794010546; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=tihIuS6HEYFiLoZFeu6yeoBHUuRFrXSHpwSm7TMmtrE=; b=lbhXekNFxGeRxDcfB9BVo44MzsAgezr9Ug4MSnmdCN2t2tP+Wul0AvDhmY5JB7PAZm R+SYGMkvhIpSvq2657M29C6uGxGPDX8ZWap5i3e/eKwasVl/Mm2YtrmxPNVAq1E+BIO2 9L/CuKo0lljSvlYeiU4iNjyLK7NcavBD6UBrHVFGQ3r/jDBM8THuEvK9hv3XGE/HGTsa vXkTReIZeWRWZn12dBxVU8Nu0bdrmekWY0kqBO/1lCiLcos2I4VeqLMg1UqsV/dvQ1bu iceaSJBLwiFO2705l35xNKpT5gwO2QDp22LSR3KbVCqwFucumbMpvr+XYfS6YIqovtrY muRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405746; x=1794010546; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=tihIuS6HEYFiLoZFeu6yeoBHUuRFrXSHpwSm7TMmtrE=; b=Lfrz1IH0g9ZKQQH0083DkFV+iyE3lyn9PEhQnuqswR1FyaBz1Z7eQss0TBsFfrgHJk Qu8u9sEpm3kLY0uhoVkiRbE3S2Jvy2gD02kZssYFP4/sdYTHD8VbY/1hWLZMYF3221y9 QhB1xs1e+8w1ACJFRYb5SK2Cq654KgqNwYB2F8R51BNuj6R923iZh0MK1RLk9NK1T95+ s2ZVbwBA8Oj8UjD6m80eUR7mTXINrGPWHZ41CFikiNMsB26qWQk3HRL9RlSAJYilwnho TrpIu0wa6Xp//uzMn5NwKOfAcMICfh93tz1BQupmQKhNSEA/ZTFU43c+c2XeMEK4t4ZT Mp/w== X-Gm-Message-State: AFq9FYI/qEOw/0xHk6jGDe8sAw0UfKxzIJSXnXzHuU5YxFw7xWXJiYHy OnIeGFlGzUT+H3hjsdCSIzyQn0rIPy1xeVmrUNgmUhXyS2OHD9laXqHrE2f9kRLjo4hqt2YycQS +Re+5Usk= X-Gm-Gg: AYBFou0HjFr+WdMWrN1o64KABxv03+1QAzQuDtp+1GBE/0WMkd2Mwha9Hh9fPPrMCxi t5XOXjDN9PkQDzNyIWkJhtX9LgjpoU/SDhT3PUry4z48K78P5Emf3Rh68G+Uao6veCZxg1f57fK vCPP4QWHJA99T4NmmJ/a7JAyv8ys8VVnW5o+moziJRC/vbCatBSVJpdrepV5MrdSItBgkL1IeXl Yvh/DcMSqAvD6kfdYY9Gz3epczihcEnoJnuQSPlhyeHGPQwHExl6CrVYDfAw5zy9p+WsPIx/1y/ BQjRhffJxdgT8tHuDLkszJ4lflT6VkGOIHGlRdJ2GBP7fGCxgYBpfjbqNFKHsUhgMXM5OwKw/+n W72z2jJYJx9LGWo7W/21y09o7MEcO2pvueEdE8eCWG6cF2ak0XcWKfZdzoSK0lJuNWviRrzCKws gsXFetXGV0g+5KigLu5E/taYRd0wS4g1ExO84s51JuFSKron+iNUgZPWzT/ri9MVXDIXEcvOAmj 8rOe/+8Q4/M8mSZ270EJou6JaF1SR+cubBNmI/6iBROhWeXv4X+bXZ1dUmelRaPKVv27qZaau86 tPrSoosRfPfdxHCdUs36I6dZ5qZ0SA1rldpJmvtQTK4RBixQCDvMiv5GXKqhGPDtMAJ/053tmuO zbOCJXKSRfYFR+SbUWTBCZ+aYF1RK X-Received: by 2002:a05:600c:4e48:b0:4a2:150f:1610 with SMTP id 5b1f17b1804b1-4ac183d16eemr82871405e9.23.1793405745645; Fri, 30 Oct 2026 17:15:45 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:45 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 05/55] util-linux: patch CVE-2024-28085 regression Date: Sat, 31 Oct 2026 01:14:26 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249080 From: Peter Marko Pick patch referencing this CVE from 2.41.6 release. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/util-linux/util-linux.inc | 1 + .../util-linux/CVE-2024-28085-0003.patch | 77 +++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index 4b889927c80..6598a92b30f 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -56,6 +56,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch \ file://CVE-2026-53613.patch \ file://CVE-2026-53612.patch \ + file://CVE-2024-28085-0003.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch b/meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch new file mode 100644 index 00000000000..63d09ef4a1b --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch @@ -0,0 +1,77 @@ +From 61b49b7160bbb6780279344574746617e7fb11a4 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Mon, 24 Aug 2026 16:37:28 +0200 +Subject: [PATCH] wall, write: sanitize hostname in banner header + +The CVE-2024-28085 fix sanitized only message bodies via +fputs_careful(), but the banner headers in wall(1) and write(1) +still interpolate the system hostname without sanitization. + +An unprivileged user can set a malicious hostname containing +terminal escape sequences via a user namespace (unshare -Ur -u ++ sethostname(2)), and wall/write will deliver those sequences +to the terminals of all logged-in users. + +Fix by routing the banner output through fputs_careful() which +strips control characters. + +This is an additional fix for CVE-2024-28085 (CVSS 3.1 score: 3.3). +A new CVE ID has not been assigned (yet). + +Reported-by: Skyler Ferrante +Signed-off-by: Karel Zak +(cherry picked from commit 9ce8f2b5aefa011ef5b0c34aa14df9bb9db02dab) +(cherry picked from commit f358b098d47659837d85b66fb387201224b272a0) + +CVE: CVE-2024-28085 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/61b49b7160bbb6780279344574746617e7fb11a4] +Signed-off-by: Peter Marko +--- + term-utils/wall.c | 3 ++- + term-utils/write.c | 6 ++++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/term-utils/wall.c b/term-utils/wall.c +index 7a4a858f5..c1c47d531 100644 +--- a/term-utils/wall.c ++++ b/term-utils/wall.c +@@ -316,7 +316,8 @@ static char *makemsg(char *fname, char **mvec, int mvecsz, + snprintf(lbuf, lbuflen, + _("Broadcast message from %s@%s (%s) (%s):"), + whom, hostname, where, date); +- fprintf(fs, "%-*.*s\007\007\r\n", TERM_WIDTH, TERM_WIDTH, lbuf); ++ fputs_careful(lbuf, fs, '^', true, TERM_WIDTH); ++ fprintf(fs, "\007\007\r\n"); + free(hostname); + } + fprintf(fs, "%*s\r\n", TERM_WIDTH, " "); +diff --git a/term-utils/write.c b/term-utils/write.c +index 3784f0300..d680d7464 100644 +--- a/term-utils/write.c ++++ b/term-utils/write.c +@@ -233,6 +233,7 @@ static void do_write(const struct write_control *ctl) + time_t now; + struct tm *tm; + char *host, *line = NULL; ++ char buf[512]; + size_t linelen = 0; + struct sigaction sigact; + +@@ -262,14 +263,15 @@ static void do_write(const struct write_control *ctl) + /* print greeting */ + printf("\r\n\a\a\a"); + if (strcmp(login, pwuid) != 0) +- printf(_("Message from %s@%s (as %s) on %s at %02d:%02d ..."), ++ snprintf(buf, sizeof(buf), _("Message from %s@%s (as %s) on %s at %02d:%02d ..."), + login, host, pwuid, ctl->src_tty_name, + tm->tm_hour, tm->tm_min); + else +- printf(_("Message from %s@%s on %s at %02d:%02d ..."), ++ snprintf(buf, sizeof(buf), _("Message from %s@%s on %s at %02d:%02d ..."), + login, host, ctl->src_tty_name, + tm->tm_hour, tm->tm_min); + free(host); ++ fputs_careful(buf, stdout, '^', true, 0); + printf("\r\n"); + + while (getline(&line, &linelen, stdin) >= 0) { From patchwork Sat Oct 31 00:14:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102521 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3725.1793405748023250408 for ; Fri, 30 Oct 2026 17:15:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=H5PqKBCq; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4a5036bbac7so7670825e9.3 for ; Fri, 30 Oct 2026 17:15:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405746; x=1794010546; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=3d8e1J0kLtWJ5JU8A/W7Dm2rw4lhderkEP3c8nbb9/c=; b=H5PqKBCqagqTet9JjqGbJtOHTreq7N/j0DCEdNKsLEgW/26Fn23GkYgmnVUUmcQ63p m8utK3xp68njWPRXq1IYggUaEl3XemJVDneYpaGlu8HVEmiHHVfXDbRoqQHgItBiEi6v OZ4cxQ6SoOmVhGOdOQuHufrCCiC+0jMeL4Y7Hh1/4bGY0C7PgY0leV9cgR57+QHPUY6r Vw5ZHuQGXp3QodIH+PLZUptC4yg/MO4gjNcLzAIlIJWI2vU7h80KrYC71bOIDhSn3CU2 re2xoi71xK5mwfAVLzXgn3kFddvLw3zsXrzdoGPwJE9YwAutTwPa+hKvnWSloLsMUKZ+ TnMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405746; x=1794010546; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=3d8e1J0kLtWJ5JU8A/W7Dm2rw4lhderkEP3c8nbb9/c=; b=LvOYjJEg9u50hjS0k+nu/Lxl3+J338J8gGpoHjfAxKyqMq7qoRwDo3hNfvyx7XH80l jSYm5yKa5m26PMt0J+lA9THQc2ZxSvxB83vkXroJE1U7LmVcLdj6dhJR6ToNqozjP070 UrNoxkwV1kPNAkeAwcAqIR4L0RE35E8vGy5Fs6McJR0p1ptHiEeY7tnem46lUAno43aA zD7+vuGSi03VkJ2d5Du1n827bjL3sPCIyGS7ZjOgnbWdwqeJRcOhiZ8DsG5r3d3kBEfb YdRdiaB40cZfvo/A82P6NBrESgHsbXKWMhyDK7Wxy+nD7hAOJlfWH0XG7arpuk5dKCgV xGvg== X-Gm-Message-State: AFq9FYJrWWFE8VfsddQThZZs0vW+Y3Z29eIpkEXOJ6D7zKPhD8WPZvR5 eiC5kuy+xLgSyjipR/DDUfW3r+s2XFxwl6BsArIFSOAuclxeTbBPo898hhGqsLAlvqs/hou8Qj0 4GOWLjAA= X-Gm-Gg: AYBFou0sbG8z2X8Td2dbuNz3kpWTXRXfEyxGotCZWa2u/vTwm/JOQXH+yzKaCkJtYKQ 2m700e5yCxlD4spiAdDmZuGqSx9xDRO2Vok6YJT4aCFG7vaB/0r6pIXhngPfk33nyRYpo2l06HT hh4ZWH4LlorQIvZGuCkN+I6FotrELRcdC7Cgc3uReJg5jB6wQTORuYLFXvhGpBoMlMuk+Leau5h A9HsK7QHTyV3xaKfhoei7wZfnwOqWNBVEtSwC0shFrxklhYprJjHYJrq3AvzuogySlpzcTC3fN/ 0cIIcoSPGXa+apY5eyjmPQZQC2d5v2Pw/KY6JIhyYY0QT+f/fxf33/IxX1M+uCaU7HFQo1vw11y ZcWvzZr47Nhg7g0bP2uB7YTxJ/LPc4kbrXYXp4Ia+IeGGnVAE1ZFv7IE+0Kri0X5BoP1m23HER9 Uzn93rDnZ3r23g+LsKGbnCcndOs5dzwg9KDSI3zb2SOh1I1vL/jDvFcQS6UEeEQq2FWjCQITvEn 96yg9/OLamoNCP1nHjfskcRIdqjXzhisdDRVs4BDOrmq3Nwzm8URDXYYKD4bvRCqh9EJiAimpY+ sNKfpmfswX/HoNYrAokYbp7mY739siEkZ+ATvz6yoR5EXLXeIF17ELxlmqQbnzMUehrW9vZL7d0 Qt/YDYjISjU++vvk2R+t8PqJ3MsxMRQbXwDTrLALhv6b7DE9rog== X-Received: by 2002:a05:600c:46d1:b0:4ab:cc03:7f60 with SMTP id 5b1f17b1804b1-4ac18993780mr87415555e9.18.1793405746282; Fri, 30 Oct 2026 17:15:46 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:45 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 06/55] util-linux: patch CVE-2026-78408 Date: Sat, 31 Oct 2026 01:14:27 +0100 Message-ID: <3893b4b5363b0c6da7506bd4282979ef5c8bfb44.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249081 From: Peter Marko Pick patch referencing this CVE from 2.41.6 release. Regression patch as submitted to Wrynose is not needed as that code is not yet present in 2.39.3. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: util-linux 2.41.6 release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.6-ChangeLog ] --- meta/recipes-core/util-linux/util-linux.inc | 1 + .../util-linux/CVE-2026-78408.patch | 98 +++++++++++++++++++ 2 files changed, 99 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index 6598a92b30f..2eb9251a704 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -57,6 +57,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://CVE-2026-53613.patch \ file://CVE-2026-53612.patch \ file://CVE-2024-28085-0003.patch \ + file://CVE-2026-78408.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch new file mode 100644 index 00000000000..36f3c91ddc5 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch @@ -0,0 +1,98 @@ +From 43ec8a89f6c99130727084b3496a2ffd2b4200f0 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Mon, 31 Aug 2026 17:03:32 +0200 +Subject: [PATCH] nsenter, unshare: add O_CLOEXEC to all open() calls + [CVE-2026-78408] + +Add O_CLOEXEC (and EFD_CLOEXEC for eventfd) as defense in depth to +all file descriptor creation sites in nsenter and unshare. All these +descriptors are already explicitly closed before exec, but O_CLOEXEC +provides a safety net against future code changes that might +accidentally introduce a leak path. + +No functional change. + +Signed-off-by: Karel Zak + +CVE: CVE-2026-78408 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/43ec8a89f6c99130727084b3496a2ffd2b4200f0] +Backport notes: +- 2 hunks left out as that code is not yet present in 2.39.3. +- Verified that no other "open(" calls are in this version in patched files. +Signed-off-by: Peter Marko +--- + sys-utils/nsenter.c | 6 +++--- + sys-utils/unshare.c | 8 ++++---- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c +index cf6c83174..9d9d90a48 100644 +--- a/sys-utils/nsenter.c ++++ b/sys-utils/nsenter.c +@@ -134,7 +134,7 @@ static void open_target_fd(int *fd, const char *type, const char *path) + if (*fd >= 0) + close(*fd); + +- *fd = open(path, O_RDONLY); ++ *fd = open(path, O_RDONLY | O_CLOEXEC); + if (*fd < 0) + err(EXIT_FAILURE, _("cannot open %s"), path); + } +@@ -492,7 +492,7 @@ int main(int argc, char *argv[]) + + /* Remember the current working directory if I'm not changing it */ + if (root_fd >= 0 && wd_fd < 0 && wdns == NULL) { +- wd_fd = open(".", O_RDONLY); ++ wd_fd = open(".", O_RDONLY | O_CLOEXEC); + if (wd_fd < 0) + err(EXIT_FAILURE, + _("cannot open current working directory")); +@@ -515,7 +515,7 @@ int main(int argc, char *argv[]) + + /* working directory specified as in-namespace path */ + if (wdns) { +- wd_fd = open(wdns, O_RDONLY); ++ wd_fd = open(wdns, O_RDONLY | O_CLOEXEC); + if (wd_fd < 0) + err(EXIT_FAILURE, + _("cannot open current working directory")); +diff --git a/sys-utils/unshare.c b/sys-utils/unshare.c +index 05db627be..c47739862 100644 +--- a/sys-utils/unshare.c ++++ b/sys-utils/unshare.c +@@ -108,7 +108,7 @@ static void setgroups_control(int action) + return; + cmd = setgroups_strings[action]; + +- fd = open(file, O_WRONLY); ++ fd = open(file, O_WRONLY | O_CLOEXEC); + if (fd < 0) { + if (errno == ENOENT) + return; +@@ -125,7 +125,7 @@ static void map_id(const char *file, uint32_t from, uint32_t to) + char *buf; + int fd; + +- fd = open(file, O_WRONLY); ++ fd = open(file, O_WRONLY | O_CLOEXEC); + if (fd < 0) + err(EXIT_FAILURE, _("cannot open %s"), file); + +@@ -219,7 +219,7 @@ static void settime(time_t offset, clockid_t clk_id) + + len = snprintf(buf, sizeof(buf), "%d %" PRId64 " 0", clk_id, (int64_t) offset); + +- fd = open("/proc/self/timens_offsets", O_WRONLY); ++ fd = open("/proc/self/timens_offsets", O_WRONLY | O_CLOEXEC); + if (fd < 0) + err(EXIT_FAILURE, _("failed to open /proc/self/timens_offsets")); + +@@ -289,7 +289,7 @@ static pid_t fork_and_wait(int *fd) + pid_t pid; + uint64_t ch; + +- *fd = eventfd(0, 0); ++ *fd = eventfd(0, EFD_CLOEXEC); + if (*fd < 0) + err(EXIT_FAILURE, _("eventfd failed")); + From patchwork Sat Oct 31 00:14:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102524 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3725.1793405748973569557 for ; Fri, 30 Oct 2026 17:15:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=RnWWhPv/; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a59100fa83so11378545e9.0 for ; Fri, 30 Oct 2026 17:15:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405747; x=1794010547; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=3mOszcfq+eN32B9y35zFEj5Am+JNiBueBGGAbLcd6IU=; b=RnWWhPv/hRAmvnl4xf727GuOQ2qVgxnmi0hohHdH2UT1I/YkkHgeqzjSI8e1jcWT62 hhKTROlfA2zEnUttwpNjNEcCBEXF0MHAdcssqpZXJVEHVGuvxXTjykPInQtHFMTxEyev YnDfNDBPGyzWWoBh9Uu0ena/OQ7xVs0sTCQqwW57gg8B6FrFoLd9GzUAeTqxsC8/DM+t ZA9IsU4YrwsRfbELfY391kqey4XQHW7MCaJi8EpVDMlnpogfkezi+sCahXxE2DTVKz+f tURzvTDaIeQFQ08Rba8hLrQBQrAgPdbBCUNsOqxTn8Blxpkn3VuPEM1nX/yMHyWWF6ac GRIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405747; x=1794010547; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=3mOszcfq+eN32B9y35zFEj5Am+JNiBueBGGAbLcd6IU=; b=C0atqR7UQyklAIQWOHff6gqykbrqsgCIkx0NBUXg8Rv/1aBX63R4/oLk9sq1fTO21v 1RKo7xhaLyOloBzfrb/F8tqZ9qbQwmmBw8OAPsNbFr5iYXOBcRKVpAR/keFqZtEk+im2 Tu5I7QRDQvDIL4RE/YqpLZkSyC5/fWW0WZsCX8+Au65GibwW7kCt3es8UmNodnKIk/k6 twEYN/Aw7f0xA3v6z2IyexkOCAuNMuB9kqBTcDlfABtsxxnRu1LhLC02QPEZFG8A9vcc lXQPhiJWZu/59WAAMzmyjCSOjzHQITr/E6WnFcyFSaORtwA3wdwkdeoBcDn95rA8MqnV uGBA== X-Gm-Message-State: AFq9FYI2EwDkCmK1kT7pGLhm8zYF4Pa7KbxveMgB1U0AVRMoCBGs/xRO IiNUaYv4bCPnUf1VXcwpZLpH1diy3KJf+wY5spFzK3CNUHsWUrkgq4JIS1i8q/gPhePVQK03dq/ D4RTHwhk= X-Gm-Gg: AYBFou0r08wQM4bq1aaaXG23uvX9Gh4MQW8tpSkfTRoVGNrQ5Dwv1F1uDgY+PDIwNhP fnpBi7eHFby9ETTRu0Rmcv5oxr2DATMc57v12WQjfs/u/LfjRf7uotdBVh8v2aEa6hGAD07N8rf ejjBF1sX5z1HvtAJpmgp5gAlwJusf52ClsuLm1wGMEsHF5nEqPxp/nk+79GfiGLK90DM8+IjhoB wB6NOFiTlf/GI6hED4a/R2L+vU4F2nLfNUMD4ZOXQw5gvFr3ViTABRXg6hVhEw2QCeMNxxhLdGz GWR0eKSv5J3lqHS8XGwJdAhHdRHX1v89T6NsAk3lXjpS0bzX6BiU6qXO33cBjPupbfy1OlvKBj9 yuTkQEfy+F9yDMaBc6Mc1EBUnlxRDTUsskSH4YDH6cIwTNfQ7LjIWWI3xzd1ina4T1TX8XTsO8d 9++IfRb5sZNS23yJiihmkAigQJqb72CmW1y12d2W8MEM5IBquSZlhSwnMA3p46pdUPgMOGjt4Y8 mQZETH8mT+RoFW3yDHl805gMKd+FMhMkn3C4vtET7q0XEhJKfX/kKX/e4AvIOob5dEZsohSg08c CobIeleLZtf+fYCRtrfbrLcrklx6IRBMgouXuXmWtxCyWpJrf4SM7WS1SplN+cPjj0Qsjtv8LqG XX21udUu4SY7TD9iNGhyJwuJzGWFMZB8FMaA9ay6AkEYqYkp37AY= X-Received: by 2002:a05:600c:83c3:b0:4a9:18f4:925e with SMTP id 5b1f17b1804b1-4ac174711afmr83479585e9.18.1793405746991; Fri, 30 Oct 2026 17:15:46 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:46 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 07/55] util-linux: patch CVE-2026-78410 Date: Sat, 31 Oct 2026 01:14:28 +0100 Message-ID: <09b1b6fc44c4d4d11f6c53a5ac618f7abb196ac3.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249082 From: Peter Marko Pick patches referencing this CVE from 2.41.6 release. Also pick regression patch and patch implementing helper function. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/util-linux/util-linux.inc | 4 + ..._open_tree-helper-for-safe-tree-open.patch | 85 +++++++++++++ .../util-linux/CVE-2026-78410-01.patch | 94 ++++++++++++++ .../util-linux/CVE-2026-78410-02.patch | 96 +++++++++++++++ .../util-linux/CVE-2026-78410-03.patch | 115 ++++++++++++++++++ 5 files changed, 394 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index 2eb9251a704..10803e38938 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -58,6 +58,10 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://CVE-2026-53612.patch \ file://CVE-2024-28085-0003.patch \ file://CVE-2026-78408.patch \ + file://0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch \ + file://CVE-2026-78410-01.patch \ + file://CVE-2026-78410-02.patch \ + file://CVE-2026-78410-03.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch b/meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch new file mode 100644 index 00000000000..efe68cc17c8 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch @@ -0,0 +1,85 @@ +From 71ff1c94be2fd2577bf600accb5c6ad2782276ef Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Mon, 20 Jul 2026 14:40:16 +0200 +Subject: [PATCH] libmount: add mnt_open_tree() helper for safe tree opening + +Add mnt_open_tree() that combines openat2() path pinning with +open_tree() into a single call. When resolve flags are non-zero, +the path is first pinned with ul_openat_resolve(), then cloned +with open_tree(AT_EMPTY_PATH). When resolve is zero, open_tree() +is called directly. + +This consolidates the openat2+open_tree pattern used for symlink +protection in restricted mount operations. + +Signed-off-by: Karel Zak +(cherry picked from commit 37afc15d9e5a0accea94eb067b151e21f8494880) +(cherry picked from commit 90a1f3b5b134b775dd30a46155064731ba40c519) + +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/71ff1c94be2fd2577bf600accb5c6ad2782276ef] +Signed-off-by: Peter Marko +--- + libmount/src/mountP.h | 2 ++ + libmount/src/utils.c | 29 +++++++++++++++++++++++++++++ + 2 files changed, 31 insertions(+) + +diff --git a/libmount/src/mountP.h b/libmount/src/mountP.h +index 97d0bf8fa..9d022d14e 100644 +--- a/libmount/src/mountP.h ++++ b/libmount/src/mountP.h +@@ -687,6 +687,8 @@ static inline struct libmnt_sysapi *mnt_context_get_sysapi(struct libmnt_context + { + return mnt_context_get_hookset_data(cxt, &hookset_mount); + } ++int mnt_open_tree(int dirfd, const char *path, unsigned long flags, ++ unsigned long long resolve); + #endif + + #endif /* _LIBMOUNT_PRIVATE_H */ +diff --git a/libmount/src/utils.c b/libmount/src/utils.c +index 4c90c951b..e4301689e 100644 +--- a/libmount/src/utils.c ++++ b/libmount/src/utils.c +@@ -24,6 +24,7 @@ + #include "strutils.h" + #include "pathnames.h" + #include "mountP.h" ++#include "fileutils.h" + #include "mangle.h" + #include "canonicalize.h" + #include "env.h" +@@ -1286,6 +1287,34 @@ done: + return 1; + } + ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT ++/* ++ * Open a mount tree, optionally pinning the path with openat2() first. ++ * ++ * When @resolve is non-zero, the path is resolved with openat2() using the ++ * given resolve flags, then the tree is opened with open_tree(AT_EMPTY_PATH). ++ * When @resolve is zero, open_tree() is called directly with the path. ++ */ ++int mnt_open_tree(int dirfd, const char *path, unsigned long flags, ++ unsigned long long resolve) ++{ ++ if (resolve) { ++ int pin_fd, fd; ++ ++ pin_fd = ul_openat_resolve(dirfd, path, ++ O_PATH | O_CLOEXEC, 0, resolve); ++ if (pin_fd < 0) ++ return pin_fd; ++ ++ fd = open_tree(pin_fd, "", flags | AT_EMPTY_PATH); ++ close(pin_fd); ++ return fd; ++ } ++ ++ return open_tree(dirfd, path, flags); ++} ++#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */ ++ + #ifdef TEST_PROGRAM + static int test_match_fstype(struct libmnt_test *ts, int argc, char *argv[]) + { diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch new file mode 100644 index 00000000000..50dadbbe884 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch @@ -0,0 +1,94 @@ +From b21f4cee55f723b045920dad5ce48a659d34cac8 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 9 Jul 2026 16:10:08 +0200 +Subject: [PATCH] libmount: restrict source path canonicalization for non-root + users [CVE-2026-78410] + +In restricted (suid, non-root) mode, mnt_context_prepare_srcpath() +calls realpath() as euid=0 to canonicalize the source path. This +follows symlinks through directories where the real user has write +access (e.g. /home/user/), allowing redirection to arbitrary files. + +Only canonicalize /dev/ paths (e.g. /dev/cdrom -> /dev/sr0) and +verify the result stays within /dev/. For non-/dev/ paths (e.g. +disk images in user-writable directories), keep the original fstab +path. Symlink protection for these paths is handled at open time +by RESOLVE_NO_SYMLINKS in ul_open_no_symlinks(). + +This is a follow-up to commits: + 5e390467b ("loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks") + d07aad41e ("libmount: ignore X-mount.nocanonicalize for restricted users") + +Signed-off-by: Karel Zak +(cherry picked from commit e554245ccc165fcdd4b8ba68bf2994ee14b98607) +(cherry picked from commit 6051830a27a852fed92ebd8493e57aa3d5d9cf18) + +CVE: CVE-2026-78410 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/b21f4cee55f723b045920dad5ce48a659d34cac8] +Backport notes: +- Left out hunk from manual not yet present in 2.39.3 +- Adapted to use the startswith() helper available in util-linux 2.39.3. +Signed-off-by: Peter Marko +--- + libmount/src/context.c | 17 ++++++++++++++++- + sys-utils/mount.8.adoc | 10 ++++++++-- + 2 files changed, 24 insertions(+), 3 deletions(-) + +diff --git a/libmount/src/context.c b/libmount/src/context.c +index 00fd099c9..8418b2d64 100644 +--- a/libmount/src/context.c ++++ b/libmount/src/context.c +@@ -1888,7 +1888,22 @@ int mnt_context_prepare_srcpath(struct libmnt_context *cxt) + /* + * Source is PATH (canonicalize) + */ +- path = mnt_resolve_path(src, cache); ++ if (mnt_context_is_restricted(cxt)) { ++ /* In restricted mode, only canonicalize /dev/ ++ * paths (e.g. /dev/cdrom -> /dev/sr0) and verify ++ * the result stays in /dev/. For non-/dev/ paths ++ * (e.g. disk images in user dirs), keep the ++ * original fstab path -- symlink protection is ++ * handled at open time by RESOLVE_NO_SYMLINKS. ++ */ ++ if (startswith(src, "/dev/")) { ++ path = mnt_resolve_path(src, cache); ++ if (path && !startswith(path, "/dev/")) ++ path = NULL; ++ } ++ } else ++ path = mnt_resolve_path(src, cache); ++ + if (path && strcmp(path, src) != 0) + rc = mnt_fs_set_source(cxt->fs, path); + } +diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc +index 2acf2e15c..add2914ae 100644 +--- a/sys-utils/mount.8.adoc ++++ b/sys-utils/mount.8.adoc +@@ -186,6 +186,10 @@ For more details, see *fstab*(5). Only the user that mounted a filesystem can un + + The *user* mount option is accepted if no username is specified. If used in the format *user=someone*, the option is silently ignored and visible only for external mount helpers (/sbin/mount.) for compatibility with some network filesystems. + ++For mount source paths, *mount*(8) only canonicalizes (resolves symlinks) paths starting with _/dev/_ for unprivileged users and verifies the result stays within _/dev/_. Source paths outside _/dev/_ (e.g. disk images in user-writable directories) are kept as-is from _fstab_. ++ ++Filesystem type auto-detection for unprivileged users relies exclusively on *udev* metadata rather than direct device probing; this means file images that are not registered with udev require an explicit filesystem type in _fstab_. ++ + === Bind mount operation + + Remount part of the file hierarchy somewhere else. The call is: +@@ -426,10 +430,12 @@ The argument following the *-t* is used to indicate the filesystem type. The fil + + + The programs *mount* and *umount*(8) support filesystem subtypes. The subtype is defined by a '.subtype' suffix. For example 'fuse.sshfs'. It's recommended to use subtype notation rather than add any prefix to the mount source (for example 'sshfs#example.com' is deprecated). + + +-If no *-t* option is given, or if the *auto* type is specified, *mount* will try to guess the desired type. *mount* uses the *libblkid*(3) library for guessing the filesystem type; if that does not turn up anything that looks familiar, *mount* will try to read the file _/etc/filesystems_, or, if that does not exist, _/proc/filesystems_. All of the filesystem types listed there will be tried, except for those that are labeled "nodev" (e.g. _devpts_, _proc_ and _nfs_). If _/etc/filesystems_ ends in a line with a single {asterisk}, mount will read _/proc/filesystems_ afterwards. While trying, all filesystem types will be mounted with the mount option *silent*. ++If no *-t* option is given, or if the *auto* type is specified, *mount* will try to guess the desired type. The filesystem type is determined using *udev* metadata first, then by direct device probing via *libblkid*(3) for root users. If neither method identifies the type, *mount* will fall back to trying all types listed in _/etc/filesystems_, or if that file does not exist, _/proc/filesystems_. Types labeled "nodev" (e.g. _devpts_, _proc_ and _nfs_) are skipped. If _/etc/filesystems_ ends in a line with a single {asterisk}, mount will read _/proc/filesystems_ afterwards. While trying, all filesystem types will be mounted with the mount option *silent*. + //TRANSLATORS: Keep {asterisk} untranslated. + + +-The *auto* type may be useful for user-mounted floppies. Creating a file _/etc/filesystems_ can be useful to change the probe order (e.g., to try vfat before msdos or ext3 before ext2) or if you use a kernel module autoloader. ++For unprivileged (non-root) users, direct device probing via *libblkid*(3) is disabled and filesystem type detection relies exclusively on *udev* metadata. This means file images that are not registered with *udev* require an explicit filesystem type in _fstab_. +++ ++Creating a file _/etc/filesystems_ can be useful to change the probe order (e.g., to try vfat before msdos or ext3 before ext2) or if you use a kernel module autoloader. + + + More than one type may be specified in a comma-separated list, for the *-t* option as well as in an _/etc/fstab_ entry. The list of filesystem types for the *-t* option can be prefixed with *no* to specify the filesystem types on which no action should be taken. The prefix *no* has no effect when specified in an _/etc/fstab_ entry. + + diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch new file mode 100644 index 00000000000..27669463630 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch @@ -0,0 +1,96 @@ +From 9fcb98bf08d9119d07ba3a3c709b1a85e4a1bbcb Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Mon, 20 Jul 2026 14:59:21 +0200 +Subject: [PATCH] libmount: pin source path with openat2() for restricted users + [CVE-2026-78410] + +In restricted (non-root) mode, mnt_context_open_tree() resolves the +source path via open_tree(AT_FDCWD, path, ...) which follows symlinks +in intermediate path components. A local attacker who can replace the +fstab-authorized bind source path or an ancestor with a symlink can +redirect the privileged mount operation to an arbitrary directory. + +When combined with X-mount.owner/group/mode the post-mount hook +applies root-privileged chown/chmod to the bind source inode, giving +a local ownership/permission modification primitive on paths not +authorized by fstab. + +Fix by using mnt_open_tree() with RESOLVE_NO_SYMLINKS in restricted +mode. Also fix hook_idmap.c fallback open_tree() call to use the +same pattern. Unrestricted (root) callers pass resolve=0 and get +the direct open_tree() path. + +Signed-off-by: Karel Zak +(cherry picked from commit fb8e2653553ce2ecd077a294d53a1422d7c6dbc0) +(cherry picked from commit 9a8d0d60c55d3a55f89f6f75a17bae31bc5ee1c6) + +CVE: CVE-2026-78410 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/9fcb98bf08d9119d07ba3a3c709b1a85e4a1bbcb] +Backport notes: +- In 2.39.3, source tree opening is in hook_mount.c:open_mount_tree(), + not context.c:mnt_context_open_tree(). Apply that security hunk there. +- Add fileutils.h to hook_idmap.c for the RESOLVE_NO_SYMLINKS definition; + without it, compilation fails when mountfd support is enabled. +- Replace the duplicate fileutils.h include in utils.c with + mount-api-utils.h for the open_tree() declaration and syscall fallback. + The original fileutils.h include further down is retained. +Signed-off-by: Peter Marko +--- + libmount/src/hook_idmap.c | 7 +++++-- + libmount/src/hook_mount.c | 3 ++- + libmount/src/utils.c | 2 +- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c +index adaa9c636..97d8e0d1e 100644 +--- a/libmount/src/hook_idmap.c ++++ b/libmount/src/hook_idmap.c +@@ -25,6 +25,7 @@ + #include "strutils.h" + #include "all-io.h" + #include "namespace.h" ++#include "fileutils.h" + #include "mount-api-utils.h" + + #include "mountP.h" +@@ -330,9 +331,11 @@ static int hook_mount_post( + } + #endif + if (fd_tree < 0) +- fd_tree = open_tree(-1, target, ++ fd_tree = mnt_open_tree(AT_FDCWD, target, + OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC | +- (recursive ? AT_RECURSIVE : 0)); ++ (recursive ? AT_RECURSIVE : 0), ++ mnt_context_is_restricted(cxt) ? ++ RESOLVE_NO_SYMLINKS : 0); + if (fd_tree < 0) { + DBG(HOOK, ul_debugobj(hs, " failed to open tree")); + return -MNT_ERR_IDMAP; +diff --git a/libmount/src/hook_mount.c b/libmount/src/hook_mount.c +index a34b2d4..f5198c6 100644 +--- a/libmount/src/hook_mount.c ++++ b/libmount/src/hook_mount.c +@@ -245,7 +245,8 @@ static int open_mount_tree(struct libmnt_context *cxt, const char *path, unsigne + DBG(HOOK, ul_debug("open_tree(path=%s%s%s)", path, + oflg & OPEN_TREE_CLONE ? " clone" : "", + oflg & AT_RECURSIVE ? " recursive" : "")); +- fd = open_tree(AT_FDCWD, path, oflg); ++ fd = mnt_open_tree(AT_FDCWD, path, oflg, ++ mnt_context_is_restricted(cxt) ? RESOLVE_NO_SYMLINKS : 0); + set_syscall_status(cxt, "open_tree", fd >= 0); + + return fd; +diff --git a/libmount/src/utils.c b/libmount/src/utils.c +index 9e2f4d53d..6c6f1aaeb 100644 +--- a/libmount/src/utils.c ++++ b/libmount/src/utils.c +@@ -24,7 +24,7 @@ + #include "strutils.h" + #include "pathnames.h" + #include "mountP.h" +-#include "fileutils.h" ++#include "mount-api-utils.h" + #include "mangle.h" + #include "canonicalize.h" + #include "env.h" diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch new file mode 100644 index 00000000000..15366a8864d --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch @@ -0,0 +1,115 @@ +From 233cf7321e9d0fd2cea901d0a97e565c725640ad Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 10:01:29 +0200 +Subject: [PATCH] libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook + +The idmap hookset was originally guarded by HAVE_MOUNTFD_API (kernel +headers have the new mount syscalls) rather than +USE_LIBMOUNT_MOUNTFD_SUPPORT (libmount is built with mountfd support). + +This was intentional (commit 9040c0900, 2022) -- the idea was to keep +idmap working even with --disable-libmount-mountfd-support by calling +the raw open_tree() syscall directly, while using an inner #ifdef +USE_LIBMOUNT_MOUNTFD_SUPPORT to optionally reuse the sysapi fd_tree. + +This fine-grained approach broke when the CVE-2026-78410 fix replaced +the raw open_tree() call with mnt_open_tree(), which is only available +under USE_LIBMOUNT_MOUNTFD_SUPPORT. The build fails with +--disable-libmount-mountfd-support because mnt_open_tree() is +undeclared. + +Rather than maintaining two code paths for a feature that fundamentally +depends on the new mount API, gate the entire idmap hookset on +USE_LIBMOUNT_MOUNTFD_SUPPORT -- consistent with how hookset_mount is +guarded. Remove the now-redundant inner #ifdef. + +Also add a note to mount.8 that X-mount.idmap requires the new +fd-based mount API. + +Addresses: https://github.com/util-linux/util-linux/issues/4598 +Signed-off-by: Karel Zak +(cherry picked from commit e06799ac325a881a297d2ffd6fe568cacdcd00ab) + +CVE: CVE-2026-78410 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/233cf7321e9d0fd2cea901d0a97e565c725640ad] +Signed-off-by: Peter Marko +--- + libmount/src/hook_idmap.c | 6 ++---- + libmount/src/hooks.c | 2 +- + libmount/src/version.c | 2 +- + sys-utils/mount.8.adoc | 1 + + 4 files changed, 5 insertions(+), 6 deletions(-) + +diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c +index d4d7fbacc..94c025097 100644 +--- a/libmount/src/hook_idmap.c ++++ b/libmount/src/hook_idmap.c +@@ -34,7 +34,7 @@ + # include + #endif + +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + + typedef enum idmap_type_t { + ID_TYPE_UID, /* uidmap entry */ +@@ -319,7 +319,6 @@ static int hook_mount_post( + * Once a mount has been attached to the filesystem it can't be + * idmapped anymore. So create a new detached mount. + */ +-#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + { + struct libmnt_sysapi *api = mnt_context_get_sysapi(cxt); + +@@ -329,7 +328,6 @@ static int hook_mount_post( + DBG(HOOK, ul_debugobj(hs, " reuse tree FD")); + } + } +-#endif + if (fd_tree < 0) + fd_tree = mnt_open_tree(AT_FDCWD, target, + OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC | +@@ -521,4 +519,4 @@ const struct libmnt_hookset hookset_idmap = + .deinit = hookset_deinit + }; + +-#endif /* HAVE_MOUNTFD_API && HAVE_LINUX_MOUNT_H */ ++#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */ +diff --git a/libmount/src/hooks.c b/libmount/src/hooks.c +index 23eca4efd..5ae91edd7 100644 +--- a/libmount/src/hooks.c ++++ b/libmount/src/hooks.c +@@ -46,7 +46,7 @@ static const struct libmnt_hookset *hooksets[] = + &hookset_mount, + #endif + &hookset_mount_legacy, +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + &hookset_idmap, + #endif + &hookset_owner +diff --git a/libmount/src/version.c b/libmount/src/version.c +index 3b61618b5..5c70ebf8a 100644 +--- a/libmount/src/version.c ++++ b/libmount/src/version.c +@@ -38,7 +38,7 @@ static const char *lib_features[] = { + #ifdef USE_LIBMOUNT_SUPPORT_NAMESPACES + "namespaces", + #endif +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + "idmapping", + #endif + #ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT +diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc +index add2914ae..4bc1bb0f9 100644 +--- a/sys-utils/mount.8.adoc ++++ b/sys-utils/mount.8.adoc +@@ -724,6 +724,7 @@ Set _mountpoint_'s mode after mounting. + + *X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__:: + Use this option to create an idmapped mount. ++This feature requires the new file-descriptor-based mount API (available since Linux 5.2). + An idmapped mount allows to change ownership of all files located under a mount according to the ID-mapping associated with a user namespace. + The ownership change is tied to the lifetime and localized to the relevant mount. + The relevant ID-mapping can be specified in two ways: From patchwork Sat Oct 31 00:14:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102539 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3727.1793405749800504634 for ; Fri, 30 Oct 2026 17:15:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=lzPUGZf8; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a35ac4475dso8899955e9.2 for ; Fri, 30 Oct 2026 17:15:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405748; x=1794010548; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TRly+ZUVY/y6VrERmE9dO2mJxiLVYuWOF4Mw8L8yHIA=; b=lzPUGZf80dsofrEdXoeRsCP7/POXySyBUA3s18RAHdmglJMNRa/9/iaPg/vkBpESmf Mb67iL/qKanBtjjdO9fV398dxhrrpZXeOrcgdR28LEJfk4zVOhHR823XVAGH4VkSWQVK sdjEy+RlhDlzIKNotwCOXLkV7x0CeMAZsVV+mVaYX6c2WyUMc1em1bGTjpZWFmo6zWE7 sVvu0RzFC6C4PJP4OaHHXTSsl0ayzsKm30o3HtOoW0Qm5I/QodG5cgN2snT1e73x21Nl rFfHPxM5oEu8bhnQoIOR4W40p5J1dnejqWNQjW3P2Zhv0bytf6SJwknfgYByxh6V0Jkb lorQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405748; x=1794010548; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=TRly+ZUVY/y6VrERmE9dO2mJxiLVYuWOF4Mw8L8yHIA=; b=Y+ajzLigs5Gx3YEPtK7jt2TsZTQBTOvD0Mq/jgN9oXb6pwooJlXyoU3d99irGitds4 t6dyYE8xGt3aQ7FhNk2YZYh/CUTc/zkhkWUjFuwot4K1fFBPAcm8OFLppjwn16HWT7rH UJq82HWsLb0tQws+M7Hw3A0INGJF2z0TrunAMM3f9Q1iYaeGkFXXkb3wUddl+wMsWv3+ H0AJy9VVyuRrzBlBDrHI2iEu/Y86tscUkD9TU0TJJarDQFcdPE+kZnnpr0jijjW9VqaQ vYQgypKUUOTq/ug+ElGVq+IjZCnjjpcLFzRCnlhWYgDSRi4tRJ3i9NLzqxV/oAWZYvW4 PElw== X-Gm-Message-State: AFq9FYIJPNDKc1Dt+VS4BY5cborwElt5a99jXpttj5g7msZfcTimmAcE eCAWnrpuqGDmh6k5etzYirKpm8mNrZcFPLZp0uJk2PVd5yTu+1LXrEWTNiOCvCRdkwUp6oqWsuF zBf9BzLs= X-Gm-Gg: AYBFou2SIn/r7SuesC83MibaEDMODyDi4v5nl2hyRPA10trOn+yuU1wH+NdADwOjXAj neeQB8ElaqkzpvCmAwyB0xyGrbWlcf5IJu0hMojJaJ2rANQjj95TrUWfn/5jqUbC0+e62vPvaXo YMt7OAAzK/ferNGvVF+uyQ18w2RznhfLUHGuJNdUcQfU4SaLXSo1XIkFNoielkqUZPWr049XIPL oPi6qQyGFFBu8Xu+IKanBWUnVn9UnnIjECL8yMtppBR1iwofUPFi4z4uDyr0RToBmPD2YBOG50v jVL2HIumI8clL+FK29anKOe+0kZF+e2T/nw+smrDyndsIRFVRKGeoorElHz0eH4AnChzE9gGDCZ by8jmGx7GEpm8FOdRJzzljz772shV1G5s3G22PiBCyyASYMAX61v8Gyxetdo0BoStI1sM981jIM 69ix/+tJmxOK6H0R4lX5jVgg7vDkUPSH37kKPulpMEH9ojAX+Q9Cx0w7GiHsAq2rUHpnKGjlX/P hn/3n4g6wYmcw0XVTDS9iOC053yqC7OvwPcz6dFDFarqC0g5f6nH+VCakwr9ns/h9EJDZelPKm+ EL4ZscYxv3D6UfpVRTkiGyW862IpYz5eyc6aWaYnP6SuisPVbJxHParfX2ez3YiJ2+nK9r00+hj 5BkRu2DL/sQwx3Fshaaun2w26Dvse X-Received: by 2002:a05:600c:6285:b0:4a1:fa27:df7c with SMTP id 5b1f17b1804b1-4ac182dc8f6mr86252485e9.34.1793405748002; Fri, 30 Oct 2026 17:15:48 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:47 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 08/55] util-linux: patch CVE-2026-76642 Date: Sat, 31 Oct 2026 01:14:29 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249083 From: Peter Marko Pick patch referencing this CVE from 2.41.6 release. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/util-linux/util-linux.inc | 1 + .../util-linux/CVE-2026-76642.patch | 136 ++++++++++++++++++ 2 files changed, 137 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index 10803e38938..fdc8c62f6e5 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -62,6 +62,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://CVE-2026-78410-01.patch \ file://CVE-2026-78410-02.patch \ file://CVE-2026-78410-03.patch \ + file://CVE-2026-76642.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch new file mode 100644 index 00000000000..b5d811770a3 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch @@ -0,0 +1,136 @@ +From a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Tue, 28 Jul 2026 11:40:25 +0200 +Subject: [PATCH] libmount: skip post-mount hooks after failed mount helper + [CVE-2026-76642] + +When an external mount. helper exits nonzero, exec_helper() +stores the failure in helper_status but returns zero (meaning the +fork/exec/wait infrastructure succeeded). This zero propagates as +the mount result, causing MNT_STAGE_MOUNT_POST and MNT_STAGE_POST +hooks to execute as if the mount had succeeded. + +This allows privileged post-mount operations on the pre-existing +target filesystem: + + - X-mount.idmap clones and idmaps the underlying target, creating + an overmount that inherits suid/exec from the root filesystem + (ignoring nosuid/nodev/noexec from fstab) + + - X-mount.owner/group/mode changes the physical target inode + ownership and permissions even though no mount was created + +Gate both MNT_STAGE_MOUNT_POST in mnt_context_do_mount() and +MNT_STAGE_POST in mnt_context_mount() on is_success_status(), which +already correctly distinguishes helper exit status from process +execution status. This is a centralized fix -- individual hooks do +not need their own guards. + +Audit of all hooks registered at these stages: + + MNT_STAGE_MOUNT_POST: + - hook_mount.c (attach, propagation, vfsflags): already skip when + helper executed (commit f94a7760) + - hook_idmap.c: would clone+idmap pre-existing target -- now blocked + - hook_subdir.c: deinit calls tmptgt_cleanup() -- safe + - hook_mount_legacy.c (propagation, bindremount): no resources to leak + - hook_loopdev.c: deinit fixed to call delete_loopdev() when the + cleanup hook is skipped (was only free(), leaking fd and device) + - hook_veritydev.c: deinit calls delete_veritydev() -- safe + + MNT_STAGE_POST: + - hook_owner.c: would chown/chmod target -- now blocked; deinit + only frees uid/gid/mode struct, no resources to leak + +Signed-off-by: Karel Zak +(cherry picked from commit f57cea130839c0af8dc0525274267ae4cfd66bbf) +(cherry picked from commit 1d14676ea70003e9f5b2a6a76af0cadb1190411a) + +CVE: CVE-2026-76642 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc] +Signed-off-by: Peter Marko +--- + libmount/src/context_mount.c | 23 ++++++++++++++++++++--- + libmount/src/hook_loopdev.c | 13 +++++++++++-- + 2 files changed, 31 insertions(+), 5 deletions(-) + +diff --git a/libmount/src/context_mount.c b/libmount/src/context_mount.c +index 77435684b..80c45beeb 100644 +--- a/libmount/src/context_mount.c ++++ b/libmount/src/context_mount.c +@@ -574,6 +574,22 @@ static int is_success_status(struct libmnt_context *cxt) + return 0; + } + ++/* Check if the mount stage explicitly failed (helper or syscall returned ++ * an error). Unlike is_success_status(), this treats "nothing happened" ++ * as not-failed -- the MOUNT stage may be a no-op for operations like ++ * bind/move with the new mount API where open_tree() runs in PREP and ++ * move_mount() is deferred to MOUNT_POST. */ ++static int is_mount_stage_failed(struct libmnt_context *cxt) ++{ ++ if (mnt_context_helper_executed(cxt)) ++ return mnt_context_get_helper_status(cxt) != 0; ++ ++ if (mnt_context_syscall_called(cxt)) ++ return mnt_context_get_status(cxt) != 1; ++ ++ return 0; ++} ++ + /* try mount(2) for all items in comma separated list of the filesystem @types */ + static int do_mount_by_types(struct libmnt_context *cxt, const char *types) + { +@@ -874,8 +890,9 @@ int mnt_context_do_mount(struct libmnt_context *cxt) + } else + res = do_mount_by_pattern(cxt, cxt->fstype_pattern); + +- /* after mount stage */ +- if (res == 0) { ++ /* after mount stage -- the post-mount hooks are commit-path only, ++ * skip them if the mount helper or syscall has failed */ ++ if (res == 0 && !is_mount_stage_failed(cxt)) { + rc = mnt_context_call_hooks(cxt, MNT_STAGE_MOUNT_POST); + if (rc) + return rc; +@@ -1058,7 +1075,7 @@ again: + } + } + +- if (rc == 0) ++ if (rc == 0 && !is_mount_stage_failed(cxt)) + rc = mnt_context_call_hooks(cxt, MNT_STAGE_POST); + + mnt_context_deinit_hooksets(cxt); +diff --git a/libmount/src/hook_loopdev.c b/libmount/src/hook_loopdev.c +index 34351116c..af9a52227 100644 +--- a/libmount/src/hook_loopdev.c ++++ b/libmount/src/hook_loopdev.c +@@ -23,6 +23,8 @@ struct hook_data { + int loopdev_fd; + }; + ++static int delete_loopdev(struct libmnt_context *cxt, struct hook_data *hd); ++ + /* de-initiallize this module */ + static int hookset_deinit(struct libmnt_context *cxt, const struct libmnt_hookset *hs) + { +@@ -30,9 +32,16 @@ static int hookset_deinit(struct libmnt_context *cxt, const struct libmnt_hookse + + DBG(HOOK, ul_debugobj(hs, "deinit '%s'", hs->name)); + +- /* remove all our hooks */ ++ /* remove all our hooks and free hook data */ + while (mnt_context_remove_hook(cxt, hs, 0, &data) == 0) { +- free(data); ++ if (data) { ++ struct hook_data *hd = (struct hook_data *) data; ++ ++ /* cleanup after skipped MOUNT_POST hook */ ++ if (hd->loopdev_fd > -1) ++ delete_loopdev(cxt, hd); ++ free(hd); ++ } + data = NULL; + } + From patchwork Sat Oct 31 00:14:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102525 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3729.1793405750369907903 for ; Fri, 30 Oct 2026 17:15:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=K0xqGtW4; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a5177d78c7so13227405e9.2 for ; Fri, 30 Oct 2026 17:15:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405749; x=1794010549; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=zUhG++Dbkha5Kr1rEnb6DfXimy7vq20nSevPP704y9o=; b=K0xqGtW4j8mk+B1/pgCBqT3dYLExwIrlN4QfOx5VeghuOaxi1mjiZ1nv6Y2hBxnUqf RMFN6SMvpEIN15s9ECA3EJKGVsdkI163jYFvYkk38x3s3c3ZGrL7aoMvOx9/rEA2bw8f BAnNNl7wGtSHewfr4RLhFYKKkzDm+yi1EnqcBgY98Lcbf3/FZc0guKJzrDEk6qRMGk0Z 5FptH9ZPv/9UUFV+5xERdlBenXoS62w/aNJC2eLgFr+Lx+GHXRyxJ9v7Un78iDR1mZFa DTe5x8pXiXyFu/tGsvb39Fyn1sd2v0DcknBj7cY+92pdc1gV5To+2WDpO+lAzxIedcXr 6+hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405749; x=1794010549; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=zUhG++Dbkha5Kr1rEnb6DfXimy7vq20nSevPP704y9o=; b=Mw80knIE+9kRArvg7ou/XIxEYrrWfyPJ8sqyRsy6LbodeXaBXE6+gCUFEdmWrGAgtn d37ty+tsyk4wiTtjiLrmWx8SmYpRbdJJg9PXgNTPpbbq9VlC2ROIc0CyQhHHLS2CfxSM /V8jN9LF+pDAPYM8kOxsneQUfeAhBOH6ogguNoWT7zleqFThTZcWQL0n+6h3B8gNvJV9 HZCo0PNPxuRiGQFuT0V5sgpgyN0nXNUJ4vZvaspZbT9AB8Mfi0q1lGdT0/rgB9j82u/A 43ppF7MM3J7ngod+maP3VAoNj58W9pgWPtcOcGZJImb1cgl5Iv1qMlgpx0B0DiC2J0HA lrOA== X-Gm-Message-State: AFq9FYK/eAhc1+R6ZTAG4jC1sFRXTC3EkNeeBEYvyPonzlvibWl4JemK leqOyfyzekuwveTC2wwM6IoBA78SbSPC2sPn/jwB9i8u+W2aIfdzdcfPDi6ecrOd/RBDnnfQypi rrHpmkN4= X-Gm-Gg: AYBFou1l4M9P8ETFeMYe0rqlq0cbE5bPhNevO7dN5wAWF5+m2Hjnqj/gVjWG7B73KbR yMppNm02/iD08A3D+tbnxYj0wWns3jCM6hrakdjkb1+eEYO6Ep022PxoScuB7LOwoHzmk1dQRVx i6qVWpdie41chNc0h0yiA6TRbGi9RJXk+SzOOg5zWpFHLtyUK+SNETseYIpRr76jVU+CvnjNrGR 1bYh1wkKysU5Ri/3L2UFhrgeWRRktjSvnQYvtPxC1D/sVutjV1hUMZSnAXXNKRc23xjBEmoYvRm eAJQz6dkhAlsJptugqX9CrPLARBK5CoAIL9TiAZAvtQXXbfJeqSmqY+LVPenTLgV56QkzHiw+Y8 sCF0due7BZpL+Tbw/6wdh8Hf6gP1R+NswCqYQujqzzAHWWP1Q5xzI4QrLBdlNTudBYm3mwsuD4n cXuPKk652N0tThCciYCrKh2tRBr+mFdu+sZa204LqdgG6L402ipY371F/emWNToIh91G/xBZ+Iy Oe09Chvc7Yz+B1gtC1oJVWJ88LEF1ejJE0jYSHInNevrb7InCj7GvE5mhvII10/fbhkJYapee4p QrKJtRFSRz903zpZAaA+N3t/mIgBfNf3D2nASxcFZB2QMgykpO6ZaOX0VViOpNWBfzOZhgGbAoK dFW006y1hSwsgErXsko07l6MopZL0 X-Received: by 2002:a05:600c:3b0e:b0:4a7:7d22:c50c with SMTP id 5b1f17b1804b1-4ac150b2243mr93278745e9.2.1793405748589; Fri, 30 Oct 2026 17:15:48 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:48 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 09/55] tzdata/tzcode-native: upgrade 2026d -> 2026e Date: Sat, 31 Oct 2026 01:14:30 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:15:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249084 From: Ankur Tyagi Changelog: https://www.iana.org/time-zones/releases/2026e Signed-off-by: Ankur Tyagi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 35a0a18640e92bd98eca22ec9150be11daca1df7) Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal --- meta/recipes-extended/timezone/timezone.inc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc index 441dc9be998..704d6b603f9 100644 --- a/meta/recipes-extended/timezone/timezone.inc +++ b/meta/recipes-extended/timezone/timezone.inc @@ -6,7 +6,7 @@ SECTION = "base" LICENSE = "PD & BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba" -PV = "2026d" +PV = "2026e" SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \ http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \ @@ -16,5 +16,5 @@ S = "${WORKDIR}/tz" UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones" -SRC_URI[tzcode.sha256sum] = "2f5c9f7fe29e6b8cb863583667884b8ce17b0a485355a054b591c6bdfcd81791" -SRC_URI[tzdata.sha256sum] = "0cb2aa8e333c3dc049badc42a0c61f21987b8cd44e107fa900bad764aacc7767" +SRC_URI[tzcode.sha256sum] = "cc3d27ca2a0d8399504551b920970d80af83bfb9c216e8082a15491921935d54" +SRC_URI[tzdata.sha256sum] = "b26882805f26aac59d5b222978e6580484b834ccdc98be89df2f05a6dc53a652" From patchwork Sat Oct 31 00:14:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102528 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3730.1793405750962603153 for ; Fri, 30 Oct 2026 17:15:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=GtpZBSdK; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4ac95761c85so7348275e9.2 for ; Fri, 30 Oct 2026 17:15:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405749; x=1794010549; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=S/n3F9sX0ygnVK6Nll3SWRtJ9EH2eCLVPl93dFAOOTM=; b=GtpZBSdKE4afFd8T8AWYDLhGxXoLjcDaZ7OsrSLfvCN59N/yMduaNcIKWt31DoEpXM 458eSprIlBvAu/f2H/EnhR56lNwFl1zwMkyekJ6pP6ywqcp+Ub9/HAyR5FK3J9HEbcJ7 iTpVf4eJMDZa3zkWTRbCkbs89JzhlFZ+s/dELpJwR60cDZLB1brIJ1vqCj0Pnps5z5K8 Edh+w593c5Vw8EkzoE4xdhlg189+rBJiKTRCbMuBIXGh/8txXsiAiFry0V7OcFiA72GK hLv7g5BnggYUKWfuGhqvxaNNkEU3I8D//CiOKU4PZn3olM+mX66PIli29Apoc/hX3+8M 8BUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405749; x=1794010549; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=S/n3F9sX0ygnVK6Nll3SWRtJ9EH2eCLVPl93dFAOOTM=; b=bZtBK9w1gVsEErJLbpaFqvJZHPhI1TDmQxk4pdWE2we+nPgqn1zVSRnJwZxI/ApcQX +2wkaJ3zxr6XC9PpVpO+h6KvXAr4olsmEAHMPQ78PL5QOku6d3gJRZ+cy4Dd88Sdy/L5 vp4xz3uBcZJ0CowLFPC/xjN3/tNOCNg6yaBh18L7jbgblH6D1F1CL/TX4w15ihgB55Ge YnzoMb1/pKcM23/UcXP/Q6pklOU/1Q/AVnQQGU8EhNtGPnG8WjQNuP6TakBjTLH5m1fz VoC2qfvKrQZrOc9HoXaRfar7O3eaCksT9nNwjChvrCLzJ5TAGsq/lmcDIo8xhNxvkDVV xJeQ== X-Gm-Message-State: AFq9FYJsTdj8l8F7U4z53pNwQ8Y31GihAmlZBNLwnlTU2BvbK9Z1CC+C XXbzFFARibnknxoeJ7FbxKXLufabblNplrvKg++7+XFrpXLlEd1sLhhFkEOg5vV6vKphxwgZJWX llp3vPSg= X-Gm-Gg: AYBFou1LWvdI//dpMFdW6yvukDgloW/CMX1zoSFvjplL+7y+Ae7/z46RsaJr6U1veBK FqkG/M1JUPw4+7zy0bNxatH5hZ4Wkdyrc3Kkyehn29RUXY/9yGBjvM2YXkmi9g6BgnM0zlEtQxh hFE3ucNQEP54sPjQVKB9KPwOZNX8eaauugteBAwpmuPNctRLbXXgm7qa+Kzrj+q5Fi3+lviEkPF XlCVb3UnjOKR/mhXevLb1jIYDeV12T6z5HT/SV8ml06jA7EuNGhcdTyYimkd6I9xOWPJ6lYlrwy Xg3z5k7Dl2xEqxao12hFtUZlRTqX52bw1rXfoP8Q85iozpaWupEHsyLFay0hfNsTJbyelEkkr3g huTF71XrzZ+90q/iq2lgXsszshN9hcwJ+y2TZNWWVi2dH9xI1YuHy4s5nHf2hnH4xDnq2HdhqYA DrBjkZKGTQxa9U47gWhRmrooJ8cnxdmkmewwb8n3Jrpilmevz3oWu5BNL9evIG7SXcTDOs7Ztmh FLOLsjXhtNBoUUJ2gb5sWWA1Y6ivKeH2ax1hUrc/qzYEbW6+2V9fIi3Yki3ROkoYwsBoU2XC9so 5vO6M0Rcwe3Gjv3rMxbmC6/MMJYkAV4a+7LeykD113RyzgnjJ2CrgrR2VbI/8RIpyz11bCWsU90 hERKhAvvpoQ1VAepiqw1zaS52TianxQ== X-Received: by 2002:a05:600c:a4e:b0:4a1:e57b:667c with SMTP id 5b1f17b1804b1-4ac183d1edamr87825695e9.26.1793405749112; Fri, 30 Oct 2026 17:15:49 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.48 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:48 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 10/55] expat: patch CVE-2026-102633 Date: Sat, 31 Oct 2026 01:14:31 +0100 Message-ID: <696abeff0f419d8fbbe2ee2f0cef5e2c4a1a36e0.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249085 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-102633 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../expat/expat/CVE-2026-102633.patch | 68 +++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 1 + 2 files changed, 69 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-102633.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-102633.patch b/meta/recipes-core/expat/expat/CVE-2026-102633.patch new file mode 100644 index 00000000000..17851201267 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-102633.patch @@ -0,0 +1,68 @@ +From 69edbec09f2cd3e0bd6e0a093b55ea38af902d7d Mon Sep 17 00:00:00 2001 +From: Filippo Tedeschi +Date: Thu, 24 Sep 2026 21:14:23 +0200 +Subject: [PATCH] lib|tests: Replace assert with runtime overflow check in + expat_realloc + +In expat_realloc, the size passed to realloc_fcn is calculated as +sizeof(size_t) + EXPAT_MALLOC_PADDING + size. Previously, expat_realloc +relied on an assertion: +assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); +under the assumption that preceding accounting checks and parser +invariants preclude reaching an overflow state in practice. + +However, in release builds compiled with NDEBUG, assertions are +compiled out. Replace the assert with an explicit runtime check: +if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { + return NULL; +} +immediately preceding the addition, ensuring consistent defensive +behavior across all build configurations. + +Also extend test_alloc_tracker_size_recorded in alloc_tests.c to +exercise SIZE_MAX and SIZE_MAX / 2 with expat_realloc, verifying +that the allocation fails and the recorded size remains unchanged. + +Signed-off-by: Filippo Tedeschi + +CVE: CVE-2026-102633 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/69edbec09f2cd3e0bd6e0a093b55ea38af902d7d] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 7 ++++--- + tests/alloc_tests.c | 4 ++++ + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index dfcfb0c2..67005454 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -1023,9 +1023,10 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) { + } + } + +- // NOTE: Integer overflow detection has already been done for us +- // by expat_heap_increase_tolerable(..) above +- assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size); ++ // Detect and prevent integer overflow ++ if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) { ++ return NULL; ++ } + + // Actually allocate + mallocedPtr = parser->m_mem.realloc_fcn( +diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c +index 6be0a073..a5cea463 100644 +--- a/tests/alloc_tests.c ++++ b/tests/alloc_tests.c +@@ -2118,6 +2118,10 @@ START_TEST(test_alloc_tracker_size_recorded) { + assert_true(ptr != NULL); + assert_true(sizeRecordedFor(ptr) == 10); + ++ assert_true(expat_realloc(parser, ptr, SIZE_MAX, -1) == NULL); ++ ++ assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged ++ + assert_true(expat_realloc(parser, ptr, SIZE_MAX / 2, -1) == NULL); + + assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 6d08a3fd94b..3a179db62cc 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -18,6 +18,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-76957-02.patch \ file://CVE-2026-93990-01.patch \ file://CVE-2026-93990-02.patch \ + file://CVE-2026-102633.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Sat Oct 31 00:14:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102533 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3727.1793405751454532940 for ; Fri, 30 Oct 2026 17:15:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=CUe4szNf; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so12080775e9.1 for ; Fri, 30 Oct 2026 17:15:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405750; x=1794010550; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=G5ExFhJSxl6Fuf2kVJZ0kw9yTp6dqT+hn+zSnF2Sp4o=; b=CUe4szNf60HBawIBXxk1W6qXXn7Klb+ASWWIJFNbW8akaeXnSFCr5Hg3WBuW7uKf9Z 246GNzizX4IKwobzaReX2NP/X+XJJZgzS0//SabfNicwNDwVw6D2rh4nrPvv9RFD3JS+ VFQombGXXY5GhA9UCYncB00PmLJS16+SqOf1BgxAk3UapDm5N026lSRgpzy6EccBswyA m3606LrQy410HQlNn6uor8gl/O5FbhBgA1XS7tmemC95O6cL//SSb1luVL9oSXk47ixM iz/ktaAsTEwc7Kpxt075gmqo6Ytj1M1oDTSJhM4/QpKsqogaRqqg3Y6XVKLTCIx5eFxa ui/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405750; x=1794010550; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=G5ExFhJSxl6Fuf2kVJZ0kw9yTp6dqT+hn+zSnF2Sp4o=; b=1HErkgrV+KaunLh4MPEaFe/tJYhoYqrxcem8ADNW81HWFX7TaHDtJXM2lbvly7TEh5 ngib6fPi2rRkB4CTgt0MjMUfShMlTnsHXXmBug3lDXFFrsY/5IGgD6B0DYlka/S/P1DL pkcaiuB8Os8RVwdetKz9Mtqu+aKCKVb45q7CZ1p+GEFHi/ueViknwF669nH8I0u8lur/ pWVfI7fF7dZEYBw5SOXqoV+30g7t9i0Z/RMR+i8b6qWTrUwow3miWY0zCA71WZaE/so2 SeEV7dSpUkojwDWvBwGm/msFg1gNsdTaepv5MtThZkYMaXEDeK9bjUcia+zOgrO9VzJi ybmQ== X-Gm-Message-State: AFq9FYI4nWg9v0G7vxx+KfoY4pLG3F9wS4vVPDs2ImTY2dahhD1Jk+CJ hnxZmK5XCCRV66g1u1XE2O9hyv8IxwlKBNzi/FiL11xfGAl10F8zktBeSCLHSE52WRgcEAEXjnb esB/eR/s= X-Gm-Gg: AYBFou2nKrX1m/s33ED/LTbTBsm+M3Bj1t0yzg2AYW1aHriwV59EMmCwt/CXnSzMTpv dEwlaTDDTYvixzZ4CAN/9NB5XmIWiu0Ep5uvb2IltYkz47ZECQg4AUuAivFj0a8CSMbvG/YThla sI31ZD+pbWTpO0gK1Qe76WsaVKGT3cga3rD481Bs86sOauTY+yAnCM/aC9rLcpxlmMKG8NlZ1Ln VgrgoqdoceNkSkejrCZS77hCPulZHEoWWpflHmi5psCLANrSbMknIHVx0sYjwTZJdBPtK2/DjIv 1kZiHqZI94E1aJQorLd4c6GIYFoIPz8hmYkamPOwd04HFFpGgeIY4tpkLWTtw1oMMJThtOSCEWL H28ZuHG1DqX8c/jV2H7GsDpd8dlwYGzkPUKdFqks8iNwpb5GhaPwkcDLVZSPzNLIvz3/wBrdnsH xcesPG/aoFjupii1laIDU7pAo/c3YTNdJqPizqtf+BQYNAidqzmR/m+8ad/FJbWOaGnMiY8gMUf VtJ8vNjL98WDXbS1EGfqWamz/rnGC5at+2x7BQQR2tZEVQYOAZUlaq736WL/f2cRJ0Sft9MNFul +DKo2L8t767NwX709XatWtoSjNVflsZyjMrA0ccU4qJcwkbDXXdb3ZECzqM4JK6AisP/+OwWmlI h0HPxJs3pEFP3KNL6K5nIaWwVqGL6iQ== X-Received: by 2002:a05:600c:34cf:b0:4a1:dbdf:17a8 with SMTP id 5b1f17b1804b1-4ac150b3d01mr91527625e9.2.1793405749666; Fri, 30 Oct 2026 17:15:49 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:49 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 11/55] expat: patch CVE-2026-77214 Date: Sat, 31 Oct 2026 01:14:32 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249086 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-77214 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../expat/expat/CVE-2026-77214.patch | 106 ++++++++++++++++++ meta/recipes-core/expat/expat_2.8.3.bb | 1 + 2 files changed, 107 insertions(+) create mode 100644 meta/recipes-core/expat/expat/CVE-2026-77214.patch diff --git a/meta/recipes-core/expat/expat/CVE-2026-77214.patch b/meta/recipes-core/expat/expat/CVE-2026-77214.patch new file mode 100644 index 00000000000..6d746487054 --- /dev/null +++ b/meta/recipes-core/expat/expat/CVE-2026-77214.patch @@ -0,0 +1,106 @@ +From 4d9b1c499ecb66323260a7274edcf86c5eab0517 Mon Sep 17 00:00:00 2001 +From: Filippo Tedeschi +Date: Fri, 25 Sep 2026 19:51:10 +0200 +Subject: [PATCH] lib|tests: Validate len against buffer capacity in + XML_ParseBuffer + +In XML_ParseBuffer(), if len exceeds the unoccupied capacity of the +internal buffer (EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd)), +parser->m_bufferEnd was previously advanced past parser->m_bufferLim. +This violated the parser's internal pointer invariant (m_bufferEnd <= +m_bufferLim) and caused callProcessor() to read unallocated or +uninitialized heap memory beyond the buffer bounds. + +Validate that len <= EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd) for +both XML_INITIALIZED and XML_PARSING states. If len exceeds the +available buffer capacity, return XML_STATUS_ERROR with +XML_ERROR_INVALID_ARGUMENT. + +Also add test_parse_buffer_exceeds_buffer in tests/basic_tests.c. + +Co-authored-by: Sebastian Pipping +Signed-off-by: Filippo Tedeschi + +CVE: CVE-2026-77214 +Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517] +Signed-off-by: Peter Marko +--- + lib/xmlparse.c | 5 +++++ + tests/basic_tests.c | 41 +++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 46 insertions(+) + +diff --git a/lib/xmlparse.c b/lib/xmlparse.c +index 08ef9f72..6e3af97b 100644 +--- a/lib/xmlparse.c ++++ b/lib/xmlparse.c +@@ -2465,6 +2465,11 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { + parser->m_parsingStatus.parsing = XML_PARSING; + } + ++ if (len > EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd)) { ++ parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT; ++ return XML_STATUS_ERROR; ++ } ++ + // Detect and avoid integer overflow + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { + parser->m_errorCode = XML_ERROR_NO_MEMORY; +diff --git a/tests/basic_tests.c b/tests/basic_tests.c +index 06268469..35e17d31 100644 +--- a/tests/basic_tests.c ++++ b/tests/basic_tests.c +@@ -3605,6 +3605,46 @@ START_TEST(test_negative_len_parse_buffer) { + } + END_TEST + ++/* Test XML_ParseBuffer rejects calls where len exceeds available buffer */ ++START_TEST(test_parse_buffer_exceeds_buffer) { ++ for (int isFinal = 0; isFinal < 2; isFinal++) { ++ set_subtest("isFinal=%d", isFinal); ++ ++ XML_Parser parser = XML_ParserCreate(NULL); ++ ++ /* Calling XML_ParseBuffer without any prior XML_GetBuffer call */ ++ if (XML_ParseBuffer(parser, 10, isFinal) != XML_STATUS_ERROR) ++ fail("XML_ParseBuffer without XML_GetBuffer was expected to fail."); ++ if (XML_GetErrorCode(parser) != XML_ERROR_NO_BUFFER) ++ fail("Expected XML_ERROR_NO_BUFFER."); ++ ++ /* Acquire a small buffer */ ++ void *const buffer = XML_GetBuffer(parser, 10); ++ if (buffer == NULL) ++ fail("XML_GetBuffer failed."); ++ ++ /* Calling XML_ParseBuffer with len exceeding available buffer capacity */ ++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR) ++ fail("XML_ParseBuffer with len > capacity was expected to fail."); ++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT) ++ fail("Expected XML_ERROR_INVALID_ARGUMENT."); ++ ++ /* Valid parse */ ++ memcpy(buffer, "", 7); ++ if (XML_ParseBuffer(parser, 7, XML_FALSE) != XML_STATUS_OK) ++ xml_failure(parser); ++ ++ /* Subsequent XML_ParseBuffer where len exceeds remaining capacity */ ++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR) ++ fail("XML_ParseBuffer on subsequent chunk was expected to fail."); ++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT) ++ fail("Expected XML_ERROR_INVALID_ARGUMENT."); ++ ++ XML_ParserFree(parser); ++ } ++} ++END_TEST ++ + /* Test odd corners of the XML_GetBuffer interface */ + static enum XML_Status + get_feature(enum XML_FeatureEnum feature_id, long *presult) { +@@ -7054,6 +7094,7 @@ make_basic_test_case(Suite *s) { + tcase_add_test(tc_basic, test_empty_parse); + tcase_add_test(tc_basic, test_negative_len_parse); + tcase_add_test(tc_basic, test_negative_len_parse_buffer); ++ tcase_add_test(tc_basic, test_parse_buffer_exceeds_buffer); + tcase_add_test(tc_basic, test_get_buffer_1); + tcase_add_test(tc_basic, test_get_buffer_2); + #if XML_CONTEXT_BYTES > 0 diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb index 3a179db62cc..02a8536440d 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.3.bb @@ -19,6 +19,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ file://CVE-2026-93990-01.patch \ file://CVE-2026-93990-02.patch \ file://CVE-2026-102633.patch \ + file://CVE-2026-77214.patch \ " GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" From patchwork Sat Oct 31 00:14:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102534 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3733.1793405752125027417 for ; Fri, 30 Oct 2026 17:15:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=W/my40IE; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a9a8d6cea8so16511205e9.1 for ; Fri, 30 Oct 2026 17:15:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405750; x=1794010550; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WFUCCkJ+WrFn64N6EEYyu9HXsGp2pxBjsaOLKyo/Yks=; b=W/my40IE+h/3d7lTS4jNm+wlHYea19ByCWeg8D1Y9bzXVe52i4NbBrcj28HchDqFVt iYidZoQuR2HwqiAjda4EVDDuMtuml8VvWhwaHEhBkvJbhDo9TjoPaqU5ElYBLfNdt1MJ Ktg51ebUgIUi+rs+Rg0UOz9TutudGSXyQCKUPwZ31hzdwzIC31Hm6Nx/QGMUI+MuA8Gu /f5QdFaBQMjQhOUlFW3E0oAdtWwpyj6e4HLGf/QrQeyqMD1jMwOVsu0XgljeqQJaqwfN 8jaLwonxxgooh0jsnG7RDUmF4QjT4/inn7iK+ILoKh6umfzWxDZpLhuCQtkdDY69+9dE 1q+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405750; x=1794010550; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=WFUCCkJ+WrFn64N6EEYyu9HXsGp2pxBjsaOLKyo/Yks=; b=PZGX0+XqFdUOxAHlbqPqBxFZqi7/fHiNkPnN+S2/bCJ+78ycaIFlRdrLRUXicfBvw0 MedP4T/SERv1Mx/qyC7rkqET0AYwb2TtZwxVWzCbuMx7jU8eyEf8bMrw5geuMej7nyZu ALiJBB9JE1bu6c1AO1Fh+A5pVdh7OERqBCLIdSIVBJPKK6Wn9rUIH7crw1oln1ZAer1M v1UeZq+Q13nBWiHQ22eM4Ttem8c5+M2IJOk9LR4SwDI6z+t1NMwmM/iT+NKwcTp1wSw7 INd9G5FNsYJn3Mh1rnRxMDK3VCrrdzU06eBXP9fifPra1i6n+LStgZ9AfsSexDCCJgJE IyQQ== X-Gm-Message-State: AFq9FYJnrCfvYu6ZaKGK6pvBWP+RFlm9CXLVViNJc5UH4b7uXx3eIR5w 5WGUmLbyfWS7arUhYdXmnTbI7bUc08qt5sAlyKKdpc5RpcNteBW+WYcvnjDsOyV67O5/dQ8AK5U EsVTXtgs= X-Gm-Gg: AYBFou3MFu1Iv4HrZ1XpWYO9gnHtjQIMzgwrypHS55dvZNgjWHFjQe+t1a5DFgdHQom H4Jswg2RniWeA63nUe7f1ICsq3fcv0otfLpz2akRi217LWSVZe6o/k5nAS44Gwm4D+2q5Qm8QlF EfgbZqxW6aShTnnq2ptfZhkTkH2wuUhH+cg4h0xD5MGj7j9kNViiPZa70WvZHVTzmoSVIweOmWQ xOA0X45keZ/R+bIsKcvw+NTb6aPuGwA9v37OBg9wLK+zIrGjIm+SVjBAUsnHXLNbD4yT80b+X8z YC7JmPrFCXW32U6mRvfSEin7cI+2D4j+WTI7g747OuST7yX1Y0Vxrk538dH4SORvuaW8/n1Gw5U NeBe5DghYfhh0kfWUTUo77DV3TXEyYiUkKgJfkbfxnGHyWyt4FdCPA9qk4DjUyQr1+4KJqK2pbw kgdtyhmTC4sqSBtMC2qH4Ym/sqVC/jSO2S3S4o3b5MpgWh91ZTQJsSJ16oMefErpgH3FgidTtRa 5BZldkQrZmhmJDL0VcS4d3JMq86L1vbK/3Obbgq88q2o0gsRSr4wOeU4LF6r7Wpm/Jmi9zSNqiW MAnm2SOJCjEN5sxNm99oWK6JM5B19P4wkvjsBep6oyafrHkiY09/JmYf6wsAlU1JcwgJRFJ7ftV O8OgGdtuL8hlI3qUnFlLqEL4/K9PN X-Received: by 2002:a05:600c:3554:b0:49e:6581:7baf with SMTP id 5b1f17b1804b1-4ac14ec66d9mr92532505e9.2.1793405750318; Fri, 30 Oct 2026 17:15:50 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:49 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 12/55] popt: patch CVE-2026-18743 Date: Sat, 31 Oct 2026 01:14:33 +0100 Message-ID: <51ba6c6a2d4a602f540f2335793161696acb8c45.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249087 From: Peter Marko Pick patch referencing this CVE. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 6a47df77d4dda066f6c3651480546a79fd445ae6) Signed-off-by: Yoann Congal --- .../popt/popt/CVE-2026-18743.patch | 97 +++++++++++++++++++ meta/recipes-support/popt/popt_1.19.bb | 1 + 2 files changed, 98 insertions(+) create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18743.patch diff --git a/meta/recipes-support/popt/popt/CVE-2026-18743.patch b/meta/recipes-support/popt/popt/CVE-2026-18743.patch new file mode 100644 index 00000000000..d57a39b4705 --- /dev/null +++ b/meta/recipes-support/popt/popt/CVE-2026-18743.patch @@ -0,0 +1,97 @@ +From ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe Mon Sep 17 00:00:00 2001 +From: Panu Matilainen +Date: Tue, 11 Aug 2026 11:45:44 +0300 +Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in + poptConfigFileToString() + +Fix the reallocation logic thinko, repeated twice in the function: +if we need to reallocate, the current maximum value is not interesting +in any way. Just allocate double the required size instead. + +The reproducer test is obviously closely tied to the initial buffer +size of 480 and wouldn't work with other sizes, but with the current +default this reliably crashes popt under ASAN prior to this fix. +Also , the reproducer only exercises the first of these flaws. + +Fixes: CVE-2026-18743 + +CVE: CVE-2026-18743 +Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe] +Signed-off-by: Peter Marko +--- + src/poptparse.c | 10 ++++------ + tests/test3-data/05.answer | 5 +++++ + tests/test3-data/05.input | 2 ++ + tests/testit.sh | 1 + + 4 files changed, 12 insertions(+), 6 deletions(-) + create mode 100644 tests/test3-data/05.answer + create mode 100644 tests/test3-data/05.input + +diff --git a/src/poptparse.c b/src/poptparse.c +index f405081..c2a5435 100644 +--- a/src/poptparse.c ++++ b/src/poptparse.c +@@ -139,7 +139,6 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + char * p; + char * q; + char * x; +- size_t t; + size_t argvlen = 0; + size_t maxlinelen = sizeof(line); + size_t linelen; +@@ -186,9 +185,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + if (*q == '\0') { + /* single command line option (ie, no name=val, just name) */ + q[-1] = '\0'; /* kill off newline from fgets() call */ +- argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1); ++ argvlen += ((size_t)(q - p)) + (sizeof(" --")-1); + if (argvlen >= maxargvlen) { +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; + argstr_tmp = realloc(argstr, maxargvlen); + if (argstr_tmp == NULL) { + free(argstr); +@@ -218,10 +217,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp, + *x = '\0'; /* null out last char if space (including fgets() NL) */ + + /* rest of line accept */ +- t = (size_t)(x - p); +- argvlen += t + (sizeof("' --='")-1); ++ argvlen += ((size_t)(x - p) + sizeof("' --='")-1); + if (argvlen >= maxargvlen) { +- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2; ++ maxargvlen = argvlen * 2; + argstr_tmp = realloc(argstr, maxargvlen); + if (argstr_tmp == NULL) { + free(argstr); +diff --git a/tests/test3-data/05.answer b/tests/test3-data/05.answer +new file mode 100644 +index 0000000..37b7fb8 +--- /dev/null ++++ b/tests/test3-data/05.answer +@@ -0,0 +1,5 @@ ++single string: ' --aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa --bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' ++popt array: size=2 ++'--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' ++'--bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' ++ +diff --git a/tests/test3-data/05.input b/tests/test3-data/05.input +new file mode 100644 +index 0000000..2508292 +--- /dev/null ++++ b/tests/test3-data/05.input +@@ -0,0 +1,2 @@ ++aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ++bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb +diff --git a/tests/testit.sh b/tests/testit.sh +index 26724d6..4078f51 100755 +--- a/tests/testit.sh ++++ b/tests/testit.sh +@@ -179,6 +179,7 @@ fi + run_diff test3 "test3 - 1" test3-data/01.input test3-data/01.answer + run_diff test3 "test3 - 2" test3-data/02.input test3-data/02.answer + run_diff test3 "test3 - 3" test3-data/03.input test3-data/03.answer ++run_diff test3 "test3 - 5" test3-data/05.input test3-data/05.answer + + echo "" + echo "Passed." diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb index b1d8bea790e..c8b4875c1b7 100644 --- a/meta/recipes-support/popt/popt_1.19.bb +++ b/meta/recipes-support/popt/popt_1.19.bb @@ -10,6 +10,7 @@ DEPENDS = "virtual/libiconv" SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \ file://run-ptest \ + file://CVE-2026-18743.patch \ " SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9" From patchwork Sat Oct 31 00:14:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102536 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3728.1793405752602013862 for ; Fri, 30 Oct 2026 17:15:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=O8BUTfkA; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so12080795e9.1 for ; Fri, 30 Oct 2026 17:15:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405751; x=1794010551; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=IEoqv/flZTgcJrHxa8wd0QKNRtqfCcxDu7Q2ziNK6Js=; b=O8BUTfkAwKkGyCBex+jtkyrxb40WqSuIgXPAdQCz/OqCtrCu8tBn0MwvuefndUOq5o P7ja43YN8rcwxt9szJBym0GaXduu5CTdyM5RQ4IwlRE830WcaqPTIWsgCgxv2057QNwl 8G/zCudzyqsCz3rGgOm+vqsHosM/xgTkBMAvypaNU95zYKOxzwebMKCLhua4ax6y6DWa jg/eYTzsHEvu6qinJw4/rsRttOy/TnboyeWbOQkeoNsgeN6i0DFVn111w/mPYrPOUFPP oBjX18vnrSFXc0tFbOCi3kxrOzaF4VjDKLCLM86MaBso9xkANAsrphsd3gaRDMXhtT+3 TGew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405751; x=1794010551; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=IEoqv/flZTgcJrHxa8wd0QKNRtqfCcxDu7Q2ziNK6Js=; b=TFt2p6q2jNAhByjqI5K+yVFYPAozyMsmHTwVtq5pJzL2eC6wvFiHoJ87qpXV01gP4V gMh7O1wHrohUtvh2sbUdQt9yzSzZBBD6fGFxIg6ZuS+Hb2dh6OdMd0vGwn7CvRe94q3J eoapJrd17Vq+Qv7kztNw6u/UtG0qFPP2l5E0K3c9cJV1iPg3ADepQttUlSilpIICynxR JmcPfAVEw7ZLW67pqva7dLa7eHsxJxT6/OQhiju75Ht3UUYYfv1gyari3aKDopTMMDLV WkXD+izbhm0TUBld/QOAx4uolQydLv9fwo7M1vaRaG9GSDv2yNx7724pXG+ZIb/3pNqt EPkA== X-Gm-Message-State: AFq9FYIJB1zCRyYlWEQvMNtUg+MB0v/+re/n+lruWEblLOyhe6TCNh6i pDBbf/4X41vKr0k53xPvEQBUP2Dq+j9oNKY217yvNsKg1aJyqwbFTSbUc6KN9o3zEZlHJfiODFt J0KOAj6I= X-Gm-Gg: AYBFou35esNaInoOcvEG75uyZgDzDj6qw4N2sjRzCAaVoB49kdILYgaBVoA7F9mdpsP SjMt3KVn6k957FflK2+OTZRN9GdiYQFG+cg3DAEUWtpNc+OUpLDb3LkZk9jQE+VrsBjRfKAR3EZ Vj9U/xmpy6c+H2U2KBzCjf6Sw5amG5516Dh+SdraUJcRLfARG7G6Md/fFUS+PanpMSzJ/WBahCN zaV9qkBQRKrh+u+F6a7ur+K/x4/GcFTRxJJnh0wOr37Qk/ssJZIIpi2/iYY9C81BahVe+s5z+Lu dO1Ul7AGuV/ZvZEwZzwEYflR0TQbwSqCJQ9jHbJ+sbdZVDhZ6nEIjRzc1ikWFhHa8YBRrBtrRlP GKcvbMjeZOWllPrK9M2xPDTicBs1PRzjpRJ0bZvQBy4qoyciSiWYykvxXV8aNdu/fdBUoh+jlXi HZJsZ4I2GDDJGsAeav6gnV9dL9pLHQxusrMCDZ98pOVO1E5h7iGRalSvpGFSEzRMQHtCfNd/FAR M2MsGS4ePM/vRV7ff2UeQWJ4LAQ7pq84wGdkUx82IBeyvrSvx8cFARz/kRLZ6o9ScBTsuDZyBIC SNv70leUJ2c2JYhJ/efSkUse8dpWylAes/xbdnH7po+R/WP67YuRMvcUkkUS+752Qn8TVD65HyS kymc3wkuV4bu5INnfVw1oodch0i8M X-Received: by 2002:a05:600c:1c0f:b0:4a1:ac66:6059 with SMTP id 5b1f17b1804b1-4ac19233381mr84069795e9.26.1793405750822; Fri, 30 Oct 2026 17:15:50 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:50 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 13/55] popt: patch CVE-2026-18739 Date: Sat, 31 Oct 2026 01:14:34 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249088 From: Peter Marko Pick patch referencing this CVE. Convert change in cmake file to autotools/makefile. Install the new test in recipe. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit c211972ad21e1801abc7dd15951093316c5528f4) Signed-off-by: Yoann Congal [YC: backport translated cmake to automake (the project migrated in between) ] --- .../popt/popt/CVE-2026-18739.patch | 92 +++++++++++++++++++ meta/recipes-support/popt/popt_1.19.bb | 2 + 2 files changed, 94 insertions(+) create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18739.patch diff --git a/meta/recipes-support/popt/popt/CVE-2026-18739.patch b/meta/recipes-support/popt/popt/CVE-2026-18739.patch new file mode 100644 index 00000000000..0a1e8f35907 --- /dev/null +++ b/meta/recipes-support/popt/popt/CVE-2026-18739.patch @@ -0,0 +1,92 @@ +From 14c42b415ba0c11640f7d4ee80920452d0287058 Mon Sep 17 00:00:00 2001 +From: Yao Zhang <294772273@qq.com> +Date: Wed, 5 Aug 2026 14:52:10 +0800 +Subject: [PATCH] Fix CVE-2026-18739: off-by-one error in poptStuffArgs() + +The poptStuffArgs function only checks whether (con->os - con->optionStack) +is equal to POPT_OPTION_DEPTH (10) before incrementing con->os, and does +not increment the value by 1 to perform boundary pre-checking, as +handleAlias does. + +Add a new test program as a reproducer for this case. + +Co-authored-by: Panu Matilainen + +Fixes: CVE-2026-18739 + +CVE: CVE-2026-18743 +Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/14c42b415ba0c11640f7d4ee80920452d0287058] +Signed-off-by: Peter Marko +--- + src/popt.c | 2 +- + tests/Makefile.am | 5 ++++- + tests/testit.sh | 2 ++ + tests/tstuff.c | 17 +++++++++++++++++ + 4 files changed, 24 insertions(+), 2 deletions(-) + create mode 100644 tests/tstuff.c + +diff --git a/src/popt.c b/src/popt.c +index 9ea3dfe..458aadc 100644 +--- a/src/popt.c ++++ b/src/popt.c +@@ -1668,7 +1668,7 @@ int poptStuffArgs(poptContext con, const char ** argv) + int argc; + int rc; + +- if ((con->os - con->optionStack) == POPT_OPTION_DEPTH) ++ if ((con->os - con->optionStack + 1) == POPT_OPTION_DEPTH) + return POPT_ERROR_OPTSTOODEEP; + + for (argc = 0; argv[argc]; argc++) +diff --git a/tests/Makefile.am b/tests/Makefile.am +index c410389..99fbf64 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -11,7 +11,10 @@ EXTRA_DIST = testit.sh \ + + AM_CPPFLAGS = -I. -I$(top_srcdir)/src + +-noinst_PROGRAMS = test1 test2 tdict test3 ++noinst_PROGRAMS = test1 test2 tdict test3 tstuff ++tstuff_SOURCES = tstuff.c ++tstuff_LDFLAGS = ++tstuff_LDADD = $(top_builddir)/src/libpopt.la + test1_SOURCES = test1.c + test1_LDFLAGS = + test1_LDADD = $(top_builddir)/src/libpopt.la +diff --git a/tests/testit.sh b/tests/testit.sh +index 4078f51..d26be3a 100755 +--- a/tests/testit.sh ++++ b/tests/testit.sh +@@ -172,6 +172,8 @@ run test1 "test1 - 61" "" -x=f1 + + run test1 "test1 - 62" "arg1: 0 arg2: (none) aInt: 1" --randint=-1 + ++run tstuff "tstuff - 1" "-13" ++ + if ! [ -e test3-data ]; then + # create symlink for running during 'make distcheck' + ln -s "${srcdir}/test3-data" test3-data +diff --git a/tests/tstuff.c b/tests/tstuff.c +new file mode 100644 +index 0000000..b820c7b +--- /dev/null ++++ b/tests/tstuff.c +@@ -0,0 +1,17 @@ ++#include ++#include ++ ++int main(int argc, char *argv[]) ++{ ++ poptContext ctx = poptGetContext(argv[0], argc, (const char **)argv, NULL, 0); ++ int rc = 0; ++ for (int i = 0; i < 100; ++i) { ++ const char *ea[] = { "a", NULL }; ++ if ((rc = poptStuffArgs(ctx, ea))) ++ break; ++ } ++ printf("%d\n", rc); ++ ++ poptFreeContext(ctx); ++ return rc; ++} diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb index c8b4875c1b7..18cc4f2867d 100644 --- a/meta/recipes-support/popt/popt_1.19.bb +++ b/meta/recipes-support/popt/popt_1.19.bb @@ -11,6 +11,7 @@ DEPENDS = "virtual/libiconv" SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \ file://run-ptest \ file://CVE-2026-18743.patch \ + file://CVE-2026-18739.patch \ " SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9" @@ -25,6 +26,7 @@ do_compile_ptest() { do_install_ptest() { install ${B}/tests/.libs/test* ${D}/${PTEST_PATH} install ${B}/tests/.libs/tdict ${D}/${PTEST_PATH} + install ${B}/tests/.libs/tstuff ${D}/${PTEST_PATH} install ${B}/tests/testit.sh ${D}/${PTEST_PATH} install ${B}/tests/test-poptrc ${D}/${PTEST_PATH} } From patchwork Sat Oct 31 00:14:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102535 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3734.1793405753130271752 for ; Fri, 30 Oct 2026 17:15:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=dasdQZqE; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4a7992e2f7dso13600865e9.3 for ; Fri, 30 Oct 2026 17:15:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405751; x=1794010551; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Iqc2vzaQIzK+nfRbs2eMIBbk2tfwKCYAmM3CG1oCDO0=; b=dasdQZqELBRaFkwYbfvkeYdEgPIRcqsiGAoFTuBs3RUTITwUcTAIJJjjkDkQyNj11a m+uxzEQHiG+9fqZmjqI4xftOblWSUvzBCT2NdlWRbhdxAekE7Gjcg5BaSPJGxvUo4c65 2V+YX9cQKeDqKLOrTI2vi9y6tF6DLoyQilY069ZFOVIU+uJhC6uHxbwZWmZHbzKouYiO h3QLK8bowCIkpkQE+N70fxVJCLc83H4T5Gk+lVRuvnYa3lSAYDDSnYx7yHo44dYpHAhm /yL8BEBwgqxYr5/+5j170a1Lv/zGfDayjwOuwEXzgzyPes4eEXm8M2whRTkMx+iKZHwM eX1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405751; x=1794010551; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Iqc2vzaQIzK+nfRbs2eMIBbk2tfwKCYAmM3CG1oCDO0=; b=IiqJUY7Ll6Ol2ZEVB//3vMArnBtgZgpDqeDM5dKRVddVCsOGIJiKeQxEUlliaQEAYo vbrNZ6kRscB6iUK2UOzJ8SdHCMvcN8dGc+ndJM8ISsADcr6hFJm2cqgQ9H0KxOzTtBMC 2TF0QeGXyqWQsBIGJVY3hohUJvYO7pC3SFj3IsDiWPvUmAxx5oi6Ta0o3mbDlmRXl9JI lOFoxDOPVwpcxJh227Ucoqvy8e/JMf6JDelzffsrW9AQLnyBwx6xQ73zYMAV3zI9BesF UZS99RAOmvmpguaGvPgMjkfJ5l1pUkux0PnD6Vw1+scdu8UoR4bhjD5gnR92vdW/NQcJ FbmQ== X-Gm-Message-State: AFq9FYIiJsaPBgOfh8nILulZAa+NDmuiB17ISm/ZtnVD3gd5FWFDRkR7 J4dJ6M4dK4p3laege2AzmzlMOdiOqJEQ5G6bfVDPT3XY8mttjf2z9eiL6/hFmXpMVFeS18A/PO1 y/xexTWA= X-Gm-Gg: AYBFou1A9tX/1LqgdPE6w/hLDvGWCux3CgdMfjqiPbkX9WXv5CO90BGDViog1k4dlT4 lsafWRwwEftuLeiqwQi8tNdJ0/MitL3mlOJAs71lWCPSY2jp7OGdQ+03ovmYK257D4uagozjs4J g3uGsI+1vw6oGYcBhUAzClNQuqV7rSthSl5LdIUnozsgEmnmbecaiXvaWag4MsmakACISUjmHdW grDVsl5P2WW43HG5th8OmE0vrnc4Oy0Omfy1fu9k31/PYTT77vmHg28NN5OHIYLX7vQvcrVk1g1 TNk+Q9zsXP6ckJJDQzuLcb75gcRkNmSaTv4nrijV/nqiUOfYxrTX1JqlwDJi8OtI1nV4RSd0V3W B1mnRiwbXPMLsfwhfL5QIE7pPWR9b+sI+eV3n2L2ZlLHO5Rq2X99uVfmdQj0Sr/+ky1o/KMfgr0 c3b5TyPPqTVrGon5yVcL/jVEIhSCJXLIKvI0xSQuOgLgSamI9HSk2ssYEtgqrKY1CREZjibL8Yj LK6Zy0oimEDlDw9UuWL4gK7PX3wuqbIRMme+/8m5IUpRY0jhfs/EJe4ZLjISB1nd/NVgVLU8o3h 308Kq/pOJYogoSA65Wb0KsNwb5kkvJ6uEGYDId4f7s5vZL5Gp58Rc01a1bwfVRqzpIk81oLJrkq DnXXshIC9Jz9FNm4eboxo/C3HmRvUVyOJQ7s31hm2imZyN/zhTQ== X-Received: by 2002:a05:600c:698d:b0:4a2:994:575c with SMTP id 5b1f17b1804b1-4ac185bcc4emr86567795e9.34.1793405751332; Fri, 30 Oct 2026 17:15:51 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:50 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 14/55] glib-2.0: patch CVE-2026-15588 Date: Sat, 31 Oct 2026 01:14:35 +0100 Message-ID: <9e99d78d51d56e29a55009d7fb2812568ea0aa9e.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249089 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-15588 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../glib-2.0/glib-2.0/CVE-2026-15588.patch | 267 ++++++++++++++++++ meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 1 + 2 files changed, 268 insertions(+) create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch new file mode 100644 index 00000000000..e5ff0e87d36 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch @@ -0,0 +1,267 @@ +From 4235f7b42ba51d6fdb4abd7c4276031802f39834 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Sat, 4 Jul 2026 18:13:08 +0100 +Subject: [PATCH] gdbusauth: Limit length of lines read from client +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The client isn’t trusted at this point, and there was previously nothing +limiting how long a line `GDBusAuth` would read. So an untrusted client +could exhaust the server’s memory by sending anything except `\r\n`. + +Fix that by applying a reasonably length limit when reading a line, and +add a unit test. + +Spotted by Gitee Codepecker Lab. + +Signed-off-by: Philip Withnall +Fixes: #3985 + +CVE: CVE-2026-15588 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/4235f7b42ba51d6fdb4abd7c4276031802f39834] +Signed-off-by: Peter Marko +--- + gio/gdbusauth.c | 44 +++++++++++++++ + gio/tests/gdbus-auth.c | 119 +++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 163 insertions(+) + +diff --git a/gio/gdbusauth.c b/gio/gdbusauth.c +index 9e31c8318..a5938c969 100644 +--- a/gio/gdbusauth.c ++++ b/gio/gdbusauth.c +@@ -262,6 +262,21 @@ find_mech_by_name (GDBusAuth *auth, + return ret; + } + ++static size_t ++get_longest_mechanism_name_length (GDBusAuth *auth) ++{ ++ size_t len = 0; ++ ++ for (GList *l = auth->priv->available_mechanisms; l != NULL; l = l->next) ++ { ++ Mechanism *m = l->data; ++ ++ len = MAX (len, strlen (m->name)); ++ } ++ ++ return len; ++} ++ + GDBusAuth * + _g_dbus_auth_new (GIOStream *stream) + { +@@ -270,6 +285,20 @@ _g_dbus_auth_new (GIOStream *stream) + NULL); + } + ++/* Arbitrarily chosen limit on the length of a DATA command payload, to prevent ++ * unbounded reads from malicious clients. ++ * ++ * - The ANONYMOUS mechanism doesn’t use DATA. ++ * - The EXTERNAL mechanism just uses it to transfer a decimal-encoded UID. ++ * - The DBUS_COOKIE_SHA1 mechanism transfers a challenge and a SHA1 hash. The ++ * hash is bounded in length, but the challenge is not, so could potentially ++ * hit this limit. It doesn’t seem unreasonable to bound the challenge to ++ * ~4KB though. GDBus itself generates a 16 byte challenge. ++ * ++ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-command-data ++ */ ++#define MAX_DATA_PAYLOAD_LENGTH_BYTES 4096 ++ + /* ---------------------------------------------------------------------------------------------------- */ + /* like g_data_input_stream_read_line() but sets error if there's no content to read */ + static gchar * +@@ -307,6 +336,7 @@ _my_g_data_input_stream_read_line (GDataInputStream *dis, + */ + static gchar * + _my_g_input_stream_read_line_safe (GInputStream *i, ++ size_t max_line_length, + gsize *out_line_length, + GCancellable *cancellable, + GError **error) +@@ -316,11 +346,22 @@ _my_g_input_stream_read_line_safe (GInputStream *i, + gssize num_read; + gboolean last_was_cr; + ++ g_assert (max_line_length <= SIZE_MAX - 2); ++ + str = g_string_new (NULL); + + last_was_cr = FALSE; + while (TRUE) + { ++ if (str->len >= max_line_length + 2 /* allow for \r\n */) ++ { ++ g_set_error_literal (error, ++ G_IO_ERROR, ++ G_IO_ERROR_FAILED, ++ _("Malformed D-Bus authentication line")); ++ goto fail; ++ } ++ + num_read = g_input_stream_read (i, + &c, + 1, +@@ -1073,6 +1114,7 @@ _g_dbus_auth_run_server (GDBusAuth *auth, + case SERVER_STATE_WAITING_FOR_AUTH: + debug_print ("SERVER: WaitingForAuth"); + line = _my_g_input_stream_read_line_safe (g_io_stream_get_input_stream (auth->priv->stream), ++ strlen ("AUTH ") + get_longest_mechanism_name_length (auth) + strlen (" ") + MAX_DATA_PAYLOAD_LENGTH_BYTES, + &line_length, + cancellable, + error); +@@ -1294,6 +1336,7 @@ _g_dbus_auth_run_server (GDBusAuth *auth, + case SERVER_STATE_WAITING_FOR_DATA: + debug_print ("SERVER: WaitingForData"); + line = _my_g_input_stream_read_line_safe (g_io_stream_get_input_stream (auth->priv->stream), ++ strlen ("DATA ") + MAX_DATA_PAYLOAD_LENGTH_BYTES, + &line_length, + cancellable, + error); +@@ -1336,6 +1379,7 @@ _g_dbus_auth_run_server (GDBusAuth *auth, + case SERVER_STATE_WAITING_FOR_BEGIN: + debug_print ("SERVER: WaitingForBegin"); + line = _my_g_input_stream_read_line_safe (g_io_stream_get_input_stream (auth->priv->stream), ++ MAX (strlen ("BEGIN"), strlen ("NEGOTIATE_UNIX_FD")), + &line_length, + cancellable, + error); +diff --git a/gio/tests/gdbus-auth.c b/gio/tests/gdbus-auth.c +index 657571be3..3323d6eeb 100644 +--- a/gio/tests/gdbus-auth.c ++++ b/gio/tests/gdbus-auth.c +@@ -263,6 +263,124 @@ temp_dbus_keyrings_teardown (void) + g_unsetenv ("G_DBUS_COOKIE_SHA1_KEYRING_DIR_IGNORE_PERMISSION"); + } + ++static void ++async_result_cb (GObject *obj, ++ GAsyncResult *result, ++ void *user_data) ++{ ++ GAsyncResult **result_out = user_data; ++ ++ g_assert (result_out != NULL); ++ g_assert (*result_out == NULL); ++ ++ *result_out = g_object_ref (result); ++ g_main_context_wakeup (g_main_context_get_thread_default ()); ++} ++ ++static gboolean ++server_new_connection_unexpected_cb (GDBusServer *server, ++ GDBusConnection *connection, ++ void *user_data) ++{ ++ g_assert_not_reached (); ++ return FALSE; ++} ++ ++static void ++test_auth_server_read_limit (void) ++{ ++ GDBusServer *server = NULL; ++ unsigned long new_connection_id = 0; ++ const char *server_address; ++ GIOStream *client_stream = NULL; ++ GOutputStream *client_output_stream; ++ GInputStream *client_input_stream; ++ GAsyncResult *result = NULL; ++ char *write_buffer = NULL; ++ char read_buffer[100]; ++ ssize_t read_len; ++ size_t bytes_written; ++ GError *local_error = NULL; ++ ++ g_test_summary ("Test that GDBusServer limits the lengths of reads it does during auth from a client"); ++ g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/3985"); ++ ++ server = server_new_for_mechanism (NULL); ++ ++ new_connection_id = g_signal_connect (server, ++ "new-connection", ++ G_CALLBACK (server_new_connection_unexpected_cb), ++ NULL); ++ server_address = g_dbus_server_get_client_address (server); ++ g_dbus_server_start (server); ++ ++ /* Start connecting as a client */ ++ g_dbus_address_get_stream (server_address, NULL, async_result_cb, &result); ++ ++ while (result == NULL) ++ g_main_context_iteration (NULL, TRUE); ++ ++ client_stream = g_dbus_address_get_stream_finish (result, NULL, &local_error); ++ g_assert_no_error (local_error); ++ g_clear_object (&result); ++ ++ /* Send an over-long AUTH line, maliciously */ ++ client_output_stream = g_io_stream_get_output_stream (client_stream); ++ client_input_stream = g_io_stream_get_input_stream (client_stream); ++ ++ write_buffer = g_strdup_printf ("AUTH DBUS_COOKIE_SHA1 context%0*d 123 456\r\n", 5000, 0); ++ ++ g_output_stream_write_all_async (client_output_stream, ++ write_buffer, ++ strlen (write_buffer), ++ G_PRIORITY_DEFAULT, ++ NULL, ++ async_result_cb, ++ &result); ++ ++ while (result == NULL) ++ g_main_context_iteration (NULL, TRUE); ++ ++ g_output_stream_write_all_finish (client_output_stream, result, &bytes_written, &local_error); ++ g_assert_no_error (local_error); ++ g_assert_cmpuint (bytes_written, ==, strlen (write_buffer)); ++ g_clear_object (&result); ++ ++ g_clear_pointer (&write_buffer, g_free); ++ ++ /* Authentication should have been rejected, so reading or writing the stream ++ * should now fail. */ ++ read_len = g_input_stream_read (client_input_stream, ++ read_buffer, ++ sizeof (read_buffer), ++ NULL, ++ &local_error); ++ g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED); ++ g_assert_cmpint (read_len, <, 0); ++ g_clear_error (&local_error); ++ ++ write_buffer = g_strdup_printf ("AUTH\r\n"); ++ ++ g_output_stream_write_all (client_output_stream, ++ write_buffer, ++ strlen (write_buffer), ++ &bytes_written, ++ NULL, ++ &local_error); ++ g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED); ++ g_assert_cmpuint (bytes_written, ==, 0); ++ g_clear_error (&local_error); ++ ++ g_clear_pointer (&write_buffer, g_free); ++ ++ /* Cleanup */ ++ g_clear_object (&client_stream); ++ g_dbus_server_stop (server); ++ ++ g_clear_signal_handler (&new_connection_id, server); ++ g_clear_object (&server); ++} ++ + /* ---------------------------------------------------------------------------------------------------- */ + + int +@@ -282,6 +400,7 @@ main (int argc, + g_test_add_func ("/gdbus/auth/server/ANONYMOUS", auth_server_anonymous); + g_test_add_func ("/gdbus/auth/server/EXTERNAL", auth_server_external); + g_test_add_func ("/gdbus/auth/server/DBUS_COOKIE_SHA1", auth_server_dbus_cookie_sha1); ++ g_test_add_func ("/gdbus/auth/server/read-limit", test_auth_server_read_limit); + + /* TODO: we currently don't have tests for + * diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb index 70b0b74e881..62f173739cf 100644 --- a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb +++ b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb @@ -58,6 +58,7 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \ file://CVE-2026-58015_p2.patch \ file://CVE-2026-58015_p3.patch \ file://CVE-2026-58015_p4.patch \ + file://CVE-2026-15588.patch \ " SRC_URI:append:class-native = " file://relocate-modules.patch \ file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \ From patchwork Sat Oct 31 00:14:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102537 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3729.1793405753647171297 for ; Fri, 30 Oct 2026 17:15:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=ZhGprU6k; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a59100fa83so11378695e9.0 for ; Fri, 30 Oct 2026 17:15:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405752; x=1794010552; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=woSSST5LOCghFpNyZ439dxnsEY2dgR2ZdUm9Qe1axn8=; b=ZhGprU6kxrC5yATi58cN6U3DeDyNN37Yp2fA8IlAi4ZE+YZz//ThvbDVJvHQUBGd9s S43Jysy87JQZf3aXzhJcz+B0RVXoaM5UptJ0ODAdHpQAUluX93PdmgjRZ5EdfbzGC4pf rans34hld0IpXEULEWOYvKO4DyQ4Ls1l1qO8ujD4AuMU0BF7zJJJEc/H+3wIKFrbtzzB poCO2747yjs6yrmyqwMiDDeMXzHpo3LL6jOJac4RaDhPlimir3ZnWPCbaYBplwAakrMO b14WLvlnB4a5PrtBxcgs50J9PLW6HVPBWMUANpjK5qvHrwETZ6gXfbrRTRnXlMte2/6U o/MQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405752; x=1794010552; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=woSSST5LOCghFpNyZ439dxnsEY2dgR2ZdUm9Qe1axn8=; b=gIJhv6x/2JS7dQLjgWqOUAkYOTroV+S0tNz0PIbprfxp7zaisUtVzPAiy34+4bjFZG 3iNWQSZ60uM8Dn6i4F5Sp6mGkwVF21wVkLgrWevBGsfaw0pdl6ZMd6Wn/YYzhfPLBi5q 2YVR8u27bXYSPm5bqeafHcPG7xjWY0eER9MF5Fmn7EtbQW1UN9W44DkHcYh7UvlE1wi5 fC8jNWd8yWsg2/BmBWMjJ28E+DPJIq0XorfMJK3ThTtxO1Ho+mxnM7gKcmzW0k2IPrRP NSb37Q5ENBGL1cVD8uPqz0UZEPViDsX/X5rexGg/FHrGhY9SGmTuwsdp/2QpRwMsQM8u i6Hg== X-Gm-Message-State: AFq9FYKyvlGdlmy0jd0s/8HOAgUJR8IWlJY18t6+BLLE19ZmzIqKMXBF hq87gQ0+ub579A/pC4AiQRalDMfzggoU+zovb8+o50LYYz1eWBXZgpa3UWfl2FvHQfgTuh+o/X4 DlLP5pt8= X-Gm-Gg: AYBFou3aCOIChQtsPYd9x4YjExJ/SspZYgiuiktqoJ+hUo1fbghIE71GBAG+nUAx3ia YrtOJF+9j2Ug+g6QyLKomsEb72DtR0SlyylMYDp1UgDbp/seLVhOKgNSaZ/phq0E0/ZR4sRlXu/ EOdI5hfbH1fMDD6Ve0GRhzE1udNnYtQf7KOJSXf5nBS5SxDiFUvGwV0XTK4+Tff1HuyB+KnobsX tAXTWuRpHSOXQOU5p7sm/f7lCZ1bGSQvxrceHYXQZnoWdASSmZqg3/+/Wi08lHCNnO9MfmQJMPS l92N+IKNA+2T3h1FNHM6sY9zvdu0vOUA65mi/5h9qDwWqiOY6RAp3vUfq9G9Tcqk9sX3Daugjis iZJm18kApC8WQSIB5PeXnh/6J+HLGN2iywhKJo/2hB/IXOyAN24rx9nBGiuExy8ew57/ls2a0YR prWV8Wk2Rh01aonEmrZcYZIitVD65RoN80tXT7llGExj5nJuGY7QyiEuve6+2tG/gkptHLR0NPu ZgWOmnIu5qV0+i2WIFW29hOqI12Sqnw+aaOBj5zNJaYQHQg4+NihGvE7yS3qWBdYz2p6ewRJ7xF vkcvkceO6FepExffdt7cCFbihgVU95ttTC9yQNKKYcv8V/xVnviReNrr4JdX1XIZQjKPJGer88B 6xh/wa4FfjfQDyJiBEzICyZbcRag3 X-Received: by 2002:a05:600c:4ece:b0:4a2:40:8d2c with SMTP id 5b1f17b1804b1-4ac17b2c396mr84373325e9.26.1793405751908; Fri, 30 Oct 2026 17:15:51 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:51 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 15/55] glib-2.0: patch CVE-2026-16118 Date: Sat, 31 Oct 2026 01:14:36 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249090 From: Peter Marko Pick patch referencing this CVE. Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../glib-2.0/glib-2.0/CVE-2026-16118.patch | 48 +++++++++++++++++++ meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch new file mode 100644 index 00000000000..72a387079e0 --- /dev/null +++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch @@ -0,0 +1,48 @@ +From ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5 Mon Sep 17 00:00:00 2001 +From: Kashyap Ekbote +Date: Wed, 5 Aug 2026 20:50:10 +0530 +Subject: [PATCH] Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c + +Fix out-of-bounds write in the byte-swap routine of +_xdg_mime_magic_parse_magic_line(). On little-endian systems, the +write side of the swap casts the base pointer to a wider type before +adding the byte offset, causing pointer arithmetic to scale by +sizeof(type) instead of 1. With value_length=4 and word_size=2, the +loop writes 2 bytes past the allocated matchlet->value buffer at i=2. + +Parenthesize (ptr + i) before the cast so both the read and write +sides use byte offsets. + +Upstream: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41 + +CVE: CVE-2026-16118 +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5] +Signed-off-by: Peter Marko +--- + gio/xdgmime/xdgmimemagic.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/gio/xdgmime/xdgmimemagic.c b/gio/xdgmime/xdgmimemagic.c +index 98a1274c8..fe374eb4e 100644 +--- a/gio/xdgmime/xdgmimemagic.c ++++ b/gio/xdgmime/xdgmimemagic.c +@@ -483,15 +483,15 @@ _xdg_mime_magic_parse_magic_line (FILE *magic_file, + for (i = 0; i < matchlet->value_length; i = i + matchlet->word_size) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->value + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); ++ *((xdg_uint16_t *) (matchlet->value + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->value + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); ++ *((xdg_uint32_t *) (matchlet->value + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i))); + if (matchlet->mask) + { + if (matchlet->word_size == 2) +- *((xdg_uint16_t *) matchlet->mask + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); ++ *((xdg_uint16_t *) (matchlet->mask + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i))); + else if (matchlet->word_size == 4) +- *((xdg_uint32_t *) matchlet->mask + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); ++ *((xdg_uint32_t *) (matchlet->mask + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i))); + + } + } diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb index 62f173739cf..c63b276fd6b 100644 --- a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb +++ b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb @@ -59,6 +59,7 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \ file://CVE-2026-58015_p3.patch \ file://CVE-2026-58015_p4.patch \ file://CVE-2026-15588.patch \ + file://CVE-2026-16118.patch \ " SRC_URI:append:class-native = " file://relocate-modules.patch \ file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \ From patchwork Sat Oct 31 00:14:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102538 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3735.1793405754170704080 for ; Fri, 30 Oct 2026 17:15:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=LmovmGEj; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a20bdaf39cso15320205e9.1 for ; Fri, 30 Oct 2026 17:15:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405752; x=1794010552; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=SoR6UsStZxwrxptAfix40IhdIqpTGd9V1rNo1g4o3hk=; b=LmovmGEj49tcXhWF7l3sfsEHXxOP0xDM5dKC5dRVq57hI2shKu4L2A1sMRv5qvEiON w1Apl6nIiZIosPSsBZmVdDc3fVXzX3r8zHzuXD/O6OZtlu/U7/ExRJig3vmYGSbBN0Wg ocDqxOb2+1R7nVxywxQ2w4UAlzFAdZ/Q2zRCp+0TxayGnbM5jxccpPmQL7MpB5XtNQYS dOxQtWZ4RTN+cGhwDe1Vxv1sAUxaiLErWLjxeNo3qqYOKDPFe/Zsf0d5gfvyLzpD2Qqt tCx+PWqlkbLvb5JS0fH3rnPnql5NcaUF4gGINO7XuaDtm1Foplu1mBeqCLvx21sPeN/H EQRw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405752; x=1794010552; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=SoR6UsStZxwrxptAfix40IhdIqpTGd9V1rNo1g4o3hk=; b=q9R2I93RwmC0ODqhEPdN7gAcwZB+UqRr/0NK0oPI/HSR9Z0FLMxaWgEhG1jVXbmf8v wFmMIRAle6n0yFRK/jBOhd2cvMEVj4yqRDjdeBWfi6OqH6/Xx7ha28KHnurVNTzWJd6w Uilys1uw5XeR7Sm4RFvW6BfC17QKNdZVos1qdKlCn8KkdigCL5q2lfgKLjIiV5H0x9j5 T7+f6WXoJphT3eJDbkJYvGY4ZhGOISYAcXM2nTax875esG0ElkbLHbr/LgjTiUVbkKMM Lt/3MjoBKbMBzQOJMeJiG24S2LwQlstIw4D3XzQjrSO4ASdjCAI/vSPiYmUfDm1HxpW1 u/8A== X-Gm-Message-State: AFq9FYLK23ZVZ0TQ+vXvDoCy/c7t04f7DNL34zC9Dy85As2fAAU/zxF5 mzBj//5gKbUSiFpMHu+Oj2BlI92NATWW2fPwpdU2MVAZH+GHO4QmEta76DJh/hYciNqFxTVxW83 JU7LeEN0= X-Gm-Gg: AYBFou3rCRVMLPZjs0ekkLj9fOu+67g088zr2MfzDW1wXvgm7TzvO88+JGgGi824eK/ 4jGxC05zqqWx51JERnSIFUt0p7nEMYrALoUyC9ZzVZ53xcf8VWdyNzBMRcNI50A2j7GDF3wo1Mi xRK+XiuKRuHx/ogb6MdAhKt51g8vMeIhMgFHCw71jDymZbO6uE+hPmS2uIQktyoZCwAdcxve/uq xzm2Ek0kZR2dKbOHv25UjgLgiVXnRuSqYMXxr+d34T4W/xfaHM4hk4p5FQ/rbLkV5GhhNysmI0Z EF6Sqn0dSTBCU/GRHPnlJqJPKga0vEJ+tNwg0AMqYDsJPWAEVuWtdtjgIn1xCAcxUVI0yg6KwTR bJ1kR41uBIJKdn8IuXQTxLBTOL2kCB3QGa3URFm0cVXr/q8LaBGNNqXynnDB97yU8VtZvUbT1zp Nmh++b9Ew35+zAcHAbsAZKsp7prOubA5rxt/62kgK0zzxpd/giFb+xK/jaXS6XV/Fluy2gzNNyQ JEUmb8cyx+KgkCs/vtKsKgdA//ycc9gxiyk+GwBpZvu3AFhzyyc8V73e/HKVKLPAT2DEyQFBlCv OCZ7DPUMaDokFWLnZyeUc9fjy+7vbU1CGYcAFZIsD8mHnBWpiMLE+ZKegMZ0Q1zDRKclkPP5OL/ ICsl6vMeQSLxQqvyJrU/zppYcsFHs X-Received: by 2002:a05:600c:6095:b0:4a3:7344:13b5 with SMTP id 5b1f17b1804b1-4ac182dcb98mr80336845e9.16.1793405752431; Fri, 30 Oct 2026 17:15:52 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:52 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 16/55] libpng: patch CVE-2026-46675 Date: Sat, 31 Oct 2026 01:14:37 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249091 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-46675 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../libpng/files/CVE-2026-46675.patch | 115 ++++++++++++++++++ .../libpng/libpng_1.6.42.bb | 1 + 2 files changed, 116 insertions(+) create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch new file mode 100644 index 00000000000..3af0251c553 --- /dev/null +++ b/meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch @@ -0,0 +1,115 @@ +From aa77ef38c17ab2fc1b41bec09fb973c6a386641d Mon Sep 17 00:00:00 2001 +From: Cosmin Truta +Date: Wed, 23 Sep 2026 18:30:11 +0300 +Subject: [PATCH] fix: Clear stale zstream pointers when releasing the inflate + stream + +The zstream buffer pointers and counters are all cleared on acquisition +in `png_inflate_claim`, but only `next_in` and `avail_in` were cleared +on release in `png_read_finish_IDAT`, and none were cleared on release +in the chunk decompression paths. + +If `png_read_end` is called before row reading starts, the IDAT stream +is never claimed. Previously, a leftover non-zero `avail_in` caused the +refill in `png_read_IDAT_data` to be skipped, and inflation continued +through a stale `next_in` into an input buffer that may since have been +deallocated. + +Introduce the function `png_inflate_detach_buffers` to clear the +pointers and the counters of zstream input and output buffers on both +acquisition and release. Although clearing `next_out` and `avail_out` +is not currently necessary at any call site, it makes release mirror +acquisition at a negligible cost paid once for each zlib stream. + +This is a cherry-pick of commit 6c7783b151377f591c83955e23da50991ad1a600 +from branch 'libpng18'. + +Reported-by: Ze Sheng +Reported-by: JasonHonKL + +CVE: CVE-2026-46675 +Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/aa77ef38c17ab2fc1b41bec09fb973c6a386641d] +Signed-off-by: Peter Marko +--- + pngrutil.c | 33 +++++++++++++++++++-------------- + 1 file changed, 19 insertions(+), 14 deletions(-) + +diff --git a/pngrutil.c b/pngrutil.c +index 551395168..482f0ae8d 100644 +--- a/pngrutil.c ++++ b/pngrutil.c +@@ -332,6 +332,18 @@ png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn) + } + #endif /* READ_iCCP|iTXt|pCAL|sCAL|sPLT|tEXt|zTXt|SEQUENTIAL_READ */ + ++/* Detach the zstream from the input and output buffers left by ++ * the current or a previous owner, and possibly deallocated since. ++ */ ++static void ++png_inflate_detach_buffers(png_structrp png_ptr) ++{ ++ png_ptr->zstream.next_in = NULL; ++ png_ptr->zstream.avail_in = 0; ++ png_ptr->zstream.next_out = NULL; ++ png_ptr->zstream.avail_out = 0; ++} ++ + /* png_inflate_claim: claim the zstream for some nefarious purpose that involves + * decompression. Returns Z_OK on success, else a zlib error code. It checks + * the owner but, in final release builds, just issues a warning if some other +@@ -392,13 +404,7 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner) + + #endif /* ZLIB_VERNUM >= 0x1240 */ + +- /* Set this for safety, just in case the previous owner left pointers to +- * memory allocations. +- */ +- png_ptr->zstream.next_in = NULL; +- png_ptr->zstream.avail_in = 0; +- png_ptr->zstream.next_out = NULL; +- png_ptr->zstream.avail_out = 0; ++ png_inflate_detach_buffers(png_ptr); + + if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0) + { +@@ -744,7 +750,8 @@ png_decompress_chunk(png_structrp png_ptr, + else if (ret == Z_OK) + ret = PNG_UNEXPECTED_ZLIB_RETURN; + +- /* Release the claimed stream */ ++ /* Release the claimed stream. */ ++ png_inflate_detach_buffers(png_ptr); + png_ptr->zowner = 0; + } + +@@ -1569,6 +1576,7 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) + + if (errmsg == NULL) + { ++ png_inflate_detach_buffers(png_ptr); + png_ptr->zowner = 0; + return; + } +@@ -1595,7 +1603,8 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length) + else /* profile truncated */ + errmsg = png_ptr->zstream.msg; + +- /* Release the stream */ ++ /* Release the claimed stream. */ ++ png_inflate_detach_buffers(png_ptr); + png_ptr->zowner = 0; + } + +@@ -4294,11 +4303,7 @@ png_read_finish_IDAT(png_structrp png_ptr) + */ + if (png_ptr->zowner == png_IDAT) + { +- /* Always do this; the pointers otherwise point into the read buffer. */ +- png_ptr->zstream.next_in = NULL; +- png_ptr->zstream.avail_in = 0; +- +- /* Now we no longer own the zstream. */ ++ png_inflate_detach_buffers(png_ptr); + png_ptr->zowner = 0; + + /* The slightly weird semantics of the sequential IDAT reading is that we diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb index f375aa5f4e9..8e7f9d8f8ec 100644 --- a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb +++ b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb @@ -32,6 +32,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz file://CVE-2026-34757_p1.patch \ file://CVE-2026-34757_p2.patch \ file://CVE-2026-33416-05.patch \ + file://CVE-2026-46675.patch \ " SRC_URI[sha256sum] = "c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450" From patchwork Sat Oct 31 00:14:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102540 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3736.1793405754865440322 for ; Fri, 30 Oct 2026 17:15:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=n/zo1fj9; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a208d93758so13416685e9.3 for ; Fri, 30 Oct 2026 17:15:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405753; x=1794010553; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=mhLxndRUcANw2n2B/eOX54RVFhFonUtg2tKtZhpVoMs=; b=n/zo1fj9GKQA9sse43SJTlsM+yyarG7ha4r6nBMMsQPkWCflQnlvCSS32CnZ/TkY43 iXLFgiriw44XlaKEXADgqb4sbdhbVQ3Y+rqFI0nc25tAhLgwze1RySfNLwTB2FbYitd2 UVTzEWkLIfjyh++4j++AXsSBjh6XD6zC6rqi6tGD4XPFdFC18uFkMdOhpOn6MEiSZWO3 bqENWK3+Lx9JLaPGODBaiAziM8nB+tAGGwdMCf3bizgFWYYNRK6d1+Bq6OYrdqXA0hZw ZCZUQvIsgPThNq85dHve+1vN8mpghr8y0HUdp5fqrGqH2eFkB00tXm7lKdr3DbwuPfyp 4ZcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405753; x=1794010553; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=mhLxndRUcANw2n2B/eOX54RVFhFonUtg2tKtZhpVoMs=; b=ztpQ/GiBYjXPmWtjzr5V3uRcHekQo5BAD9o55AP39SgGgSZLMAd7rzUz9SQtRbO+Kx TIsB3XOLexIIWwvxCdxZ6H/KYXpblNZDVmt0uXvHL1NAs+G0pOP5SHNWdIHkJ3xy+/EH hSc5idEjJ756Fk30WCNjpACz+4jMJ8t+SkQPJxYzxrmg4rnAAun4P4zmCs+eLtdc3Pvv FB0RKLBQ2bJvisgM2QAEwSsXbj6O/t/mEz9zWmM5RDxb+AQrpJlQqw9iXnQSHLkhW34J ASkxrv+Rcp89JrYCGq6ZHIGc2sAx4vbjJst8/mqdlnjuNJ982AP/1FnwUSxessX/T82b 7Q4w== X-Gm-Message-State: AFq9FYJWI+zyV9Q0wgcI1Yz78BK+YCM8PDNZG9lLUpbIZtNGEqtb+oup G9f2vJ2o468PMeMMnikw9uF7OmZrNyMy2LZ7+89eTTTwrjc567prfD7HGzr9XqiD73WLEr3W3Vb lDqtsqqE= X-Gm-Gg: AYBFou2v6ryBGyofBUfMASPF6k8Ox53xJb4ymF6HSOgoZpQcv01WkBurSKaI//tCedO NIq7xoSNXQzIPhpq8CtmMLGyLCPVF4D3nuZGAsPSBe0/xl0A9jHVQP89snW+bXiLfqyBCn/xpLt QV28V28mtJNDqPGQzcAabdtJjCknTizuBmxA26m3pB44nYzXCKRTAIPEEPOfZ6nDq8L7SyyHDfn p95vOX0eMokKPfupNUJCVf4Gzn8jZN0R7O3PTrfiYhmwAmrKQvFozqcUkZybDAZIWeMqHlkwwJ+ +CYW5dv/HTR0J2palT0Ud7+DsMo09U/XS5tYcc6FcwGljJODYSC9bkVbT+5cDv2W9jaC/PHNTnB yOZXpczDdt8dSvIsFcOrXfOSujq8qTVnaW1qkRoavwgm+biBsgkraw/g+R8qA62qHuBuDBeWLCT TjuavOpkyHNuPnyIthuRbbIruMhAPehmjlSCY3rb2+H52W+pr+OFoSHtGutO5XMK+w5j5fjsRsG FFvWOrQmRJ8Vceo3VYfzSlTH/EJ8O7eOZqDTIeVQ9Pj7xJGHXmvaTS56chPUBMh4hW9c40eB7f2 uiisqFUw3D1kJOgJk41WWV/gcwzbKJ0MybfvLfeBD82UOJvrdVMfUAmIsCzTXPA44XBZx4/Xr3J YmW+Mx+YWsal0iJAKewRJpvdiPNr4zJqhEPflK9CRxd8evgiuHQ== X-Received: by 2002:a05:600c:a41:b0:4a1:ac66:6ac6 with SMTP id 5b1f17b1804b1-4ac18c73d85mr81512945e9.26.1793405753054; Fri, 30 Oct 2026 17:15:53 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:52 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 17/55] go: fix CVE-2026-56862 Date: Sat, 31 Oct 2026 01:14:38 +0100 Message-ID: <55017ae457253c6f8ef3a1ae4e74be3c63c420e3.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249092 From: Benhur Tessele A malicious TLS 1.3 peer could keep sending KeyUpdate messages after the handshake completed, forcing the other side to perform key derivation indefinitely, because handshake records were always treated as state-advancing. Backport the upstream fix [1]. The bogo_config.json hunk is dropped since the BoGo test harness does not exist in Go 1.22, and the new test is adapted to use testConfig. [1] https://github.com/golang/go/commit/27420571845abc6a97e19e21542a3213a74f67f4 Signed-off-by: Benhur Tessele Signed-off-by: Yoann Congal --- meta/recipes-devtools/go/go-1.22.12.inc | 1 + .../go/go/CVE-2026-56862.patch | 98 +++++++++++++++++++ 2 files changed, 99 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-56862.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index c8fb9ef450d..cec3bbbb4ee 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -63,6 +63,7 @@ SRC_URI += "\ file://CVE-2026-32288.patch \ file://CVE-2026-27145.patch \ file://CVE-2026-39823.patch \ + file://CVE-2026-56862.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-56862.patch b/meta/recipes-devtools/go/go/CVE-2026-56862.patch new file mode 100644 index 00000000000..5fca5be4ce8 --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-56862.patch @@ -0,0 +1,98 @@ +From 616c582eae27699513109445d5c177b42c3bb9fc Mon Sep 17 00:00:00 2001 +From: "Nicholas S. Husin" +Date: Wed, 22 Jul 2026 12:27:12 -0400 +Subject: [PATCH] crypto/tls: do not count handshake messages as + state-advancing post-handshake + +Previously, we always counted handshake messages, such as KeyUpdate, as +state-advancing, regardless of whether a handshake has been completed or +not. As a result, a malicious client can keep sending KeyUpdate messages +to force the server to keep performing key derivation operations +indefinitely. + +Fix the issue by making it so that handshake messages are regarded +as state-advancing only prior to handshake completion. + +Thank you to Qi Deng of Aurascape.ai for reporting this issue. + +Fixes #79866 +Fixes #80528 +Fixes CVE-2026-56862 + +Change-Id: I37d27fd5f16227a9dde5f29bb5ae6c436a6a6964 +Reviewed-on: https://go-review.googlesource.com/c/go/+/804261 +Reviewed-by: Roland Shoemaker +Reviewed-by: Neal Patel +LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com +Reviewed-by: Neal Patel + +CVE: CVE-2026-56862 +Upstream-Status: Backport [https://github.com/golang/go/commit/27420571845abc6a97e19e21542a3213a74f67f4] + +Backport notes for go1.22.12: +- Dropped the src/crypto/tls/bogo_config.json hunk; the BoGo test + harness and its config do not exist in Go 1.22. +- Test uses testConfig instead of testConfigClient/testConfigServer, + which were introduced after Go 1.22. + +Signed-off-by: Benhur Tessele +--- + src/crypto/tls/conn.go | 2 +- + src/crypto/tls/conn_test.go | 34 ++++++++++++++++++++++++++++++++++ + 2 files changed, 35 insertions(+), 1 deletion(-) + +diff --git a/src/crypto/tls/conn.go b/src/crypto/tls/conn.go +index 770d456f18..376b2dcd1e 100644 +--- a/src/crypto/tls/conn.go ++++ b/src/crypto/tls/conn.go +@@ -699,7 +699,7 @@ func (c *Conn) readRecordOrCCS(expectChangeCipherSpec bool) error { + return c.in.setErrorLocked(c.sendAlert(alertUnexpectedMessage)) + } + +- if typ != recordTypeAlert && typ != recordTypeChangeCipherSpec && len(data) > 0 { ++ if (typ == recordTypeApplicationData || (typ == recordTypeHandshake && !handshakeComplete)) && len(data) > 0 { + // This is a state-advancing message: reset the retry count. + c.retryCount = 0 + } +diff --git a/src/crypto/tls/conn_test.go b/src/crypto/tls/conn_test.go +index 5e090a017d..303012ccc5 100644 +--- a/src/crypto/tls/conn_test.go ++++ b/src/crypto/tls/conn_test.go +@@ -317,3 +317,37 @@ func TestRecordBadVersionTLS13(t *testing.T) { + t.Fatalf("unexpected error: got %q, want %q", err, expectedErr) + } + } ++ ++// TestKeyUpdateSpamPostHandshakeTLS13 tests that TLS 1.3 KeyUpdate messages do ++// not count as a state-advancing message after a handshake has been completed. ++func TestKeyUpdateSpamPostHandshakeTLS13(t *testing.T) { ++ client, server := localPipe(t) ++ defer server.Close() ++ defer client.Close() ++ ++ go func() { ++ c := Client(client, testConfig.Clone()) ++ if err := c.Handshake(); err != nil { ++ t.Error(err) ++ return ++ } ++ ku, err := (&keyUpdateMsg{}).marshal() ++ if err != nil { ++ t.Error(err) ++ return ++ } ++ cs := cipherSuiteTLS13ByID(c.cipherSuite) ++ for i := 0; i <= maxUselessRecords; i++ { ++ c.writeRecordLocked(recordTypeHandshake, ku) ++ c.setWriteTrafficSecret(cs, QUICEncryptionLevelInitial, cs.nextTrafficSecret(c.out.trafficSecret)) ++ } ++ }() ++ s := Server(server, testConfig.Clone()) ++ if err := s.Handshake(); err != nil { ++ t.Fatal(err) ++ } ++ expectedErr := "tls: too many non-advancing records" ++ if _, err := s.Read(make([]byte, 1)); err == nil || err.Error() != expectedErr { ++ t.Fatalf("unexpected error: got %v, want %q", err, expectedErr) ++ } ++} From patchwork Sat Oct 31 00:14:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102531 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3730.1793405755315604870 for ; Fri, 30 Oct 2026 17:15:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=ZLEgMXIb; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a60f9474c4so14290345e9.0 for ; Fri, 30 Oct 2026 17:15:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405753; x=1794010553; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=e+cCW7z1GOgC62nQq2ic1PLhwlMAHSkksR3BwekheGs=; b=ZLEgMXIbM/Pd/6H0VK39gAZwoZrEFDzXM76FzXHhRXXScU2w+/dCk7bjTYakjAV9t2 J2ZtGhYR6Av17Bxtrzxs6HFHeJD4uw9PkaCc8gEOtejYBDVC6sXo2SVBrt3lr1TAnGVb Teye2h9F+3YTOox2lLy4uinK2u7BBlMs2WlHHnM4yRwYQQO+zM8meucLMU3tRaLQSx6y c2hMlPKhuOqvrsHvD3awkVNsnSCEtiHVFQ9TVPG4AK1caBYLUUx7YGIrlAUiYlRDuLEF YGCEGEQ5frWN+94/F522zh7enIKuwzQz/96sjg2+h4JEj/WtuoWX4z1t5O4cq+kGhOtB GlEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405753; x=1794010553; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=e+cCW7z1GOgC62nQq2ic1PLhwlMAHSkksR3BwekheGs=; b=Hr+p4AsExvJKI18hxYLQ1iZBwGvivx6qvnvOAFVyIedOythFfAbomiHpuKYfViUeU9 cWAO/B6AZ7ugt4pLzVjFhjSJ/xr2tv2PXDKkq7nuIfegP3RddMbEsJa7yJcKpFQUPque ofKyBvoRTgWoHhZaG7W5et2y+fLYR1CXi2GEk/hrDGgRsu8/7Ef6S5mU+OwtrwU0+W7M MSk5dDzSXGxZmbUS7y3uLMAdxvRm5hmbWupUJijisCbAdRZ7vbvLrrt5MHHJS78LuOH3 2PQhQVK3gE3fIAqTc+C49UdipqbxIFsM8t99/P5Xx9j7PUsg3CtEmA76mI2Lw16HJp7l gTrQ== X-Gm-Message-State: AFq9FYLMqRq3wBBpenVKpoj+oXwgrROC1xyp5TzFo7l9o5x34X1ad0ap D9un7d1Qwpys47LKHLsUOz1NHAFXBE1ILaW/Qz8EcppEIWHixl7rO0GB+Q6QU1aVi59mipRHy7U nWitXHxA= X-Gm-Gg: AYBFou0X6aszXnx942ApJ+flHmQuk78mMqsKnruJihRSBwCfBnXA9gP0GCnFtHfFVG9 DNj0tXd9B7C8NOLjeNVL7nC6ANARJFsHIOarTTfdMPykjJ9aPFHaO4hKrTU7jqbJCejZMJy6AGV l/Of/SgapP4C1o+ZGZ0MjwOQsKALMKcK3vDWjAj4fA/2oc1XRME52UJHZkWiulZqHDW4U9Fr8OG ghZ+p0cAVa5+Q5xP/uMSVtDfxt30Ldfn7l66HR++FNfAkhQIwx9arvIsP3kZZFCyMrQNmsaFoZz uoX2l19B1tz+ON6OtBSX+8dXtzQ5mz3Ux6kzX5r10UMafgUxytNwr+JtEmGB3hu8OsbGMJABhEX 8+3RRfrlmy9AqCCP9IXMBnEyfixvjSDm71an60qV0r1PMqh7Vwm0BUx9CS4rwJpY2q0sQA5covJ J5Z9lLwl7DO7hmEdWQR/d/Z6C6Vq/u2UOOOQd4D7FFzYl5KgSbJynujX6l80Z414V0Z7UGXTvae T5BBP0Y5UeAjbOhm6XuOgNtByX38FCJ/F4i7m2CqHsYOLeWch0XjLYUQLQZdJfL/c9O9ugZl77S vdH53AAmnnG2Fo2aDky6IBD2FZdyFzrAHsPwtbl9NjoKAkjHsRJufD6ziY+yTdDJo5NRMML7nv5 C3Xnn5BKMOy/V8VHkE9o16Q4DkfAJkSFmFkmKr9T/DFbM54iyfQ== X-Received: by 2002:a05:600c:1d16:b0:4a1:fa33:441a with SMTP id 5b1f17b1804b1-4ac151a8fd2mr88694795e9.2.1793405753545; Fri, 30 Oct 2026 17:15:53 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:53 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 18/55] libpcre2: update to latest release branch hash 50b3c0d7ce Date: Sat, 31 Oct 2026 01:14:39 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249093 From: Peter Marko Handles CVE-2026-103111, CVE-2026-86145, CVE-2026-89158, CVE-2026-89160, CVE-2026-89157, CVE-2026-89156 and CVE-2026-89161. The project committed to have 5 year security support for each release on a dedicated release branch. Switch from release tarball to git fetcher to use this feature. Git log with all changes and manually created CVE annotations: $ git log --oneline pcre2-10.43..50b3c0d7ceaf23578d04e644c02781c322ef6cb0 50b3c0d7 Backport of pcre2-10.49-Fix-large-stack-allocation.patch [CVE-2026-103111] b7d3ffd4 Backport of pcre2-10.48-Fix-DFA-workspace-overflows.patch [CVE-2026-86145] 9c11f0dc Backport of pcre2-10.48-Fix-compiler-integer-overflows.patch [CVE-2026-89158] 2866e543 Backport of pcre2-10.48-Fix-invalid-UTF-backwards-scans.patch [CVE-2026-89160] 714e1062 Backport of pcre2-10.48-Fix-allocation-byte-sizing.patch [CVE-2026-89157] 91759151 Backport of pcre2-10.48-Check-JIT-mode-before-validation.patch [CVE-2026-89156] 87f50503 Backport of pcre2-10.48-Fix-JIT-match-context-reuse.patch [CVE-2026-89161] ed0e58f5 Backport of pcre2-10.48-Fix-JIT-STR_END.patch dc733f56 Backport of pcre2-10.44-Fix-incorrect-compiling.patch 7f3e5400 Backport of pcre2-10.44-Fix-locking-region.patch Diff of release tarball and git repository is: Only in pcre2-10.43/: aclocal.m4 Only in pcre2-10.43/: ar-lib Only in libpcre2-10.43+git/: autogen.sh Only in libpcre2-10.43+git/: .bazelrc Only in libpcre2-10.43+git/: BUILD.bazel Only in libpcre2-10.43+git/: build.zig Only in pcre2-10.43/: compile Only in pcre2-10.43/: config.guess Only in pcre2-10.43/: config.sub Only in pcre2-10.43/: configure Only in pcre2-10.43/: depcomp Only in libpcre2-10.43+git/: .git Only in libpcre2-10.43+git/: .github Only in libpcre2-10.43+git/: .gitignore Only in libpcre2-10.43+git/: index.md Only in pcre2-10.43/: INSTALL Only in pcre2-10.43/: install-sh Only in pcre2-10.43/: ltmain.sh Only in pcre2-10.43/m4: libtool.m4 Only in pcre2-10.43/m4: lt~obsolete.m4 Only in pcre2-10.43/m4: ltoptions.m4 Only in pcre2-10.43/m4: ltsugar.m4 Only in pcre2-10.43/m4: ltversion.m4 Only in libpcre2-10.43+git/: maint Only in pcre2-10.43/: Makefile.in Only in pcre2-10.43/: missing Only in libpcre2-10.43+git/: MODULE.bazel Only in libpcre2-10.43+git/: pcre2_fuzzer_16.dict Only in libpcre2-10.43+git/: pcre2_fuzzer_16.options Only in libpcre2-10.43+git/: pcre2_fuzzer_32.dict Only in libpcre2-10.43+git/: pcre2_fuzzer_32.options Only in libpcre2-10.43+git/: pcre2_fuzzer.dict Only in libpcre2-10.43+git/: pcre2_fuzzer.options Only in libpcre2-10.43+git/: README.md Only in pcre2-10.43/: test-driver Only in libpcre2-10.43+git/: WORKSPACE.bazel Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../recipes-support/libpcre/libpcre2_10.43.bb | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/meta/recipes-support/libpcre/libpcre2_10.43.bb b/meta/recipes-support/libpcre/libpcre2_10.43.bb index f744df88fad..743b0ec04e5 100644 --- a/meta/recipes-support/libpcre/libpcre2_10.43.bb +++ b/meta/recipes-support/libpcre/libpcre2_10.43.bb @@ -10,23 +10,27 @@ SECTION = "devel" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENCE;md5=321a5eb46acae6b6c1ff2c7a866d836a" -SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2" - -GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases" -UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P\d+(\.\d+)+)$" - -SRC_URI[sha256sum] = "e2a53984ff0b07dfdb5ae4486bbb9b21cca8e7df2434096cc9bf1b728c350bcb" +BASE_VER = "${@d.getVar('PV').split('+')[0]}" +SRC_URI = "git://github.com/PCRE2Project/pcre2;protocol=https;branch=release/pcre2-${BASE_VER}" +SRCREV = "50b3c0d7ceaf23578d04e644c02781c322ef6cb0" +PV .= "+git" CVE_PRODUCT = "pcre2" -S = "${WORKDIR}/pcre2-${PV}" +CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS" +CVE_STATUS_STABLE_BACKPORTS = "CVE-2026-103111 CVE-2026-86145 CVE-2026-89158 CVE-2026-89160 \ + CVE-2026-89157 CVE-2026-89156 CVE-2026-89161 \ +" +CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash" + +S = "${WORKDIR}/git" PROVIDES += "pcre2" DEPENDS += "bzip2 zlib" BINCONFIG = "${bindir}/pcre2-config" -inherit autotools binconfig-disabled github-releases +inherit autotools binconfig-disabled EXTRA_OECONF = "\ --enable-newline-is-lf \ From patchwork Sat Oct 31 00:14:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102529 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3732.1793405756100085927 for ; Fri, 30 Oct 2026 17:15:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=YFj+lZKC; spf=pass (domain: smile.fr, ip: 209.85.221.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-48b060ec084so712804f8f.0 for ; Fri, 30 Oct 2026 17:15:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405754; x=1794010554; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=uRLq2lVBQ748efm/Bk73jg9Gh7f4yso5SjuptXvBXFs=; b=YFj+lZKCRp6yJfP7SA2uTi1YDQvMSZT62eeRKB+fx9z+UfS5wykP3AQch8paHKPzz6 3yLIMjhdwewBjL0hfisdF/r/bABqPSMRW0M2RHXdgW2V9rChm0+6X5EiTcfPtZM48Upq mHQCqdKMYEkQyp7pgnZB6kkavXMScOA2IrxXyBOnz7xbrp3CJmHlZjmQEvYphQjynv00 csyqfW+wTHyLxb4n1DqwlqWDSe2sRPEtLhkAlFtuzjgXsvhVwv0r/Hu6Kn0C4WiV0W6f GLB7QH0H97+xqA6av8inDpWcy+b2OiDwM/eupxE+4LMltZmqPiL28pcnOFTDUvo5bIYa UmyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405754; x=1794010554; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=uRLq2lVBQ748efm/Bk73jg9Gh7f4yso5SjuptXvBXFs=; b=kgaAiMcaqmbBqxDz/PFI3zMZdIlRkpdzThbHvUVZXBxT8x8wNYXCKqYKj83+vGcFDk BdT3Ybs1mhlb12FRrLa+5bBQ417Ou/N5A6R7NtB9E1OCHj47/nvytld4ePnEd7uzRNjX kVfBZnrjdFd8x8PniwwXTcYTqjqEo9YeYOFPYfevtBznjyZ6KXyWi0V3sjQO4ve84Xfe up52haMIqRx6Rs+Fuk0vh5Lgr+6rXneIOsub8L3gBvFuRyf7BGiKcEaNRWeioBndBJk7 EMdgMqjQeyU9I/51k7FJiyszl5oecvVU9gGcNMQnxFkBG27APlFA16wTARYRJlbERZIt Zx+w== X-Gm-Message-State: AFq9FYJaBZo7aOGkJDsXtqzUWejgVvums/ffo9ccZ/IM/fTt07HNIA5j RVEGSh2zmvPvLhKUdIM0lubwZ64MpC1gPcLIQmGy9iDvXPWYpZEYzxzJGWXlvbQEdTX/kJXSoLL AjC1fvOs= X-Gm-Gg: AYBFou3IsrhS3KLEw9bSJQH8qLH9pKYoACdA6aKtkntRy9u+vNuz9AQkZkNrjb/e/Ps 9QC0kbubUmh0ex2pvop3d7wUF46d2feudCTgFCCNIcCkC4R8kG0iKfrwa7Oxcp7Y78MwYLb9VK2 FWbFFLRyGn8YpqutrZR0V0ce1aI1CVdQKhYSvQDy1wOUEiGgsjqpYWOvVfR9qEfKz9l7vdHHodI 3c4o5TnsOdc5BThc5uXQgvNL61ufwTMeh90iVc2EeOhaH7OVStA/eA1KWAeiDBKmFZvd/M8ADiE 4TpkA0KQv2fp/vJrHgmmI6jUFIek0xRNNO7eI1RsSWus+5TfZM3v4gQyjN6nFEfFZpnl+fNCam+ 7yVX5x/t/l70PCtBq1VOeA8AY20jpBUTSo8TtJi3oG6Umdl2OiDWdK2d5AZsu4/79QhtlJAnY63 M+kbyME6roOcJo/kf0ZEPwi/556uckoZ/aEntKZ7doXn/0B2ghJea1RyHf+IciIfcmer2Ahotya 2GBTmjyNQjy0DJOkFE3C5xHvcqYxXyPYy+P5dGW5mszZfAzaR0dvgWnjOLwTomvuPlAo7/1Du37 L8nZ34e0TmMgBpvgSHoRtrXR5j0DFwKREgSZAXLbwuG4n6/9Ie8ojPFLuXgIHVMywGG5ciePfSd 6w9Mm4cASlRlafIPRPchUOT4GD5fY X-Received: by 2002:a05:600c:83c5:b0:4a2:148b:c88c with SMTP id 5b1f17b1804b1-4ac17191017mr85482245e9.8.1793405754084; Fri, 30 Oct 2026 17:15:54 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:53 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 19/55] python3-urllib3: Fix CVE-2026-97689 Date: Sat, 31 Oct 2026 01:14:40 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249094 From: Jaipaul Cheernam Backport the upstream fix [1] as mentioned in [2] [1] https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed [2] https://nvd.nist.gov/vuln/detail/cve-2026-97689 Testing: - test_response.py::test_chunk_size_line_too_long - passed - test_response.py::test_chunk_trailer_line_length (6 cases) - passed - test_socketlevel.py::test_chunked_size_line_too_long_does_not_buffer - passed - Full test_response.py: 161 passed, 45 skipped (no regressions) Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal --- .../python3-urllib3/CVE-2026-97689.patch | 251 ++++++++++++++++++ .../python/python3-urllib3_2.2.2.bb | 14 +- 2 files changed, 258 insertions(+), 7 deletions(-) create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch new file mode 100644 index 00000000000..98b007324cf --- /dev/null +++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch @@ -0,0 +1,251 @@ +From 5d5fac45ff18a8159c5a4aa973ed9fc2f5dd35ad Mon Sep 17 00:00:00 2001 +From: Quentin Pradet +Date: Tue, 15 Sep 2026 22:33:41 +0400 +Subject: [PATCH] Merge commit from fork + +* Bound chunk-size line reads to prevent memory exhaustion DoS + +The streaming chunked path (HTTPResponse.stream() / read_chunked()) read +each chunk-size line with an unbounded readline(), unlike the plain read() +path which delegates to http.client's _MAXLINE-capped reader. A malicious +server could advertise Transfer-Encoding: chunked and then send a very long +run of bytes with no newline, forcing the client to buffer the entire run +before the chunk size could be rejected. + +This caps the chunk-size line (and the trailing CRLF line) at _MAXLINE, +raising ProtocolError when exceeded, matching the behaviour read() already +had. Only the size line is bounded; chunk bodies still go through the sized +_safe_read(), so legitimate large chunks are unaffected. + +Verified with a local malicious server streaming a 200 MiB unterminated +size line: stream() previously grew RSS by ~530 MB, now stays at ~1 MB and +fails fast, matching read(). A 5 MiB chunk body still streams correctly. + +* Fix a black formatting issue + +* Test chunked response trailer length limits + +* Fix number in the changelog entry + +--------- + +Co-authored-by: Illia Volochii + +CVE: CVE-2026-97689 +Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed] + +Note: + - changeLog change is not backported + - Adjusted commit change as per current version + +Signed-off-by: Jaipaul Cheernam +--- + src/urllib3/response.py | 20 +++++- + test/test_response.py | 82 ++++++++++++++++++++++- + test/with_dummyserver/test_socketlevel.py | 34 ++++++++++ + 3 files changed, 132 insertions(+), 4 deletions(-) + +diff --git a/src/urllib3/response.py b/src/urllib3/response.py +index d52e37a..caeec0a 100644 +--- a/src/urllib3/response.py ++++ b/src/urllib3/response.py +@@ -67,6 +67,13 @@ if typing.TYPE_CHECKING: + + log = logging.getLogger(__name__) + ++# Maximum length of a chunk-size line (and the trailing CRLF line) when reading a ++# chunked-transfer-encoded response. Matches ``http.client._MAXLINE`` so urllib3's ++# streaming path bounds these reads exactly like the stdlib ``.read()`` path does, ++# preventing a malicious server from forcing unbounded buffering (memory exhaustion) ++# via an unterminated chunk-size line. ++_MAX_CHUNK_LINE_LENGTH = 2**16 ++ + + class ContentDecoder: + def decompress(self, data: bytes, max_length: int = -1) -> bytes: +@@ -1333,7 +1340,12 @@ class HTTPResponse(BaseHTTPResponse): + # we'll try to read it from socket. + if self.chunk_left is not None: + return None +- line = self._fp.fp.readline() # type: ignore[union-attr] ++ line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1) # type: ignore[union-attr] ++ if len(line) > _MAX_CHUNK_LINE_LENGTH: ++ self.close() ++ raise ProtocolError( ++ "Response chunk size line exceeded maximum allowed length" ++ ) from None + line = line.split(b";", 1)[0] + try: + self.chunk_left = int(line, 16) +@@ -1437,7 +1449,11 @@ class HTTPResponse(BaseHTTPResponse): + + # Chunk content ends with \r\n: discard it. + while self._fp is not None: +- line = self._fp.fp.readline() ++ line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1) ++ if len(line) > _MAX_CHUNK_LINE_LENGTH: ++ raise ProtocolError( ++ "Response chunk trailer line exceeded maximum allowed length" ++ ) + if not line: + # Some sites may not end with '\r\n'. + break +diff --git a/test/test_response.py b/test/test_response.py +index 0e8abd9..2871ac2 100644 +--- a/test/test_response.py ++++ b/test/test_response.py +@@ -26,6 +26,7 @@ from urllib3.exceptions import ( + SSLError, + ) + from urllib3.response import ( # type: ignore[attr-defined] ++ _MAX_CHUNK_LINE_LENGTH, + BaseHTTPResponse, + BytesQueueBuffer, + HTTPResponse, +@@ -1375,6 +1376,63 @@ class TestResponse: + assert isinstance(orig_ex, InvalidChunkLength) + assert orig_ex.length == fp.BAD_LENGTH_LINE.encode() + ++ def test_chunk_size_line_too_long(self) -> None: ++ # A malicious server can send a chunk-size line with no newline. urllib3's ++ # streaming path must reject it with a bounded read rather than buffering ++ # the whole line (memory exhaustion). See GHSA / CVE for chunked DoS. ++ stream = [b"foooo"] ++ fp = MockChunkedEncodingLongChunkSizeLine(stream) ++ r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type] ++ r.fp = fp # type: ignore[assignment] ++ r.chunked = True ++ r.chunk_left = None ++ resp = HTTPResponse( ++ r, preload_content=False, headers={"transfer-encoding": "chunked"} ++ ) ++ with pytest.raises(ProtocolError) as ctx: ++ next(resp.read_chunked()) ++ ++ assert "chunk size line exceeded maximum allowed length" in str(ctx.value) ++ ++ @pytest.mark.parametrize( ++ "trailer_length", ++ [ ++ _MAX_CHUNK_LINE_LENGTH - 1, ++ _MAX_CHUNK_LINE_LENGTH, ++ _MAX_CHUNK_LINE_LENGTH + 1, ++ ], ++ ) ++ @pytest.mark.parametrize("line_ending", [b"\r\n", b""]) ++ def test_chunk_trailer_line_length( ++ self, trailer_length: int, line_ending: bytes ++ ) -> None: ++ # The line limit includes its CRLF, but not the final blank line. ++ trailer = b"X:" + b"x" * (trailer_length - 2 - len(line_ending)) + line_ending ++ fp = BytesIO(b"3\r\nfoo\r\n0\r\n" + trailer + (b"\r\n" if line_ending else b"")) ++ r = httplib.HTTPResponse(MockSock, method="GET") # type: ignore[arg-type] ++ r.fp = fp # type: ignore[assignment] ++ resp = HTTPResponse( ++ r, ++ preload_content=False, ++ headers={"transfer-encoding": "chunked"}, ++ original_response=r, ++ ) ++ chunks = resp.read_chunked() ++ assert next(chunks) == b"foo" ++ ++ if trailer_length > _MAX_CHUNK_LINE_LENGTH: ++ with pytest.raises( ++ ProtocolError, ++ match="Response chunk trailer line exceeded maximum allowed length", ++ ): ++ next(chunks) ++ else: ++ assert list(chunks) == [] ++ ++ assert fp.closed ++ assert r.isclosed() ++ assert resp.closed ++ + def test_truncated_before_chunk(self) -> None: + stream = [b"foooo", b"bbbbaaaaar"] + fp = MockChunkedNoChunks(stream) +@@ -1629,8 +1687,20 @@ class MockChunkedEncodingResponse: + self.cur_chunk = self.cur_chunk[amt:] + return chunk_part + +- def readline(self) -> bytes: +- return self.pop_current_chunk(till_crlf=True) ++ def readline(self, amt: int = -1) -> bytes: ++ # Emulate a real file object's readline(size): return bytes up to and ++ # including the first newline, or at most ``amt`` bytes when ``amt >= 0``, ++ # whichever comes first. ++ if len(self.cur_chunk) <= 0: ++ self.cur_chunk = self._pop_new_chunk() ++ line = self.cur_chunk ++ newline_index = line.find(b"\n") ++ if newline_index != -1: ++ line = line[: newline_index + 1] ++ if 0 <= amt < len(line): ++ line = line[:amt] ++ self.cur_chunk = self.cur_chunk[len(line) :] ++ return line + + def read(self, amt: int = -1) -> bytes: + return self.pop_current_chunk(amt) +@@ -1658,6 +1728,14 @@ class MockChunkedInvalidChunkLength(MockChunkedEncodingResponse): + return f"{self.BAD_LENGTH_LINE}{chunk.decode()}\r\n".encode() + + ++class MockChunkedEncodingLongChunkSizeLine(MockChunkedEncodingResponse): ++ def _encode_chunk(self, chunk: bytes) -> bytes: ++ # A chunk-size line far longer than _MAX_CHUNK_LINE_LENGTH with no ++ # newline, simulating a malicious server that never terminates the ++ # size line (memory-exhaustion attack). ++ return b"f" * (2**16 + 1024) ++ ++ + class MockChunkedEncodingWithoutCRLFOnEnd(MockChunkedEncodingResponse): + def _encode_chunk(self, chunk: bytes) -> bytes: + return "{:X}\r\n{}{}".format( +diff --git a/test/with_dummyserver/test_socketlevel.py b/test/with_dummyserver/test_socketlevel.py +index dceb5ee..2b258ae 100644 +--- a/test/with_dummyserver/test_socketlevel.py ++++ b/test/with_dummyserver/test_socketlevel.py +@@ -2055,6 +2055,40 @@ class TestStream(SocketDummyServerTestCase): + + done_event.set() + ++ def test_chunked_size_line_too_long_does_not_buffer(self) -> None: ++ # A malicious server can advertise chunked encoding and then send an ++ # unterminated chunk-size line (no newline). The streaming path must ++ # reject it with a bounded read instead of buffering the whole run, ++ # which would exhaust memory. ++ done_event = Event() ++ # Well above the 65536-byte cap, but small enough for a fast test. ++ run_length = 512 * 1024 ++ ++ def socket_handler(listener: socket.socket) -> None: ++ sock = listener.accept()[0] ++ ++ buf = b"" ++ while not buf.endswith(b"\r\n\r\n"): ++ buf += sock.recv(65536) ++ ++ sock.sendall(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n") ++ # A chunk-size line that never terminates with a newline. ++ with contextlib.suppress(OSError): ++ sock.sendall(b"f" * run_length) ++ ++ done_event.wait(5) ++ sock.close() ++ ++ self._start_server(socket_handler) ++ ++ with HTTPConnectionPool(self.host, self.port, retries=False) as pool: ++ r = pool.request("GET", "/", timeout=LONG_TIMEOUT, preload_content=False) ++ with pytest.raises(ProtocolError) as ctx: ++ next(r.stream(65536)) ++ assert "chunk size line exceeded maximum allowed length" in str(ctx.value) ++ ++ done_event.set() ++ + def test_large_compressed_stream(self) -> None: + done_event = Event() + expected_total_length = 296085 diff --git a/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb b/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb index b77dd5297d3..7ca210429b7 100644 --- a/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb +++ b/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb @@ -7,13 +7,13 @@ SRC_URI[sha256sum] = "dd505485549a7a552833da5e6063639d0d177c04f23bc3864e41e5dc5f inherit pypi python_hatchling -SRC_URI += " \ - file://CVE-2025-50181.patch \ - file://CVE-2025-66418.patch \ - file://CVE-2025-66471.patch \ - file://CVE-2026-21441.patch \ - file://CVE-2026-44431.patch \ -" +SRC_URI += "file://CVE-2025-50181.patch \ + file://CVE-2025-66418.patch \ + file://CVE-2025-66471.patch \ + file://CVE-2026-21441.patch \ + file://CVE-2026-44431.patch \ + file://CVE-2026-97689.patch \ + " RDEPENDS:${PN} += "\ python3-certifi \ From patchwork Sat Oct 31 00:14:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102527 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3738.1793405756422161222 for ; Fri, 30 Oct 2026 17:15:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=jQx3X+/E; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a9a8d6cea8so16511585e9.1 for ; Fri, 30 Oct 2026 17:15:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405755; x=1794010555; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KpjrTlL0tGUsVt/Qk7sQ22nNeHP+z/jz0lZxweFvlIY=; b=jQx3X+/EUW7KKt8qm+iN/keC2jwx32Nxv1djxOGm8lvjfCuvOuz1aG/S0qTolYneR1 0EqAyQnEeauyeR/OB2EIFnGnNeORzcYLMgoRodjkOpvp/DEYKknZY8TXKqt1B8Gu7Ra7 w5R6zhZ3Bs5fgaNcC2qAB40PtX/w4OWcWsOpwYgSALjTdL1FYAX4FKUrWWFct9grOSga muIOVZOu3mbdUeOGr05iQ5+77JU2XVjH80SHCo/mxpiZ9KeXYey3jXWpOfe6KDIY6Bvd QbiUjpWHunl/Vf1HWfaX7EebTuyzdcmnr6ewZEDb6QTIGCqVx4BjwclEtmjG8dwgn/mz B51w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405755; x=1794010555; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KpjrTlL0tGUsVt/Qk7sQ22nNeHP+z/jz0lZxweFvlIY=; b=OcdOiRw7A/5wcYJRkvVMhytY3MKFJ2soJOG/x0YRzgLcJvQNTKzCHnl27qJK2W7OLs ILqohIJmjjM0S1adWSxnB3jBp+CmAwIOzWzITCHgNTkKjsqbTkctZyTBtPOgrDIl0dMf uWgNs+NDBqjLEctiFFPcR7sNtmwFoKf/osvjUzZFjZjEpnmT3s4hevHATHatS9YaWs8Y zZmiK/UQupyBeB1KUMLXS9knryyd8Qr0zMIfoUWFiNhpLBBdLQR7zK1O9fOrNET0FTUz Zrazeve5qJYvFECOP+4Eory3jy+D/nwcMMNtvpC++SrZbtUDvEIe4wg9BmWUnipEKooQ WDNg== X-Gm-Message-State: AFq9FYL77aabAcFyV/kSbnp00yQDKyZwP6QRp8/VD7ALeY6cAMWkbR6r vIP99n2y4Jt/ts79KxOFZ0E4C6w4zUtkCZs2muzpU7bMCc4a848RzFUvFpqv6cw2zd0ZVVIPMmp YK9nUVVA= X-Gm-Gg: AYBFou2qRBRy0XAUCuX3yAAxpDQg6umGO36u15xcZjuNqxdsXTzI/21IiQxf90CYRox 7b/s+NXav0wyTq9l9NxIkRd3x+WAZBZduOz5+yDtev0LneSjcF0yxkIT7+QiQqZqdwDLks6li0I nwWMyADKvuipc2DZoShxS2wqCZJRhnkSZWN8EYY4CSFr4jKalpYvR3ssatogwNDLlJU2DY/oMk3 k2DJ9qvKG2nlroVIUtJ/XypbCwfSZeIoVSTdL0K1/XxKAqkmAJvIGnWw1VVFaS3vmdOqWwaXyYM 43EZKsh8PHDYXiOmZ0anjclVNZyLghfoXSL8mUpiCt2hpFHT+isvBPBHk0bJ83SW0QPRxbG9Iy/ vi2+pNUGayJFFoF5zOeQeslLvGUtzwJtqQIjooXKwT13nKXrsA4uvRc/JvdrdxIoiYJQw25yQ23 an3E4DE3Nel/eCa4m8pnBBb+Dpqk7U1HR48JdamOPmINQf8Gb0pDhiuOkzCnZo8aZVlAhTJCvlx RWUwElAnMudEisDzXMdMf1GW3ZZGHW7Mu94ZTTHS66TwkDAPslh1LztcnMz+wqDLGOoXA8Rfy5o rTtJcMS1Vo3eN5kCDQR+PTDfc2E2YmN8cj2JSGSqGPAXut4lwFBjz/HOcXVZsE41aO8QDRocnLk FjrbxT7SIWkSOt5d88V5pThd3n9Ba X-Received: by 2002:a05:600c:8b01:b0:49f:c5aa:9ef4 with SMTP id 5b1f17b1804b1-4ac16fa4f73mr91933265e9.8.1793405754707; Fri, 30 Oct 2026 17:15:54 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:54 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 20/55] python3-pyelftools: add python3-logging to RDEPENDS Date: Sat, 31 Oct 2026 01:14:41 +0100 Message-ID: <4b2e21065095076846b1667c1ec875bb912021b2.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249095 From: Theo GAIGE python3-logging is needed as a runtime dependency of python3-pyelftools else the readelf.py script run into the following error : ``` Traceback (most recent call last): File "/usr/bin/readelf.py", line 31, in from elftools.elf.elffile import ELFFile File "/usr/lib/python3.12/site-packages/elftools/elf/elffile.py", line 29, in from ..dwarf.dwarfinfo import DWARFInfo, DebugSectionDescriptor, DwarfConfig File "/usr/lib/python3.12/site-packages/elftools/dwarf/dwarfinfo.py", line 17, in from .structs import DWARFStructs File "/usr/lib/python3.12/site-packages/elftools/dwarf/structs.py", line 10, in from logging.config import valid_ident ModuleNotFoundError: No module named 'logging' ``` Signed-off-by: Theo GAIGE Reviewed-by: Louis Rannou Signed-off-by: Mathieu Dubois-Briand (cherry picked from commit 9b956f6b5a345bd3022a9e64fa70a0365bfac502) Signed-off-by: Theo Gaige (Schneider Electric) Signed-off-by: Yoann Congal --- meta/recipes-devtools/python/python3-pyelftools_0.30.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-devtools/python/python3-pyelftools_0.30.bb b/meta/recipes-devtools/python/python3-pyelftools_0.30.bb index 837edb71653..b799f5acf8a 100644 --- a/meta/recipes-devtools/python/python3-pyelftools_0.30.bb +++ b/meta/recipes-devtools/python/python3-pyelftools_0.30.bb @@ -12,4 +12,4 @@ inherit pypi setuptools3 BBCLASSEXTEND = "native" -RDEPENDS:${PN} += "python3-debugger python3-pprint" +RDEPENDS:${PN} += "python3-debugger python3-pprint python3-logging" From patchwork Sat Oct 31 00:14:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102530 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3733.1793405757026930910 for ; Fri, 30 Oct 2026 17:15:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=FWzdkqnB; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4a9a8d6cea8so16511665e9.1 for ; Fri, 30 Oct 2026 17:15:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405755; x=1794010555; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Uv2agkakm/YeH+aatKZoSbg1BvgobRxU0ooaJDgdUW0=; b=FWzdkqnBBH2W4MhqAKCPtcODrAHV22ud5LcLyzovq+zzwkNV7Y3If+abhPbY3b7h0R rL73NVZReW3qFlsoGJ29NPj5ZhYavXPaNXrqqdN3e9m8YzNsu6DGBvv20HUZKgdPydGf sGWEPn8hLKMPTuohuv6DtjRfpMXY45aEFXfm314L/o+vFngNI4XZjxyNkprrzTpe7KNK HpRlX0M9vD6A8656M/Ts3JIoJgbEW25R5ClQDJ8JNotzIUgLMhl35LH6LAr0bWL+UCbt fYkF4KaSz17MTijx3FuhfVmTdAd1gC4po3bPWOMj+H3daXpRKxHljUoL4zL6FEVV+0Gd rH3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405755; x=1794010555; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Uv2agkakm/YeH+aatKZoSbg1BvgobRxU0ooaJDgdUW0=; b=gIl99KG/orW5T7AN0xXD8/lh/7tMN+VWcVwIeWwe+fupCUiPMDo9HUr6t12ZCrBwTD tsk3j+t2BFW8OxT74KJYOOpciLAuuP5aBWZ97XRjAq7xkFuT/70nTLjEpJRUPItdWRNU 2BJkmBa0iQ2Lxz++5h2XOfg7tyAc9px9EnbCOuIpv62g3hCxX7azanAoGdhyiyI0cFlC CtheyxxfCFiEl/nxzjzm40CckBOV8fzlW295uzTfEh8tqPE0o9zfg36oM7Sl5OVscDNw 9FX32JHTleWpptVccP9m1lq1qpZ4idIBq+nWE247pqpJmjPvzgj0vCqkX6OOPzy3442A PLRw== X-Gm-Message-State: AFq9FYLjO6KbleiIqqZ4P3mkvkztv5Fxubb/C/1hjgL+x0NWiRx1jyuU DeZbOJU1SZXns4EodR9ous2SedY1vhnUFvJq/qCt93WCoikkWTDQcEN9KJWctHAi3ogk9IxjUd5 T30Bm490= X-Gm-Gg: AYBFou23Wr3bsGDIZlGu+9pIBLI6Ze1FLuCTyyGLdHE7VE4Iw4PZrx1T8rCeIAjVBsT PwskgvKlDJfcX0rZo9UJps/h4O9VJkceF0RHUv1KCp7yyFQ0WmNMBxcrCq4zYByXCdNgUu2u66g 81zJf7us3mqLJUzb2PbJtXjcZ64s2Vn7gae7F0H4ZuhKWIZYZNet0wS7YildDL++/J8B1yhlNoZ ksPh/8ZiJKwYiJLq64GYqPhsjak6JeImKL6x+UkAvuk3fuLA6Bz3dMFQYIn1gWkgn7a/1PGn9UH X2XN09zIPsECEesXBYJxoK4yc9KOCy9yi4j1QxWwtQln3Rsa/dN4rr+JncSEKt4BYzZJ+iNXUrt 9BRVSaeTTIb9goIWBtzJDmcbCix0wleOhT+7dzXmz0ITMyAyQUqEpdJ1tOl2dhm0+s9SE3enLP0 ra0F4gT/Fz8VKu4cs7XDEesrrxuh0bYYv4qy4taeNpG24qT0xx6YAmzmraSt/B8oS6OTZ9IbeBz vIZNFkTj+DxwO5oSV6CmqhpYqaSIzZ4TGZgdLJ56CfZa9OPP/aoQEEKmhTs7thfEGti7Du48FYw HHcK0ReQDbI1KnD6p8YFH9TpZ+v+5uAyGyR/cH6KduQBkF0vK5ljqxyHWTCvjNYnIq9Th7UPk33 qZQ0pz+O3tmCN5GgI4qrQVQavXmm0rw== X-Received: by 2002:a05:600c:c87:b0:4a1:efbe:529c with SMTP id 5b1f17b1804b1-4ac17567fe1mr89407265e9.12.1793405755169; Fri, 30 Oct 2026 17:15:55 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:54 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 21/55] glibc: patch CVE-2026-5928 Date: Sat, 31 Oct 2026 01:14:42 +0100 Message-ID: <1284d19d8055885de7ab943b8b0ef74b2e9f5493.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249096 From: Peter Marko Pick patch [1] which is [2] backported to 2.41 (oldest release still receiving security updates) which is mentioned in [3]. [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=8941538b92a574a24e9308e164869239d2b0d845 [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=ef3bfb5f910011f3780cb06aa47e730035f53285 [3] https://security-tracker.debian.org/tracker/CVE-2026-5928 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0031-CVE-2026-5928.patch | 112 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 113 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch diff --git a/meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch b/meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch new file mode 100644 index 00000000000..60b81e74529 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch @@ -0,0 +1,112 @@ +From 8941538b92a574a24e9308e164869239d2b0d845 Mon Sep 17 00:00:00 2001 +From: Rocket Ma +Date: Fri, 1 May 2026 20:39:07 -0700 +Subject: [PATCH] libio: Fix ungetwc operating on byte stream [BZ #33998] + +* libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one +character, it accidently compare the wchar to push back with the last +char from byte stream, instead of wide stream. Under specific coding, +attacker may exploit this to leak information. This commit fix bug +33998, or CVE-2026-5928. + +Signed-off-by: Rocket Ma +Reviewed-by: Carlos O'Donell +(cherry picked from commit ef3bfb5f910011f3780cb06aa47e730035f53285) + +CVE: CVE-2026-5928 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=8941538b92a574a24e9308e164869239d2b0d845] +Signed-off-by: Peter Marko +--- + libio/Makefile | 1 + + libio/bug-wgenops-bz33998.c | 54 +++++++++++++++++++++++++++++++++++++ + libio/wgenops.c | 4 +-- + 3 files changed, 57 insertions(+), 2 deletions(-) + create mode 100644 libio/bug-wgenops-bz33998.c + +diff --git a/libio/Makefile b/libio/Makefile +index e143ccdb2c..43ee8db06d 100644 +--- a/libio/Makefile ++++ b/libio/Makefile +@@ -83,6 +83,7 @@ tests = \ + bug-ungetwc1 \ + bug-ungetwc2 \ + bug-wfflush \ ++ bug-wgenops-bz33998 \ + bug-wmemstream1 \ + bug-wsetpos \ + test-fmemopen \ +diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c +new file mode 100644 +index 0000000000..cc4067da99 +--- /dev/null ++++ b/libio/bug-wgenops-bz33998.c +@@ -0,0 +1,54 @@ ++/* Regression test for ungetwc operating on byte stream (BZ #33998) ++ Copyright (C) 2026 The GNU Toolchain Authors. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include "support/temp_file.h" ++#include "support/xstdio.h" ++#include "support/xunistd.h" ++#include ++#include ++#include ++#include ++#include ++#include ++ ++static int ++do_test (void) ++{ ++ char *filename; ++ int fd = create_temp_file ("tst-bz33998-", &filename); ++ TEST_VERIFY (fd != -1); ++ xwrite (fd, "A", sizeof ("A")); // write "A\0" by design ++ xclose (fd); ++ ++ FILE *fp = xfopen (filename, "r+"); ++ TEST_COMPARE (getwc (fp), L'A'); ++ /* If the bug is fixed, then ungetwc should not touch byte stream. ++ If the bug is not fixed, ungetwc firstly match last read char, L'A', ++ failed, then the pbackfail branch, matching last read char in byte ++ stream, that is, '\0' (initialized when setup wide stream). */ ++ char *old_read_ptr = fp->_IO_read_ptr; ++ TEST_COMPARE (ungetwc (L'\0', fp), L'\0'); ++ TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr); ++ ++ xfclose (fp); ++ free (filename); ++ ++ return 0; ++} ++ ++#include +diff --git a/libio/wgenops.c b/libio/wgenops.c +index 0a11d1b1de..9e0b2c00ea 100644 +--- a/libio/wgenops.c ++++ b/libio/wgenops.c +@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c) + { + if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base + && !_IO_in_backup (fp) +- && (wint_t) fp->_IO_read_ptr[-1] == c) +- --fp->_IO_read_ptr; ++ && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c) ++ --fp->_wide_data->_IO_read_ptr; + else + { + /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/ diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index d31c8656414..0a4f7ac3bd6 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -63,6 +63,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0028-CVE-2026-6238-0004.patch \ file://0029-CVE-2026-6238-0005.patch \ file://0030-CVE-2026-6238-0006.patch \ + file://0031-CVE-2026-5928.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102526 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3735.1793405757573580293 for ; Fri, 30 Oct 2026 17:15:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=T7Turuwi; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a2167bd087so10155875e9.3 for ; Fri, 30 Oct 2026 17:15:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405756; x=1794010556; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yVnabflqnxV8/zCDKyMXJ67qoJMX/ah2HwrRlaW2LIg=; b=T7Turuwi/74jnMIHmOD/vSEuqgj3yx4rxSq1Mirqyk48QFhrE3Qijgs3ADo6Vxr7sn Vs3nMZbnhuG2sK3dvdaNE4/IhJ6ad0LL1KXZkcDGrHX7PmeGciY0QFQj6xWe47JeaFBn NYyb7pZDGeULuBfZnAxeYbfe1SPZDcRkapyg+7HQ3Q25+10Q88PJFqG1jwTPKQEs+aAF 8QjQmijSFyMY28v7aZog+DOw6J3asTQFHZQDpf9zaCN6QcHAUBB+f1OLKCTSO0O/Z1Vm 5DyRZ1bKYdfrb9e8fQj2MhZBvr3lQvmETI20zIzO3n7pqUMTVnUG/cLagA21gBwCAlMt QhCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405756; x=1794010556; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=yVnabflqnxV8/zCDKyMXJ67qoJMX/ah2HwrRlaW2LIg=; b=MtTXQSvdZNEZCghtvKsqitiLyDcl5mnNCaQO3g5gr4PTgSaVO4TQ3esJRjoFfGGGzj zgvGwyEdEVRkESZeJIx2pzxK3enoDWf0Lz6tTL+fR+xUOg1NmZaB+Ule+sqUrLI/+qcY 1S6gssx5yMkb51ZgI9QG5tWWyHwZ8G+FcZ3P8sMDiEGS6BQmkKOthQ+UJFA9qnWAiORU mBsxbfhD/Rwz66WBhWlMZ5JhCnq53AfCBiKB9NdJxrrgu+KVDxGBSGIqKx8fDsbEayaD jfaa5sNMuphvDnu5MBL3HY1OgdHZdukNGeD7B2Ouht9p6budyWfCUvzAxKzoucLUUSZ0 6Cmw== X-Gm-Message-State: AFq9FYKoWSghg1PGVyePJQ5OvUwhTTb/Cs+QWhNvicWj0Xi12MFtVQol xBJ3i3Q7AEZ+N6B/7Qbt/cg5/D70MiSr2myFdsXFcDyEbATbrstz/NTsESDJwmG6MIQqNzWyzqU SkA2i78c= X-Gm-Gg: AYBFou37jbzmijAhxF/aP5pp2zx1AwCNZnTl3RCTReFOsClCNdgsm0ZC54TAAxG1uCC wUlKhuGXuMaqV3b6EiGa2QDbTsWGgQWTYmNOkW9f+SUqW71mvIH7wvGuZqkHTeAvAsR4ANXYTBw nIq4ezkC13a563UQj6N7DsA1lsExinOr0628wJtJybrgZHvda+qe/cjeKJmQaAOPdvGmVa00bzE P26Q7mdeHJRWlFTJpoy3UK056kRh76457S+yDjW3vny3riYLQVGtBpUhflnSkR1ba86N5ILPvN3 gKHDwHqZbVqgwRD2WPPbR1DsbxJzcfbLrMKtEo3mubzz5br0stlTrPkGTjCoSrF+R09UCQ+GoEg lWmH9bnCxl4Q6isV0oHAmlSvMWcxBbR3Tp7OsGMr+y2rIV+qEqL9sSiqrWJa0p8ypeMJ4PgJbiH DJcS6XokbuL3WHysRz18Tr9Wycsyq3f1e+IXcg4EpHT2Fq+hIrsgmCrYvzIuoT9JTjYNDn5QmrJ /r6zDKrGqY5OyvyGrUEcdBkVqAKgiALwny+yyrq2rCq7BHMN5HSfSh3zkJzS4trOzMeD3Loif0X roN9VDT/mcmWEjNAM6UBz0L5P1t1oCcSy4Nk8iVD168rg221bm/AhwgTE96JkwUcVQiFW+EcDtM RRy2U1lhHEUyHrj4Y7fTn2eokniIg X-Received: by 2002:a05:600c:8b04:b0:4a1:fb01:13 with SMTP id 5b1f17b1804b1-4ac17a3683bmr88178115e9.18.1793405755776; Fri, 30 Oct 2026 17:15:55 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:55 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 22/55] glibc: patch CVE-2026-5450 Date: Sat, 31 Oct 2026 01:14:43 +0100 Message-ID: <8e0de08b8c72587c4eb71a876609f8cf21469dab.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249097 From: Peter Marko Pick patch [1] which is [2] backported to 2.41 (oldest release still receiving security updates) which is mentioned in [3]. [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=1a74f82eedaf0987eda1f522121e6a48fac502e7 [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=839898777226a3ed88c0859f25ffe712519b4ead [3] https://security-tracker.debian.org/tracker/CVE-2026-5450 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0032-CVE-2026-5450.patch | 133 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 134 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch diff --git a/meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch b/meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch new file mode 100644 index 00000000000..631b63f4654 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch @@ -0,0 +1,133 @@ +From 1a74f82eedaf0987eda1f522121e6a48fac502e7 Mon Sep 17 00:00:00 2001 +From: Rocket Ma +Date: Fri, 17 Apr 2026 23:48:41 -0700 +Subject: [PATCH] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008] + +* stdio-common/vfscanf-internal.c: When enlarging allocated buffer with +format %mc or %mC, glibc allocates one byte less, leading to +user-controlled one byte overflow. This commit fixes BZ #34008, or +CVE-2026-5450. + +Reviewed-by: Carlos O'Donell +Signed-off-by: Rocket Ma +Reviewed-by: H.J. Lu +(cherry picked from commit 839898777226a3ed88c0859f25ffe712519b4ead) + +CVE: CVE-2026-5450 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=1a74f82eedaf0987eda1f522121e6a48fac502e7] +Signed-off-by: Peter Marko +--- + stdio-common/Makefile | 4 +++ + stdio-common/tst-vfscanf-bz34008.c | 48 ++++++++++++++++++++++++++++++ + stdio-common/vfscanf-internal.c | 7 ++--- + 3 files changed, 55 insertions(+), 4 deletions(-) + create mode 100644 stdio-common/tst-vfscanf-bz34008.c + +diff --git a/stdio-common/Makefile b/stdio-common/Makefile +index ac098dcd8a..72c18e5dc1 100644 +--- a/stdio-common/Makefile ++++ b/stdio-common/Makefile +@@ -266,6 +266,7 @@ tests := \ + tst-vfprintf-width-i18n \ + tst-vfprintf-width-prec \ + tst-vfprintf-width-prec-alloc \ ++ tst-vfscanf-bz34008 \ + tst-wc-printf \ + tstdiomisc \ + tstgetln \ +@@ -401,6 +402,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \ + tst-vfprintf-width-prec-ENV = \ + MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \ + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so ++tst-vfscanf-bz34008-ENV = \ ++ MALLOC_CHECK_=3 \ ++ LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so + tst-printf-bz25691-ENV = \ + MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \ + LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so +diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf-bz34008.c +new file mode 100644 +index 0000000000..48371c8a3d +--- /dev/null ++++ b/stdio-common/tst-vfscanf-bz34008.c +@@ -0,0 +1,48 @@ ++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008) ++ Copyright (C) 2026 The GNU Toolchain Authors. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include "malloc/mcheck.h" ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define WIDTH 0x410 ++#define SCANFSTR "%1040mc" ++static int ++do_test (void) ++{ ++ mcheck_pedantic (NULL); ++ char *input = malloc (WIDTH + 1); ++ TEST_VERIFY (input != NULL); ++ memset (input, 'A', WIDTH); ++ input[WIDTH] = '\0'; ++ ++ char *buf = NULL; ++ TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1); ++ TEST_VERIFY (buf != NULL); ++ ++ free (buf); ++ free (input); ++ return 0; ++} ++ ++#include +diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c +index 1ba034d961..fabb0ec874 100644 +--- a/stdio-common/vfscanf-internal.c ++++ b/stdio-common/vfscanf-internal.c +@@ -853,8 +853,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + { + /* Enlarge the buffer. */ + size_t newsize +- = strsize +- + (strsize >= width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + + str = (char *) realloc (*strptr, newsize); + if (str == NULL) +@@ -925,7 +924,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + && wstr == (wchar_t *) *strptr + strsize) + { + size_t newsize +- = strsize + (strsize > width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + /* Enlarge the buffer. */ + wstr = (wchar_t *) realloc (*strptr, + newsize * sizeof (wchar_t)); +@@ -980,7 +979,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr, + && wstr == (wchar_t *) *strptr + strsize) + { + size_t newsize +- = strsize + (strsize > width ? width - 1 : strsize); ++ = strsize + (strsize >= width ? width : strsize); + /* Enlarge the buffer. */ + wstr = (wchar_t *) realloc (*strptr, + newsize * sizeof (wchar_t)); diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 0a4f7ac3bd6..e62d941fdde 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -64,6 +64,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0029-CVE-2026-6238-0005.patch \ file://0030-CVE-2026-6238-0006.patch \ file://0031-CVE-2026-5928.patch \ + file://0032-CVE-2026-5450.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102532 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3739.1793405758171530284 for ; Fri, 30 Oct 2026 17:15:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=oFvlI200; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a218c463d1so7692545e9.0 for ; Fri, 30 Oct 2026 17:15:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405756; x=1794010556; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MLhNWUoTNHVLsYRDxLZPPKaO+w+TJPNGXT3tbkXdYbA=; b=oFvlI200WkxYeNaP8gqj69/rsP0aBbe8oBhBsDpZGPT+ec8ZnCkH9qU810F/c4b/bG TYqxEJHcwC1PoCpoNuy7bCdQBwWFaBuFiRU3Vk5Gv8omSBysmlS/jWuSfpgve7RNS8le 839aR1C+Bbh6eeymeCfLSW4o5AB1G7kiUaOhWmEE4CyO5sahhkP2qYTvMWc/cL863IkD FyoZ1NbS27ybodD8mXwRNAPS3VcUjaxMllhKP7dhQsJOBJ+FZrfNehXHWz9daAWWJh7v eMW89wHh7xQ/YCgt0rJS0MgQycEpgyYOKnOrTULo+0eDrz1OFTy77kmw2kSAUpZ1ciPh TUPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405756; x=1794010556; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=MLhNWUoTNHVLsYRDxLZPPKaO+w+TJPNGXT3tbkXdYbA=; b=Mm4e8Q6UIh4OEr1TXcvtNcv7QCqhRuN9LrjsW7/wE1FabqU0V+Ad2/krhw+qNCTnk6 WIC00UIPXypvnqiDVbLKYzKP2dfsGETTLsGPF2e4or6xDGAj4/Bf98PpC0wbvD9m5Yqi wCQJqnGmQq1x1sEI/QwqwY8A0AwLx3hiTgPfcaYoI0yYQ4z1tsBokMrVCXDpSUd6NHGx HTwvNoK9uEMBtDQIuLzjRT7Em+Eg9WJLwD8P5Fh+kv0kXHVsbfTjcqeso4zbw5jgj/bV Un3Sog4ZBkDq/dO6knRd4EmsWEzUkHItB0YWikj4jetSyhikPG4u6vodZgghNLSc0HeH tySQ== X-Gm-Message-State: AFq9FYLFEWL3KNpnFXF4OLZFcAUreL3czsho6tKtJIdnKL7t5MoUOP8Z RUOnAM3/svLQFrFem/kUHSXZ9aiR1WXYcFymN0dJmM5g9TsbBSAN9st+3DUD2aCgkgjfJgaW1Kt uSAP/pM4= X-Gm-Gg: AYBFou0CJati4p5oGAYTxo2uPv0kJOZuEnGFfgE/sycyPsvc3fpbXg/cYX+UhIUkyE4 KcsXA+L3WkLfSkZPmPfcS3LxWt5N8396rqNeIPaK8eY8/H3xthxVJWY3VupVDdeINfXLm0hTXge 2N20CjSf4eo4f2UnLfKmyuUiG6j43VnlA9DMCRUOdiGq8JwQDaBzq4LdzPrJpc+iAza8WlF97gG 0Ns6SLCcdVCcQd4x2ZRn71l4RLpsaOpm3On2xcqZ/dWh04gXDETpocx/6mocjs3sanst0qRgVz3 D0YIc53eCVyE5e/0OiSqx+dcwDgVB8ctH9PSswlY4xqkmtKfmJEhkB0acg2h8GwuvkdvU9c2CTI 6hZRGNo/zeC5JK+28XIDFE6D47ORnZEe7o4cBf9GVOgn2m8dnlwXXn130lRajOFj9Exki0oWtXY ww+LEl/oM8VowfFZaW3e7iiVoMSvUWh+2QSqwOm9IW1M0Vlf5Q/br5GWqVU4lHrd7IrLgopK2qq wvXrUpbGuWBZIUq43PQvizz5qFqYbxZzoXktx4z957TK7vysvJYeLwBK4SV3OPEKdjepfmnWlk4 67K5G+1W8IIrRpaDPb6DXzM0Jj/vnBybpLaxPvAFIpTPUAo3L+f+azBFr6EaIohYen77iS79JHl 89H1p3qlR3vF1erRx7OncCow+JlMJ X-Received: by 2002:a05:600c:818e:b0:49f:fd40:80fa with SMTP id 5b1f17b1804b1-4ac1932aa2amr87699335e9.34.1793405756329; Fri, 30 Oct 2026 17:15:56 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:55 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 23/55] glibc: patch CVE-2026-6791 Date: Sat, 31 Oct 2026 01:14:44 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249098 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0033-CVE-2026-6791.patch | 364 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 365 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch diff --git a/meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch b/meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch new file mode 100644 index 00000000000..83294df46e8 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch @@ -0,0 +1,364 @@ +From 965b580070b8184b0dd390800d9194291a600e67 Mon Sep 17 00:00:00 2001 +From: Adhemerval Zanella +Date: Tue, 14 Apr 2026 10:50:37 -0300 +Subject: [PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ + 34091, CVE-2026-6791) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The parse_tilde function previously used strndupa to allocate memory +for the parsed username on the stack, and since the input is +user-defined, this can lead to a stack overflow. + +This patch fixes the issue by replacing strndupa with scratch_buffer, +by reusing the buffer used in the __getpwnam_r call. + +The new “tst-wordexp-tilde.c” test is a test-container to avoid using +system-defined NSS modules. + +Checked on x86_64-linux-gnu and i686-linux-gnu. + +(cherry picked from commit 07c24f35392b727e6100d33edfdf811a6c68c218) + +CVE: CVE-2026-6791 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=965b580070b8184b0dd390800d9194291a600e67] +Signed-off-by: Peter Marko +--- + posix/Makefile | 1 + + posix/tst-wordexp-tilde.c | 244 ++++++++++++++++++ + posix/tst-wordexp-tilde.root/etc/group | 1 + + .../tst-wordexp-tilde.root/etc/nsswitch.conf | 3 + + posix/tst-wordexp-tilde.root/etc/passwd | 1 + + posix/wordexp.c | 24 +- + 6 files changed, 268 insertions(+), 6 deletions(-) + create mode 100644 posix/tst-wordexp-tilde.c + create mode 100644 posix/tst-wordexp-tilde.root/etc/group + create mode 100644 posix/tst-wordexp-tilde.root/etc/nsswitch.conf + create mode 100644 posix/tst-wordexp-tilde.root/etc/passwd + +diff --git a/posix/Makefile b/posix/Makefile +index 9360bc7ff8..c2c05b3973 100644 +--- a/posix/Makefile ++++ b/posix/Makefile +@@ -354,6 +354,7 @@ tests-internal := \ + tests-container := \ + bug-ga2 \ + tst-vfork3 \ ++ tst-wordexp-tilde \ + # tests-container + + tests-time64 := \ +diff --git a/posix/tst-wordexp-tilde.c b/posix/tst-wordexp-tilde.c +new file mode 100644 +index 0000000000..1661603681 +--- /dev/null ++++ b/posix/tst-wordexp-tilde.c +@@ -0,0 +1,244 @@ ++/* Test wordexp tilde expansion with large usernames (BZ 34091). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++#include ++#include ++ ++typedef void (*func_callback_t)(void); ++ ++static void ++subprocess_small_stack (void *closure) ++{ ++ struct rlimit rl; ++ TEST_COMPARE (getrlimit (RLIMIT_STACK, &rl), 0); ++ rl.rlim_cur = 512 * 1024; ++ TEST_COMPARE (setrlimit (RLIMIT_STACK, &rl), 0); ++ ++ func_callback_t func_test = closure; ++ func_test (); ++} ++ ++/* Build a string "~/tail" where is LEN bytes of the ++ character CH. The caller must free the result. */ ++static char * ++make_tilde_input (char ch, size_t len, const char *tail) ++{ ++ /* ~ + len + / + tail + \0 */ ++ size_t taillen = tail != NULL ? strlen (tail) : 0; ++ size_t total = 1 + len + 1 + taillen + 1; ++ char *buf = xmalloc (total); ++ buf[0] = '~'; ++ memset (buf + 1, ch, len); ++ buf[1 + len] = '/'; ++ if (tail != NULL) ++ memcpy (buf + 1 + len + 1, tail, taillen); ++ buf[total - 1] = '\0'; ++ return buf; ++} ++ ++/* Test 1: A very long username must not crash. The username will not match ++ any real user, so wordexp returns ~/rest. */ ++static void ++test_long_username (void) ++{ ++ printf ("info: test_long_username_no_crash\n"); ++ ++ static const char REST[] = "rest"; ++ ++ /* 1 MiB username — well beyond any reasonable stack frame. */ ++ const size_t long_len = 1024 * 1024; ++ char *input = make_tilde_input ('A', long_len, REST); ++ ++ wordexp_t we = { 0 }; ++ int ret = wordexp (input, &we, 0); ++ /* The (non-existent) username is invalid, so wordexp falls back to ++ literal output: ~AAA…/rest. */ ++ TEST_COMPARE (ret, 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ ++ /* Verify prefix: '~' followed by long_len 'A's. */ ++ const char *result = we.we_wordv[0]; ++ TEST_COMPARE (result[0], '~'); ++ TEST_COMPARE (strlen (result), ++ 1 /* ~ */ + long_len + sizeof (REST)); ++ for (size_t j = 1; j <= long_len; j++) ++ if (result[j] != 'A') ++ { ++ printf (" mismatch at position %zu: expected 'A', got '%c'\n", ++ j, result[j]); ++ support_record_failure (); ++ break; ++ } ++ /* Verify the tail after the username. */ ++ TEST_COMPARE_STRING (result + 1 + long_len, "/rest"); ++ ++ wordfree (&we); ++ free (input); ++} ++ ++/* Test 2: A username that just exceeds the default scratch_buffer inline ++ size (1024 bytes) exercises the scratch_buffer_set_array_size growth path ++ without being excessively large. */ ++static void ++test_scratch_buffer_growth (void) ++{ ++ printf ("info: test_scratch_buffer_growth\n"); ++ ++ const size_t len = 2048; ++ char *input = make_tilde_input ('x', len, NULL); ++ ++ wordexp_t we = { 0 }; ++ int ret = wordexp (input, &we, 0); ++ TEST_COMPARE (ret, 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ ++ /* ~xxx…/ — the trailing slash makes a separate empty component, but ++ wordexp merges it into the single token ~xxx…/. */ ++ const char *result = we.we_wordv[0]; ++ TEST_COMPARE (result[0], '~'); ++ for (size_t j = 1; j <= len; j++) ++ if (result[j] != 'x') ++ { ++ printf (" mismatch at position %zu\n", j); ++ support_record_failure (); ++ break; ++ } ++ TEST_COMPARE (result[1 + len], '/'); ++ ++ wordfree (&we); ++ free (input); ++} ++ ++/* Test 3: ~root still resolves to the correct home directory through the ++ __getpwnam_r path. */ ++static void ++test_known_user (void) ++{ ++ printf ("info: test_known_user\n"); ++ ++ /* Look up root's home directory for comparison. */ ++ struct passwd *pw = getpwnam ("root"); ++ if (pw == NULL || pw->pw_dir == NULL) ++ { ++ printf (" SKIP: cannot look up root\n"); ++ return; ++ } ++ ++ char *expected = xasprintf ("%s/file", pw->pw_dir); ++ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("~root/file", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ TEST_COMPARE_STRING (we.we_wordv[0], expected); ++ ++ wordfree (&we); ++ free (expected); ++} ++ ++/* Test 4: Bare tilde expands to $HOME. */ ++static void ++test_bare_tilde (void) ++{ ++ printf ("info: test_bare_tilde\n"); ++ ++ const char *home = getenv ("HOME"); ++ if (home == NULL) ++ { ++ printf (" SKIP: HOME is not set\n"); ++ return; ++ } ++ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("~", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ TEST_COMPARE_STRING (we.we_wordv[0], home); ++ ++ wordfree (&we); ++} ++ ++/* Test 5: Short non-existent username falls back to literal ~username output, ++ exercising the invalid-login-name path. */ ++static void ++test_unknown_user (void) ++{ ++ printf ("info: test_unknown_user\n"); ++ ++ /* Pick a username that is extremely unlikely to exist. */ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("~no_such_user_xyzzy42", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ TEST_COMPARE_STRING (we.we_wordv[0], "~no_such_user_xyzzy42"); ++ ++ wordfree (&we); ++} ++ ++/* Test 6: Tilde with username and WRDE_APPEND — exercises parse_tilde's ++ interaction with the WRDE_APPEND word list. */ ++static void ++test_tilde_with_append (void) ++{ ++ printf ("info: test_tilde_with_append\n"); ++ ++ const char *home = getenv ("HOME"); ++ if (home == NULL) ++ { ++ printf (" SKIP: HOME is not set\n"); ++ return; ++ } ++ ++ wordexp_t we = { 0 }; ++ TEST_COMPARE (wordexp ("first", &we, 0), 0); ++ ++ TEST_COMPARE (wordexp ("~/path", &we, WRDE_APPEND), 0); ++ TEST_COMPARE (we.we_wordc, 2); ++ TEST_COMPARE_STRING (we.we_wordv[0], "first"); ++ ++ char *expected = xasprintf ("%s/path", home); ++ TEST_COMPARE_STRING (we.we_wordv[1], expected); ++ ++ wordfree (&we); ++ free (expected); ++} ++ ++static int ++do_test (void) ++{ ++ test_known_user (); ++ test_bare_tilde (); ++ test_unknown_user (); ++ test_tilde_with_append (); ++ ++ support_isolate_in_subprocess (subprocess_small_stack, ++ test_long_username); ++ ++ support_isolate_in_subprocess (subprocess_small_stack, ++ test_scratch_buffer_growth); ++ ++ return 0; ++} ++ ++#include +diff --git a/posix/tst-wordexp-tilde.root/etc/group b/posix/tst-wordexp-tilde.root/etc/group +new file mode 100644 +index 0000000000..1dbf9013ee +--- /dev/null ++++ b/posix/tst-wordexp-tilde.root/etc/group +@@ -0,0 +1 @@ ++root:x:0: +diff --git a/posix/tst-wordexp-tilde.root/etc/nsswitch.conf b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf +new file mode 100644 +index 0000000000..098a8d5938 +--- /dev/null ++++ b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf +@@ -0,0 +1,3 @@ ++passwd: files ++group: files ++shadow: files +diff --git a/posix/tst-wordexp-tilde.root/etc/passwd b/posix/tst-wordexp-tilde.root/etc/passwd +new file mode 100644 +index 0000000000..eb85a552ad +--- /dev/null ++++ b/posix/tst-wordexp-tilde.root/etc/passwd +@@ -0,0 +1 @@ ++root:x:0:0:root:/root:/bin/sh +diff --git a/posix/wordexp.c b/posix/wordexp.c +index 9df4bb7424..731d1650e9 100644 +--- a/posix/wordexp.c ++++ b/posix/wordexp.c +@@ -335,17 +335,29 @@ parse_tilde (char **word, size_t *word_length, size_t *max_length, + else + { + /* Look up user name in database to get home directory */ +- char *user = strndupa (&words[1 + *offset], i - (1 + *offset)); +- struct passwd pwd, *tpwd; +- int result; ++ size_t userlen = i - (1 + *offset); ++ /* tmpbuf contains both the user and the __getpwnam_r working area. */ + struct scratch_buffer tmpbuf; + scratch_buffer_init (&tmpbuf); ++ if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1)) ++ return WRDE_NOSPACE; ++ char *user = tmpbuf.data; ++ memcpy (user, &words[1 + *offset], userlen); ++ user[userlen] = '\0'; + +- while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length, ++ struct passwd pwd, *tpwd; ++ int result; ++ while ((result = __getpwnam_r (user, ++ &pwd, ++ tmpbuf.data + userlen + 1, ++ tmpbuf.length - userlen - 1, + &tpwd)) != 0 + && errno == ERANGE) +- if (!scratch_buffer_grow (&tmpbuf)) +- return WRDE_NOSPACE; ++ { ++ if (!scratch_buffer_grow_preserve (&tmpbuf)) ++ return WRDE_NOSPACE; ++ user = tmpbuf.data; ++ } + + if (result == 0 && tpwd != NULL && pwd.pw_dir) + *word = w_addstr (*word, word_length, max_length, pwd.pw_dir); diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index e62d941fdde..26aa6fb275e 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -65,6 +65,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0030-CVE-2026-6238-0006.patch \ file://0031-CVE-2026-5928.patch \ file://0032-CVE-2026-5450.patch \ + file://0033-CVE-2026-6791.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102543 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3736.1793405759389919788 for ; Fri, 30 Oct 2026 17:15:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=BByt6eIS; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a20a37703bso9691875e9.1 for ; Fri, 30 Oct 2026 17:15:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405758; x=1794010558; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bzyES17Lan1TINzWAIxKeSbf20rcIk6qWVoMI0bO5dI=; b=BByt6eIS6E7DeuxWj9pXGMx8/uOkC4sJu2Ab6Wwynv8xA3x+E0W8xefUaZ6oz8p/Zq qs7zxnWYdVrtZ5D6XBqOGYbmHYqTx5WEDOKr8mbEiaIzve1k7+53pDWiUuzeXArN3taZ 1kpIOWYHJ3j68vkeQ0ASTLWl6XKgT2zilkKIhQ1JFux1HoE3/6NqNiAjKKc3th3+Nkv9 VR4Ec5iH7G5xMUMTPsWWRWNem0KwJf/LNi30IF/yuAHU1/5Q+UKJneg3ra78kPTuLDj/ WuFmvBIwR4zZoHPdrSnxRhW0WqVcTdqs+//QlIMATScviU65olES+291zG/ZB1UiwXvL NMwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405758; x=1794010558; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bzyES17Lan1TINzWAIxKeSbf20rcIk6qWVoMI0bO5dI=; b=gQphDAdLWWHE+yOT5N4NTIVZGjWOjaDNnz7GzcIr4CeGigMCi2ba1/aFsEF/fLlzxa qHPEvUg5y9wAYbMLSCeYcEt/6wwiWa1+XnImuaqAyjUCyBgXN993Hyvp0Kf0HXLQN85B dNJu7hZyPiyjaHHVFLX9+612ZBILNPPEbBa9S/5dBbHWzlM+ZUaRRFsf2hhkuFwSdRc0 jDUKi7ncGuoC+EPPrlf7BnSrE1uLKWolnuuRTnJJHNXtldCl87BNmlum8YwKyiZUum5x HoJjMHjJg7HgyvR+9m1SCK4jVeoRjfLMDj1r9OWdC+CtSz51o2g+4Aaq0fgQmPhs+Emp XhJQ== X-Gm-Message-State: AFq9FYJFqxzDRMXjPXMr2AlGuAGN7caE5zbtKGWFMixVc/mUWSXbakm7 v4m4vkSzqC1AVzvKArCDk0/pedAHKVD7D4wZGZljk3Kh2fL4UVkY7C583C1DPSgZyycBiko5BWc BdcBan/M= X-Gm-Gg: AYBFou0KIAsQFI71XwGd+gB9ilIe0FGtfsN8T6Ir+LAVuVGZMPNgzLoFS0mNY4Vae7U lIWpYLiIvt1/aaYxQ25E2jVvj8VH0qYb5v96pjqxiG5b6lNPUz0G38ZplRMsXp5BczeDdCX/o03 t8WnDbxZkwEzAQ5R0enBIHsxjxIymX2r1bdp6sfEi4V9YhBhcpRaqEJtOlqILj7HpY8rhXeDUd7 /xHYx0MJpchczmv1XT6G+y4iIQBMfT96dD/lj/Vu/EImmo5ZznCEXqBMxehQyYardsSK/3AQowh 8FdU+GqSmwqVJeN6CKi8L3wCbl1yTLaR8nrSSO92lGi6kWS6bZlZhBiL84ahl7445GPsK/nwRBb IJEpvDEjxIAEiuqfj5UPt8YZw/WNokPomeWyYMuOXtU+oQ8ASaOZJrkuSz3HUeIRj3VYzH1bEH/ /sMrK9dYpeP0ZN9o9JdX/bjqOxeGLQS06bmqq9cNO/1sRxe3ygTrlApyCKK4+tCcd9DCi8B6JFM msTCRh1AIr42m8yYJSbLUW5vUJQ6y6vytxyzsvEqlybkZJlo7xdinZ0dR7em8geR6sJXtbcaXer mQrjHOsyg9D+Vz7B/pvqjwxgm27Wgy7waNmXYZRGkNKtOtTh3EaEJh/wGJ5oLYEWrDbuRvtBz1n hjyhm6+anbm0AXD+/s/i6UXXyX73o X-Received: by 2002:a05:600c:3b29:b0:4a2:167a:c939 with SMTP id 5b1f17b1804b1-4ac17d19aeamr79456375e9.21.1793405757275; Fri, 30 Oct 2026 17:15:57 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:56 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 24/55] glibc: patch CVE-2026-6368 Date: Sat, 31 Oct 2026 01:14:45 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249099 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name and backport URL] --- .../glibc/glibc/0034-CVE-2026-6368.patch | 577 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 578 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch diff --git a/meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch b/meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch new file mode 100644 index 00000000000..982d10845bf --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch @@ -0,0 +1,577 @@ +From dfc8ef388ef7856f318ade7dec501f92ce54f9e3 Mon Sep 17 00:00:00 2001 +From: Adhemerval Zanella +Date: Mon, 13 Apr 2026 16:33:30 -0300 +Subject: [PATCH] posix: Fix wordexp WRDE_APPEND to preserve state on + non-NOSPACE errors (BZ 34090, CVE-2026-6368) + +The previous implementation saved a copy of the wordexp_t struct at +entry and blindly restored it on error via (*pwordexp = old_word). +This is incorrect when WRDE_APPEND is set because w_addword may have +called realloc on we_wordv during partial processing before the error +was detected. If realloc relocated the buffer, the saved we_wordv +pointer is dangling; restoring it causes a use-after-free in the +caller (e.g. via wordfree), and the relocated buffer is leaked. + +Fix this by duplicating the we_wordv pointer array at entry when +WRDE_APPEND is set, so that all subsequent realloc calls inside +w_addword operate on the copy. + +This change also fixes a POSIX conformance issue: if the WRDE_APPEND +flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall +not be modified. + +Also fix two pre-existing error return paths in the '"' and '\'' cases +that returned directly from w_addword failures instead of going through +do_error, which would leak the saved array (and previously would also +skip the word cleanup). + +Checked on x86_64-linux-gnu and i686-linux-gnu. + +Reviewed-by: DJ Delorie +(cherry picked from commit e2cefe16c37a617df9f11407cb00a272a6098823) + +CVE: CVE-2026-6368 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=dfc8ef388ef7856f318ade7dec501f92ce54f9e3] +Signed-off-by: Peter Marko +--- + posix/Makefile | 1 + + posix/tst-wordexp-append.c | 393 +++++++++++++++++++++++++++++++++++++ + posix/wordexp.c | 69 ++++++- + 3 files changed, 454 insertions(+), 9 deletions(-) + create mode 100644 posix/tst-wordexp-append.c + +diff --git a/posix/Makefile b/posix/Makefile +index c2c05b3973..5358a3f8c1 100644 +--- a/posix/Makefile ++++ b/posix/Makefile +@@ -325,6 +325,7 @@ tests := \ + tst-wait3 \ + tst-wait4 \ + tst-waitid \ ++ tst-wordexp-append \ + tst-wordexp-nocmd \ + tst-wordexp-reuse \ + tstgetopt \ +diff --git a/posix/tst-wordexp-append.c b/posix/tst-wordexp-append.c +new file mode 100644 +index 0000000000..87f388f0a7 +--- /dev/null ++++ b/posix/tst-wordexp-append.c +@@ -0,0 +1,393 @@ ++/* Test for wordexp with WRDE_APPEND flag. ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++#include ++ ++#include ++#include ++ ++static unsigned int relocating_reallocs; ++ ++/* w_addword grows we_wordv with realloc, make every call guaranteed to ++ relocate the block. This makes BZ 34090 regression more deterministic. */ ++void * ++realloc (void *ptr, size_t size) ++{ ++ if (ptr == NULL) ++ return malloc (size); ++ if (size == 0) ++ { ++ free (ptr); ++ return NULL; ++ } ++ ++ void *new = malloc (size); ++ if (new == NULL) ++ return NULL; ++ ++ /* Copy only what is valid in the old block to avoid reading past it. */ ++ size_t old = malloc_usable_size (ptr); ++ memcpy (new, ptr, old < size ? old : size); ++ /* Clobber the old block so that a stale we_wordv pointer restored on the ++ error path reads garbage instead of the old contents, which might ++ otherwise survive intact and mask the bug. */ ++ memset (ptr, 0x5a, old); ++ free (ptr); ++ relocating_reallocs++; ++ return new; ++} ++ ++/* Verify that all words in we match the expected NULL-terminated ++ array. */ ++static void ++check_words (const wordexp_t *we, const char *const *expected) ++{ ++ size_t i; ++ for (i = 0; expected[i] != NULL; i++) ++ { ++ TEST_VERIFY (i < we->we_wordc); ++ TEST_COMPARE_STRING (we->we_wordv[we->we_offs + i], expected[i]); ++ } ++ TEST_COMPARE (we->we_wordc, i); ++} ++ ++#define CHECK_WORDS(we, ...) \ ++ do { \ ++ const char *const expected_[] = { __VA_ARGS__, NULL }; \ ++ check_words (we, expected_); \ ++ } while (0) ++ ++/* Test 1: WRDE_APPEND + WRDE_BADCHAR preserves we_wordc. */ ++static void ++test_append_badchar_preserves_count (void) ++{ ++ printf ("info: test_append_badchar_preserves_count\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("one two three", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 3); ++ ++ size_t saved_count = we.we_wordc; ++ ++ /* ')' triggers WRDE_BADCHAR and "extra" would be a new word if the ++ expansion succeeded, exercising the w_addword path before the error ++ is detected. */ ++ TEST_COMPARE (wordexp ("extra )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ ++ wordfree (&we); ++} ++ ++/* Test 2: WRDE_APPEND + WRDE_BADCHAR preserves the we_wordv pointer even ++ when internal realloc would move the buffer. */ ++static void ++test_append_badchar_preserves_pointer (void) ++{ ++ printf ("info: test_append_badchar_preserves_pointer\n"); ++ wordexp_t we = { 0 }; ++ ++ /* Use many words so that the initial we_wordv allocation is ++ non-trivial and a later realloc is more likely to move it. */ ++ TEST_COMPARE (wordexp ("a b c d e f g h", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 8); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ unsigned int saved_reallocs = relocating_reallocs; ++ ++ /* The interposed realloc guarantees the internal we_wordv buffer moves ++ during parsing, so the pointer-stability check below is meaningful. */ ++ TEST_COMPARE (wordexp ("append )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ /* Verify that a relocating realloc actually happened during the failed ++ call, otherwise the pointer-stability check is vacuous. */ ++ TEST_VERIFY (relocating_reallocs > saved_reallocs); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ ++ wordfree (&we); ++} ++ ++/* Test 3: After a failed WRDE_APPEND the original words are still accessible ++ and correct. */ ++static void ++test_append_badchar_words_intact (void) ++{ ++ printf ("info: test_append_badchar_words_intact\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("alpha beta gamma", &we, 0), 0); ++ CHECK_WORDS (&we, "alpha", "beta", "gamma"); ++ ++ TEST_COMPARE (wordexp ("delta )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ ++ /* Words must still be intact. */ ++ CHECK_WORDS (&we, "alpha", "beta", "gamma"); ++ /* The NULL terminator must still be present. */ ++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL); ++ ++ wordfree (&we); ++} ++ ++/* Test 4: Successful WRDE_APPEND still works (regression test). */ ++static void ++test_append_success (void) ++{ ++ printf ("info: test_append_success\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("hello", &we, 0), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ ++ char **saved_wordv = we.we_wordv; ++ ++ TEST_COMPARE (wordexp ("world", &we, WRDE_APPEND), 0); ++ TEST_COMPARE (we.we_wordc, 2); ++ /* A successful append works on a fresh copy of the array, so the ++ caller-visible pointer must have changed. */ ++ TEST_VERIFY (we.we_wordv != saved_wordv); ++ CHECK_WORDS (&we, "hello", "world"); ++ ++ wordfree (&we); ++} ++ ++/* Test 5: Successful append after a failed append — the implementation must ++ recover and allow further use of the wordexp_t. */ ++static void ++test_append_success_after_failure (void) ++{ ++ printf ("info: test_append_success_after_failure\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("first", &we, 0), 0); ++ CHECK_WORDS (&we, "first"); ++ ++ TEST_COMPARE (wordexp ("bad |", &we, WRDE_APPEND), WRDE_BADCHAR); ++ ++ /* State must be exactly as before the failed call. */ ++ CHECK_WORDS (&we, "first"); ++ ++ /* A subsequent successful append must work. */ ++ TEST_COMPARE (wordexp ("second third", &we, WRDE_APPEND), 0); ++ CHECK_WORDS (&we, "first", "second", "third"); ++ ++ wordfree (&we); ++} ++ ++/* Test 6: Multiple consecutive failed appends do not corrupt state. */ ++static void ++test_append_multiple_failures (void) ++{ ++ printf ("info: test_append_multiple_failures\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("keep this", &we, 0), 0); ++ CHECK_WORDS (&we, "keep", "this"); ++ ++ size_t saved_count = we.we_wordc; ++ char **saved_wordv = we.we_wordv; ++ ++ /* Each of these bad characters must leave the state unchanged. */ ++ TEST_COMPARE (wordexp ("x )", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x |", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x ;", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x &", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x <", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (wordexp ("x >", &we, WRDE_APPEND), WRDE_BADCHAR); ++ ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ CHECK_WORDS (&we, "keep", "this"); ++ ++ wordfree (&we); ++} ++ ++/* Test 7: WRDE_APPEND with WRDE_SYNTAX error (unterminated quote) also ++ preserves state. */ ++static void ++test_append_syntax_error (void) ++{ ++ printf ("info: test_append_syntax_error\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("original", &we, 0), 0); ++ CHECK_WORDS (&we, "original"); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ ++ /* Unterminated double quote triggers WRDE_SYNTAX. */ ++ TEST_COMPARE (wordexp ("\"unterminated", &we, WRDE_APPEND), WRDE_SYNTAX); ++ ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ CHECK_WORDS (&we, "original"); ++ ++ wordfree (&we); ++} ++ ++/* Test 8: Error without WRDE_APPEND still works (regression test for the ++ non-APPEND code path in do_error). */ ++static void ++test_no_append_error (void) ++{ ++ printf ("info: test_no_append_error\n"); ++ wordexp_t we = { 0 }; ++ ++ /* Simple failure without WRDE_APPEND. */ ++ TEST_COMPARE (wordexp ("bad |", &we, 0), WRDE_BADCHAR); ++ ++ /* After failure without WRDE_APPEND the struct should be safe to ++ reuse — start fresh. */ ++ TEST_COMPARE (wordexp ("ok", &we, 0), 0); ++ CHECK_WORDS (&we, "ok"); ++ ++ wordfree (&we); ++} ++ ++/* Test 9: WRDE_BADCHAR on the very first character (no partial words added ++ before the error). */ ++static void ++test_append_badchar_immediate (void) ++{ ++ printf ("info: test_append_badchar_immediate\n"); ++ wordexp_t we = { 0 }; ++ ++ TEST_COMPARE (wordexp ("hello world", &we, 0), 0); ++ CHECK_WORDS (&we, "hello", "world"); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ ++ /* The bad character is the very first byte — no w_addword call happens ++ before the error. */ ++ TEST_COMPARE (wordexp ("|", &we, WRDE_APPEND), WRDE_BADCHAR); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ ++ wordfree (&we); ++} ++ ++/* Test 10: WRDE_APPEND into an empty wordexp_t (initial call uses WRDE_APPEND ++ with a zeroed struct — unusual but allowed). */ ++static void ++test_append_into_empty (void) ++{ ++ printf ("info: test_append_into_empty\n"); ++ wordexp_t we = { 0 }; ++ ++ /* First call with WRDE_APPEND on a zeroed struct. The implementation ++ must handle we_wordv == NULL gracefully. */ ++ TEST_COMPARE (wordexp ("solo", &we, WRDE_APPEND), 0); ++ TEST_COMPARE (we.we_wordc, 1); ++ CHECK_WORDS (&we, "solo"); ++ ++ wordfree (&we); ++} ++ ++/* Verify that the leading we_offs slots are all NULL. */ ++static void ++check_offs_null (const wordexp_t *we) ++{ ++ for (size_t i = 0; i < we->we_offs; i++) ++ TEST_VERIFY (we->we_wordv[i] == NULL); ++} ++ ++/* Test 11: successful WRDE_APPEND with WRDE_DOOFFS and a non-zero we_offs. ++ The leading offset slots must stay NULL and words must land at ++ we_wordv[we_offs + i] across both the initial and the appended call. */ ++static void ++test_dooffs_append_success (void) ++{ ++ printf ("info: test_dooffs_append_success\n"); ++ wordexp_t we = { 0 }; ++ we.we_offs = 2; ++ ++ TEST_COMPARE (wordexp ("one two", &we, WRDE_DOOFFS), 0); ++ TEST_COMPARE (we.we_offs, 2); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "one", "two"); ++ ++ TEST_COMPARE (wordexp ("three", &we, WRDE_APPEND | WRDE_DOOFFS), 0); ++ TEST_COMPARE (we.we_offs, 2); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "one", "two", "three"); ++ /* The NULL terminator must sit right after the last word. */ ++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL); ++ ++ wordfree (&we); ++} ++ ++/* Test 12: failed WRDE_APPEND with WRDE_DOOFFS preserves we_wordc, the ++ we_wordv pointer, the words and the leading NULL offset slots. This ++ exercises the we_offs arithmetic in the array duplication and in the ++ error-path cleanup (we_wordv[we_offs + --we_wordc]). */ ++static void ++test_dooffs_append_error_preserves_state (void) ++{ ++ printf ("info: test_dooffs_append_error_preserves_state\n"); ++ wordexp_t we = { 0 }; ++ we.we_offs = 3; ++ ++ TEST_COMPARE (wordexp ("alpha beta", &we, WRDE_DOOFFS), 0); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "alpha", "beta"); ++ ++ char **saved_wordv = we.we_wordv; ++ size_t saved_count = we.we_wordc; ++ unsigned int saved_reallocs = relocating_reallocs; ++ ++ /* "gamma" is a partial word added via w_addword (forcing a relocating ++ realloc of we_wordv) before ')' triggers WRDE_BADCHAR. */ ++ TEST_COMPARE (wordexp ("gamma )", &we, WRDE_APPEND | WRDE_DOOFFS), ++ WRDE_BADCHAR); ++ TEST_VERIFY (relocating_reallocs > saved_reallocs); ++ ++ TEST_COMPARE (we.we_offs, 3); ++ TEST_COMPARE (we.we_wordc, saved_count); ++ TEST_VERIFY (we.we_wordv == saved_wordv); ++ check_offs_null (&we); ++ CHECK_WORDS (&we, "alpha", "beta"); ++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL); ++ ++ wordfree (&we); ++} ++ ++static int ++do_test (void) ++{ ++ test_append_badchar_preserves_count (); ++ test_append_badchar_preserves_pointer (); ++ test_append_badchar_words_intact (); ++ test_append_success (); ++ test_append_success_after_failure (); ++ test_append_multiple_failures (); ++ test_append_syntax_error (); ++ test_no_append_error (); ++ test_append_badchar_immediate (); ++ test_append_into_empty (); ++ test_dooffs_append_success (); ++ test_dooffs_append_error_preserves_state (); ++ ++ return 0; ++} ++ ++#include +diff --git a/posix/wordexp.c b/posix/wordexp.c +index 731d1650e9..50b0d7a256 100644 +--- a/posix/wordexp.c ++++ b/posix/wordexp.c +@@ -35,6 +35,7 @@ + #include + #include <_itoa.h> + #include ++#include + + /* + * This is a recursive-descent-style word expansion routine. +@@ -2224,6 +2225,12 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + char ifs_white[4]; + wordexp_t old_word = *pwordexp; + ++ /* When WRDE_APPEND is set we work on a copy of the we_wordv array so that ++ the caller's original pointer is never invalidated by realloc inside ++ w_addword. The saved_wordv keeps the original; on success we free it, ++ on non-NOSPACE error we free the working copy and restore the original. */ ++ char **saved_wordv = NULL; ++ + if (flags & WRDE_REUSE) + { + /* Minimal implementation of WRDE_REUSE for now */ +@@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + pwordexp->we_offs = 0; + } + } ++ else if (pwordexp->we_wordv != NULL) ++ { ++ /* WRDE_APPEND with an existing word list: duplicate the array so that ++ realloc during parsing does not invalidate the caller's pointer. The ++ strings themselves are shared. */ ++ size_t num_p; ++ char **dup; ++ if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p) ++ || INT_ADD_WRAPV (num_p, 1, &num_p)) ++ return WRDE_NOSPACE; ++ dup = __libc_reallocarray (NULL, num_p, sizeof *dup); ++ if (dup == NULL) ++ return WRDE_NOSPACE; ++ memcpy (dup, pwordexp->we_wordv, num_p * sizeof *dup); ++ saved_wordv = pwordexp->we_wordv; ++ pwordexp->we_wordv = dup; ++ } + + /* Find out what the field separators are. + * There are two types: whitespace and non-whitespace. +@@ -2338,7 +2362,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + error = w_addword (pwordexp, NULL); + + if (error) +- return error; ++ goto do_error; + } + + break; +@@ -2356,7 +2380,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + error = w_addword (pwordexp, NULL); + + if (error) +- return error; ++ goto do_error; + } + + break; +@@ -2422,10 +2446,18 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags) + + /* There was a word separator at the end */ + if (word == NULL) /* i.e. w_newword */ +- return 0; ++ { ++ free (saved_wordv); ++ return 0; ++ } + +- /* There was no field separator at the end */ +- return w_addword (pwordexp, word); ++ /* There was no field separator at the end. The only possible error ++ from w_addword is WRDE_NOSPACE. */ ++ error = w_addword (pwordexp, word); ++ if (error != 0) ++ goto do_error; ++ free (saved_wordv); ++ return 0; + + do_error: + /* Error: +@@ -2436,11 +2468,30 @@ do_error: + free (word); + + if (error == WRDE_NOSPACE) +- return WRDE_NOSPACE; ++ { ++ /* we_wordc and we_wordv are updated to reflect any words that were ++ successfully expanded. The old array is obsolete. */ ++ free (saved_wordv); ++ return WRDE_NOSPACE; ++ } + +- if ((flags & WRDE_APPEND) == 0) +- wordfree (pwordexp); ++ if (flags & WRDE_APPEND) ++ { ++ /* POSIX 2024 states that for in other error cases, if the WRDE_APPEND ++ flag was specified, we_wordc and we_wordv shall not be modified. ++ ++ Free strings appended during this call, discard the working copy of ++ we_wordv, and restore the caller's original pointer. */ ++ while (pwordexp->we_wordc > old_word.we_wordc) ++ free (pwordexp->we_wordv[pwordexp->we_offs + --pwordexp->we_wordc]); ++ free (pwordexp->we_wordv); ++ pwordexp->we_wordv = saved_wordv; ++ } ++ else ++ { ++ wordfree (pwordexp); ++ *pwordexp = old_word; ++ } + +- *pwordexp = old_word; + return error; + } diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 26aa6fb275e..b7f6278c95a 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -66,6 +66,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0031-CVE-2026-5928.patch \ file://0032-CVE-2026-5450.patch \ file://0033-CVE-2026-6791.patch \ + file://0034-CVE-2026-6368.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102544 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3740.1793405759587732044 for ; Fri, 30 Oct 2026 17:15:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=kLuzt86y; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a5b2be99a8so8104765e9.2 for ; Fri, 30 Oct 2026 17:15:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405758; x=1794010558; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=XJyI0grHAWQ2SKe1I9yHMJY+ZwqKLuwF46fLMNFDNn0=; b=kLuzt86yLVazcHQEFCYCns5wN9dtJwivn4PursazcQWzpsfWy4DHKf1u9DuDHt0xaA Mb1hUA7lLBd311HV+qYUp9fdgYP76tdKDITPRrHpNhrGGr5wYue+z76tsiEKBxfEBCA3 Y7+UgH8bPyg4vMS7MuAsgRhq3anP2iRr91eMgz/ucB378TQoHwlE7hpNYCDpGERvJ9+e tomKUMH3bz9e79uUXruCEeoEH6Rt5OUXLKQdmUM+Y/zTbUMECSCm4O0pdwr7T4/47gMy q1ZwSUMnJbioWjIioJHLjbLt3XsMaTiV4G5LksKaR+t/BVlumoz+eix9V0cDEHkbCgc+ Ggrg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405758; x=1794010558; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=XJyI0grHAWQ2SKe1I9yHMJY+ZwqKLuwF46fLMNFDNn0=; b=ImVebGdQWo7gHjgkY8lOV8DzFrRqjh+DOpq2icV1DLWTRZUNJLjGQQLm7SRkEKSnYC VsmXRXdmdnGGQVvoFLq/qardkNxnp3K4JbUjz540ReKSnxEtPDTroS+83iyY8LLUru1Q Ux8BTEUltnQyKnW6IsDdr3hxXYz3Hun14LUminhBXOHodh9qPQe1FTa960MX204+stZM cKLx0N6TCtWXDC/fo+FG2KaERz4vZ8Q70/LIwt4YuwH1LwvcQ00EV7sypV+9872P3hyg Texa2Z1Z2CeMFAdIVmxRRf2fOE0pezS/+M3Um+/O0D2Y8hZh31E6HPdnPKf7EslpRPm0 Pfhg== X-Gm-Message-State: AFq9FYK8pia3FVVwNwQ4zUo0TpgS+WgbIawUt8BgsLwEKvKLJuo0MOfF 8KSPAQheccQRKkMs8xHUUr5U5WejVPl3ZdCR4NSRz/7X/WzmToRxsAllEuk0KtbsCaq/tlRVeVs Ge4sQsmI= X-Gm-Gg: AYBFou1VpF9GyAf01XuNsYL/69iATvuSWQfamMmr0yOy3GI7zPgqft4Dekz5jF05FX3 8vOvTUqtgH0GB59H3KFBLk3ixl3/Re1o72odjr4k2ZKysm3SvLrC3QY51zq3A/regRah+TVy0ab /UwiQ6ZGdV8q/BTJVv2b9D1NYs/vgOXr5PkZhlnOljZniJsykooqldlBj/yAVCGH+FyCFm1JB7w Su99l1sVLX7HksL4eFIh92JvXP45wbzn/xmDrwPxMZfbyiFEuEb2EhkUOXr5daQyPXRiRDYHIFn /yDG9kwG6zK6t4x018mVDlf6nAgIYC+wsuuNMxnhnj+wS2TPFGrL6Iz48G6kwVaWp4ydAPnUph1 mt8WmN3JR02GWqTUUGAhbhXzg374mQo6Z/9VMHmrbQAhlEvxZVCZi30VT392uaPPCueEWimgjQN lyHOioxvV911p5zKbcFXCBCLfi9jNwLIaVCJWEwUPqKcW2tpDwbHHDRMESpKLf29RXvnBfg0UYa 15N1Fxxb4dAam925d44uWuqdNAUttXDnYsmGGQI3WwgwQaKkrgEsYOjLXLW/btgvf5zgDeCxW3S LHH973ytrwNgwq6ppcdGDsARR5mAbQMTKlhadEwPAY3AHqMTroBeBBrpW+rjhRsphPyXZMQzC8/ YB1PNQ07EGo+D5VLjrJiTjZnckhlX X-Received: by 2002:a05:600c:524c:b0:4a1:fcfa:2a07 with SMTP id 5b1f17b1804b1-4ac1960dd8dmr86629295e9.30.1793405757841; Fri, 30 Oct 2026 17:15:57 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:57 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 25/55] glibc: patch CVE-2026-19542 Date: Sat, 31 Oct 2026 01:14:46 +0100 Message-ID: <63acfcce6e0d6f926b5328d52407be935332493c.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249100 From: Peter Marko Pick patch [1] which is [2] backported to 2.41 (oldest release still receiving security updates) which is mentioned in [3]. [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=9318c2571576017d280a31b7b9ab576c9b696b1a [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=e2789c46e3bfdcd67a82bea9946b315c179e83d3 [3] https://security-tracker.debian.org/tracker/CVE-2026-19542 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0035-CVE-2026-19542.patch | 99 +++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 100 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch diff --git a/meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch b/meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch new file mode 100644 index 00000000000..5c82606792c --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch @@ -0,0 +1,99 @@ +From 9318c2571576017d280a31b7b9ab576c9b696b1a Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 14 Aug 2026 13:41:16 +0200 +Subject: [PATCH] misc: Fix out-of-bounds array write in tdelete (bug 34506) + +Allocate the maximum array sizes directly, instead of resizing +the arrays as needed. This eliminates alloca usage from the +function, and fixes the out-of-bounds accesses. The asserts +guard against the bug coming back if the balancing of the tree +turns out not to work correctly. + +Reviewed-by: Adhemerval Zanella +(cherry picked from commit e2789c46e3bfdcd67a82bea9946b315c179e83d3) + +CVE: CVE-2026-19542 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=9318c2571576017d280a31b7b9ab576c9b696b1a] +Signed-off-by: Peter Marko +--- + misc/tsearch.c | 31 +++++++++++-------------------- + 1 file changed, 11 insertions(+), 20 deletions(-) + +diff --git a/misc/tsearch.c b/misc/tsearch.c +index d15260baed..350fe15bf0 100644 +--- a/misc/tsearch.c ++++ b/misc/tsearch.c +@@ -85,6 +85,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -406,12 +407,13 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) + int cmp; + node *rootp = (node *) vrootp; + node root, unchained; +- /* Stack of nodes so we remember the parents without recursion. It's +- _very_ unlikely that there are paths longer than 40 nodes. The tree +- would need to have around 250.000 nodes. */ +- int stacksize = 40; ++ /* Stack of nodes so we remember the parents without recursion. The ++ stack size is a conservative approximation of the maximum height ++ of a red-black tree, based on size of the address space. ++ Actual numbers are closer to 57 (32 bit) and 117 (63 bit). */ ++ enum { stacksize = 2 * UINTPTR_WIDTH }; + int sp = 0; +- node **nodestack = alloca (sizeof (node *) * stacksize); ++ node *nodestack[stacksize]; + + if (rootp == NULL) + return NULL; +@@ -424,14 +426,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) + root = DEREFNODEPTR(rootp); + while ((cmp = (*compar) (key, root->key)) != 0) + { +- if (sp == stacksize) +- { +- node **newstack; +- stacksize += 20; +- newstack = alloca (sizeof (node *) * stacksize); +- nodestack = memcpy (newstack, nodestack, sp * sizeof (node *)); +- } +- ++ assert (sp < stacksize); + nodestack[sp++] = rootp; + p = DEREFNODEPTR(rootp); + if (cmp < 0) +@@ -470,13 +465,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) + node upn; + for (;;) + { +- if (sp == stacksize) +- { +- node **newstack; +- stacksize += 20; +- newstack = alloca (sizeof (node *) * stacksize); +- nodestack = memcpy (newstack, nodestack, sp * sizeof (node *)); +- } ++ assert (sp < stacksize); + nodestack[sp++] = parentp; + parentp = up; + upn = DEREFNODEPTR(up); +@@ -541,6 +530,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) + SETNODEPTR(pp,q); + /* Make sure pp is right if the case below tries to use + it. */ ++ assert (sp < stacksize); + nodestack[sp++] = pp = LEFTPTR(q); + q = RIGHT(p); + } +@@ -625,6 +615,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar) + SETLEFT(p,RIGHT(q)); + SETRIGHT(q,p); + SETNODEPTR(pp,q); ++ assert (sp < stacksize); + nodestack[sp++] = pp = RIGHTPTR(q); + q = LEFT(p); + } diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index b7f6278c95a..eb198427d1a 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -67,6 +67,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0032-CVE-2026-5450.patch \ file://0033-CVE-2026-6791.patch \ file://0034-CVE-2026-6368.patch \ + file://0035-CVE-2026-19542.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102541 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3738.1793405760299894895 for ; Fri, 30 Oct 2026 17:16:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=eHAO1G/+; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so12081125e9.1 for ; Fri, 30 Oct 2026 17:16:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405758; x=1794010558; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=acZltvv8U/hK3FqPP8SNuYpjpClnMu1iR1fpZYYRUH8=; b=eHAO1G/+bbtiy9y/QMzZQjcYYHQhz/6WZJfzPu2rfA1H575rw5+ELSBADPibJjF/dC SlanxRY8t0aCfzObruBU0+tdfbQQxeTgoglsK5CDO3LX2pwW7gLuysyBe0zU6N172aCj F+alAWW7eh1C/0oQvPbSYCbivFXynEgEe/K9abEI8bNO7Hk0/5UtrmKattep71GtGCRT tDTH3lwFUhRkrRq+WALCbobKAkYkPjtLfdWXNaimHNHKYYupW8BJ322LUjPPTm9oB0ZH Dmg9aqjA6TYSJv/Vc3IaXj4FH48s/lFE00Sq3hny8RKAvW6ZbvqvFv136/vHUzqay7y8 l/sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405758; x=1794010558; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=acZltvv8U/hK3FqPP8SNuYpjpClnMu1iR1fpZYYRUH8=; b=sQl6Ybe4BN1Z2x70FD9CW6bpKrNSATqTMQvXjv3wquclbzq1gLjiyJvAXaUOwSZIXC 28UodDXrmGdGw1UnRLFkGT/TOEZyhSw9zPQ2vqQPdDrFwpwNN9dn4/oRJdY40/uDOrwO 5GQUoDlWlL62ZdDIqh9XvweOBqsRMbL7D8Vh/h7Z1DTmCws9UnRXp+LSdFp5f292ACV3 lYclXa5pNb7Ik3Tsj019NIkgAcSR9geS2IQ2pLfU+yzsWlYExWj7wfTDlQh/AUy6VAZ+ 4y5OJvlkt8/mNCqZa2l1IZnqybWMIm1n4oHMB25NqALW9ssFHOU7O+FviRf1JZDiEfU0 Hj7w== X-Gm-Message-State: AFq9FYJUsL7pnadFUYo4l9vO/xqV7lRzI2zIvdXVzeptlgl51o5lHw1H yE67evnRMV876GT/oTQxotsG4QnmuAwni72PLfIDz5fO1T7dMagdFXKpPbnoDfZOH6/e+CCE4xI ZMSnO1mk= X-Gm-Gg: AYBFou2/p4CvYFoA79uPWYrJL/HbEGQSnGOGgyjUcTY+BnpyLYb6YhYgHgxbHIj4HMD 7pap6xYCavBhkyxLC31s/DWThORHAfoAkW/K3DRbyB5w/1ZJ7X/8LtCVo7Jbd37lEag4PPK/pkp nXVuLvDcNM5kXF+7GnwAOwbyZqoyCbkDp1zAQDMDkQwyu4/7qRWDZBrKaXlV5YUa0ikCEVK0ji/ ucLZ7zSxGCmN5csNxhOCVjuUo+DTDRMC2HRWjhtX74pezFGUgFASq7tGoVIznn3a4io9G80Bsql LHOczjfNxjakOxMg+BiOkDyKGqUZPelM9pf06UwPR59tqtqf5sq062yamDeZQF5NLk0PkJZge40 gm3fnFm/gyt415lkgI70Be3JxphI4MlqIDXiUPV4vN1G1G6leNTD8tmyzxTh5pOdIkhu37d8naC rjAyBcllzbmlP3n6BsZEaSnYrLiw+Qznx8BDrke0qSfaHKLY8CYJjS/k5P36xSEodKyGDGKrj5I 4pJEWAdPh1DumN93hURrl83IcWOj+8enhR7xjJ+DkItnw62RDG8bz2H1q0HEAO2+zTMDE2OTXhK Ta1+9GIScT8B6yhoNxY80CtntkuCJAySgaoFvLxZMjHfit/2cSpRjPiqzlknBzBff/ZgTxmU71i isyvsGf9gDQb7FtFuMLgnFmDQEm60 X-Received: by 2002:a05:600c:4f8b:b0:4a3:5a98:c279 with SMTP id 5b1f17b1804b1-4ac17ffb07cmr85525665e9.8.1793405758463; Fri, 30 Oct 2026 17:15:58 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:57 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 26/55] glibc: patch CVE-2026-19499 Date: Sat, 31 Oct 2026 01:14:47 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249101 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0036-CVE-2026-19499.patch | 100 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 101 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch diff --git a/meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch b/meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch new file mode 100644 index 00000000000..792c5276d0b --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch @@ -0,0 +1,100 @@ +From 5256941bc811248670eda4636dccd0a390d34dec Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Thu, 27 Aug 2026 13:34:54 +0200 +Subject: [PATCH] stdlib: Fix right-justification in strfmon (bug 34510, + CVE-2026-19499) + +The memmove call did not take into account that __printf_buffer_pad +updated the buffer pointers. + +Fixes commit e88b9f0e5cc50cab57a299dc7efe1a4eb385161d +("stdio-common: Convert vfprintf and related functions to buffers"), +which went into glibc 2.37. + +Reviewed-by: Adhemerval Zanella +(cherry picked from commit b090cf226ff65b913e41536f1f573f500855615c) + +CVE: CVE-2026-19499 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=5256941bc811248670eda4636dccd0a390d34dec] +Signed-off-by: Peter Marko +--- + stdlib/Makefile | 1 + + stdlib/strfmon_l.c | 5 +++-- + stdlib/tst-strfmon-bug34510.c | 33 +++++++++++++++++++++++++++++++++ + 3 files changed, 37 insertions(+), 2 deletions(-) + create mode 100644 stdlib/tst-strfmon-bug34510.c + +diff --git a/stdlib/Makefile b/stdlib/Makefile +index c9c8f702a2..b655f0e5eb 100644 +--- a/stdlib/Makefile ++++ b/stdlib/Makefile +@@ -324,6 +324,7 @@ tests := \ + tst-stdc_leading_zeros \ + tst-stdc_trailing_ones \ + tst-stdc_trailing_zeros \ ++ tst-strfmon-bug34510 \ + tst-strfmon_l \ + tst-strfrom \ + tst-strfrom-locale \ +diff --git a/stdlib/strfmon_l.c b/stdlib/strfmon_l.c +index 5e22aac750..bd849ff470 100644 +--- a/stdlib/strfmon_l.c ++++ b/stdlib/strfmon_l.c +@@ -549,7 +549,8 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc, + /* Now test whether the output width is filled. */ + if (buf->write_ptr - startp < width) + { +- size_t pad_width = width - (buf->write_ptr - startp); ++ size_t written_width = buf->write_ptr - startp; ++ size_t pad_width = width - written_width; + __printf_buffer_pad (buf, ' ', pad_width); + if (__printf_buffer_has_failed (buf)) + /* Implies length check. */ +@@ -558,7 +559,7 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc, + Otherwise move the field contents in place. */ + if (!left) + { +- memmove (startp + pad_width, startp, buf->write_ptr - startp); ++ memmove (startp + pad_width, startp, written_width); + memset (startp, ' ', pad_width); + } + } +diff --git a/stdlib/tst-strfmon-bug34510.c b/stdlib/tst-strfmon-bug34510.c +new file mode 100644 +index 0000000000..b187bde1f4 +--- /dev/null ++++ b/stdlib/tst-strfmon-bug34510.c +@@ -0,0 +1,33 @@ ++/* Test handling of right-padding in strfmon (bug 34510, CVE-2026-19499). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++ ++static int ++do_test (void) ++{ ++ struct support_next_to_fault ntf = support_next_to_fault_allocate (100); ++ TEST_COMPARE (strfmon (ntf.buffer, ntf.length, "%100n", 1.23), -1); ++ TEST_COMPARE (errno, E2BIG); ++ return 0; ++} ++ ++#include diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index eb198427d1a..567d53dd6f6 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -68,6 +68,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0033-CVE-2026-6791.patch \ file://0034-CVE-2026-6368.patch \ file://0035-CVE-2026-19542.patch \ + file://0036-CVE-2026-19499.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102542 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3739.1793405760926226941 for ; Fri, 30 Oct 2026 17:16:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=QkhU3wmC; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4a3517554f7so10822395e9.2 for ; Fri, 30 Oct 2026 17:16:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405759; x=1794010559; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=B8e/1hPUYF7XWTxY7TKGR+voFJWZw6veG77yXSTn9i4=; b=QkhU3wmCpElRI0agi70mknnVpfNp39Kl92ZN4flrnfVX8PTYODXY0lvhfGkDHnwtAG EgcT6cqNd6ufB6MI+KwMKjRqLoFMehWybePDvc8qU4llBdMTjcPUFwIdynXy8SI9BM0q whpYPLWn0+FEfaYoGvEo+OgtYiIO1ZrE6lw1c/V+jdNKubuTmElPvPSf+x8jQq3k9rAO BGRp49E+/4yemYlBGCEc7KlNkV2O8NDGVBOdDDwlueRTDH1/45UoCtxurMkjzdctTHzk c3HcgaTPm22AaTFdGzwY6GHnzs6XRFmuncbOzNLaWGsDqsBkW9hIzIDCCXAxxBtMPbxO 5lnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405759; x=1794010559; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=B8e/1hPUYF7XWTxY7TKGR+voFJWZw6veG77yXSTn9i4=; b=hKoqNWGlcIwxdukDqVSer013zDMMf0DvyQICnFae0GG4Y0LEjZfEYLiqiUNv8T41bJ pL2TceNLcVZGcn5FNfv/TmhZEFZG7wU5yIyJbU3XUo2JPsfTjQa7+vreDhteWG9u8wTi MEiQUsV0DM/cXQV7EnIL+v+2H51/TkTkd1HE9+iyzf3/eZHozWavjZJQ64KC9BUNKGjz Afckev4p5I8ZRWXvmoQHkdu5YJ2pCemaB6zVr6N3drjIcBnDSoAMwx9uWStXqRZqfsKn E7avhbRr0SvHQ7DrwBsJyMWtSPEw4+dKAh5ykJ9ck82qdfu6N1y/z8bKzu9GKgz/B6dp 7n0g== X-Gm-Message-State: AFq9FYLGxf0jkxikOfCllY6DESzILRmdrbecqMxP51zuO4frP9N6o/zx 5PEPlWugw/Vk25NGC/t4YT9uC9kP+SFSrnGBQGGqrcevJ7nVlq0FaB0o+IpWwHTTENQ8KlmNKIJ gw8MPubA= X-Gm-Gg: AYBFou1wzmV6RHkU44U8w2TXwh3LjFIQFDR3W4cg1niJOnyziaOVpW7iGpefmTTfJ/g ov4tNLJn2Hn1BeWjwSJHHoJdOh1PcVW1P7K7b+ECqbrYzqu9vugI1iPL+JG5AY26LHd9gDwBCPm 3KN7gtL08pZ3n2/MPzAZFIG6S+Atu3afiOEdntXEbmkLc1eyqmhIV8+6kchtt1eT0g7otCMZHyc YXnNGU/b2ADKnkvPPTrlItpacdm8tEErM5j07JxspdHIoh+Xa7GjQIZ+EiNDlLllRB5dn2FxLd2 zcmF5Mkdx2Nk+msatbD0Wpl7/fQpjiT//1WWf3pqLFA/ZKAMcP4ohOlT875cgiDVg1N6CAn7LHU B4PTy0xs3Dzwz6KbErEnLQKvRhJ9voS7LDsq6BvGfYX2BjRFdxlofscdficl2QFS4MmMKQy0u8i wLpo0X6GHmfcvBRtVobrBTHyH1gEN7UsMDVyDQSeqwxm+altfZIqepuobAQxw45Uh7WaryZfqWe +cWs1qT7F3le8G+66a6M3TNNPDTrfFYQ/URxto+hWEtTaAC0O0Qe2mQzp1WGkcrTTbozkXnXe0I 2zQwgaNiycwaHL/atMukrNK1S6vJfUzCWiPPQ96vgtb+cVVafGmXEDHf8YW2skJOphzBdUctJEL yCbbEUOJWiW4tWp1cS9NFeOaSg2K+TiM5i9jxPcNTQZJgNWo9OQ== X-Received: by 2002:a05:600c:1f87:b0:4a1:f68a:9736 with SMTP id 5b1f17b1804b1-4ac17b2be08mr85337655e9.26.1793405759129; Fri, 30 Oct 2026 17:15:59 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:58 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 27/55] glibc: patch CVE-2026-77117 Date: Sat, 31 Oct 2026 01:14:48 +0100 Message-ID: <53899a08c24fd46024112ebb665d4dcd4a04a8ea.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249102 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0037-CVE-2026-77117.patch | 32 +++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch diff --git a/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch new file mode 100644 index 00000000000..fa42a548c34 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch @@ -0,0 +1,32 @@ +From e43e46f94398b3de446fec11da1e7633ea5202ec Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 28 Aug 2026 10:26:07 +0200 +Subject: [PATCH] iconvdata: SHIFT_JISX0213 decoding lacks pending character + reset (CVE-2026-77117) + +This fixes bug 34556. + +Reviewed-by: Carlos O'Donell +(cherry picked from commit 68d94bbe50b7577d48998107d632ef3a0df050e3) + +CVE: CVE-2026-77117 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=e43e46f94398b3de446fec11da1e7633ea5202ec] +Signed-off-by: Peter Marko +--- + iconvdata/shift_jisx0213.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/iconvdata/shift_jisx0213.c b/iconvdata/shift_jisx0213.c +index 364298dcff..834fa81322 100644 +--- a/iconvdata/shift_jisx0213.c ++++ b/iconvdata/shift_jisx0213.c +@@ -226,6 +226,9 @@ + STANDARD_FROM_LOOP_ERR_HANDLER (1); \ + } \ + } \ ++ else \ ++ /* There was a pending character. Clear it. */ \ ++ *statep = 0; \ + \ + put32 (outptr, ch); \ + outptr += 4; \ diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 567d53dd6f6..3090b9cd277 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -69,6 +69,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0034-CVE-2026-6368.patch \ file://0035-CVE-2026-19542.patch \ file://0036-CVE-2026-19499.patch \ + file://0037-CVE-2026-77117.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102545 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3740.1793405761358170763 for ; Fri, 30 Oct 2026 17:16:01 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=heOiR6xD; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a549cd7fd2so11366115e9.0 for ; Fri, 30 Oct 2026 17:16:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405760; x=1794010560; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RNEOwpRbC8H/x/ExUaL8Olf+KaLVsgrAIpPMIDg6ZqA=; b=heOiR6xDrj4N3HvfupOS0x0Vfc5jnBFAP/vEwKYwnkN8nVSUFBW/LqfRGcS+W7XAyl XGaynQEqBLmOnuQPT6I0hSS3kFB907HPapDlxJIG4VELcWisZ5NBvgZoqXo1HM679Gyh cfmD8Ls23NU3Q9rVz+b30xmm9y4HjVCcawBCMoTRLnRZ80B5g2gIgY4i7ngPZjd3Ie4I baV0uSIha/9DLqc7cg04zSukcQxc3UbCLvvq4QB38b1peDx6ojIltO5p0uRnx/ooYM6u 3czEACcuYfB9MSzwpXzVYR7n66DBwlfGWxYa99PGqDS5gIB5mvYKEFqm7aLLC/3CJtPm BstQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405760; x=1794010560; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RNEOwpRbC8H/x/ExUaL8Olf+KaLVsgrAIpPMIDg6ZqA=; b=O05cXbLmDRH6ULGgX37XSStfUo8HmIcr6/ky47r4YYzB6rTNP5+PZIYFLCICQVm4V7 wPNHL6BcNBjmEyum5q/b/W473JQ0CwEeH4RAgoAtEMmHReflH9qYuxl6Qda6f/35fqmO TC0JSJOCKi4xqcArn1P/61OrI8+D30YuUPq9WsNeavYKiOOzbleo08s9DoIbT0H6iiXW VsQP08TtNAzBDBR/aQEye2wJaBjOCF5DwLAKoZEngxfMYZuGBm+0r0t5MNtQFHb9MfW6 CJEnMf4B0uXqXBxaOhG9sDT+NwM/7b1suvLZ8nmvYPyBZqt4mRsw3AESeMINe51R240X auyw== X-Gm-Message-State: AFq9FYI4Vtb7P38GzYhude6fQEVzdA8SNA0AwTGcLvuZuyTnd3m27Yn8 x70z4/TsQBUVhR6Zcr8QAawINFMDrsyy2sBjs6Jj7hGJ2JsHbF162CckC4xMsANeHLSGNs39hbp tP7XMmcE= X-Gm-Gg: AYBFou2h9pnnHrfdjatV2xeLVQe6hQ9PHzTuPthx/R2j02TUpEnxB5NXUPDNFZMSFxt Cf4MMEWY2P/El26/Kr1cUjHSsgCmjob8I7/C1h9xEox4IHnNozdVP+FwxAx7SFpsE0rKPHk6xEu pUiH0gVowh/3QszaZwYhUn8P93UUJUbbwBnKiGdgu45ZmAD53ok1CPCNp173RQ1ixJEDRVPjEcO DJyd6dkzQMZ8Wqa+Hypl49iiXWm5rx+BW2JiVJv0A8OoWmVka5nDZAb+vNWN5TTlA1KWlTNtIar tgplryDdxJZsBfQeewUWntY7GPxGI1daPvwVYpDjSflnuzoMMwz61FUyqbDu+RVG8rYjFOyW8xy zrlmTUnYPza3UyrHsnxAIS9aahGyivDpg2UgsDEKPR0D3nG+FjvvVSLb06CElqt5FrCHU4qLlpI w6DPHJ41q4CJS1VYhOulFV5zDBEVCr08kqsoLsZADrQ5RwBtZyzmBIb+mnEnRhj/4OTWcOmjLpe 5AseqZR+J4Yrz5DT5FxawJocxk8GlbzcccJ3wb/pt0ABKc/9NOviAOJD+llf/B+XKrHZYohhOv6 mRnXD0UTWNsUw+bKdmZFo3Eo6DHxuncAy7QK3vMen5MZALtUYQ0Du1C1I4l9AD1wtJcdyV1nLol O+VVdQBtMwov0gpDqi18cSYWe18T8 X-Received: by 2002:a05:600c:64c9:b0:4a2:180a:3417 with SMTP id 5b1f17b1804b1-4ac14dd1debmr90451745e9.1.1793405759610; Fri, 30 Oct 2026 17:15:59 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:59 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 28/55] glibc: patch CVE-2026-80489 Date: Sat, 31 Oct 2026 01:14:49 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249103 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0038-CVE-2026-80489.patch | 32 +++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch diff --git a/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch b/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch new file mode 100644 index 00000000000..3ca1c959bb2 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch @@ -0,0 +1,32 @@ +From ec116a0fbedcc860631e525e70b409cf295f27da Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 28 Aug 2026 10:26:07 +0200 +Subject: [PATCH] iconvdata: EUC_JISX0213 decoding lacks pending character + reset (CVE-2026-80489) + +This fixes bug 34568. + +Reviewed-by: Carlos O'Donell +(cherry picked from commit 4dafa087ff5fe7df45bd37dc727e988da6b8c935) + +CVE: CVE-2026-80489 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=ec116a0fbedcc860631e525e70b409cf295f27da] +Signed-off-by: Peter Marko +--- + iconvdata/euc-jisx0213.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/iconvdata/euc-jisx0213.c b/iconvdata/euc-jisx0213.c +index 9c3f28da2d..f0305c113a 100644 +--- a/iconvdata/euc-jisx0213.c ++++ b/iconvdata/euc-jisx0213.c +@@ -224,6 +224,9 @@ + STANDARD_FROM_LOOP_ERR_HANDLER (1); \ + } \ + } \ ++ else \ ++ /* There was a pending character. Clear it. */ \ ++ *statep = 0; \ + \ + put32 (outptr, ch); \ + outptr += 4; \ diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 3090b9cd277..bd0b4f06190 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -70,6 +70,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0035-CVE-2026-19542.patch \ file://0036-CVE-2026-19499.patch \ file://0037-CVE-2026-77117.patch \ + file://0038-CVE-2026-80489.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102546 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3741.1793405761822090395 for ; Fri, 30 Oct 2026 17:16:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=BJMb9xev; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a7992e2f7dso13601415e9.3 for ; Fri, 30 Oct 2026 17:16:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405760; x=1794010560; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=G1BSwD2yOYEo7wHo9m0oH696bE7lDCYieal0pyH2igg=; b=BJMb9xevKf/1Tt7/CRADRSBTO34b3jMKxweEtr+OJDHwE0tK6fh3oC8hTUMAoxkhGk fIWVUXIG18xo/vQdWtTzrOFII+Su5XTjseCy4AX/44syLSDqDHYa0Mde+iVNeTYCLFVc IQ+u0LGGdQhVgWieiGAYPrA/bXW43eH8vgrW6eZMsbw5Le9eklYSEp11NwX0s+slOzOO uzNOjRQ9vtFjz71Zxxw36s2gqdYiiPHRoLvjgmemELAHCnkYFXYnDzIs7KXZI5iWI0MU SH7bz2u57OQKmTvvQSf1EgIYuJcLGFSGJ5oZI/kncynGUaNhTspC0/jVlZCvFL/Ib6fK t7ag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405760; x=1794010560; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=G1BSwD2yOYEo7wHo9m0oH696bE7lDCYieal0pyH2igg=; b=yaUxDPxgCJVjG44M2BwBgGp38DHQ60fG3S0Vd59WO+i1MrtDfNAyxVz2xsLKtiLJRQ C/7nIFsejPUlPZ7mDk/0nFWTdbx3Xwk+7kuUAu09ic1VfN4+HmITHchiqzKsbT8xpBDB hqDRFbQlP1uSRxLHY885Q5m7wcvCa8CoBKz/w/0FoS5cPwIAj59YlXY0USAmWoT0WJB5 wpbMbJK7S7NsPs6tqYQPSCRAiu9XWvoVgwtKcVgkxN0As/rbseJZbZNC40ChuREkxN5e WrrTI8bpr5N5WyUfHK8KYb1ZDjEzIX+eN2pxNIwpIjsRXBGSjTqtB5HtbtueLQYO2zSh WwLA== X-Gm-Message-State: AFq9FYKCnKJspxrSJqqkvkFT9U/TpqDpf0W2B44nm156QvJHwXmrSJ7Z 3WelZ9VsZ0+5dxCXV4SWSIgxui2iNaU486a1bnPFw6o3yNiXjr4NI8lxW5rZQil81WMh/LyxULu bdID7q5k= X-Gm-Gg: AYBFou3v5H2qc/mHblhAWboyLHEwkS/CSsZjfCAokQKY1Q/JYnqJ2KK3ZN+5Wq+AUmg n4Al435ZUa0YCLDd3Sb/c7pnPXGjBZvOKDzP3DQ0J1aLph44YWMFIS3ngu9pLGz9MQ7/N6gSXQW iY+if6jQAJ34JsDnQ3qvHkePU9DSEmRmC0rMsEw5gF0pKNkyJVTfh47fktWs7Awil4XofnFh2j9 b4DTbq4ZKF0HS0CRwPNHAd4gutthVhkpFyEXu1GfHzm8qfyd3uq5mRE7EarnuR30voWofi9gJFg t02nrXiPdMF0/UbROXISDNmlnaYveTtToHibxQmaVakXxHk9+HUjXUHyjFV5B0A8ylVpr8asiZc GmMzUvjtG9V3lSKnUrvbLvCkW1Ikz/pdLpk0/PE2Mq19F6z3DTFhiD+p5yHEdK21EPCHdRi3far AX4jM4l1R/1Ww9diLtx3bcVBX3RZNAjhBeK3zpOt+jkxFPhkIdxlsFOBfaCDDj/yYMNmm0+r2va znCTTdpVEZWOYcii5t/vnxkHV8SorDWTQmgbcoyzkveSco8sxO1PNP4hnm2zyEvuGgFH50jHndX lALUyREvuBW9L+jvlvDIkqorfPOWxc16TRlK5zfuT4uD7Sg2RKsqOv68CThID0QmZ9FY+wb/DNS +NPIVkkwRgkUwzr0LdosGZLZo/Cey X-Received: by 2002:a05:600c:8b0a:b0:4a1:777b:8a12 with SMTP id 5b1f17b1804b1-4ac1709ae4emr93577105e9.14.1793405759997; Fri, 30 Oct 2026 17:15:59 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.15.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:15:59 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 29/55] glibc: add tests for CVE-2026-77117 and CVE-2026-80489. Date: Sat, 31 Oct 2026 01:14:50 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249104 From: Peter Marko Pick commit referencing bug IDs from patches for these CVEs from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../0039-CVE-2026-77117-CVE-2026-80489.patch | 172 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 173 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch diff --git a/meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch b/meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch new file mode 100644 index 00000000000..7e9141bd9f7 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch @@ -0,0 +1,172 @@ +From 3d141c23899d90559741b5fe74db97ccf0ef5c29 Mon Sep 17 00:00:00 2001 +From: Florian Weimer +Date: Fri, 28 Aug 2026 10:26:07 +0200 +Subject: [PATCH] iconvdata: Test case for bug 34556, bug 34568 + +Assisted-by: LLM +Reviewed-by: Carlos O'Donell +(cherry picked from commit 35efcffa97553df071bc37ab31fd7dc2c634e7da) + +CVE: CVE-2026-77117 +CVE: CVE-2026-80489 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=3d141c23899d90559741b5fe74db97ccf0ef5c29] +Signed-off-by: Peter Marko +--- + iconvdata/Makefile | 5 +- + iconvdata/tst-jisx0213-progress.c | 124 ++++++++++++++++++++++++++++++ + 2 files changed, 128 insertions(+), 1 deletion(-) + create mode 100644 iconvdata/tst-jisx0213-progress.c + +diff --git a/iconvdata/Makefile b/iconvdata/Makefile +index cc689f63e9..36f48749d2 100644 +--- a/iconvdata/Makefile ++++ b/iconvdata/Makefile +@@ -76,7 +76,8 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \ + tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \ + bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \ + bug-iconv13 bug-iconv14 bug-iconv15 \ +- tst-iconv-iso-2022-cn-ext tst-bug33980 ++ tst-iconv-iso-2022-cn-ext tst-bug33980 \ ++ tst-jisx0213-progress + ifeq ($(have-thread-library),yes) + tests += bug-iconv3 + endif +@@ -335,6 +336,8 @@ $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) + $(addprefix $(objpfx),$(modules.so)) + $(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \ + $(addprefix $(objpfx),$(modules.so)) ++$(objpfx)tst-jisx0213-progress.out: \ ++ $(addprefix $(objpfx), $(gconv-modules)) $(addprefix $(objpfx),$(modules.so)) + + $(objpfx)iconv-test.out: run-iconv-test.sh \ + $(addprefix $(objpfx), $(gconv-modules)) \ +diff --git a/iconvdata/tst-jisx0213-progress.c b/iconvdata/tst-jisx0213-progress.c +new file mode 100644 +index 0000000000..7b2073be1f +--- /dev/null ++++ b/iconvdata/tst-jisx0213-progress.c +@@ -0,0 +1,124 @@ ++/* Test JISX0213 combining character conversion progress (bug 34556, bug 34568). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++/* Certain JISX0213 byte sequences map to a combining sequence, for ++ example U+304B (HIRAGANA LETTER KA) followed by U+309A (COMBINING ++ SEMI-VOICED SOUND MARK). When converting to internal encoding ++ (actually UTF-32) with a small output buffer, the first code point ++ is emitted and the second is queued in the converter state. This ++ test verifies that the queued code point is consumed exactly once ++ on retry, so that the conversion makes progress and terminates. */ ++ ++#include ++#include ++#include ++#include ++ ++#include ++#include ++ ++static void ++test_one (const char *charset, const char *input, size_t outbufsize) ++{ ++ printf ("info: %s: testing output buffer size %zu\n", charset, outbufsize); ++ ++ /* Expected UTF-32 output. */ ++ static const wchar_t expected[] = { 0x304b, 0x309a, 'A' }; ++ ++ /* Use WCHAR_T encoding to avoid the BOM. */ ++ iconv_t cd = iconv_open ("WCHAR_T", charset); ++ TEST_VERIFY_EXIT (cd != (iconv_t) -1); ++ ++ char result[64]; ++ size_t result_len = 0; ++ ++ char *inptr = (char *) input; ++ size_t inleft = strlen (input); ++ ++ char outbuf[64]; ++ ++ int iterations = 0; ++ while (inleft > 0) ++ { ++ char *outptr = outbuf; ++ size_t outleft = outbufsize; ++ size_t inleft_before = inleft; ++ ++ size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft); ++ size_t produced = outptr - outbuf; ++ ++ TEST_VERIFY_EXIT (result_len + produced <= sizeof (result)); ++ memcpy (result + result_len, outbuf, produced); ++ result_len += produced; ++ ++ if (ret == (size_t) -1 && errno == E2BIG) ++ { ++ if (produced == 0 && inleft == inleft_before) ++ { ++ /* Output buffer too small for a single code point. */ ++ TEST_VERIFY_EXIT (outbufsize < 4); ++ break; ++ } ++ /* Bound iterations to detect non-progress bugs. */ ++ if (++iterations < 10) ++ continue; ++ else ++ { ++ FAIL ("%s: no progress", charset); ++ goto out; ++ } ++ } ++ if (ret == (size_t) -1) ++ FAIL_EXIT1 ("outbufsize %zu: iconv: %m", outbufsize); ++ break; ++ } ++ ++ /* Flush pending converter state. */ ++ { ++ char *outptr = outbuf; ++ size_t outleft = outbufsize; ++ size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft); ++ TEST_VERIFY (ret == 0); ++ size_t produced = outptr - outbuf; ++ memcpy (result + result_len, outbuf, produced); ++ result_len += produced; ++ } ++ ++ if (outbufsize >= 4) ++ { ++ TEST_COMPARE (inleft, 0); ++ TEST_COMPARE_BLOB (result, result_len, ++ expected, sizeof (expected)); ++ } ++ ++ out: ++ TEST_VERIFY_EXIT (iconv_close (cd) == 0); ++} ++ ++static int ++do_test (void) ++{ ++ for (size_t outbufsize = 1; outbufsize <= 16; outbufsize++) ++ { ++ test_one ("EUC-JISX0213", "\244\367A", outbufsize); ++ test_one ("SHIFT_JISX0213", "\202\365A", outbufsize); ++ } ++ return 0; ++} ++ ++#include diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index bd0b4f06190..144ce36ccc2 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -71,6 +71,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0036-CVE-2026-19499.patch \ file://0037-CVE-2026-77117.patch \ file://0038-CVE-2026-80489.patch \ + file://0039-CVE-2026-77117-CVE-2026-80489.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102556 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3741.1793405762545082191 for ; Fri, 30 Oct 2026 17:16:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=VvFzf8bi; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a207b02a2cso8818825e9.1 for ; Fri, 30 Oct 2026 17:16:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405761; x=1794010561; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=98M2pcD2IMyud5Fc930BxTCtGZSqFPo9LMn5E/lIBH0=; b=VvFzf8bi/MWoaFRZgzqUr3ecx7KRKAFgcH/U0kc3AlN4A0MvbqqadBg4K4ZLrHkd8p VY38nnBNDGKSdFoJKNamYYwUg2mO5EVpJ/Q9bNvxXIlRneHAUmhw2AnGrA3Y334p/P4c fahRlC36PE0zRGUsDwdcx2g6evTfXPTEHWFJ8bse/vpU3LXXQVhUfZKa6ZgEQnMWFlzF mHaXjLlFzB2TnVKjgc+fEIEwlW0MbHyuXnqmpTDuERNVfnaJq6dWU15Hpq5Y5nV9/N0L PTLMz0rDAy52HCRIQRunNQAGWxXI+wuZcCpBdFvzBjyEEaIuEf5CksNyYK6lHXdbmFHT BfyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405761; x=1794010561; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=98M2pcD2IMyud5Fc930BxTCtGZSqFPo9LMn5E/lIBH0=; b=XwcNiQeml9gB01B70auX4d6Ct2E0Mri4o5v06f4RiYMMABWP2bLDVkb8/tCI8rtxrE R+TZtKWrpq+56rYcuxp+AMDANbQ57McZ/CeFJ4Tn3eJBmrHtyU+yEXG19Pncd5Dkrf63 LofwlrZlzyKdsFwyAp62i5CJqZ42IeMOtHOyEPca+IJulQ6VK73ee7bx2nCCzVfwL0qI VQyY2ggHafv2405qt8oUW9gyMWSQGmKO4r+k4Q8IRRBeq9ss6f4g1jbfzhgzOBoaJr8B 6CvTlxfq5G6gaq1xpjgyTVEJG8B91fampZbtLjSsx+nutey12jgrWGcK2gQRAOvbypao LNqw== X-Gm-Message-State: AFq9FYJHAVzj92HTq9SSC8vZ75NYAX3s/Y3U+PCA9ZGi/zvPJ5a6WbIa JkVDS/jh0jf0aqvsKX0GWlSXsIyMB0kPcsEZYzP+iYvTHBbUDwttgnRxPVW9NfLZ41wP9lznpXp hMgTRsY8= X-Gm-Gg: AYBFou0GRdA4kg51RQyu8R7WKRLdBSGznnT95u8643vtgsmu/Lq660eyNOLY/AfE6pP cR0zXkPTKtWdt72tAPnJ3fJVcVXqy6tEqL+5GuFxNGtyR+ci++kHfJPaMmzX0tk2klmi1D6MtvF WfIP+2V7N0nXZtHiJeMsIjE08ELnFdS65lUNH+wDbiluS7XGLLstus/zxOygVI2ACZDZSK4FbR3 x20ycbFMbbUEr1YEtoxZ0ztd6sQAOG0eQab989ifQ+buTnBp8wbt7e/V98B/JNL7X83BNKvOlga vvH/oqz95fqKUg2SYkjmCDPrjySpgBcJlWuk15mKor15KOaBzWSKk4TZJ09drSEi0ubTUwtq+nu VOHbpZOT8ekFxJXqshnYswpZJqmmKjhbkPzPqzGVcGg4pp29YwRvrdgag5IpD1EUNuPKA7RfiKd 1WLrtSx8EuA9qymZoWxwf2ITGgmq8kpOJLgAtbJFD+RzaoQoLDaK1aroTKPD97Lpsfy02wIt8lt ERwNUUPdkEyqZmDbxgoBPy5/z4GSPQKtKlWJBOtsJk4PEVKZ9BH16jM65dShOvtfDFJB3qUHjHG uANc4vSWIka2OGEeiDpybm07ChrzgnrZLDNgmQ2lLQgwAlCMJH+dCtAKkIfN6lzU81W2EWFwNVJ cccMjD4PoLoqVE1geNZPzw6E2xPMB X-Received: by 2002:a05:600c:354c:b0:4a1:9663:7639 with SMTP id 5b1f17b1804b1-4ac18c7389amr90804745e9.34.1793405760692; Fri, 30 Oct 2026 17:16:00 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:00 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 30/55] glibc: patch CVE-2026-18374 Date: Sat, 31 Oct 2026 01:14:51 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249105 From: Peter Marko Pick patches referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0040-CVE-2026-18374-01.patch | 53 +++++++++ .../glibc/glibc/0041-CVE-2026-18374-02.patch | 103 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 2 + 3 files changed, 158 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch create mode 100644 meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch diff --git a/meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch b/meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch new file mode 100644 index 00000000000..a5a71473ab2 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch @@ -0,0 +1,53 @@ +From f806c45178dbca3be08a25cc5dd6d5542ce84a59 Mon Sep 17 00:00:00 2001 +From: Dongkyun Son +Date: Fri, 4 Sep 2026 21:28:41 +0900 +Subject: [PATCH] libio: Fix CVE-2026-18374 heap buffer overflow in ccs= + handling + +When fopen() is called with a ,ccs= parameter whose value becomes empty +after strip(), the code must reject it with EINVAL instead of attempting +to use it. The original upstr() fallback could read past the ',' delimiter +and cause a heap buffer overflow. + +The fix checks if the charset specification is empty after strip() and +returns EINVAL immediately, preventing the overflow and following the +approach described in BZ #34574. + +CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) + +Reported-by: AISLE in partnership with Red Hat +Signed-off-by: Dongkyun Son +Reviewed-by: Florian Weimer +(cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4) + +CVE: CVE-2026-18374 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=f806c45178dbca3be08a25cc5dd6d5542ce84a59] +Signed-off-by: Peter Marko +--- + libio/fileops.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/libio/fileops.c b/libio/fileops.c +index 775999deb3..18efe8e0c0 100644 +--- a/libio/fileops.c ++++ b/libio/fileops.c +@@ -305,12 +305,14 @@ _IO_new_file_fopen (FILE *fp, const char *filename, const char *mode, + *((char *) __mempcpy (ccs, cs + 5, endp - (cs + 5))) = '\0'; + strip (ccs, ccs); + +- if (__wcsmbs_named_conv (&fcts, ccs[2] == '\0' +- ? upstr (ccs, cs + 5) : ccs) != 0) ++ /* After stripping, ccs[2] == '\0' means the charset name is empty. ++ This is not a valid charset and would cause problems downstream. ++ Reject it with EINVAL (BZ #34574, CVE-2026-18374). */ ++ if (ccs[2] == '\0' || __wcsmbs_named_conv (&fcts, ccs) != 0) + { +- /* Something went wrong, we cannot load the conversion modules. +- This means we cannot proceed since the user explicitly asked +- for these. */ ++ /* Either the charset name is empty after strip(), or conversion ++ modules cannot be loaded. This means we cannot proceed since ++ the user explicitly asked for character conversion. */ + (void) _IO_file_close_it (fp); + free (ccs); + __set_errno (EINVAL); diff --git a/meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch b/meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch new file mode 100644 index 00000000000..d653d545f51 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch @@ -0,0 +1,103 @@ +From 5dd252cf1d113644b3679f5a158e9ef20217865e Mon Sep 17 00:00:00 2001 +From: Shamil Abdulaev +Date: Thu, 3 Sep 2026 20:19:42 +0300 +Subject: [PATCH] libio: Add test for fopen with an empty ", ccs=" value [BZ + #34574] + +This goes on top of the fix for CVE-2026-18374. The test runs the +reproducer from the bug report, plus "w,ccs=" and "w,ccs=,", and +expects NULL with errno set to EINVAL. + +Signed-off-by: Shamil Abdulaev +Reviewed-by: Florian Weimer +(cherry picked from commit cca93e5d88d3d4ed073c03100467696f652269e7) + +CVE: CVE-2026-18374 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=5dd252cf1d113644b3679f5a158e9ef20217865e] +Signed-off-by: Peter Marko +--- + libio/Makefile | 1 + + libio/tst-fopen-ccs-empty.c | 62 +++++++++++++++++++++++++++++++++++++ + 2 files changed, 63 insertions(+) + create mode 100644 libio/tst-fopen-ccs-empty.c + +diff --git a/libio/Makefile b/libio/Makefile +index 43ee8db06d..5b9929c3de 100644 +--- a/libio/Makefile ++++ b/libio/Makefile +@@ -99,6 +99,7 @@ tests = \ + tst-fgetc-after-eof \ + tst-fgetwc \ + tst-fgetws \ ++ tst-fopen-ccs-empty \ + tst-fopenloc2 \ + tst-fputws \ + tst-freopen \ +diff --git a/libio/tst-fopen-ccs-empty.c b/libio/tst-fopen-ccs-empty.c +new file mode 100644 +index 0000000000..64723965e1 +--- /dev/null ++++ b/libio/tst-fopen-ccs-empty.c +@@ -0,0 +1,62 @@ ++/* Test fopen with an empty ",ccs=" value in the mode string (bug 34574). ++ Copyright (C) 2026 Free Software Foundation, Inc. ++ This file is part of the GNU C Library. ++ ++ The GNU C Library is free software; you can redistribute it and/or ++ modify it under the terms of the GNU Lesser General Public ++ License as published by the Free Software Foundation; either ++ version 2.1 of the License, or (at your option) any later version. ++ ++ The GNU C Library is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU ++ Lesser General Public License for more details. ++ ++ You should have received a copy of the GNU Lesser General Public ++ License along with the GNU C Library; if not, see ++ . */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++static void ++check_fopen_fails (const char *path, const char *mode) ++{ ++ errno = 0; ++ FILE *fp = fopen (path, mode); ++ TEST_VERIFY (fp == NULL); ++ TEST_COMPARE (errno, EINVAL); ++ if (fp != NULL) ++ fclose (fp); ++} ++ ++static int ++do_test (void) ++{ ++ char *path; ++ xclose (create_temp_file ("tst-fopen-ccs-empty", &path)); ++ ++ /* The value is blank and the mode string continues well past it. */ ++ enum { size = 1024 * 1024 }; ++ char *mode = xmalloc (size); ++ memset (mode, 'X', size); ++ mode[size - 1] = '\0'; ++ static const char prefix[] = "w,ccs= ,"; ++ memcpy (mode, prefix, sizeof (prefix) - 1); ++ check_fopen_fails (path, mode); ++ free (mode); ++ ++ check_fopen_fails (path, "w,ccs="); ++ check_fopen_fails (path, "w,ccs=,"); ++ ++ free (path); ++ return 0; ++} ++ ++#include diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 144ce36ccc2..3e95792b359 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -72,6 +72,8 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0037-CVE-2026-77117.patch \ file://0038-CVE-2026-80489.patch \ file://0039-CVE-2026-77117-CVE-2026-80489.patch \ + file://0040-CVE-2026-18374-01.patch \ + file://0041-CVE-2026-18374-02.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102559 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3743.1793405763043807540 for ; Fri, 30 Oct 2026 17:16:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=gNOBplq0; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a3517554f7so10822515e9.2 for ; Fri, 30 Oct 2026 17:16:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405761; x=1794010561; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=B0TrtbR6yzRP1pQeoThvh7wqjUnHLUS9A3nsWlFaWpg=; b=gNOBplq0rh6lKTELn403dPchdtGrbNQNZsZy6vi6kX0VuyXRgZaDAvOgErfoGxIhow ye/Fig9B4qulZpnOmcF2FpPimn4f7YtfvOTNwlMwVpvmfS6UxJWoYvIJsu+t9GgcTxY1 EcaAsNVrRM8gPxDXcBJCJqCdkfrBC6MVpX8hC8RuM5TuN9lauS6f5LZM7WH23tBzH9NL Yl1HMNRHv6QaTaLvNvbVOeZAD0IpfQo0QjAPwAKMs1ci9Pgo+OqDZA06AUexIEr0rSB/ yBUMlKh0Wuriw8jN6AtzPsyTRlS4HfvqKYO2cWzrELhFsddqUijh6qSFDUsZc7kkFxHS G3Qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405761; x=1794010561; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=B0TrtbR6yzRP1pQeoThvh7wqjUnHLUS9A3nsWlFaWpg=; b=bvK7zYwSWNvCyJzlPJ7DoOA7tbz5YVO/OlINY+CVOyH2FnRXqRmBxMjci3t6yHxIGW 5/Hgc8jAYXaVegfNay+iHo2JsFo2qVrMIVQrSIsimLu6k538a0cBhmLi0H+mUILL4frN Dce2TJE5RbDxUtJyV7wSG7uasjdap+699x7+9qYHzUysHaD8hJT46Yj6qow0czKtL6yK 0Fg1PkOyeP1lX6M01Zod9bv5K7lMR7GvX76u3OXmUwCRhGqpmhM/GYeZFVS2XVpUbc+H Ag+MFcbz5AUrrXTBMvc1+cnN9VQR65AzvUPBReXO9KE50clClQHhh/LTMygrgzkNjrFz dsbQ== X-Gm-Message-State: AFq9FYIBrvbTpaBW8RnxvP7nHP3DGvU12zUMX9324t26gn+AHCVSuZJX bCXfewwe5PDs5Oi4wtYRPnRhyZOlJfdr1p5ZXRvVm/lfEJPB4fE6guxJTwYmqOcGe4e8tkVveJH QMX3H5ns= X-Gm-Gg: AYBFou3BkXvYXglFCf4xeBK7QTyJ5T9ixnr0v3Z8XvARZUJG6gG8+8LHEOjwctLYtI8 ZFrnGPRxoHEPBoIHEQVu7Udhrt8s8Mv4zU/JL4nXoJvBl+eMmkH2U2vRv8LcR9ViBFQYjztY1FL 9SvJqatH4840Tcg58J7ofuIxB8hGmwx0faEPzmTV/uyb1QddoO3EMm0SU5b8Ha1zZdhd6T6BBeP ix3q1QiBZiYIKZQtH4m5wVpbFVrZn8TmHlpP+AEqvtrW/eGgKJS58k0rjhQJmyqbUEUj7bWofEW q2rGkLjPCRS/VNHlMVQ2AgLwRjp7G50E/cE0FpuRTnPyCX8JxY7VbQTJwxi4p81ZLU9JPvhhnaU ACPammGOlGat1nAWXdtt2tsZ7jvoDAA2g0ysZUWoRLP4l8etEIqKfv2uimRx/QJj2Q4T3baIyBO 8fUv6p0Mqd/qKSc6p0a0KGbIcByQGIT1BzEM+p0dBUEzpTSoAAtoJEdcw8DyeAacg+ftZIUvyf/ Ov+Mq3LV+yyVraOBferjFDWwSxUJaF/d6hvoXYep84mjTGY+g4o77UpKXdx4IUnKQ8zosP5sSDP 8N9+KlFgwcyctAhzJ/UaopdLBe8qWaugKzs+FCYlvYBsiCxGmngbL94enpk4P1+KrUhksSQXJFK fPfh9cTumJ0k5YKHbQ9BQvuPDqv7k X-Received: by 2002:a05:600c:e545:b0:4ad:181a:4354 with SMTP id 5b1f17b1804b1-4ad181a4478mr30232815e9.30.1793405761223; Fri, 30 Oct 2026 17:16:01 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:00 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 31/55] glibc: patch CVE-2026-8674 Date: Sat, 31 Oct 2026 01:14:52 +0100 Message-ID: <2ee1db69d295556b5aa99965ff088e844c1eb168.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249106 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0042-CVE-2026-8674.patch | 118 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 119 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch diff --git a/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch b/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch new file mode 100644 index 00000000000..bbdeafd5f38 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch @@ -0,0 +1,118 @@ +From c97fdd483232a831829aaff458a212307f1bf4bc Mon Sep 17 00:00:00 2001 +From: Adhemerval Zanella +Date: Mon, 14 Sep 2026 17:08:03 -0300 +Subject: [PATCH] resolv: Fix assertion failure on search list truncation [BZ + 31026, CVE-2026-8674] + +update_from_conf copies the search list into the 256-byte +resp->defdname and truncates it when an entry does not fit, then +asserts that resolv_conf_matches accepts the result. + +The truncation check there compared the accumulated size against +sizeof (resp->dnsrch) (the pointer array) instead of resp->defdname, +and the empty-list case did not account for a first entry that does +not fit at all. A long search domain in resolv.conf or LOCALDOMAIN +thus aborts any process using the resolver. + +Check whether the entry fits in the remaining defdname space, matching +alloc_buffer_copy_string, and also accept an empty resp->dnsrch when +the first entry is too long. Add tests covering both cases through +the search and domain directives. + +Checked on x86_64-linux-gnu and i686-linux-gnu. +Reviewed-by: Florian Weimer + +(cherry picked from commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a) +(cherry picked from commit c0c8a45dee30c8089822d859575a3ad4324b15ff) + +CVE: CVE-2026-8674 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=c97fdd483232a831829aaff458a212307f1bf4bc] +Signed-off-by: Peter Marko +--- + resolv/resolv_conf.c | 19 +++++++++------ + resolv/tst-resolv-res_init-skeleton.c | 35 +++++++++++++++++++++++++++ + 2 files changed, 47 insertions(+), 7 deletions(-) + +diff --git a/resolv/resolv_conf.c b/resolv/resolv_conf.c +index dcf92ee90e..0418267044 100644 +--- a/resolv/resolv_conf.c ++++ b/resolv/resolv_conf.c +@@ -281,8 +281,12 @@ resolv_conf_matches (const struct __res_state *resp, + { + if (resp->dnsrch[0] == NULL) + { +- /* Empty search list. No default domain name. */ +- return conf->search_list_size == 0 && resp->defdname[0] == '\0'; ++ /* Empty search list, or the first entry does not fit in ++ resp->defdname. No default domain name. */ ++ return resp->defdname[0] == '\0' ++ && (conf->search_list_size == 0 ++ || (strlen (conf->search_list[0]) + 1 ++ > sizeof (resp->defdname))); + } + + if (resp->dnsrch[0] != resp->defdname) +@@ -309,11 +313,12 @@ resolv_conf_matches (const struct __res_state *resp, + } + else + { +- /* resp->dnsrch is truncated if the number of elements +- exceeds MAXDNSRCH, or if the combined storage space for +- the search list exceeds what can be stored in +- resp->defdname. */ +- if (i == MAXDNSRCH || search_list_size > sizeof (resp->dnsrch)) ++ /* resp->dnsrch is truncated if the number of elements exceeds ++ MAXDNSRCH, or if conf->search_list[i] does not fit in the ++ remaining space of resp->defdname. */ ++ if (i == MAXDNSRCH ++ || (search_list_size + strlen (conf->search_list[i]) + 1 ++ > sizeof (resp->defdname))) + break; + /* Otherwise, a mismatch indicates a match failure. */ + return false; +diff --git a/resolv/tst-resolv-res_init-skeleton.c b/resolv/tst-resolv-res_init-skeleton.c +index 3ccbe71db9..4e9c57f3cb 100644 +--- a/resolv/tst-resolv-res_init-skeleton.c ++++ b/resolv/tst-resolv-res_init-skeleton.c +@@ -713,6 +713,41 @@ struct test_case test_cases[] = + "nameserver 192.0.2.1\n" + "; nameserver[0]: [192.0.2.1]:53\n" + }, ++/* Search list entries which do not fit in the legacy 256-byte ++ resp->defdname buffer (bug 31026). LONG244 is 244 characters long, ++ so it does not fit after "example.com\0" (12 bytes). LONG256 is 256 ++ characters long, so it does not fit even as the first entry. */ ++#define LBL63 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" ++#define LONG244 LBL63 "." LBL63 "." LBL63 "." \ ++ "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" ++#define LONG256 LBL63 "." LBL63 "." LBL63 "." LBL63 "a" ++ {.name = "search list truncated at long entry after short entry", ++ .conf = "nameserver 192.0.2.1\n" ++ "search example.com " LONG244 "\n", ++ .expected = "search example.com\n" ++ "; search[0]: example.com\n" ++ "; search[1]: " LONG244 "\n" ++ "nameserver 192.0.2.1\n" ++ "; nameserver[0]: [192.0.2.1]:53\n" ++ }, ++ {.name = "search list truncated at long first entry", ++ .conf = "nameserver 192.0.2.1\n" ++ "search " LONG256 " example.com\n", ++ .expected = "; search[0]: " LONG256 "\n" ++ "; search[1]: example.com\n" ++ "nameserver 192.0.2.1\n" ++ "; nameserver[0]: [192.0.2.1]:53\n" ++ }, ++ {.name = "long first entry from the domain directive", ++ .conf = "nameserver 192.0.2.1\n" ++ "domain " LONG256 "\n", ++ .expected = "; search[0]: " LONG256 "\n" ++ "nameserver 192.0.2.1\n" ++ "; nameserver[0]: [192.0.2.1]:53\n" ++ }, ++#undef LONG256 ++#undef LONG244 ++#undef LBL63 + {.name = "trust-ad flag", + .conf = "options trust-ad\n" + "nameserver 192.0.2.1\n", diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 3e95792b359..3b27328c21a 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -74,6 +74,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0039-CVE-2026-77117-CVE-2026-80489.patch \ file://0040-CVE-2026-18374-01.patch \ file://0041-CVE-2026-18374-02.patch \ + file://0042-CVE-2026-8674.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102548 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3742.1793405763703231585 for ; Fri, 30 Oct 2026 17:16:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=oG/J9ph5; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a2069b9710so10908965e9.2 for ; Fri, 30 Oct 2026 17:16:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405762; x=1794010562; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=aqmdWtKznIjZ3teWeP1yQrf0EEuIDYwfR2aDUfUeDz8=; b=oG/J9ph5HkiNvKGqAGerVmdkFKv/qluJHb26Q9EWlVLLaq6l+f/A+8lJrbvDfS9pbM aWa1B6gfejfhVvm/95k5SQFjEoBGWyWo+Vb++9Ba/CVgbM+hiRhN1CmhqZ+3Zaa8ZdHB PxrY1aWqdZE1VU3vjWpeJrK6urM4lNcX/SgZ7zNo4kSO5uwtJ97GBEKh1va0bKgIylt/ nFoyKoLCUROM5kBopyeT/QU0gwmAsZvKjOH9jY2MWJwLUfMicPSce/E91GgyedbU3pag jxMeXgvS9vacLq4GULLX+f+p++oqn4iJcxDBilk4/Q/FIJbIs5iLhiIfD4uu4WnBKZZk CrxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405762; x=1794010562; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=aqmdWtKznIjZ3teWeP1yQrf0EEuIDYwfR2aDUfUeDz8=; b=BKsSFEsRfwvnoakzl8VPRRzLjPTtR22s1+j0dqsOTY4k1r7syPTuX6/rW3Ub7ypfhs QrUQBcKlgU4ukX/9ZVczYTNNR0FqTot97CupKaUm3+pTGDKX9TbOdRWZMtuSKcsnADVu mSuH/71tvQBK9aaSWe4fg5kZNuWvdHYpTn6J3H1Y0WHV1di3ksujtZFAZ1W5gxISxutY lqEN/DF/LPO+KDxoXVEMht3CJ4m0x40lxbLZZ0j4K66mfP+RmP6YfgiqzrEsj7UPMUZ3 YMwslYIDCui0vNKNntrsuJcHYrC06xEqIvZ4m+i0yIg5FYWYIzYCRxjOshZ6X4zeDgIz GBSg== X-Gm-Message-State: AFq9FYJ7PAS6mAyOX7MbyY+OscuCuJuTcORcuiFK1Dt3mvyIdnyBKBSm 3iC5401waI0kBTDW20jYLG+bGpvFVORQYuwUX1uqE7S4QaB4K5KJtH5BDOzmiNuLzzOEWg29KIU 0tsIp4yI= X-Gm-Gg: AYBFou36giICmyZW7wXatc8pd+8FrbVYPuRr+kk7ln+ulWnnqWagYt/hSh34PFGTkQJ 6ryU9bn8xQDk03dTon+v9Nm414ZcMTUTT0G1MoU6EWTWwZxsH6cU/7iGPzZmhPdkoX5GZkGbQkf Lx/qPBXH9TKrEOjatL7VJRPLYbmfxugP2JZViJ57z5USS+XHaHH06+rhgRvmtpHudAOJiE6Qs5+ HQ2wx1eZhdD4HglXf8eRVqqOdOKoVltSD3IWNSRsC3lc4hlaVMMurpkuzJ3+0Vh4ToxV6BryKQ9 lfSp2sA1duD/KgD93Yx3R4kv2inx3AXwYkhJzq8Nabarr5Jf9RUd9q4nVtEOlnmxLAs3nBWCtxX yRjovFG87UTxpPlcl7i6BBMqK8YypN8SJQprldPe387uwd8SG4YkT4zoMzbrYzohxyKTeeHIxXO fswoghqC7fwn0Y8uXtcf2NJgnB1WkAY/5CA4YRoCnCH2/DgUv31qrLB1BV/OA2omk1dP58bRK/t Ih6QV1GGvi8ubqNeXUV84GDziv3+QU4TDv499P2abWH8NpdyPqPyHyvbshkdNvJQuI7LGmyynIV X9u/eEq297qSJhB5LI6A0moTv41oTHi7t+06qxCmR+OAjS4CIXgr7nTLr/ra30MGRCj67J82edI SWjwGezhXX8OEonrMVCa4qZHsPwdZ X-Received: by 2002:a05:600c:4f52:b0:49d:1fa8:b266 with SMTP id 5b1f17b1804b1-4ac18e5d029mr94999295e9.26.1793405761820; Fri, 30 Oct 2026 17:16:01 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:01 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 32/55] glibc: patch CVE-2026-89092 Date: Sat, 31 Oct 2026 01:14:53 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249107 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0047-CVE-2026-89092.patch | 245 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 246 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch diff --git a/meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch b/meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch new file mode 100644 index 00000000000..8df9dc904e4 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch @@ -0,0 +1,245 @@ +From fa3ea0362354af7370abb5fe8c6f31a32a73af8e Mon Sep 17 00:00:00 2001 +From: DJ Delorie +Date: Mon, 28 Sep 2026 14:27:16 +0200 +Subject: [PATCH] CVE-2026-89092: nscd: replace alloca with malloc in aicache, + hstcache + +This changes the alloca fallback to a malloc fallback +in the addrinfo and host cache code. + +This fixes bug 34624. + +Co-authored-by: Florian Weimer +Reviewed-by: Adhemerval Zanella +(cherry picked from commit cbf59b836645b6ac69ad8c47a560598bc4942ecc) + +CVE: CVE-2026-89092 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=fa3ea0362354af7370abb5fe8c6f31a32a73af8e] +Signed-off-by: Peter Marko +--- + nscd/aicache.c | 27 ++++++++++++++++++--------- + nscd/hstcache.c | 47 ++++++++++++++++++++++++++++++++++------------- + 2 files changed, 52 insertions(+), 22 deletions(-) + +diff --git a/nscd/aicache.c b/nscd/aicache.c +index 6f47236627..1ac86b86d8 100644 +--- a/nscd/aicache.c ++++ b/nscd/aicache.c +@@ -93,7 +93,9 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req, + int32_t ttl = INT32_MAX; + ssize_t total = 0; + char *key_copy = NULL; +- bool alloca_used = false; ++ /* If not NULL, dataset is a temporary dataset not inserted into the ++ database, and needs to be free'd. */ ++ void *dataset_alloc = NULL; + time_t timeout = MAX_TIMEOUT_VALUE; + + while (!no_more) +@@ -164,10 +166,12 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req, + /* We cannot permanently add the result in the moment. But + we can provide the result as is. Store the data in some + temporary memory. */ +- dataset = (struct dataset *) alloca (total + req->key_len); ++ dataset = (struct dataset *) malloc (total + req->key_len); ++ if (dataset == NULL) ++ goto out; + + /* We cannot add this record to the permanent database. */ +- alloca_used = true; ++ dataset_alloc = dataset; + } + + /* Fill in the address and address families. */ +@@ -336,10 +340,12 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req, + /* We cannot permanently add the result in the moment. But + we can provide the result as is. Store the data in some + temporary memory. */ +- dataset = (struct dataset *) alloca (total + req->key_len); ++ dataset = (struct dataset *) malloc (total + req->key_len); ++ if (dataset == NULL) ++ goto out; + + /* We cannot add this record to the permanent database. */ +- alloca_used = true; ++ dataset_alloc = dataset; + } + + /* Fill in the address and address families. */ +@@ -391,8 +397,7 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req, + resp)) == 0) + { + /* The data has not changed. We will just bump the +- timeout value. Note that the new record has been +- allocated on the stack and need not be freed. */ ++ timeout value. */ + dh->timeout = dataset->head.timeout; + dh->ttl = dataset->head.ttl; + ++dh->nreloads; +@@ -410,7 +415,9 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req, + key_copy = (char *) newp + (key_copy - (char *) dataset); + + dataset = memcpy (newp, dataset, total + req->key_len); +- alloca_used = false; ++ ++ free (dataset_alloc); ++ dataset_alloc = NULL; + } + + /* Mark the old record as obsolete. */ +@@ -488,7 +495,7 @@ next_nip: + out: + __resolv_context_put (ctx); + +- if (dataset != NULL && !alloca_used) ++ if (dataset != NULL && dataset_alloc == NULL) + { + /* If necessary, we also propagate the data to disk. */ + if (db->persistent) +@@ -514,6 +521,8 @@ next_nip: + scratch_buffer_free (&tmpbuf4); + scratch_buffer_free (&canonbuf); + ++ free (dataset_alloc); ++ + return timeout; + } + +diff --git a/nscd/hstcache.c b/nscd/hstcache.c +index 7b3a8ab1ea..11af5cb34a 100644 +--- a/nscd/hstcache.c ++++ b/nscd/hstcache.c +@@ -15,7 +15,6 @@ + You should have received a copy of the GNU General Public License + along with this program; if not, see . */ + +-#include + #include + #include + #include +@@ -187,7 +186,7 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + /* Determine the I/O structure. */ + size_t h_name_len = strlen (hst->h_name) + 1; + size_t h_aliases_cnt; +- uint32_t *h_aliases_len; ++ uint32_t *h_aliases_len = NULL; + size_t h_addr_list_cnt; + char *addresses; + char *aliases; +@@ -201,7 +200,13 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + for (cnt = 0; hst->h_aliases[cnt] != NULL; ++cnt) + ++h_aliases_cnt; + /* Determine the length of all aliases. */ +- h_aliases_len = (uint32_t *) alloca (h_aliases_cnt * sizeof (uint32_t)); ++ if (h_aliases_cnt > 0) ++ { ++ h_aliases_len = (uint32_t *) reallocarray (NULL, h_aliases_cnt, ++ sizeof (uint32_t)); ++ if (h_aliases_len == NULL) ++ return MAX_TIMEOUT_VALUE; ++ } + total = 0; + for (cnt = 0; cnt < h_aliases_cnt; ++cnt) + { +@@ -215,8 +220,11 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + ++h_addr_list_cnt; + + if (h_addr_list_cnt == 0) +- /* Invalid entry. */ +- return MAX_TIMEOUT_VALUE; ++ { ++ /* Invalid entry. */ ++ free (h_aliases_len); ++ return MAX_TIMEOUT_VALUE; ++ } + + total += (sizeof (struct dataset) + + h_name_len +@@ -227,8 +235,10 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + change. Allocate memory on the cache since it is likely + discarded anyway. If it turns out to be necessary to have a + new record we can still allocate real memory. */ +- bool alloca_used = false; + dataset = NULL; ++ /* If not NULL, dataset is a temporary dataset not inserted into ++ the database, and needs to be free'd. */ ++ void *dataset_alloc = NULL; + + /* If the record contains more than one IP address (used for + load balancing etc) don't cache the entry. This is something +@@ -244,10 +254,15 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + /* We cannot permanently add the result in the moment. But + we can provide the result as is. Store the data in some + temporary memory. */ +- dataset = (struct dataset *) alloca (total + req->key_len); ++ dataset = (struct dataset *) malloc (total + req->key_len); ++ if (dataset == NULL) ++ { ++ free (h_aliases_len); ++ return MAX_TIMEOUT_VALUE; ++ } + + /* We cannot add this record to the permanent database. */ +- alloca_used = true; ++ dataset_alloc = dataset; + } + + timeout = datahead_init_pos (&dataset->head, total + req->key_len, +@@ -270,7 +285,8 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + cp = dataset->strdata; + + cp = mempcpy (cp, hst->h_name, h_name_len); +- cp = mempcpy (cp, h_aliases_len, h_aliases_cnt * sizeof (uint32_t)); ++ if (h_aliases_cnt > 0) ++ cp = mempcpy (cp, h_aliases_len, h_aliases_cnt * sizeof (uint32_t)); + + /* The normal addresses first. */ + addresses = cp; +@@ -282,6 +298,8 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + for (cnt = 0; cnt < h_aliases_cnt; ++cnt) + cp = mempcpy (cp, hst->h_aliases[cnt], h_aliases_len[cnt]); + ++ free (h_aliases_len); ++ + assert (cp + == dataset->strdata + total - offsetof (struct dataset, + strdata)); +@@ -307,8 +325,7 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + dh->allocsize - offsetof (struct dataset, resp)) == 0) + { + /* The data has not changed. We will just bump the +- timeout value. Note that the new record has been +- allocated on the stack and need not be freed. */ ++ timeout value. */ + assert (h_addr_list_cnt == 1); + dh->ttl = dataset->head.ttl; + dh->timeout = dataset->head.timeout; +@@ -334,7 +351,9 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + key_copy = (char *) newp + (key_copy - (char *) dataset); + + dataset = memcpy (newp, dataset, total + req->key_len); +- alloca_used = false; ++ ++ free (dataset_alloc); ++ dataset_alloc = NULL; + } + } + +@@ -362,7 +381,7 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + the current cache handling cannot handle and it is more than + questionable whether it is worthwhile complicating the cache + handling just for handling such a special case. */ +- if (! alloca_used) ++ if (dataset_alloc == NULL) + { + /* If necessary, we also propagate the data to disk. */ + if (db->persistent) +@@ -393,6 +412,8 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req, + + pthread_rwlock_unlock (&db->lock); + } ++ free (dataset_alloc); ++ dataset_alloc = NULL; + } + + if (__builtin_expect (!all_written, 0) && debug_level > 0) diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 3b27328c21a..0fe9c41662b 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -75,6 +75,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0040-CVE-2026-18374-01.patch \ file://0041-CVE-2026-18374-02.patch \ file://0042-CVE-2026-8674.patch \ + file://0047-CVE-2026-89092.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102552 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3745.1793405764296349130 for ; Fri, 30 Oct 2026 17:16:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=Xygi02xN; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a3517554f7so10822605e9.2 for ; Fri, 30 Oct 2026 17:16:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405762; x=1794010562; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Uj4yrA/E8e+7y4d/wFq0im6DjGnF52e1slDHxjvr9NM=; b=Xygi02xNWstclPuiaeWBpBcyDtTDtITyC6JtDgvJ5lmPnPKsXzoV7imdNuhn15VBWI twu8afK5QbO3C2F6kCqBIyaM7i989rycMRSeIkXZyM0/JZpFvgqyhlx8u88A7nzRfcXv bOxR3zvsNwq7oBpjKrmGucvATZEy2amxOnJ7N+rH4el/qheOCHudu/437a1mGvWMdCe4 r4ZyR+J2+zd9hHxrBMxrarhFBVT0QM0E/qYkaLeTs1EQaFI5hecf3hk6tZP7q1+LN4rS 1tfxj/OuHLXXlEVL9z1RGejDR4qMVRygWHds/7fbP5XUenLzAzFUW42l0ZN8+gC5FR9P HSVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405762; x=1794010562; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Uj4yrA/E8e+7y4d/wFq0im6DjGnF52e1slDHxjvr9NM=; b=jaE7MMBkNToGEKgMP1leylmkHBcd9pBBYwBJAEPM8spS4+v1HSZ9hvbKKwXt1RtIFZ wQTUg8WPm8rrQgiqCjAO2CC2ufmoYQ4M5T8lgqGUBAKVc2MBeLBx1t7uRNxsW2XniNvd 7xJ7JlOwOrwvNXwh9Yd9YEPczZ+GSYHasTx7NjpubSEqOzgWO653WQF6z+r7+oSiu5sm P6rkd0uhfpNGk/VW9XPMHWNhIHl2gaLlR86egwYjruo38jQ+SjQnZFUGn0kKkSjaXdiw DndAhpLAMaBrRljS65xWfPw7fU/xZXLTm+VvprtKBdAEVfqInXl23TqdCQ/EOuhv0sGD mALg== X-Gm-Message-State: AFq9FYLwZkuA5QVdVaBgL0KVpgyRiPle+ViaRZo/i7jgqS1vug27fclh uS0bzrzUQQDU9oNFnu5lAe0rGallSZm3XiOk/nWKPPyd8Oj50DXw0uQc1hu/0P8C/pqpcggmxeA DT7BeyKI= X-Gm-Gg: AYBFou1vocIF7YQqPq+3HNNY7cH3RjN6pi7EH8F6H8Oa78sYBTZnSCC4VGYM0B/EmBr REYWYn76/5Tnc0qkQpKseCxzeYUimpqNjtrKq3vaRjyZDsh1/yx+TLTCzxVj0ZhS2ycOVRhGVsx lZbd9tAj3nowXN9FbWF9rKFdzYB/zbxR3POFyrcBtrp2POAsfPpeN75r79Meg8otJHTJQgZRu1s Xbjuox9Z1EUPH9BotKnSNLeM+ARVHAXYLEKLWeyreZwAvs/ju0xdKvfbylHK59XUMXAlcgW8w6k 0udOZ3IpwjTA8vp9dvxvR9aOTm8odiYJw/2dUPCWjffDrLbmVhtd35ENO8MHt5iQ7VFDl7HwRLS wZp1qNTny6ndxvyoerP5NXIhQFI3lTmZIs2BLW7/Z0lFglEibt5JkmrauWJsDeSGWvb5oG0t2+k +go+uICD4bzHfQ64XUL00xg+gozPFajXy1g/D5/QQA65BxsUB02H04n1mcxttfXWIUJXUGF4PyM 53exb9NGlmbBQkpAgKkCNbuiW3xoTkcE/Idhs/SD90zbuwKSCSbxZuWqGXeOwi/cvgteB1Trt+n BVAQao5CHwOoOKnC2CVbfw/lqk9JK1WyENmNGrYmlq1FcZW4v3GWTCPNxxnCLIZ533demDVFSd1 Sizwjq8Q4nNPEUDHXCwqclSlXZLg9Gw== X-Received: by 2002:a05:600c:1d02:b0:4a0:1c94:7042 with SMTP id 5b1f17b1804b1-4ac16bc4731mr94404375e9.8.1793405762393; Fri, 30 Oct 2026 17:16:02 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:02 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 33/55] glibc: patch CVE-2026-97399 Date: Sat, 31 Oct 2026 01:14:54 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249108 From: Peter Marko Pick patch referencing this CVE from 2.41 branch (oldest release still receiving security updates). Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 3.41 -> 2.41 typo in branch name] --- .../glibc/glibc/0048-CVE-2026-97399.patch | 128 ++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 129 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch diff --git a/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch b/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch new file mode 100644 index 00000000000..c5aec0802c9 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch @@ -0,0 +1,128 @@ +From f247c0a2fb5b3e48a771d2d23efc9a45c64e957d Mon Sep 17 00:00:00 2001 +From: Sachin Monga +Date: Thu, 1 Oct 2026 00:51:23 +0530 +Subject: [PATCH] powerpc: Fix one byte overread in strncasecmp (bug 34683, + CVE-2026-97399) + +The Power8 strncasecmp (strcasecmp.S with USE_AS_STRNCASECMP) touches +s1[n]/s2[n] in three places when the first n bytes compare equal and +contain no NUL: L(loop) preloads the next byte before its bdnz; +L(loop1) increments then loads before its bdnz; and L(bytebybyte) loads +s1[0]/s2[0] before checking r5. A caller that maps exactly n readable bytes +can get SIGSEGV if byte n falls on an unmapped page. + +The L(bytebybyte) site was identified by Florian Weimer; the +original AISLE report covered only the two loops. + +Fix all three sites: guard L(bytebybyte) with a r5 == 0 check, split the +bdnz/load pairs in L(loop) and L(loop1) so the load only runs when the +count is still positive, and preload rCHAR1/rCHAR2 in L(lessthan4) after +confirming r5 != 0. strcasecmp is unaffected; its generated code is +unchanged. + +Add string/test-strncasecmp-nonarray.c, built on the test-Xncmp-nonarray.c +skeleton: maps a PROT_NONE page past both buffers and sweeps all start +offsets and lengths. Runs as an xtest. + +Reported-by: AISLE in partnership with Red Hat +Suggested-by: Florian Weimer +(cherry picked from commit e622f82ea8797704ac8f761f88ed3e429e97fedd) + +CVE: CVE-2026-97399 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=f247c0a2fb5b3e48a771d2d23efc9a45c64e957d] +Signed-off-by: Peter Marko +--- + string/Makefile | 4 +-- + string/test-strncasecmp-nonarray.c | 4 +++ + sysdeps/powerpc/powerpc64/power8/strcasecmp.S | 25 +++++++++++++++---- + 3 files changed, 26 insertions(+), 7 deletions(-) + create mode 100644 string/test-strncasecmp-nonarray.c + +diff --git a/string/Makefile b/string/Makefile +index c83b195e2e..d7437cd915 100644 +--- a/string/Makefile ++++ b/string/Makefile +@@ -238,8 +238,8 @@ endif + # This test allocates a lot of memory and can run for a long time. + xtests += tst-strcoll-overflow + +-# This test runs for a long time. +-xtests += test-strncmp-nonarray ++# These tests run for a long time. ++xtests += test-strncasecmp-nonarray test-strncmp-nonarray + + # This test needs libdl. + ifeq (yes,$(build-shared)) +diff --git a/string/test-strncasecmp-nonarray.c b/string/test-strncasecmp-nonarray.c +new file mode 100644 +index 0000000000..d68e58d5ec +--- /dev/null ++++ b/string/test-strncasecmp-nonarray.c +@@ -0,0 +1,4 @@ ++#define TEST_IDENTIFIER strncasecmp ++#define TEST_NAME "strncasecmp" ++typedef char CHAR; ++#include "test-Xncmp-nonarray.c" +diff --git a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S +index 7ce53407b8..838b8bf75f 100644 +--- a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S ++++ b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S +@@ -355,6 +355,14 @@ L(bytebybyte): + offset and string descriptors are only updated in the end + of loop unrolling. */ + ld rLOC, LOCALE_CTYPE_TOLOWER(rLOC) ++#ifdef USE_AS_STRNCASECMP ++ /* This entry point can be reached from the vector loop with ++ r5 == 0 (the last vector chunk ended exactly at the `n' ++ boundary). Do not read s1[0]/s2[0] in that case: those ++ bytes are s1[n]/s2[n], one past the caller's bound. */ ++ cmpdi cr7, r5, 0 ++ beq cr7, L(retnull) ++#endif + lbz rCHAR1, 0(rSTR1) /* Load char from s1 */ + lbz rCHAR2, 0(rSTR2) /* Load char from s2 */ + #ifdef USE_AS_STRNCASECMP +@@ -405,19 +413,23 @@ L(loop): + cmpw cr1, rLWR1, rLWR2 + crorc 4*cr1+eq,eq,4*cr1+eq + beq cr1, L(done) ++#ifdef USE_AS_STRNCASECMP ++ /* Test the remaining count before touching the next byte. */ ++ bdnz L(loop_load) ++ b L(lessthan4) ++L(loop_load): ++#endif + lbz rCHAR1, 0(rSTR1) /* Load char from s1 */ + lbz rCHAR2, 0(rSTR2) /* Load char from s2 */ +-#ifdef USE_AS_STRNCASECMP +- bdnz L(loop) +-#else + b L(loop) +-#endif + #ifdef USE_AS_STRNCASECMP + L(lessthan4): + clrldi r5, r5, 62 + cmpdi cr7, r5, 0 + beq cr7, L(retnull) + mtctr r5 ++ lbz rCHAR1, 0(rSTR1) ++ lbz rCHAR2, 0(rSTR2) + L(loop1): + cmpdi rCHAR1, 0 + sldi rADDR1, rCHAR1, 2 +@@ -427,11 +439,14 @@ L(loop1): + cmpw cr1, rLWR1, rLWR2 + crorc 4*cr1+eq,eq,4*cr1+eq + beq cr1, L(done) ++ bdnz L(loop1_load) ++ b L(retnull) ++L(loop1_load): + addi rSTR1, rSTR1, 1 + addi rSTR2, rSTR2, 1 + lbz rCHAR1, 0(rSTR1) + lbz rCHAR2, 0(rSTR2) +- bdnz L(loop1) ++ b L(loop1) + #endif + L(done): + subf r0, rLWR2, rLWR1 diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 0fe9c41662b..09ac0fc53f7 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -76,6 +76,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0041-CVE-2026-18374-02.patch \ file://0042-CVE-2026-8674.patch \ file://0047-CVE-2026-89092.patch \ + file://0048-CVE-2026-97399.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}" From patchwork Sat Oct 31 00:14:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102553 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3746.1793405764574616932 for ; Fri, 30 Oct 2026 17:16:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=eGp/xIrA; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a2000d5fb1so7643485e9.1 for ; Fri, 30 Oct 2026 17:16:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405763; x=1794010563; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=IPEdGzyjjEvwhu2TIQJcT9CPJui5LN71e1AbOGjHfAU=; b=eGp/xIrAlV2Ng8Xa4wEuojceE6mF4OfTVZ2ZglProbYl67d9Di0E5gkFMCmg/9hRsz MKyQA/VHIe2f07dUT9Y931G4mtjjawso3cQHY04T4k22GzKoETk1/I5ch/F4Ep7cPc4X 8XMRIwQ8cD77ft0qYvzgNgHZ+qT3qVPtvuIwxgqvOruLVKIdzonqy56cyX3iDfEymdoL gQio686I773jstf6wUHjrry8ij6wS/zgGeqhqpxWmfpESZKbI4cQb9xPWGckwTMk3BT/ FfJq4ConUe+yYF3YfSW2m9kYZTLbfy8MCoEdAlYolbNXz7BGoJXaeCYjgl4UxwruJ55x KQqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405763; x=1794010563; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=IPEdGzyjjEvwhu2TIQJcT9CPJui5LN71e1AbOGjHfAU=; b=rYZy4jMlTwt/whgTsFu+peMy42piD64Zf8LAp5dYMayE7v9GjxlsgyJwsPTQiK5Tt9 7XrSX7GcSVYYB6EABmVKo2JqfVumjGOXo56BV/G7FdBjeZnIds5HmlTIwpzNCuXQtDo7 2D7IscylBSlOoN6ejwnurT0YW0Rbhsul2OhKmMbXJ3zu2etdJz8p83OM0gJuq+9F28sr CVMVT+63+BjXpuKzc2wpHCUnobCnEHHrID0lrPUYrfIjsP7B5lr8p0/g8mFoHh6nd0t9 xfRsxNDQIs26IAMATZLq5z9fD6/z+Q4amP+/ssltuU8BybeD+dRX9JTGl3JaalVO2qPC VTbQ== X-Gm-Message-State: AFq9FYI7PT+qJZeKq7qf4Jt/4CbyUkKnvXPtQeTd8epqaEJb3+hGhGrt SPd+Q2P0OUWaPCj457xea3o6M8S3MGyWfgqWdSu2ZbZQv/e3gj+jBgq4mtouEcRrnJEdH/fsuWz qEoKUAy0= X-Gm-Gg: AYBFou1deKP1bN/vuq20N8GMB7WlL8RslOaqtY9O5O2wEqB/ROp7MBFBGNWThdj/WJm wz+fEIZKMm/4VVyu+2BJrQNeK7g/ahYtEl1Q6bpY0tjKMelz9x3QZKEzcnleT8nWZyafQCXZhGj zAjymx9iRk1RIlUqAykf/f9hFfbV0gDI6avng8/UJllTlf2JjLXq7SM47d/cw3sS4eS7il4SGn3 GobW+XLOh4m1D6RoG0LAf1MNRAwuled82xMfpuUqmSyQrk0xiN92yG5JwKN9UmtVU9IhHBE0UuC KpG9SKSb/bMtaqO9R8mBffkhdJV2NetBFZ0BXRHZaw1OQxB1Y05JsLiTyYltv48vBVkuD58D5YR AKKhniZRq9+QwX3xnpkW9qjHhsLKVOUNZ1u6s/dkPIFZ7BC7GhroZVcLBi1NjsL4Y01lK6ZaNSL zbbOYDNjU++nMJOhMJatMB0N8OhtehScpEfItTRQYmNbG9LvE+crcOQzZKwcDnRt4CMunY16n/z jJBwD8Ku+kr/xHtI4jJ4JmO8hbgL31UE6ABnCZhvE3uPhBFFLSbjBTLjJ9ThAfUOHx1L2dxaAyG V4dtXEa/ABU5yRj/FyE+sjrtd02lwlX5DmfKCaFQVbd7LrXTFO/h234Pq0vcBPrbULfoIjvTdAE OkpJpHwcxoYOhotv+G3oHO4oWwE6cdQ== X-Received: by 2002:a05:600c:e543:b0:4ac:ab43:b50b with SMTP id 5b1f17b1804b1-4acab43b5f3mr53302635e9.26.1793405762850; Fri, 30 Oct 2026 17:16:02 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:02 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 34/55] glibc: stable 2.39 branch updates to b7a0de2c8f Date: Sat, 31 Oct 2026 01:14:55 +0100 Message-ID: <77cd6c551efab4e73b765421cdb4650bcdfeab0a.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249109 From: Peter Marko Update SRCREV to pull the latest fixes from the upstream release/2.39/master branch. This branch does not seem to receive security fixes anymore, but still got two new commits during last months. Commits between the old SRCREV (be1e627cd7) and the new SRCREV (b7a0de2c8f): b7a0de2c8f powerpc: Fix off-by-one in AT_HWCAP4 loop in _dl_procinfo d9eaad3515 rtld: cache cpuid results on the stack for intel Testing Results: (note that the comparison is done against yocto-20.0.21, so includes testing of last 14 CVE patches) +--------------+--------+--------+------+ | Result | Before | After | Diff | +--------------+--------+--------+------+ | PASS | 4933 | 4941 | +8 | | FAIL | 221 | 223 | +2 | | XFAIL | 16 | 16 | 0 | | XPASS | 4 | 4 | 0 | | UNSUPPORTED | 227 | 227 | 0 | +--------------+--------+--------+------+ Changes in testcases: Before After Source (no change in already existing tests, flaky test filtered by 3 runs) elf/tst-dl-path-normalize --- PASS CVE-2026-86805/CVE-2026-95818 elf/tst-tunables-enable_secure --- PASS CVE-2026-86805/CVE-2026-95818 test harness iconvdata/tst-jisx0213-progress --- PASS CVE-2026-77117/CVE-2026-80489 libio/bug-wgenops-bz33998.test-result --- PASS CVE-2026-5928 libio/tst-fopen-ccs-empty --- PASS CVE-2026-18374 posix/tst-wordexp-append --- PASS CVE-2026-6368 stdio-common/tst-vfscanf-bz34008 --- PASS CVE-2026-5450 stdlib/tst-strfmon-bug34510 --- PASS CVE-2026-19499 elf/tst-origin-secure --- FAIL CVE-2026-86805/CVE-2026-95818 posix/tst-wordexp-tilde --- FAIL CVE-2026-6791 The two new tests which do not pass when running glibc-testsuite will pass under following conditions: * FAIL -> UNSUPPORTED: removing patch 0022 fixes these tests this fixes 41 FAIL -> 6 PASS + 35 UNSUPPORTED and can be sent as separate patch if requested see OE-Core rev: 5eb80f3c562f6e395562c52df67fab60ae0ff32b * UNSUPPORTED -> PASS: running natively qemu-user doesn't support the call test-container makes to create its isolated environment (unshare(CLONE_NEWUSER)) running natively is possible when target arch equals to host arch Signed-off-by: Peter Marko Signed-off-by: Yoann Congal [YC: fixed a 2.44 -> 2.39 typo in branch name] --- meta/recipes-core/glibc/glibc-version.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index 5d57dafed0a..1f4f372c13b 100644 --- a/meta/recipes-core/glibc/glibc-version.inc +++ b/meta/recipes-core/glibc/glibc-version.inc @@ -1,6 +1,6 @@ SRCBRANCH ?= "release/2.39/master" PV = "2.39+git" -SRCREV_glibc ?= "be1e627cd72db31161a3b4ce1c8114674f0895eb" +SRCREV_glibc ?= "b7a0de2c8f68722cfdfc735b8358a3a6559ec0eb" SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5" GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https" From patchwork Sat Oct 31 00:14:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102554 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3747.1793405765116756445 for ; Fri, 30 Oct 2026 17:16:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=GSn6ghQ4; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a59100fa83so11379225e9.0 for ; Fri, 30 Oct 2026 17:16:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405763; x=1794010563; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=J8aH8aMtaZ9G+AJsv6ysdRGbsB+5UiA6iH46LAA+7rY=; b=GSn6ghQ4fvUK2nj+u08vxXykON5WjRYrBCKtVtPxb8AYsEL0FotzDWtYoIZZVeyVA5 Az1X2c1+KrFYWvE+xa/TcIgY/ifq1CXy/gIJrSIPrNSPHtskqLKOzDdnJjKHV58Kir/e Id9qC9zj4XKFar8JRgrWPOGqhNTWCJPTapp3uUMPXxOcfGvlgA9C0hy4R5brACTXm3MG 233lrTHUkwiUUy8OFRzwVkLm6ZTxEtvUHJ8Q1j3Fmv5xveK0eIppnSM0VW5Ak9GZ/FBD mO+OjveJecSMgE5jKeH6iDUTX4OX3yGvrGP1ZDapLTFPfnHcG4Au3EGpWbYk5wEtvAzM M2fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405763; x=1794010563; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=J8aH8aMtaZ9G+AJsv6ysdRGbsB+5UiA6iH46LAA+7rY=; b=nTTkAnV1OMeOG+fgF079QbaeB1G9St6VFaOr8GmUJm5vMjP9QFDNyuRIQseS7JbVuB /dfjn698QOeq5mq6udxx0FvDxvX0mf6sHYaR4W6a6hAGix6IO2VTh+CaIrRJoz4IagEb A4S6PgLLH9/J3ymHjHFvYk60vqmG9ZLelrEEMKvC0MRAPucu7moCCnIag+qFnejx/Jsn cSTqpD7umdirU52NlZlYwV61aS+NFUrLaL5tgLnlnhb09xqTiJNVSYDFBMSNhhm7du8H NfFPOAl49A67OtmLGjSwy3t3uzlrs13B7AzCekVjzLNr9/S8LmXST0BlLZM4pQWHZUPd PA+Q== X-Gm-Message-State: AFq9FYLEt+iwoEwsJRwXUL7pn2Dn8MgOZwnaTOzsKKvAGYyAsuXMDSXG MQjfqEwLq+fOx+fQO5CtSqs2zLPX7A1pYy+YUx9MeXBxE5CQbkBO5V6KReU2NrAA+U6m1wTE5XJ suMkXDE0= X-Gm-Gg: AYBFou1UvcqqaeNBxrtvrviHs0nW9yYS525qcitbZOw/U2n97lClTb1RCgZI3mRiubn ek3lVOhhfr/hBSyOlOvgiPt9aKaMWb/P5Un1rmFXhl3tDYpcbukKOKCx+FRvRlayAOtDxHSKtyU jRlrqNb0b4nLBoWOsUwE/1JAwoVvc85QWH/Z2WGU+UyOWoLoOQo+jUFHuDk/4Sgb8/SZEebKY9q ZFyfcH4BRCfPvMTSfQjm8fbajcpK5SfYLRq3pfrccGPoMamuGWyhk3N4sWF3edXgcvMZSOjzbqj oRD8F2WGeIveAJIIFXDAZBZ125L03nZLcf0d3POwjmBXUgsoDB3/kBAV9eeLoMh8feqv32U9jG5 b8diBeiQSNI0MA25uZNZqvaczsyJYc4oZ+qCj9DjAIXsTXiaPracmz6gzgzIq0LKGgr2mN0FF5L VgP5sOseVJO17eHpFjh3KuQNwoMF1cpRNZGu9eaf53rEVO/oanDB1Qeu8A5epvazXMX0kvSQ1sz vlIBdf2l9PnyZFCZCHX5wcctAgpuiQvMoUuYlhBvUMpK/8VxFGYuQR6FF2c3Fh2nIxcSbo4UPaH 9ym7qEOMSUsngz29SIPDPDfH3u8NpYzsA1+O5p6qqE3eUhY/p+Z9I+xyR8FSlPuvaLWanjWDT+G R7Uq+goncUvLTgDWYb0rc8K2j4pvW7Gs6BhxsvHrcKUvY6vdaCw== X-Received: by 2002:a05:600c:5246:b0:4a1:f377:5c6c with SMTP id 5b1f17b1804b1-4ac16acfe48mr86338365e9.10.1793405763420; Fri, 30 Oct 2026 17:16:03 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:03 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 35/55] b4-config: Add configuration for scarthgap Date: Sat, 31 Oct 2026 01:14:56 +0100 Message-ID: <470df3d03192b603a621135a9b3e6118983a7272.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249110 From: Paul Barker This should simplify sending patches for scarthgap using `b4`. Signed-off-by: Paul Barker Signed-off-by: Yoann Congal --- .b4-config | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 .b4-config diff --git a/.b4-config b/.b4-config new file mode 100644 index 00000000000..5876a9f2691 --- /dev/null +++ b/.b4-config @@ -0,0 +1,4 @@ +[b4] + send-series-to = openembedded-core@lists.openembedded.org + prep-pre-flight-checks = disable-needs-auto-to-cc, disable-needs-checking + send-prefixes = scarthgap From patchwork Sat Oct 31 00:14:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102555 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3748.1793405765772159409 for ; Fri, 30 Oct 2026 17:16:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=QuQfaAtU; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a214af2076so9619495e9.0 for ; Fri, 30 Oct 2026 17:16:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405764; x=1794010564; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=dwb2oJD9hqGFsK4sVQWYT1NVq8oORnSmydMmAjQBNkg=; b=QuQfaAtU+7iYb8Nl5mJbfeVav61xsFBc1clgUDA+eEG6+6TkBxLzr6ebFNB6IOjrqn pocSxyNoxOZE3Q0T9IOCXa9q/8SIXXIakrFPJ66Xp/eAOJY0Va8MNS9RV9Oe3tSx/wtw x8/GcxdzgxV6QL+4Sh6e6rPLEJRSUjXC0AV5mwvMkjkcQHoB1edNun/KSoY0WPy9BdIS 6EItwwr247hFuys32cJN+Zx+1t5jMI6Kv5hES4tpJ23d361GliUXP1DgEy6ZHHsH29dG /yh/CxYTebsmwo8mJo4fIz2GKqu//KnO9CYaHfF9OZSQBwUAnY7c+yzjH4Krk8s3ehzD KVVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405764; x=1794010564; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=dwb2oJD9hqGFsK4sVQWYT1NVq8oORnSmydMmAjQBNkg=; b=Qovv61vT92i3Ac2gpdC69zUHLah/wjfo9Kb4xHaaiZAvgdPQqx2itoQ1giA/DDbIrm cAX/kcYy5Zx3t5SBgitoLWypaly0m+3uGBXfM6TLDpSWF0KmN7fdDuRRxri6rbmvCn2u vVOgGQbckVztGm3JBcu/X6u+f9CQdXl46LIIOMdMXOgGWY4VVkRpFRkgA9REx6xfGcrR KnHDRGFmgJKBB8Qikz6mlGEWHN2fSNrvozA3sMmaI5RuDnzDOeJWNY/W7NvaF33Ih3cV 2eaHezOdHlwya+hYk6SOdnvruRt/6rXv0nEQW7Ve/By/XqQ3SpBtP8nUUhNBk4WTTjSz q+Bg== X-Gm-Message-State: AFq9FYK5TuRioYiY5HnW5wtz5k3b3T6MIXSAhtnoo2Xi4UZuR/imTB5D njSfq0NRxBMXnN8p3WBKIbhyp0q8ivuL8tcMFXxxj+9mM579M2IfuQLyAufMQPLRat32k1szOpg 5sMg2IlU= X-Gm-Gg: AYBFou1w+pCSeaV2Rh3yoWRCLYT+yTF1uMLWhV8nb72NUWFTcBfzGigzOi9QSMaWJYb nRhgPD0gjFY0tK9SUeReb7jau6rLsVERGq6iS4KLXDwk1orihJirC4TxARHRXignyZUxI9lJjaO 5sb22VlTLmarpKSKneMWevC9Polunw21Vd8Ocsb9n7YDpFLw3rWC9M91oYK1ZdYfKp8iCCi6KHI bohr9fyMWXwnUJQcwu/1LurQswFBRj90Wuw3sQzqXaz8AciL/GtRjv/XWKnmQdfFqVo4xHWgmAO PHnTqXIr62f3561s3oRnSG4FxkrEVHfIvBA5qYQxFmTkwO+XySrddTNPExZlYhKIUD+DbmTGT0G NPJ9Ejo0F/lfcCzQYIVuhLLCLIcA49tfRJ0vaRMIpYwy88+aUdhuRg4ZclHOi/NzXgtR2bjdZBe t1wN5gT7kG9Pqr3KMnu1nWD6LCy0bmnhyPNY8PtGradc4LiAZTFXw8zvCLZY5Vux2u6tGIUrVfZ YIa794SchxiyEZf7w9njHwIfd2QekGsmfImWaZXiQBImo5updW6qPUyKOhV21o2x6G3MQ/Tiopn GE7I2Y/ioUPzLx6NIvAKL0Nty1EthEbl75dEBzeFD46n0bNc2gFOEur5gF5N2mYz9sMHbLfWGXw ali1icPADEmqWwB63DdJnq3FJq3u3qQjJCnoFuMveQTwiLky8Yw== X-Received: by 2002:a05:600c:8b63:b0:4a2:40:7f35 with SMTP id 5b1f17b1804b1-4ac18993232mr83435105e9.31.1793405764033; Fri, 30 Oct 2026 17:16:04 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.03 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:03 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 36/55] dhcpcd: patch CVE-2025-70102 Date: Sat, 31 Oct 2026 01:14:57 +0100 Message-ID: <8acfcc9878c973c60ad9aee96b25e5e943f70e67.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249111 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-70102 Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../dhcpcd/dhcpcd_10.0.6.bb | 1 + .../dhcpcd/files/CVE-2025-70102.patch | 30 +++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch diff --git a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb index c32db0adf5d..85f55611eaf 100644 --- a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb +++ b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb @@ -18,6 +18,7 @@ SRC_URI = "git://github.com/NetworkConfiguration/dhcpcd;protocol=https;branch=ma file://CVE-2026-56113.patch \ file://CVE-2026-56114.patch \ file://CVE-2026-56117.patch \ + file://CVE-2025-70102.patch \ " SRCREV = "1c8ae59836fa87b4c63c598087f0460ec20ed862" diff --git a/meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch b/meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch new file mode 100644 index 00000000000..e2b0e291f9c --- /dev/null +++ b/meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch @@ -0,0 +1,30 @@ +From 117742d755b591764036dd4218f314f748a3d2b7 Mon Sep 17 00:00:00 2001 +From: Roy Marples +Date: Sun, 21 Dec 2025 08:31:52 +0000 +Subject: [PATCH] options: Ensure ldop is not NULL dereferenced (#568) + +ldop itself cannot be non NULL as it points to the location. +but *ldop CAN be NULL. + +Fixes #567. + +CVE: CVE-2025-70102 +Upstream-Status: Backport [https://github.com/NetworkConfiguration/dhcpcd/commit/117742d755b591764036dd4218f314f748a3d2b7] +Signed-off-by: Peter Marko +--- + src/if-options.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/if-options.c b/src/if-options.c +index 083449b9..9ac9f0b8 100644 +--- a/src/if-options.c ++++ b/src/if-options.c +@@ -1882,7 +1882,7 @@ err_sla: + if (*edop) { + dop = &(*edop)->embopts; + dop_len = &(*edop)->embopts_len; +- } else if (ldop) { ++ } else if (*ldop) { + dop = &(*ldop)->embopts; + dop_len = &(*ldop)->embopts_len; + } else { From patchwork Sat Oct 31 00:14:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102557 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3751.1793405766483129688 for ; Fri, 30 Oct 2026 17:16:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=WK8LrOZT; spf=pass (domain: smile.fr, ip: 209.85.221.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-48e1d0e5dafso1284907f8f.1 for ; Fri, 30 Oct 2026 17:16:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405765; x=1794010565; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=qjqIiwlBLSKt4hgfzBBQFM4WYirL8dc6fmEyYAuTbxU=; b=WK8LrOZT0MdvuMi2J7r+AdAWjQ5PnZ04V92qCPGVfzAi9+OSsRGW6GtUZfn9UIpxWg OPGqtDWxiQFzLiboIK9JfcFLlXm/tRSV2SjF6wFDvxWSKlJE6i7QPBqOddMraIUslLXn oyr14TtCSU70Jaips6jmQ+WDOtPDuLBDJLZBnYJcIfdX1R9qhv6ncxLGw94dV9h3Wy3N PAdaxTOz9VqxptIJtWdzneSqIxIkJZEsHRr7zE+uxtrX/yy/zTt1nO9U1ursF/D5jw93 t9aGsidLh1tTTHETYNbXGLpvRHK1xeNYvrdqD8k6BtAEffHWjw0PKbBqqf8gCcavN9SZ E2Gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405765; x=1794010565; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qjqIiwlBLSKt4hgfzBBQFM4WYirL8dc6fmEyYAuTbxU=; b=XvWQ09BuvqC0Sk+eUc7FswmAWg0NjXP5YcjLu0qQugWh/7otfxQyX7SgbmZqc3wpIY NPcqVdL/jGu+u0tE/drAbj3/bJxPGZqM94V6KGFIjcUAyNYECZW2iQi+j4WgGB6QNzxW Ge95y2B+WMszP+1Hi9KUAxdqihBYro6mxtNJaLl2UfRA7utJEuEDY1RJiUw/l074Mqsz u4kvzRXhUE7ctrL0SEqiKoNTS8wqcmaliqSSGyjgPxWUTfe87UHttP6+pFSBbZE/SGpb m/q+lM5i5yY9PcTYt54FW2KFSaq3ouCDoNJgWZ6dndmW/sI45UkR26hw5MCQ6HvaONKG Dncw== X-Gm-Message-State: AFq9FYLK3YLevcRTYk8lX3L3B9/BlkJwdDLQBSIBjHSbclUIjOiV3op9 ln/lEp4NTJIhn6Fu5Kq6vLiCYd/9yIaA9R45xa2nVlMCGK+02OGJEOZ0369/x2sDLFFHN1ihp8j 81D/1lVw= X-Gm-Gg: AYBFou3DCC+IajjZ28Q3SaXni2Alvysiz1Xki7vRJ+7ClDdebxUTqJ5/i4PCgXGTmMa I9LQ8Sveuk2roh9Nb6BvkOX1jyDvYWDdmsAo9Yc7DzDSdTV/FH2Hr4nbm6YFqixsrRo1UKKf/rt pfXxsszc5S/UPki13vMpfcxvndsnBls4p3jt+RKpwPsDnyvJ4MeKLAvPQrHaSh8D8HaGmUCmEJf xEAmq5KhX9aVEOrF0Dbclm5jgR3kVNRt7NG5Cfnd9aD9tV3AV9Z2s9Rwdq5CBAkE+hhJULeCbYm Dck6JKcoqJZJJSLClzDgTO1z3VNAMLVnpI67RypPHpoq8pPYDPuZEZSM5LCNwt23vVOzUHW2vff y7Y4bpkK1XnJTK+DKlFHYA9fcCSHUUXnF5kTdq6qLP/IvNYNAuOdHcYInsFvNxg+529p8BflT1e 3ncRQprYLmnALUOygdJbC0tm2cKGTqyICAkWK1negF2Pq5vZxxKvGmWsfWevw1bZMuJ9eQdsvA+ RXvr/1x0d/cwJ6ak9QGrnig37tzbNrI9Lzi3utY93VwNEvN9k9lsCBJbXtADoIqpJGRdY4Zgprw P405GpeSqt9nCc+hz5mW/6TrvpS7yA8Mq6lydo2FffR5IdAn9BT85l3zEYiXhURmGyuFeP47LkV GQq6/jvKWGFxEp5TncmqWP/gCZfVM X-Received: by 2002:a05:600c:1387:b0:4a1:88df:8a2a with SMTP id 5b1f17b1804b1-4ac1793e81cmr91188195e9.13.1793405764673; Fri, 30 Oct 2026 17:16:04 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 37/55] python3: upgrade 3.12.15 -> 3.12.16 Date: Sat, 31 Oct 2026 01:14:58 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249112 From: Peter Marko This is a security release of Python 3.12 Release information: [1] This is an expedited security release to address the compromised eMudhra intermediate CA keys. These keys are now blocked by the ssl module as a last resort against their use. Normal uses of pip, including to upgrade pip itself, are now safe from attacks based on those compromised keys, even if pip hasn't been updated yet. Security content in this release * CVE-2026-115557 gh-160040: Distrust compromised eMudhra intermediate CA keys * CVE-2026-77214 CVE-2026-102633 gh-158876: Update bundled Expat to 2.9.0 * CVE-2024-3220 gh-159428: Don't read mimetypes.knownfiles by default on Windows * CVE-2026-114583 gh-160097: Reject links replacing the destination in tarfile.tar_filter * gh-87720: Fix additional header refolding-quoting edge case * gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory * gh-160300: Reject cookies with a negative version in http.cookiejar [1] https://www.python.org/downloads/release/python-31216/ Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- .../0001-Avoid-shebang-overflow-on-python-config.py.patch | 2 +- ...1-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch | 2 +- ...1-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch | 2 +- .../0001-test_ctypes.test_find-skip-without-tools-sdk.patch | 2 +- meta/recipes-devtools/python/python3/makerace.patch | 2 +- .../python/{python3_3.12.15.bb => python3_3.12.16.bb} | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) rename meta/recipes-devtools/python/{python3_3.12.15.bb => python3_3.12.16.bb} (99%) diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index 6c8b1bf6cd9..3da1b60f3bd 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 2d235d2..1ac2263 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2361,6 +2361,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2366,6 +2366,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch index 6066b26e38f..3cbde6c6cc5 100644 --- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch +++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch @@ -13,7 +13,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 083f4c7..dce36a5 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -663,8 +663,7 @@ profile-run-stamp: +@@ -665,8 +665,7 @@ profile-run-stamp: # enabled. $(MAKE) profile-gen-stamp # Next, run the profile task to generate the profile information. diff --git a/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch b/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch index 5fdf5f4514e..3f59d824054 100644 --- a/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch +++ b/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch @@ -16,7 +16,7 @@ diff --git a/Lib/tarfile.py b/Lib/tarfile.py index 0a0f31e..4dfb67d 100755 --- a/Lib/tarfile.py +++ b/Lib/tarfile.py -@@ -2721,7 +2721,8 @@ class TarFile(object): +@@ -2735,7 +2735,8 @@ class TarFile(object): os.lchown(targetpath, u, g) else: os.chown(targetpath, u, g) diff --git a/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch b/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch index 307e4bf3069..d820e37e601 100644 --- a/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch +++ b/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch @@ -18,7 +18,7 @@ diff --git a/Lib/test/test_ctypes/test_find.py b/Lib/test/test_ctypes/test_find. index a41e949..eb5fe19 100644 --- a/Lib/test/test_ctypes/test_find.py +++ b/Lib/test/test_ctypes/test_find.py -@@ -113,10 +113,12 @@ class FindLibraryLinux(unittest.TestCase): +@@ -133,10 +133,12 @@ class FindLibraryLinux(unittest.TestCase): # LD_LIBRARY_PATH) self.assertEqual(find_library(libname), 'lib%s.so' % libname) diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index 4575a30bfcf..4fcf6468762 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index dce36a5..2d235d2 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2272,7 +2272,7 @@ COMPILEALL_OPTS=-j0 +@@ -2277,7 +2277,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3_3.12.15.bb b/meta/recipes-devtools/python/python3_3.12.16.bb similarity index 99% rename from meta/recipes-devtools/python/python3_3.12.15.bb rename to meta/recipes-devtools/python/python3_3.12.16.bb index 6c6289b0e69..9946bb075dd 100644 --- a/meta/recipes-devtools/python/python3_3.12.15.bb +++ b/meta/recipes-devtools/python/python3_3.12.16.bb @@ -42,7 +42,7 @@ SRC_URI:append:class-native = " \ file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ " -SRC_URI[sha256sum] = "c2c4321961fab0fb999d66e0cecf521c2ab3994c7992873ea99e306c1094fd5a" +SRC_URI[sha256sum] = "b5796915dc45ff745cfb4e990a7e7c93d6f546328a102ce31448d69ebc37575c" # exclude pre-releases for both python 2.x and 3.x UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" From patchwork Sat Oct 31 00:14:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102558 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3752.1793405767245853208 for ; Fri, 30 Oct 2026 17:16:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=PzzR6iO2; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a35d5d4a20so13645195e9.2 for ; Fri, 30 Oct 2026 17:16:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405765; x=1794010565; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=e7UAWR+Nk7/pNeu2Y9kU1H0diu/iQ72DNQgmENMeLT8=; b=PzzR6iO2KralpF85YjwjXboed/5MNwzTPzESQmpB8yMgzFSWw35wdjxZZtz4SFw9qN vEJcHw6oOmnbvRIicYmAkyQ2oSPf94hBkKXDxDWPURLKnr2m4Rma3h9p7UqHRC4PoZrl oSTx3BO0oktn6Gnp+CiH5a5prP74zcejBt7z4xQ9NvO5cFzw0u30GLjMkG7l/I+W435n 1hqkj/wlp+Cq5euZJ9hG0AOZvZoJhj3zwFz2wo40XtQu3QdqpkeViuHhVqwFyyY6N0S5 ii8+tLsgqx4ml27eKXrqa+7LH9tF6EN+r3UsFU4Oyswa4vX0Z5dCeeAMuavJKMjoYBu4 CITw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405765; x=1794010565; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=e7UAWR+Nk7/pNeu2Y9kU1H0diu/iQ72DNQgmENMeLT8=; b=RMzCVOW1rFz0Yt0YFgG99KoXC6pV9YHIQXhSP/f6RMHZ39thW07/x9c6nAB2uZXUYi wSJ/htMGKvazHI0V4kHsaP1TtY/jq3RKqZMOzCDDs9oX7kKnq7dGAzfHWbMlP51CCEyT EypFMYuC96lVBWyYEsa7HrkR+qM3A//CH9nUKRHsIk/z4PbLgyN2CWEQKhsiHo5Vfa4A EidlBAAXXusdd6EnnqB/g4Wd92qr8xK8CNEY0ztlcVboDdSz/v2OtGH0HXmXj7pjLaKm EWYEkY9kit3SslWuFvm4D14FdD2bwABaCeQXhC3cjfdY3u7uBfQUBI4J8Ob0uag+mF/j RIxw== X-Gm-Message-State: AFq9FYJozOfrsIdgzGYimj3nR4DtWeI5DBd0C2TIA3rtp//5mslLYOXc 5oB7xj1i4iR7R1XA750UUftzDh9s54JTkZ29DLArqZWvKMIL66cUr0xa2g4h1jvlb0lsK6OSjQN AkcZyf2I= X-Gm-Gg: AYBFou19/NPRIso+o82COA22pE7kE+u7Hta/B1CHkhz/9yOJYA+fykYjsS4xkufTOsc fi3d/pbsT7zN7PjOVNf1bdXGA40Wu3mo26Z8/PNb7xe5cvakZTKlTUGXo7uCHNby5JYp+jVS4ez VWiiSJl5cEoiHX4SjS0g+QNddsZcRlYqpGH9KE8RLnyUow4LW1XARr2p7ut/sdZQyN3HvAHOjXl skyO80j1oP95IxLdSf5zbif12QRqjTgkzo3mLSNg0yfifhVq5BmXtFRqkgrxvsvRC/5qvhK34oT M8v0s5UqnEPYUZSvx2PrX7mxx/JWH7u69p/+5atMX0EasxZqa5nLNwswjy1aO5pndA207b2sPFH vu6b3rrKsphEp5oghzilXVrRFO4Y+Piyu8j8vtaTk5kwVEiV0OrXx2omx2Ggq9VdHtkr2QI7Tfi KIi817otJJkTyKRhF0HUESQm8BEDESD/q0TCxt7NU+0LaD51T4S6oBZ9SZskEeHdolokj4oPh2z YVqn5kIMx26+3wJvFj8Vh/FWpQ1IzSBXE/AZudHIYiBvahORLQm4CWgLeKHJJrn4smxlYJAHndH JC7HpiQdOwdblPLFg+TgGxmDf6TsnETW1bYD8YrzBys36WascIsDcGeCLE9vQytRA1XuL4MRVJK 8Vct/hmK1yWk5yEG+MPTP12w2vhhE X-Received: by 2002:a05:600c:8b63:b0:49d:34:420d with SMTP id 5b1f17b1804b1-4ac17ff9d41mr82056125e9.20.1793405765441; Fri, 30 Oct 2026 17:16:05 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 38/55] shadow-native: Disable syslog usage Date: Sat, 31 Oct 2026 01:14:59 +0100 Message-ID: <8f136272878dea4e0540e2f53491a2b5c37821f3.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249113 From: Richard Purdie Spamming the build host's syslog with useradd information during image creation isn't great. Add a patch to disable that. It may be possible to convince upstream to make it a configure option but for now the patch is trivial and reduces host impact to the logs. Signed-off-by: Richard Purdie (cherry picked from commit a52572886e60e4aff9d54b57bf45a301e1dec1ee) Signed-off-by: Yoann Congal --- .../shadow/files/disable_syslog.patch | 22 +++++++++++++++++++ meta/recipes-extended/shadow/shadow.inc | 1 + 2 files changed, 23 insertions(+) create mode 100644 meta/recipes-extended/shadow/files/disable_syslog.patch diff --git a/meta/recipes-extended/shadow/files/disable_syslog.patch b/meta/recipes-extended/shadow/files/disable_syslog.patch new file mode 100644 index 00000000000..7299a8e61cd --- /dev/null +++ b/meta/recipes-extended/shadow/files/disable_syslog.patch @@ -0,0 +1,22 @@ +When building images using shadow-native, we shouldn't be spamming the host's +log with lots of syslog messages which aren't relavent. Disable syslog use +in the native case. + +Upstream-Status: Inappropriate [Would upstream accept a configure option?] +Signed-off-by: Richard Purdie + +Index: shadow-4.17.2/lib/defines.h +=================================================================== +--- shadow-4.17.2.orig/lib/defines.h ++++ shadow-4.17.2/lib/defines.h +@@ -88,7 +88,9 @@ + + /* cleaner than lots of #ifdefs everywhere - use this as follows: + SYSLOG((LOG_CRIT, "user %s cracked root", user)); */ +-#ifdef ENABLE_NLS ++#if 1 ++#define SYSLOG(x) ++#elif ENABLE_NLS + /* Temporarily set LC_TIME to "C" to avoid strange dates in syslog. + This is a workaround for a more general syslog(d) design problem - + syslogd should log the current system time for each event, and not diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc index a308ea00d24..37aa7b1f17c 100644 --- a/meta/recipes-extended/shadow/shadow.inc +++ b/meta/recipes-extended/shadow/shadow.inc @@ -24,6 +24,7 @@ SRC_URI:append:class-target = " \ SRC_URI:append:class-native = " \ file://commonio.c-fix-unexpected-open-failure-in-chroot-env.patch \ + file://disable_syslog.patch \ " SRC_URI[sha256sum] = "a305edf5d19bddbdf5e836d2d609fa8bff2d35458819de4d9f06306a1cf24342" From patchwork Sat Oct 31 00:15:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102551 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3749.1793405767755620590 for ; Fri, 30 Oct 2026 17:16:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=hVNXgCl1; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a2000d5fb1so7643625e9.1 for ; Fri, 30 Oct 2026 17:16:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405766; x=1794010566; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=gMaW2rIgiTJytx2lWlTzvZR7CynM61FRDOOplTuCQMY=; b=hVNXgCl1UH356XVwhpKGg1UcfpQ7bscfQQHD0eYk5hgVYEPdnwSFO23gev5WmKZ5Ii pnqfqM3zZ+DB/uzYXdVcz0Gkj2Zm5G8OZiX5jILxl79RwFdAu2M42vS4GJJUZC2Ikea7 en8s6OEHZ0SUiAPTMfobjgLQ7wmh8n7xL/adzrCh4FoNfAtuYvJZPU93ahY1veEETqlI pIDCLCit+SLVohwf31V1/ynJkDynyNFl8X+N4oYoRFJkFydXNZ1K7/ojZ2UaVNg2A75H tqlyghLcRELQgal9aQ/Rwkb3KKW1k1TsnsU1DGYsu02+GZCjHkw611lz0gozRBceYLC9 uHWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405766; x=1794010566; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=gMaW2rIgiTJytx2lWlTzvZR7CynM61FRDOOplTuCQMY=; b=TKKuHSMioL14oG+lNNGoyFaY3/wHxyxgdyAEbhGIEgh+RLh79MvNrC2krP5Y3F6gIp EYFLElvrSPu2vsMeHIs+iVZsKP/YTWMHJ7/9QSBAvN00/soZtI6CHhh5+JaWYgmrJVRe Fx+1lJc51MXIeJsZm0BuNlU6iqjkG+1L4SXCmfqEg2BezeDhBB6OjwgUgXL1ILLbtJ6U zdTDALZJXVuv5MLwtBnmH2l8zjWIZKZyEQhZD8SKEuHAV/WsndIKwV9mMP+taGDj0a5F v37masY3V9uvuZIHHukMm51SpxmK+BBgybSJdHaMh92KqqNIPblzU/UQFUvbLzRb6KQe /xYQ== X-Gm-Message-State: AFq9FYLjCVE2njheHkl9fJX0D6+qd2fcocaBEigqtsrDvihF6Ov0xvg6 qvujP/8o8Jdsv8ltrQw79cn/LZ5TQUQUTAQi9LgfW5Pw/E842IPqtWC6c5ZCaBxxLhtzCNojR5U NHU9ACnQ= X-Gm-Gg: AYBFou02IpavUGBgk8DLc5V8Dw5FSfuO8iXH89s6AI8eLowE++cnGqp1UabwQuxmj5y D6wbm+fJhx3JwCc71BlyU5vIo+KhP5Vvks3bi4fRm5lGmyhdRReSHcAxJIFTHew4swTUMsxIC/o Zyunu9tm7JR+KL0RbGCxiTALMIVBhTTiEnBfyYqjD4kPIIEmrlGBp7zbPiuhPiW8ckDQxrkqMeF 9pfxweZLXzVBIXr3HCQxWy4o1SeYmbQMyZUIc74EY/LYdOsfSHFl3NXhe01NU31bmo5NmZnRxYm qdtvXgwwrq4rLCD8UAlAZRqMCnuojeF8ldBA7wDlnoir0LFCoBVRrjDQddTNzwHxsik2i+2PcdY orCezPJ4pyG2tcFws0un4nVY6xsTewQCarJT/IUBuzoAtnM4BaKp0q+wqNMI3hH0BBtNUZgdYOO 57QmbisDyxg55dTzEjWNHlelzHKHQdoxf3NI/xC0PrlUaQzK4wpgByERtXEQinhhZdG3Uz5BbSF x2EGrH4FyojtZF2H4q5sCPO3I5KISLbpYu/UVgiIEpyP1XYzOUwRyeNVS7Apr9AkbeHzp2OjOzy Js9p6JdS2nsZrTesDDd1AwhNtk0C0bUu9JCSvgSeGtPNplR6NMSPz2a+FblQrCkOMql/lCH75kT eyRYsavqdhjAmjBQjTJgg02lsHSKp X-Received: by 2002:a05:600c:4708:b0:4a2:167a:c93b with SMTP id 5b1f17b1804b1-4ac19234ad8mr81658595e9.30.1793405766063; Fri, 30 Oct 2026 17:16:06 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:05 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 39/55] gstreamer1.0: disable an intermittently failing test Date: Sat, 31 Oct 2026 01:15:00 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249114 From: Alexander Kanavin Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 79ec3a84acc65594942ca9352fddf93d90952d71) Signed-off-by: Yoann Congal --- meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest index 7fee5a3d09c..d6219ddcccb 100755 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest @@ -23,4 +23,8 @@ GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_pull_short_read" # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3524 GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_convert_duration,parser_pull_frame_growth,parser_reverse_playback" +# Intermittent fail +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5163 +GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,test_device_monitor" + gnome-desktop-testing-runner gstreamer From patchwork Sat Oct 31 00:15:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102560 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wr1-f50.google.com (mail-wr1-f50.google.com [209.85.221.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3751.1793405768248431971 for ; Fri, 30 Oct 2026 17:16:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=EoXBDTry; spf=pass (domain: smile.fr, ip: 209.85.221.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f50.google.com with SMTP id ffacd0b85a97d-48afbd2c386so699479f8f.3 for ; Fri, 30 Oct 2026 17:16:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405766; x=1794010566; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ld843SK4pwH1kMpypeItx54BJTQXHbxkSsgBiP8mFmQ=; b=EoXBDTry+sEcIg72ymZAOCqnnnOFXX3//XsnfyRMIwUSNdwQzSxKT05JunOaAcAnE9 1fYJSuhlBnPy0Vgsu//tHu7a0U6URkCvUL4iBw8COeVFg5jt52xz3S4tAsI9FuTzxkxh B5YFEBh3ggm743gtdurwQ0+OEh42CEWS8/tTbNx830iZNKXqhOiNl6DQ3FDzOFqfKqNN 78hqvBMVR3nT+zFLaDPSGa7TNjSJmBhfZbyvu9lHEUCEnx4EIv+a6PfYIcwI79I8taQQ askl+uT6nQ7mUOVEGB3jZwfDQWGSIMuhGQVt8/8OkLywn9J+DhtyNIoa5cdvm0cz4xhf X1ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405766; x=1794010566; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=ld843SK4pwH1kMpypeItx54BJTQXHbxkSsgBiP8mFmQ=; b=NNgB0AmNyhyn9CmsYPMUBVbA8iZQQ+LDYs88oy4uWKz2puFsnu/4A5UQVNU0UZpxsr Q7sCsIIh94jwLG2D0dFkND7kZGm7rMG2cljTKbIgkPSo7sIw4ggZFyTebbcH/xco5IHj AXSKO5fwp/Tw395+M222a+SfqNaGpgpeNMqIdV0eE43fhpxSLShP/siR/mEMp5Q4VZUp /H+qTvTiZtLlW/DoJ8/HOAm8LvsgXRPh7tRBwdK9YRPMezbfA1IEuDkwUvLYnBo1v+H3 i6oI11jHEWtvOju5QqKdlcjUJHG4UU1jxV5Gxg3ry/CNQOJIoH1mTr+LCDyDShNsCgrv 546A== X-Gm-Message-State: AFq9FYLB9rfJmYK+jg7U/5zVVHM+FzQDxOMKIq4HB+qaLqjZYTnmnJT0 gOl3G7KGWjeRspkybgzjDfdvXfVF18qxrxO3a4udaB9ZDL5uO3HSh8sEdWF4BUEno9RnT4oe1hu GyuZ3q8c= X-Gm-Gg: AYBFou0sxAv46VkHDa/BFCHjozg2LBQH4W0jAO3GNTfCr0pmNbqPmiuASAz6XCzw4K0 yUGIcFzzHMyRn7Zyu6IHlZUtrPrjs5IiJXgEoBCQXQhnvaQO1zit1Uq+MKB4Os0y3cluXTTT16E BRPhFMFyOsnNXHKNTlk3x8BDoUUrscwNm1hA3r+7xnIEoSoLiEbdbEASzIsBnsLU7CDuxSnK9KT 2yI2C1tAPD8qVD94ghGBu9SRLoNcDr9gf+hz0zVVP4t1qgd6QrwjPgHBp/9m+SnZQdhQ2ES7Oqq nKaQ2gwO5+X0mTx1xI7XhbHZuOLFjmWX27Q63nVW0lycCSG9BAlSwjfO+NtJOPmsaesTnpl7hCA TB6oZNSnN4EE5yscA4eXI+wvtxR5YeKqPHQaeOLbYUz3n5Oo57b6ZeiLl0PXYjKTLxQ4PjHBql7 hZIKLnAnJjWWUrdiv/o5i558UnbYNqASn+YoO0tGMa/WQgPkraAWXF1mFme0VXsw9eg7jo5ES76 K8jNhcfoNL1cfPZzN3U6ROPGT8uMeUtn6QBH1/F71rAr+jPpd0zfha0za6tPrCakwzIZxiRI7SI fBAGtJXD1cwDcf4Ydr2U8P1I3tP5uuDYS0hdmB5f7Bn4+2YKGCHE+J+G6iV8JITm4M2TemO6sbm W3uYYaXKrKOwAx5EnSReThZOIyFId X-Received: by 2002:a05:600c:8709:b0:4a1:9078:911 with SMTP id 5b1f17b1804b1-4ac181e75b7mr93786355e9.31.1793405766555; Fri, 30 Oct 2026 17:16:06 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:06 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 40/55] gstreamer: skip test_queue:test_leaky_downstream test as it's flakey Date: Sat, 31 Oct 2026 01:15:01 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249115 From: Ross Burton This test occasionally fails, so skip it. A bug has been filed upstream. [ YOCTO #15408 ] Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit ac8fa6ada2a0cf0ae27316837985dd57b01e727f) Signed-off-by: Yoann Congal --- meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest index d6219ddcccb..b0f2a3050b6 100755 --- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest +++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest @@ -27,4 +27,7 @@ GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_convert_duration,parser_pull_frame_ # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5163 GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,test_device_monitor" +# https://bugzilla.yoctoproject.org/show_bug.cgi?id=15408 +GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,test_leaky_downstream" + gnome-desktop-testing-runner gstreamer From patchwork Sat Oct 31 00:15:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102550 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3753.1793405769253555642 for ; Fri, 30 Oct 2026 17:16:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=Jem5Pq5M; spf=pass (domain: smile.fr, ip: 209.85.128.41, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4a20bdaf39cso15321415e9.1 for ; Fri, 30 Oct 2026 17:16:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405767; x=1794010567; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=hNurThRtrKMm9OwR5lR+NTnPPZXbUiPvU4MWT6jRkAs=; b=Jem5Pq5M6U7E/csbrSdMpHs8RoJuzcdPQkf0AMIQUOcB+X9arDdHVbgMpN8xbas42o 817vtsgww6LYp2Lcz1qM/UHG5ZZ0ixNvKlGGarxLnO/EirVD/y9cjcBj3/gY7IB1SM9g W4F+uSqKYaHohT7pX4Zw8Varcaovuo6cQfGP0PPwWBzqFtYZOm1MCYY7qpEZ1Xqv4XRI Gu5WMr15j5EUaQwBSUkJqCzNdxAJ0N/IXvZfW6w56iSzIoj46IlTF672jia+fK2pImV2 5tKu1ui8pWPWVzXnxXlZ0jcgt+mZtXA8CzyfAlycCGLvLcwxisMbvE60f6vv7RGif7r3 2hQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405767; x=1794010567; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=hNurThRtrKMm9OwR5lR+NTnPPZXbUiPvU4MWT6jRkAs=; b=CvFD+cD9Q7YtWP7FuS4FIksR5oTsTnRA8HFdlby6ekyQ4U9Ky/vT4JY0VMvibUZfOr QkRs7BspQddGcf2wnA4z/li+U52QLjOp43FBfyKJN40KvLjUoDS3JHSs1wgIsYTBqKX3 3loXi/g5/Z0DX7n/TulzBwktob0ihoTkg0PWAUZc0Cp8jFPKuiEvWMMuFxWOCAQZ03um BZSTJ+KokFpXmUGZsbHDfXS35kdTOP8DixMa5U2I6gYPOi7nyzjidj61PIIIkHUDMrTM sV/Y1dHBlJE1ZGKebwAVPYBGEB0c0+8aMXmBtsautImPk7Vv/BOun8sfBGMQ2dvi2/P4 2UMA== X-Gm-Message-State: AFq9FYJ9aySSqM0zEsCv0AzM3unC/EjR5NL33nXeIvA9GJf2Ulnnt7kT jcvBnEydQ/+/mYpWCJ4kC1j1rI9q+wj8rOjE6c9LbaXsT7EfltTVbJPE1Q8Nb1g3Lgu5w1746WC TMZrXDCs= X-Gm-Gg: AYBFou2vVVZ2JTn7JU259YJh6T5aT3S+sOcz4eCe6a4dR/497APl18GTqAz4wOdZFeb XiclMdQfi1vLD1rr22/+X00uzfHBbjoH1bP/9ug/tvc/rn37C2ra5jAGgAR5Z4GKFZAJBMfTyH5 CfH+njip18XN6Y9SCEn1fstSNwJHdXjQzOYP9ocLQrvMd/c4Y6FC7Ak78M/8ofPQ1TcL625cnza jEDbNc9IRVDO5dIOllCiTWVOiUzZoiAFIDOxs57J6URXdsgI4deQaeHXQPm/eags2kbE40gddcV cYKVsnw3eNvicv161gLnLS1T3tut4cZULeKX2kZ0chwT4YqeQrTwrruWibzvwdp7xfuZ5UIsOlB G7eGV6ib+ulB0TIodOl425ByhtEiOYyPoL/Bo/Y93GWCS3sQfNMsfFFOV6RzlFoMQEUfoaCfyI5 7j7blRYm44jnlG5W1GqInutIvnM5sCe9fkQSJDlK87OR5lLz6q5dhbB0NDHEeLq6YXGatNPKj9I 6zgRLUbe6C4H9R6APSLqp4+ivkWe8Z7rYYFCoUZI9z06CiRb66LG4uZXrlok5oZ0zIiWrBUL7i4 pT2UnSkHN4q/2tPbvCbA0P428C0qyI8pG02WlA5N0uNgyjprNQfxTwSeVVdCy5vhJPKD6yVDHt1 fdPNR0qrG7JPg8HtJy2rPhsq76ghI X-Received: by 2002:a05:600c:348f:b0:4a2:be6:60aa with SMTP id 5b1f17b1804b1-4ac17d16b14mr88128625e9.10.1793405767099; Fri, 30 Oct 2026 17:16:07 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:06 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 41/55] linux-yocto/6.6: update to v6.6.156 Date: Sat, 31 Oct 2026 01:15:02 +0100 Message-ID: <22bbc8a753f517ea9666f57fef705e620956c052.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249116 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: 8b73de7da85fd Linux 6.6.156 65879e0a452ca usb: usbfs: fix use-after-free of usb_device in usbdev_release() 62cd519ab74ca USB: c67x00: fix use-after-free in c67x00_add_iso_urb() 8e987c4daf4f4 USB: serial: spcp8x5: drop broken carrier detect support 030e3a73d3c3a USB: serial: option: fix slab OOB read in interrupt URB callback f1c05c41d07b8 ALSA: usb-audio: Complete cleanup after system-resume errors 94e4562fcc81b ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() 656bd0ccb9006 usb: core: Strengthen error handling in hub_hub_status() 04ab260407972 usb: core: Add lock to usb_wakeup_notification() 087c19cc60a8c KVM: s390: vsie: zero stale crypto bits fb8110b748b20 crypto: qce - Remove unsafe/deprecated algorithms 1537bd55b4f84 crypto: mxs-dcp - fix source scatterlist length access cc56d2b0d77cf crypto: qce - fix CCM AAD buffer underallocation 4d35a92dd3da5 crypto: atmel-tdes - use scatterlist length before DMA mapping da45847766b52 mm/swap: reject swapon() on filesystem-level encrypted files f52f1e75716d2 ipv6: seg6: clear IPv4 control block on IPIP decapsulation 7c54fd8cfbcf3 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context c8837bbe79225 xfrm: fix xfrm_state_construct() auth-trunc leak f00df8500e5a3 xfrm: ah6: validate routing header segments_left 2dd1609cadff4 xfrm: drop ESP-in-TCP packets with no ingress device ff8dd7a932f34 xfrm: espintcp: fix UAF during close a622167351020 x86/CPU/AMD: Carve out a Zen5 models range 7287cc1211312 x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range fa05e559102ec x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range ed9cf952fdec3 x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5 5953e7a89966f x86/CPU/AMD: Add X86_FEATURE_ZEN5 a832d7cb09da2 tls: device: fix out-of-bounds write in tls_append_frag() ad6f0375d2e93 usb: gadget: f_tcm: keep port count until LUN teardown completes f95e57b66195c usb: usbtest: disable dynamic ID support dcf30a56624c2 fuse: fix invalidate lock leak on open O_TRUNC DAX failure 92588d187ba46 fuse: fix invalidate lock leak on setattr writeback failure c36e7e4eb83e9 xhci: dbgtty: Fix unregister on tty_alloc_driver() failure eaca2814f32b9 xhci: dbgtty: Fix unregister on tty_register_driver() failure d27599347b691 usb: xhci: Handle USB3 port events when there is one roothub daba8d1cd995c accessibility: speakup: unregister tty ldisc on later init failures ba537c32de311 fpga: dfl: fme: add error handling 95f90c6029cae xfs: remove file_path tracepoint data b5181516a9f5c Bluetooth: hci_sync: Fix accept list UAF during suspend b95bc136fe541 Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() 2e0471bf3ab2a HID: pidff: fix OOB write when hid->inputs is empty e9f2ce45b311d HID: pidff: clang-format pass 1acff0590a447 HID: pidff: Support device error response from PID_BLOCK_LOAD 9d77ac82e57ea HID: uclogic: fix use-after-free of inrange_timer on remove 460514d46e889 HID: ft260: fix stack-use-after-return write in I2C read race 3a32b93cff2a3 HID: ft260: validate i2c input report length c023443f0e6cf HID: nintendo: stop device IO before hid_hw_stop on probe failure 25ad03d5c0e85 nvmet-tcp: bound SGL data length before allocating command buffers e4f43b3d85885 nvme: rename CDR/MORE/DNR to NVME_STATUS_* cb8b78b34593b nvme: fix status magic numbers 59d4c2352e823 nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err d16df755b4493 HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() 250cea475827f HID: magicmouse: re-enable multitouch after reset-resume e25b44bd8b8cc nfc: nci: add data_len bound checks to activation parameter extractors a5e776e293758 nilfs2: reject invalid block index in GC ioctl df75b4d1656b5 nilfs2: correct return value kernel-doc descriptions for ioctl functions 267a15c4f994d ext4: propagate errors from fast commit range replay 0b34ea0dc2bb6 ext4: make some fast commit functions reuse extents path e971a37c68cb5 ext4: make state in ext4_mb_mark_bb to be bool 4241e3b406c80 ksmbd: harden file lifetime during session teardown bfd861dadd3a4 crypto: starfive - Do not free stack buffer b300312562fd6 powerpc/hv-gpci: fix preempt count leak in sysfs show paths 2df9641e4b622 net/sched: initialize noop_qdisc owner 524323f52cbfb net/sched: Fix mirred deadlock on device recursion 4f15e7704c335 selinux: switch two allocations to use kzalloc_objs() 9a4d8e559c3c9 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk(). a698d43ce95b7 ASoC: nau8821: Cancel pending work before suspend b671ba32c5638 Revert "PM: sleep: Use complete() in device_pm_sleep_init()" 66dedb6028c3d riscv: Fix register corruption from uninitialized cregs on error 5662dac41a344 bpf: Fix use-after-free in offloaded map/prog info fill 36fb28fa033f6 ASoC: nau8821: Cancel delayed work on component remove 4f5f52a584293 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). 80d1fd39f4e37 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). 7b854e68365a8 KVM: arm64: Prevent access to vCPU events before init 302dbed4760bc smc: Fix use-after-free in __pnet_find_base_ndev(). 53ca5b78b69d3 can: j1939: make j1939_sk_bind() fail if device is no longer registered fd8c807f8d5f1 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler 76957b618ce72 can: j1939: implement NETDEV_UNREGISTER notification handler 75194165e6501 mISDN: hfcpci: Fix warning when deleting uninitialized timer 71209954f1e8f media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode() ac65f76db9b2f exfat: fix double free in delayed_free a39f811a9f5ed jfs: Fix null-ptr-deref in jfs_ioc_trim 9bc078818ec76 ibmvnic: Use kernel helpers for hex dumps 47a99881ecc50 jfs: add check read-only before txBeginAnon() call 41da1715cd24e jfs: add check read-only before truncation in jfs_truncate_nolock() e217492f6fa22 bpf: Remove tst_run from lwt_seg6local_prog_ops. ce12e1170c0c7 perf: Reject exited events as group leaders c1164f14c6366 bpf: Ensure reg is PTR_TO_STACK in process_iter_arg ff3f428df00bc Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal" eb1e94fee5e27 io_uring/io-wq: fix worker accounting when canceling creation callbacks a13f61ba9b2a7 ext4: don't enable DAX on new encrypted files 429b6f43b4d8c KVM: x86/mmu: Check write tracking in all address spaces f5e6580a3a16a RDMA/rxe: Fix OOB in free_rd_atomic_resources() a4a971135a2ff Linux 6.6.155 3edf721bb4b99 inet: frags: strip GSO state from fragments before reassembly 93e0c9521fa8e Linux 6.6.154 e907bf694ed55 net: gro: properly validate BIG TCP aggregation criteria 26741d178f319 Bluetooth: hci_event: validate LE Set CIG Parameters response 0628cc9b2fa29 Bluetooth: hci_event: fix LE list UAF on reset 334271d3812ab HID: hyperv: validate initial device info bounds 2ce90cfc6646a HID: sensor: custom: Fix use-after-free in enable_sensor abec577de5fc1 HID: core: fix number/pointer type confusion on long items bd397c4123a4b HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() bb32e9a6a9a9f mptcp: pm: fix memory leak from alloc-during-teardown race a5321b00b98ec Input: atkbd - skip deactivate for HONOR ZQC-P 346f0edba1d49 Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard c4cec575a6d6f Bluetooth: hci_sync: Fix advertising data UAFs f0ab9a71167ba xfrm: fix sk_dst_cache double-free in xfrm_user_policy() c1d9c16af51cc HID: core: fix OOB read of field->usage in hid_set_field() 9b3469d162e3a HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID 3d7a7bac4c75f HID: magicmouse: do not keep a stale msc->input if no input is claimed 514a814c74277 HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C 13aa13ce3d653 mptcp: pm: fix data race in add_addr timer callback 48b76879f5bfc ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses 4931c09d83877 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout 74ec9c120e900 ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err() 5f291adb281ea ASoC: SOF: pcm: Move period/buffer configuration print after platform open 93c9bee226152 ASoC: SOF: Relocate and rework functionality for PCM stream freeing 925cb11b60c14 ASoC: sof: pcm: use snd_pcm_direction_name() 86cc450022473 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations d094582cce9c0 nvmet-fc: fix invalid free in LS IOD error path 8f6363c8d54dd nvmet-auth: zero the AUTH_RECEIVE response buffer 087ee0d914aaa ipv6: fix use-after-free in ip6_finish_output2() b0ea911453ce7 ipv4: reject undersized MTUs in ip_do_fragment() eab3eeb68bfc6 libceph: fix OOB read in decode_watchers() via missing bounds check 28d984a66b9e1 Input: byd - synchronize timer deletion before freeing private data 3a398e09a6c15 ndisc: ndisc_send_redirect() cleanup 790576dc7ccc4 nfc: nci: free destination parameters when closing a connection 7489f59d1ea2d nfc: nci: fix uninit-value in the RF discover/activated NTF handlers 24761d3a5f692 nfc: nci: fix out-of-bounds write in nci_target_auto_activated() 9635507fe8294 nfc: st21nfca: validate ATR_REQ length against the received frame 4a52ec2457ff8 nfc: pn533: purge fragmented skbs during cleanup 3793d768b40f3 nfc: llcp: reject PDUs shorter than the LLCP header a209334ed9299 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers 1964addc8dd53 nfc: llcp: bound the connect_sn TLV walk to the skb 18f02354ed229 nfc: microread: validate target discovery payload lengths fc3c2bd5b1ec6 nfc: fdp: bound the device-reported read length and fix an skb leak d0756a98277e3 nfc: digital: clamp SENSF_RES length to the destination buffer 77693fb8aec30 drm/amdgpu: check ASPM on the dGPU host link b287812f88a1c drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix 874d1bdda79bc drm/amd/display: Fix BT2020 YCbCr limited/full range input 3227cd5116751 drm/amd/amdgpu: disable ASPM in some situations a3d60ae24183e s390/vfio_ccw: Implement a crw lock f0d189d95eee0 s390/vfio_ccw: Calculate idal length based on idaw type 460b977a4e71c s390/vfio_ccw: Ensure first IDAW remains constant 152fcb74a2680 s390/vfio_ccw: Free all memory if cp_init() fails b6505a4cea45d gpio: ml-ioh: use raw_spinlock_t for the register lock e99120b5944a1 xfs: validate attr entry pointer before field access 46116f574be32 ext4: clear error before retrying inode xattr space fallback a40c45268f435 ext4: stop retrying saturated xattr cache entries a2fb8222cde23 kcov: fix data corruption and race conditions on PREEMPT_RT 075e52fd6d86c null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows 6a009f1e61b11 ocfs2: fix missing metadata reservation for large xattrs b20eb7ecbdaa3 ALSA: dummy: Check card index validity at probe b7528b42813f0 xfs: bounds-check buffer log item's dirty bitmap 2eca18dd026b2 xfs: don't use a xfs_log_iovec for ri_buf in log recovery d3ffb89b29446 inet: frags: publish queues before arming timer bb7488c797d0f inet: frags: save a pair of atomic operations in reassembly 32fa602b5dd6a inet: frags: change inet_frag_kill() to defer refcount updates c69b3593aa735 ipv4: frags: remove ipq_put() 4d40d900ffb2d inet: frags: add inet_frag_putn() helper 4a8887dd3a8a9 serial: sc16is7xx: enable THRI before filling TX FIFO 811b44be278b2 serial: sc16is7xx: use guards for simple mutex locks a289a78f13ab0 serial: sc16is7xx: rename EFR mutex with generic name 7047aa394d6ce serial: sc16is7xx: convert bitmask definitions to use BIT() macro 969e3867ef67e serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants 1606abb7ce8c0 serial: qcom-geni: fix TX DMA buffer flush 80c6054a4c40a perf/core: Fix group leader use-after-free after sibling detach c4ab0d6888022 perf: Unify perf_event_free_task() / perf_event_exit_task_context() c8c8e895f65fb serial: amba-pl011: synchronize DMA teardown fcaf8ba7e56bb NTB: ntb_netdev: Preserve RX queue depth on allocation failure 10a6b99079697 rndis_host: add overflow check in rndis_rx_fixup() 362726c9c6e56 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept 8d08713ec83a1 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems dc6160265ffc7 Linux 6.6.153 22709117d9ae9 ring-buffer: Use current_context for safe per-CPU buffer swap cf0bc75d1ca9d ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() 171f95d662863 net: harmonize tstats and dstats 2fdf8b07bee5e binfmt_misc: use exe_file_deny_write_access() for the interpreter clone 1fc9f6d2c7c9f net/x25: fix use-after-free of the socket by its timers 74365aef5bf22 erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms ec5a552f4b2d8 net/sched: cls_bpf: reject dev-bound programs bound to a different device 551688b410d3f net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG f60c71deb17ea m68k: Define NR_CPUS to 1 2930f1b49133e m68k: use the coherent DMA code for coldfire without data cache 5904c758e0e95 dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol 19d114b93c94b net/sched: cls_u32: skip hash tables in u32_bind_class() 91d55fd1fdb85 net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain a857e3408be07 net: sched: Add initial TC error skb drop reasons d54e7ec851664 net: sched: Move drop_reason to struct tc_skb_cb 14f679a8d2ddc packet: add a generic drop reason for receive b72e44dc038f2 net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config 69c66cf557906 net, sched: Add tcf_set_drop_reason for {__,}tcf_classify 5599966042e05 net, sched: Make tc-related drop reason more flexible 1fc70b3d513ba af_packet: Don't send zero-byte data in tpacket_snd(). b4ef887bee4d3 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers 06c2a53604fa1 net/tls: Fail tls_sw_splice_read() after a failed async decrypt e451e20adb869 net: packet: fix wrong transport_header when sending VLAN-tagged frame 28afc87bd8da0 macvlan: inherit needed_headroom and needed_tailroom from lowerdev f3c17ff65f547 ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ccc33e1b2edb4 netfilter: ipset: let destroy callbacks adjust ext mem size eada630d0ae3e netfilter: ipset: fix list type element drift bug d37917e7bebe0 netfilter: flowtable: publish GC-visible tuple last 17c132e18ca5d netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path b891e7a6bb06e netfilter: ipset: fix refcount race between list:set GC and swap 9f4a626420c71 crypto: ccm - Set rfc4309 maxauthsize from child 4f1dde17b1222 arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 f3a874a903053 mm/huge_memory: fix huge_zero_pfn race 28afde1edbd8b KVM: SVM: Serialize accesses to the owner and mirror list with separate lock 76df4edf7d61e mm/ptdump: always stabilise against page table freeing using init_mm 8d7f560f4b048 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF 56a45fdbe5b25 mm/pagewalk: split walk_page_range_novma() into kernel/user parts 898a44d811cf0 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini 9efc767335234 drm/amd/pm: fix pptable use-after-free 50cfece0b1c02 drm/amd/pm: fix torn gpu metrics reads 584a5d96b6ebf can: rcar_canfd: change the initializing flow for clocks and resets 441e9c33284c1 i2c: iproc: reset bus after timeout if START_BUSY is stuck b95dd3225eea5 i2c: bcm-iproc: remove printout on handled timeouts bb01c51950c3f vxlan: use pskb_network_may_pull() for transmit path header pulls 1db9041e91ac5 vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS. 72496cf871aa2 vrf: Make pcpu_dstats update functions available to other modules. 7806ff0e8a4d9 net: core,vrf: Change pcpu_dstat fields to u64_stats_t 73e7998c3361c vxlan: Do not alloc tstats manually bbd63ba7961c6 ice: fix VF interrupts cleanup dd9ba32169e73 binfmt_misc: restore write access when removing an entry bf5ed2ef5cdb7 fs: don't block write during exec on pre-content watched files 04958dba44dc7 veth: convert frag_list skbs before running XDP 577443530cb59 net: pktgen: fix proc entry use-after-free b0a3d6d582ec2 net: pktgen: fix code style (WARNING: Block comments) 81e21cb7bd147 ksmbd: reject repeated SMB2 NEGOTIATE requests 5964d1f35402f ksmbd: conn lock to serialize smb2 negotiate a0f16c3376918 igc: remove napi_synchronize() in igc_down() 1f389ecd0c35e ASoC: tas2562: Validate values for volume writes 5b948706f11a9 mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE 94a15b8a8f5a9 btrfs: zoned: fix missing chunk metadata reservation 2c3bd3b6ba701 btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg() 76f70daebe757 btrfs: add space_info argument to btrfs_chunk_alloc() 17fe8f41c8c21 btrfs: add debug build only WARN 8b0a3a094f4ca tcp: challenge ACK for non-exact RST in SYN-RECEIVED 6eb6b1d172659 tcp: fast path functions later 6ad63d36f6c5f tcp: Pass flags to __tcp_send_ack d8e5c5672724b ksmbd: validate minimum PDU size for transform requests b9e4b3b9aadbb smb/server: fix minimum SMB2 PDU size ecb45f5c8b0db smb/server: fix minimum SMB1 PDU size 618af5277dcb5 ksmbd: rename smb2_get_msg to smb_get_msg 45e3e87561b4a smb/server: rename include guard in smb_common.h 7964b9ab3baf9 smb: move get_rfc1002_len() to common/smbglob.h bc73642ccd637 smb: move smb_version_values to common/smbglob.h 05536cad35f27 super: fix emergency thaw deadlock on frozen block devices 4131dd0b6f67a net/sched: serialize qdisc_rtab_list against concurrent get/put db3e82da616f5 net: gro: fix double aggregation of flush-marked skbs 2cb6c8b12bda5 net: move skb_gro_receive_list from udp to core 02430f6f729b2 libceph: fix two unsafe bare decodes in decode_lockers() d974b4b786214 userfaultfd: prevent registration of special VMAs d97b01e78ce31 userfaultfd: move vma_can_userfault out of line 896e8884fc2cc mm: userfaultfd: add pgtable_supports_uffd_wp() 48829622212f6 iomap: fix out-of-bounds bitmap_set() with zero-length range 7439dc31f6781 iomap: hold state_lock over call to ifs_set_range_uptodate() a155aa7a52c6f ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP 42bc06c67d94d libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE 7cd7b483893b6 libceph: Amend checking to fix `make W=1` build breakage 34bb4c61948da ceph: Use a folio in ceph_page_mkwrite() e05c315b4da0c ceph: fix hanging __ceph_get_caps() with stale mds_wanted 78af6441b8966 ceph: Remove ceph_writepage() c8a21660c3b90 ceph: avoid fs reclaim while using current->journal_info dbb90d8b21b94 RISC-V: Provide pgtable_l5_enabled on rv32 48552988925d9 xfs: check v5 superblock features early 5b756fbb60b5d xfs: don't swallow dquot recovery verification errors ed8bfb43de712 xfs: fix ilock leak on error in xfs_dq_get_next_id 472cfa4ba2433 xfs: only check mergeability of bnobt records 070229262ede3 drm/amdgpu: disallow multiple FENCE chunks in one submit 60539d517e843 drm/amdgpu: Fix UVD decode image min size calculation fa96c24485942 drm/amdgpu: Fix UVD dpb min size calculation for H264 7cff5d7870a11 drm/amdgpu: Fix UVD min buffer sizes f0f5048d58dec drm/amdgpu: Implement insert_end for VCE 3 8435d41afcf2b drm/amdgpu: Reject UVD message with dimensions above 4096 ce5da474c3ddf drm/amdgpu: validate GEM_CREATE domain combinations a930c54cb6720 drm/amdgpu: Reject UVD message with invalid number of h265 refs f72a51810d494 s390/vfio_ccw: Selectively expand io_mutex f98a9890ca42f s390/vfio_ccw: Move cp cleanup out of not operational af3f80ca4c8b1 s390/vfio_ccw: Fix out of bounds check on CCW array 79ea5e0c4c8a9 s390/vfio_ccw: Ensure index for read/write regions are within range e868ea8be0bc8 s390/vfio_ccw: Cancel existing workqueues 15fb4559a7fdf s390/vfio_ccw: Limit the number of channel program segments 2acbeace14672 drm/radeon: fix autosuspend cleanup during teardown 38d60f808b341 mmc: sdhci: make tuning_err a signed int fc90985bd5d7e mmc: sdhci: unmap the bounce buffer before device release 2d481fc84b589 mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit 762be85fadd97 libceph: tolerate addrvecs with multiple entries of the same type 54aff77ed44ac ceph: fix MDS random selection readiness predicate e2ffeec85201b libceph: Avoid using invalid osd indices from primary_temp 28d9cd72827be Input: sur40 - fix V4L error path cleanup 3e8ed76a4f357 Input: sur40 - fix input device registration ordering b4d73c3848bae openrisc: signal: do not restore privileged SR bits on sigreturn 82f4f07f3f040 ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() 8c6ee5351b264 ftrace: Protect direct_functions in ftrace_find_rec_direct fa4aa86fff0c5 libceph: fix multiple unsafe decodes in decode_locker() de52c713d2180 crypto: qce - fix error path in devm_qce_register_algs ec61ca4e31066 Input: hynitron_cstxxx - validate touch count and finger IDs 2b0403fb7e28f Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue 1d718f1461766 Input: synaptics-rmi4 - block s_input when F54 queue is busy 12be3c6ca9589 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer 77749685e55da Input: synaptics-rmi4 - zero report size on F54 work error 8e3e0f23f8fd4 powerpc/pseries: lparcfg - fix kbuf[] underflow 5232529eaf57f Input: iforce - validate input packet lengths 9094997f073e9 Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard da6b8b05db0cf Input: psxpad-spi - set driver data before use 81b07470cb293 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet 0739c65e799d4 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo e19b45d5e031a powerpc/pseries: pci - logic bug 142346822c700 Input: xpad - add support for ZENAIM LEVERLESS e5cb281913621 drm/amdgpu: fix aperture iounmap skipped on device removal 42bc07b4e5a3c fbdev: core: Fix pointer desynchronization in fb_io_read() 891129df5de79 ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses ad8b255006580 ASoC: cs35l41: sort the register default table 673348de84471 ASoC: cs35l45: sort the register default table c18fe394ddcce ASoC: cs4265: sort the register default table b270ed3273804 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() cc423f4105fe1 s390/qeth: validate user buffer length in SNMP and ARP query ioctls f75f174edc865 mptcp: fastopen: only mark MPTFO subflows with SYN data 26dac5c9ffb20 mptcp: options: reset DSS fields in case of unexpected size dc1d8d3eb345c mptcp: avoid combining some incoming suboptions 6e46970fc0001 selftests: mptcp: join: mark tests with data corruption as failed e0285bb152211 selinux: reject an unclaimed class value in security_get_classes() 1acc317d67a75 selinux: do not cancel a policy conversion that never started 2b7ffd7921fcb selinux: reject a class permission count below its inherited common 3161daa3f1e3c selinux: require every boolean value to be defined 6515053335d9f net: mana: Fix EQ leak in mana_remove on NULL port 3e9d5f325e9ce ipvs: separate destination availability state 68e094232dfe5 f2fs: fix UAF issue in f2fs_merge_page_bio() 6f06dbe5012c1 block: stop the timeout timer when releasing a never added disk c610b395b0a51 Linux 6.6.152 1a9e400a19df4 regulator: devres: fix devm_regulator_get_enable_read_voltage() return 2ee4194be09fc net/tcp_sigpool: Use kref_get_unless_zero() 0490d0b862ed5 net/tcp_sigpool: Fix some off by one bugs 7a6a6d2a12786 bpf: tcp: fix double sock release on batch realloc 50f0c8dd8c339 thunderbolt: Bound the DROM dual link port number before indexing sw->ports 31efa656cf6af sctp: clear new_transport when removing a peer dc67d528c2fa9 sctp: fix use-after-free of cached ASCONF chunk 1adf929121e13 sctp: keep chunk->transport in step with the list it is queued on ed935348a9a96 scsi: scsi_debug: Negate wrapped memcmp() result d192cff2a37d5 bpf, sockmap: Fix sk_redir use-after-free in send verdict 310b5a537a78c sched/psi: Shut down rtpoll_timer in psi_cgroup_free() 33b7e810ce099 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() 64e41736a26f3 ip6_tunnel: clear skb2->cb[] in ip6ip6_err() 0b9e02f3bd31c ipv6: fix Route Information option length validation 3d965811be784 ptp: ocp: Fix board ID over-read 999e573212d5f Revert "thermal/drivers/hwmon: Cleanup coding style a bit" b77581b25e213 eventfs: Fix use-after-free in eventfs_remove_rec() f33ecb89d3523 KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page c292d4686f717 smb: client: Fix use-after-free in cifs_try_adding_channels() 47ba70891b10b tipc: read le->link under the node lock in tipc_node_link_down() aa8b14647721b tls: don't leave a full plaintext sk_msg ring unpushed cf363a7a02ce1 vhost: reset the vring metadata cache on vring reconfiguration 2f2a7f3f8b9f1 veth: fix skb length accounting after XDP frag adjustment 9d80a04129a6c vsock/virtio: avoid refilling the RX queue after teardown a1fb0c5b8a7c2 vsock/virtio: read virtqueues under worker locks 619dd29045e43 vxlan: do not arm the ageing timer on a device that is down ba13763d667e0 xdp: reject clones that overrun skb_shared_info tailroom 7380f1bfe9d7e Revert "drm/amdgpu: fix aperture mapping leak" 513478092966d ovl: don't warn when the mount is completed from another user namespace 6bcb8839aa2d6 net/sched: act_gact, act_police: range check the fallback control action 737873a59905a net/sched: act_ct: fix sk_buff leak when the header checks reject a packet ff451bc4290b7 net: atlantic: free RX pages of consumed but not refilled buffers 7a3e1481f4ee6 net: atlantic: free stranded TX buffers on ring deinit 63853eb20bba4 netfilter: nf_conntrack: defer invalid log until after unlock 6ea88401e10e0 netfilter: bridge: release template ct on non-IP path cc5bd568f9b76 ipv6: prevent in6_dev_get() from resurrecting inet6_dev af02c67ce6543 net: smc: fix splice entry lifetime imbalance in smc_rx_splice 94134d70abf92 fbdev: bitblit: bound-check glyph index in bit_cursor() e5f1d301b4bda tracing: Fix race between update_event_fields and, event_define_fields 4208db2453e1e ALSA: usx2y: bound the hwdep mmap fault offset d431941825d35 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs 93e7044b548a7 ring-buffer: Fix crash passing ERR_PTR to kthread_stop() 3ceec39788481 misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free 3f265e405e5ef misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke 97273624f7b35 misc: fastrpc: Remove buffer from list prior to unmap operation a2f5efe0b6ccf misc: fastrpc: fix channel ctx ref leak when session alloc fails c5e5d78743992 staging: rtl8723bs: validate monitor transmit frame lengths 4ba402fd47009 staging: rtl8723bs: fix missing shared-key auth challenge length check 1158b99312073 staging: rtl8723bs: fix OOB read in WMM_param_handler() 0d19f0600fbb6 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() e7a5d792cf64a serial: 8250_dma: Clear stale RX state on shutdown 201b6961f02c6 mei: pull kvfree out of spinlock dfe388da13aa7 ipv4: fix use-after-free in fib_nhc_update_mtu() 7f80ad373ce4a ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops 606612b75d16d selftests/bpf: Adapt sockmap update error handling ce1418fec60e0 fscrypt: Replace mk_users keyring with simple list 401b84010a93a pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP 41cd5a536b3b2 fortify: Disable -Wstringop-overread in tests 4d48c73b0a24b fortify: refactor test_fortify Makefile to fix some build problems aa5c571901c6b futex: Prevent robust futex exit race some more 55a3e01f89480 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk eefd1214882fa KVM: s390: pci: Fix aisb calculation 0e75b02682188 KVM: s390: pci: Fix resource leak on IRQ registration failure dea31682783ff KVM: s390: pci: Fix missing error codes and memory unaccounting dc7465a364104 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages 06d58b8d2f053 net: bridge: mrp: fix uninitialised bytes on the wire 9d8a94b48b393 netfilter: ebt_nflog: pin the NFLOG backend fe820dcc1d8ff mac802154: fix netdev use-after-free in beacon worker 99df6b7a713f9 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header eff6343033f57 net: octeontx2-pf: Fix UB in shift operation 8ca8cdb749395 net/sched: reject overly deep qdisc hierarchies 87d0c0040b5d4 net: openvswitch: reallocate update replies for mismatched IDs cf8189b82bb93 packet: synchronize pressure clearing with ring reconfiguration b47ba8fe6e1d2 net/packet: reset the MAC header on the packet-socket transmit path d85d2fd54e901 packet: use consistent hard_header_len in TX_RING send path 91f041451f967 packet: use consistent hard_header_len in non-ring send paths ed246dd85ebf2 ipvs: clear IPv4 options after rebasing tunnel ICMP errors 2061525f3431d ipvs: properly update the overload flag on dest edit bc2cba3662e23 ipvs: add totalconns for dest d5122a2b26011 ipvs: stop estimator after disabled calc phase b6cb134707a21 ima: fix out-of-bounds read in xattr_verify() 06a286b320236 Input: evdev - fix information leak in evdev_pass_values() 38a0aa593ebc2 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get d8ead5083b203 vt: add permission check for KDSKBMETA ioctl 1c63303659a22 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup() 11413d7ed4217 usb: gadget: f_ncm: Use unsigned int for ndp_index 0f770d5edaca2 usb: cdnsp: fix incorrect endian conversions for APB timeout register c81b71b737b47 thunderbolt: icm: Preserve USB4 proxy data-valid bit 993f7677949e3 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() 6607f85242577 ALSA: usb-audio: fix OOB write on Type II inbound URBs 5db341189bb7f Input: evdev - sanitize event type index when fetching event masks a74a3bc424b75 spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers 1232fd8cc252f net: fec: do not release NULL pages when RX buffer allocation fails 83837e3e827dd hwmon: (ads7828) Fix external VREF regulator handling 4f2f4e9cfbb48 regulator: devres: add API for reference voltage supplies 6ae440fe5ff72 hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination 73c1ff87b63b4 tls: don't abort the connection on signal-interrupted sends 8de65194a04d2 sctp: clear control chunk transport if it is being removed 35f258fee9ed3 net/atm: fix slab-out-of-bounds read in vcc_setsockopt() 8adedc923f821 net/tcp: Add TCP-AO config and structures e2d44d24385a9 net/tcp: Prepare tcp_md5sig_pool for TCP-AO fa0dca89b4fb0 ata: pata_sl82c105: fix bridge revision use-after-free b5a21615f627c net: thunderbolt: Tear down DMA paths before stopping the rings 01865e1ddb126 net/smc: fix TOCTOU race between smc_listen_out() and listener close d2adc4e80b29e net: remove WARN_ON_ONCE() from sk_mc_loop() 6fad06bb793d7 net: prestera: validate firmware header length 43c7d0a691775 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length 585fc5247d149 tcp: fix TFO max_qlen accounting across reuseport migration 0de370f9bbf35 sctp: fix addip_serial increment on ASCONF_ACK allocation failure dd5d6de4ca86a bnxt_en: Fix PTP PPS setting bug b61c4911204a0 bnxt_en: Disable EOP for TPA on all chips to prevent data corruption b8b4950f331b3 bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips ca84302458977 selftests/ftrace: refactor eprobes test to fix argument checks cbe7aaaa2ac91 hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations a3f598c0bfbed hwmon: (lm25066) Use i2c_get_match_data() 2b316608f521a hwmon: (nzxt-smart2) Check return value of init_device() in probe 34e77d8e3570f net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers 69cba7b704400 net: sched: refine software bypass handling in tc_run 4d1fc1d990f81 net: sched: cls_api: fix slab-use-after-free in fl_dump_key 544cf4801b6cf net: sched: make skip_sw actually skip software f236d51f9caf2 net: sched: cls_api: add filter counter efd3ffa472d68 net: sched: cls_api: add skip_sw counter d8bea341b1831 net/openvswitch: check Ethernet header length in key_extract() 0c4882bff3455 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter 1ae134c012e10 udp: fix potential use-after-free in tunnel segmentation 7bcb21bead667 tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss() 893775f29af77 vhost/vdpa: reject overflowing PA map page counts on 32-bit ddbe966b5d1fe bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() f9d22822720b7 bpf: tcp: Avoid socket skips and repeats during iteration 4e3eaa5dce352 bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items beb8ffae319b7 bpf: tcp: Get rid of st_bucket_done 1d7a82c1df5fc bpf: tcp: Make sure iter->batch always contains a full bucket snapshot 524f2d0409706 bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch ccbbbca21ddda counter: microchip-tcb-capture: Fix DT channel validation 9a416f000285a net/mlx5: fw_tracer, return NULL on create error 7b6552e53426e devlink: fix net namespace reference leak in reload 0e6c8440aeb3e net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete b969984b2bdc8 net/sched: cls_route: fix fastmap use-after-free on filter 06734dfeaeba8 net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() 8cb23101a3fcc bpf: Preserve pointer state for commuted arithmetic e2c7e88815edd btrfs: fix memory leak in btrfs_do_encoded_write() f40409265dcb6 ipvs: return the csum validation for forward hook 3c779b258c9c3 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp 2dd0312392d07 netfilter: ipset: switch ext_size to atomic64_t 607adbda01053 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock dd148539fb474 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor 5d59e549b9033 Revert "net: thunderbolt: Enable end-to-end flow control also in transmit" 51e32c5555b07 drm/bridge: ps8640: propagate AUX transfer register errors eacc1a5838710 ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt 4f7bb93a59082 ARM: npcm: Fix OF node refcount leaks in SMP setup caee6a68ffaa5 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call 7dd6e556dbfc9 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() 590d9aec777cb selftests/bpf: Fail unbound UDP on sockmap update 91baa89437961 mount: honour SB_NOUSER in the new mount API Signed-off-by: Bruce Ashfield Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index 1d4f95e42c8..e8d1f9da078 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "eaa4bfd4f99ab0f3cf46ec5a207b73e22fb1c3f9" -SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2" +SRCREV_machine ?= "f92c1779022032aac8134ccb9e75365b19f6c596" +SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.151" +LINUX_VERSION ?= "6.6.156" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index f2d6e5eef53..03889d329ec 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.151" +LINUX_VERSION ?= "6.6.156" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "c51e01ecff210644b5d199a4edb30cb1a94a746f" -SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2" +SRCREV_machine ?= "d9da23dffd2dea6dcfa986e0aad77898a7b373da" +SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index c1ac8e0a08f..2632a4ef2fc 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "ed7cf749dcade8ded9fda05be53c235a446dcbff" -SRCREV_machine:qemuarm64 ?= "b96d2d770cab02b84c46606fa538ce027bee6b08" -SRCREV_machine:qemuloongarch64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemumips ?= "fcfa6f13ad7894cedda5f59124e7a6f6f0100a67" -SRCREV_machine:qemuppc ?= "89811e5148d2a4c925940684ad9126bd08de9799" -SRCREV_machine:qemuriscv64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemuriscv32 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemux86 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemux86-64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_machine:qemumips64 ?= "b6dc41bac21f990565fffb211d470fdc97533291" -SRCREV_machine ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3" -SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2" +SRCREV_machine:qemuarm ?= "f05eb652ce405932e2f47a78f721d1c2c5859e80" +SRCREV_machine:qemuarm64 ?= "2f7ef6e4d70eadf8f8b110cd81cfcafb2bb038fb" +SRCREV_machine:qemuloongarch64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemumips ?= "1434d63083252688215ad6f5f6af122ead5865ee" +SRCREV_machine:qemuppc ?= "fc69e9d8f99c5c151415f6ba9f1e0428bb7e8e84" +SRCREV_machine:qemuriscv64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemuriscv32 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemux86 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemux86-64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_machine:qemumips64 ?= "7969f6574cf5b126fa6eb28f33d0f2bcd8e7da5e" +SRCREV_machine ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" +SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "d27334b2888c10d2b60c954c59b186182d833107" +SRCREV_machine:class-devupstream ?= "8b73de7da85fde281a385e0b26eda9bffd3ca477" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.151" +LINUX_VERSION ?= "6.6.156" PV = "${LINUX_VERSION}+git" From patchwork Sat Oct 31 00:15:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102549 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3755.1793405770983709768 for ; Fri, 30 Oct 2026 17:16:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=e/OxMjZo; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4a208d93758so13417555e9.3 for ; Fri, 30 Oct 2026 17:16:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405769; x=1794010569; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=M0egYazAavA6x0CYr1cs169/P7uvw6YmANIWT79uPvw=; b=e/OxMjZo4p3wABWcoVcI833Kmjvk39wJkiZPTXykLahReP57UPBLkrCdacg/Ql7OG3 +5Ma/Zo5EZUF/NTQb6iyd60o4W1tPq+B87Hyl7K9zXP79BLYusktl4KuypNXUWdRx6if 9ylJlK+/v6/WICT1SrSx5tTKb+pPMueikVJLq696ixIHBo7UvG6KvO6dew6OV++6/dhe fcqZDCjDTJStdFi46n8ptv8AHCJzy+Rip6Q//35Y7pz186/6fhD76/s3utDSh5y4CzXs qd9gIVTN63hlGEOjdfDNW+PLyvqLEBRpLICmCR5vRbErV3tbLKJQM4DT4RPlUj2pBUY9 65Hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405769; x=1794010569; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=M0egYazAavA6x0CYr1cs169/P7uvw6YmANIWT79uPvw=; b=b6T1UjVUlmu5sqJIFlifY2kwhAc9QuM/DPYqvetR6HwGQ54z2XCbUpkirfPRxrak6R sx8DOQC9yejhzzcGNtjRBJCwxDWLgC9W9UdlFzw0QlqdmhI2OLNlhbUnyTZv3jFI/QwQ 49lxDcNWwlOuO0VxkK8uoXA/0qIpMFMA6j37x0OXhXp2XKIw8sEQxRrDJENs3djmmiVU LtgpCgoGNCp+KtW4cbpQjvfdSQ3zNXJelAk9vOj0WGU5KTlh1i5xwW+U6AMbWwEESDu2 mHVXl9Qqr2ZR2O6QmSBp4FTkgKArR1M1hl6IGJV9pNj2SgTQOKeqr2a6YGvlZqAEDnNd vr4A== X-Gm-Message-State: AFq9FYL31zbKxdlaTRbYX2fDnyyFRQWe5HGWyFi4rn74oCqeWRI68kaZ j44aKzxfv4mt2UB827kjlFAQtSlHaCph7Nn9v4qyXy6JF5dWa0HZ2w2i7WsHbsF4WhsAM95Qy2h QP8J0Ru4= X-Gm-Gg: AYBFou2ARyI8NZR7uDLYdiyZu1+naTpSLUwHNu/JNp9o+7h7JGZTGK3jjpf6LUGTe4A 5ejptOrNkBXZayi3oj6NNQxc+Y4nk/OjVDqRue/xaBSq84cXTOWIKLEYdfATPhdQIabQWz5JAV/ dl+pONKOd9s5YbcS8WjuoPrFoOKktXLzGvaw81w2TS8qyRX15Nezwt2csQTQLzwqzUvUbmXl1fO J04N/AS7TCfzsGdwhA1MHMNj6e+DNtOFPr8hvRGfF9J6P8HvE688ApWWluMQjH8ZGPDQayW6xFm xL1+OoytYcLeNwVmjVvl3ECk3V6l5E9SQjYAEkX5/Z4uEx4jC1mkr9hjRr/SSdwp2CQj3Iqlqs0 9tLjA67d+kf06buXdp/UvWScKv/QHpvSTTSl+AIBzQyQY4JK2zwuIzMZ0nkxZ+bDMs4zJgRc4Ly aDdw2pggVot22T3Da47VZ56plwMXBjqSiq2d2P4c8yxFqdmTtu6v9rd5aQdRVAt9ZjhfxBlO28t 4CFqP3fNqeruLz3k1zLOdZPGGhm8/JtSbNgZqB0xxeqz04piHxpebfHDLFqUcQw1XPdlvd9txIl Cn/4sPqvG+nJ926KOk6b9KbezrBbqBaQzzKazYrP/Wi2Mw6RBdETYEtlUDCRwk9xZx6iG4cqH4C eHqFMafeM2u1aIVKQYVEgPQ3TJKzZsZTyVNgyx6Ow3nNHPiS/3Q== X-Received: by 2002:a05:600c:1d29:b0:4a5:5fb9:5d35 with SMTP id 5b1f17b1804b1-4ac187a7678mr89981035e9.21.1793405767835; Fri, 30 Oct 2026 17:16:07 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:07 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 42/55] linux-yocto/6.6: update to v6.6.157 Date: Sat, 31 Oct 2026 01:15:03 +0100 Message-ID: <62c4ea3a235c6a2e8e921a0d1e99736323825fa9.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249117 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: 79643295eba17 Linux 6.6.157 32e598324edc3 nvmet-rdma: fix queue leak when connect backlog is exceeded 6536d707ed924 perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error a77a45fbadd9c net: hsr: must allocate more bytes for RedBox support 4cad6ecdfee8c pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init() dfda4aabd3213 tools/build: Use SYSTEM_BPFTOOL for system bpftool 1fb06c7a5d307 ALSA: control: Fix unannotated kfree() cleanup 42ddedd71536d net: hsr: init prune_proxy_timer sooner 2ea73f9a1fe72 net: hsr: Use the seqnr lock for frames received via interlink port. 4cdb74d35b0e0 net: hsr: enable promiscuous mode on interlink port with fwd offload 7840a2c9c797c wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event() 7554d498e4283 wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() ee556d118b11c firmware: arm_scmi: Roll back partial protocol table registration 6f5fb111a0a72 irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n 712f3268a62d0 nvme: target: rdma: fix ndev refcount leak on queue connect b93f47d5c0288 kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c 6a22da9752591 kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings 08aaba219793b xsk: Fix offset calculation in unaligned mode 85316d624f565 nvme-apple: Reset q->sq_tail during queue init 073b9238fac4d nvme-apple: Prevent shared tags across queues on Apple A11 0f0a317dd9e66 ACPI: processor: Update cpuidle driver check in __acpi_processor_start() a8adb672758fb ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver() d607e038f1024 ACPI: processor: idle: Remove redundant static variable and rename cstate check function 6da7c7a29009f ACPI: processor: idle: Move max_cstate update out of the loop 60e5299f552d4 ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init 49457494d5d97 pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers 944b7b366ce5d pinctrl: mediatek: Fix new design debounce issue d6ba3a2ca3c9d pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask() 010d05df52cec net/sched: sch_htb: limit htb_classify inner-class filter hops 4fd2ee4ac154c tcp: fix corruption of urgent data on multi-segment retransmit 7baa0c92be39e usb: atm: usbatm: fix invalid ci_range initialization 7566789664813 net: fec: only stop PTP if it was initialized a2dbac3fb03b4 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() 82fdbf49b9f75 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup e4570c6556d47 net: stmmac: selftests: Account for the UC filter list for filtering tests 556b55a209ea0 net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering ee22ca41efdcb net: stmmac: dwmac4: Account for the primary MAC address for UC filtering b7be75bb83add net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering 6315e468ef7e6 net: stmmac: selftests: Check multiple MMC counters 81dd9ed216358 selftests/arm64: Treat KSM merge_across_nodes as optional 3e0e4275b4b12 selftests/arm64: Print missing MTE TAP headers 2c75d9087a8e7 selftests: arm64: add hugetlb mte tests 6030f45bd0656 netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() 87f49ea98c88f netfilter: xt_HL: add pr_fmt and checkentry validation 4fc6882b18350 netfilter: xt_cgroup: Make it independent from net_cls 79eafe22ab0a6 netfilter: nf_tables: move hardware offload step after building the chain blob 339f47ae04dcc virtio-net: Ensure that TCP packets don't overflow gso_segs ae7173188ab06 net: stmmac: selftests: Pass the IP proto mask in the TC selftest 96a4696f8b74c net: ethernet: sun4i-emac: Fix IRQ error handling 7a96b9f6d5ba2 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify 1630774d81d06 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify 3b2e62a7655d3 libceph: validate banner payload length 7a64106070d4b ceph: revalidate ki_pos for O_APPEND writes after cap acquisition faf539af1a595 ASoC: dapm: Fix off-by-one check on the second enum channel 0664c75afe87a apparmor: policy_int make sure list heads are initialized before fail path fc75c2c7001c6 apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init 93c6fe34f22da tpm: st33zp24: Validate locality read result 1bfd5c54e4070 tpm: st33zp24: Return zero on status read failure aa39a790d56b4 net/sched: sch_teql: restore skb->dev on the slave failure path 9d782c662879c net/sched: sfq: clamp quantum to avoid signed overflow soft lockup dea2789a9d5ff net/sched: hhf: clamp quantum before hhf_change() to avoid overflow 435da3734a8e6 net/sched: fq_pie: clamp default quantum to avoid signed overflow 19bc715de421b net/sched: sch_codel: clamp default mtu to avoid disabling CoDel 397e2b1f71d9f net/sched: fq_codel: clamp default quantum and mtu 0675cff3c2924 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings d9a8113a5c152 maple_tree: fix argument name in header bc8be70fdeb94 selftests/mm: skip COW tmpfile cases when fallocate() is unsupported 4498f617a4948 selftests/mm: report unique test names for each cow test 328256478e9f3 selftests/mm/cow: modify the incorrect checking parameters bdd5574a636f9 selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL d10b6f53483bb selftests/mm/cow: generalize do_run_with_thp() helper 8086709b7f87e cifs: fix clearing stats for fastest execution of each smb2 command 42884bd8b8fd0 net/rds: use wq_has_sleeper() in rds_cong_map_updated() 573c088b6d479 octeontx2-af: Fix TL3/TL2 link config ENA clearing 4bcef54e4a335 net: qualcomm: rmnet: restore skb->dev on deaggregated frames e3b9aa0773abd gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free fc4851ff8dfb5 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop 0b71a6caaf284 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path 89d23a0fd43e7 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX 8765eb64f9deb Bluetooth: btmtk: Do not discard the subsystem reset timeout 7c7ac736b50fa Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan bbd262d2d750b Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference 491e4c6001796 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN 0911a5e777e3b erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic 74e4a43e1b0ea scsi: qla2xxx: Fix an loop timeout test d3c55dcc863f3 rtc: pcf85363: Add error checking to regmap calls in probe() dd5bd091daa48 NFSv4/pnfs: key the data server cache on the NFS version 0faf682964678 nfs: move the nfs4_data_server_cache into struct nfs_net 5aca000630c0f NFSv4.2: fix LAYOUTSTATS send buffer exhaustion 957dba2b8b5ae net/smc: free pending qentry in smc_llc_flow_stop() before memset 056395acb7041 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition 5f127e3cc9647 inetpeer: randomize RB-tree node comparison using SipHash 9b0a36df7f443 net: add missing ref_tracker_dir_exit() to net_passive_dec() be9ed08140dee net: ipa: balance runtime PM reference on remove error c1ac60ad8c182 net: ipa: Convert to platform remove callback returning void 95428d7d2c712 forcedeth: stop the tx_timeout register dump past the requested window 93c413d953e19 net: thunderbolt: Count delivered packets in rx_packets and rx_bytes 4b0f5b25f1146 net: bridge: Reject descending VLAN tunnel ranges aaebce297efc3 xsk: fix NULL pointer dereference in __xsk_rcv() b9d97ecb89576 xsk: avoid double checking against rx queue being full ba95f77c98687 xsk: Get rid of xdp_buff_xsk::orig_addr e4746c6e60ab1 RDMA/ucma: Allow path records to exactly fit the output buffer c5c7c7b6cfae7 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup da3c2437df2c6 ALSA: core: Add scoped cleanup helper for card references c2a2036209b37 ALSA: control: Use guard() for locking 478cfdb6844fe ALSA: control: Use automatic cleanup of kfree() 9f756f1965bad clk: visconti: Make sure clk_init_data is fully initialized 73f4671d68193 clk: ti: Make sure clk_init_data is fully initialized 5f74a6e9afc90 prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator 6945acee8677b rtc: gamecube: check return value of devm_rtc_register_device() 68bf51c58479d i2c: ocores: Disable clock on failed resume b5ba8b861b5d8 irqchip/renesas-rzg2l: Fix loss of interrupt 321ef4e8f74e6 rtc: zynqmp: Return optional clock lookup errors 58066940076b9 smb: client: fix request buffer leak in smb2_new_read_req() 7afb8db47c4f1 rtc: pcf8563: fix clock provider leak on unbind eeac2ea4ad265 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path feafa109f031e vdpa_sim: fix cleanup after worker creation failure f20ade5e9739b virtio_balloon: disable indirect descriptors ad22f0605c2d3 i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode fa47845df3626 i3c: mipi-i3c-hci: Refactor PIO register initialization 25c99c36760ec i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc() 31d1e6df88c0f i3c: mipi-i3c-hci: Quieten initialization messages 2011e714e5f99 i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1 b5e40cceb591c i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes 18a4463528f09 bonding: initialize err for empty target lists 4c2ffe2bbfdb9 mlxbf-bootctl: fix the build error with FIELD_PREP() c224759555a13 platform/x86: hp-bioscfg: fix password encoding bounds check 35364a037c2df vsock: use sock_error() to consume sk_err after a failed connect 93808d9572d40 platform/x86: dell-wmi-sysman: Fix instance ID bounds 48796058a5cd1 net/smc: hash socket only after full initialisation in smc_sk_init() 4944ed85a0e8a 8139cp: fix Rx and Tx not being disabled in cp_suspend f8a9b988e7a7b vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() 7c197d96f053f vxlan: mdb: Add MDB bulk deletion support 2e4fe6c423379 net: Add MDB bulk deletion device operation 94d8313ba1aaa bridge: add MDB state mask uAPI attribute 75ee201a1303f vxlan: mdb: Add MDB get support 88f464358411e net: Add MDB get device operation c9a5c400dfc59 bridge: add MDB get uAPI attributes c2a7f6064dfb5 vxlan: mdb: Factor out a helper for remote entry size calculation 8e4be8729f256 vxlan: mdb: Adjust function arguments 9cf0fc4bb6296 ALSA: hda: Fix connection list comparison in proc output 17120c5bfb168 fuse: check for NULL root inode in fuse_fill_super_submount dc925f22df8ad fuse: check attributes staleness on fuse_iget() 051eaaa875f50 fuse: convert readdir to use folios 358640784ba10 fuse: support folios in struct fuse_args_pages and fuse_copy_pages() a3713498429e4 fuse: use FUSE_ROOT_ID in fuse_get_root_inode() be829860d1dbb fuse: convert to new timestamp accessors d585ed0830890 fs/ntfs3: validate ef->size covers the record's name and value 700973cc65db4 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() ac5c499413385 cuse: wait for pending RCU callbacks on module exit 9c59ee8d63c42 net: bridge: vlan: fix inverted default vlan notification 59f4ad9b3d1e8 tls: fix RX desync on overlapping skbs 7df3271df8678 net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error 47bfcc871576e vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes deaa88fa010ba ipvs: fix integer overflow in ftp helper port/address parsing 0a340ffd96943 net: hsr: free learned nodes on device setup failure d90e4f72e8d46 net: hsr: Provide RedBox support (HSR-SAN) 9baf4bf4763ce net: hsr: Use full string description when opening HSR network device f3d74ab3f49ea pppox: drain queued packets on channel handoff cbb0879aeaa13 net: dsa: b53: fix error propagation from b53_fdb_dump() b0e94ea63dbdc net: kcm: Hold RCU read lock while running BPF parser 5d6c3f6e90d73 octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap() 642d3bc08c731 clk: ti: mux: resolve parent clocks by DT index, not by name 6b9aedc0b998b clk: ti: use kcalloc() instead of kzalloc() fc95ca82d5ae5 NFSv4: remove callback IDR entry on client allocation failure 788b59a395434 nfs: refactor pNFS functions using clear_and_wake_up_bit a49d54e6cb560 nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper a2051ffe452af ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size 6bf378cfea2de ksmbd: disconnect on SMB3 decryption failure e6fbf0eba87f5 bpf: Reject negative optlen in cgroup getsockopt hook 7d3f15a664d11 m68k: nfcon: Do not call console_is_registered() in nfcon_device() de2b2004e16f2 lwt_bpf: Restore reserved headroom after xmit program ca119d4a6b19e smb/server: preserve error status in smb2_handle_negotiate() 3f8651f6bb521 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() effcf48d79d8a ksmbd: free preauth sessions on connection teardown c3a8100dbf6bc ksmbd: do not advertise unimplemented CA support 17b7d1a2b4d54 ksmbd: validate ipc response length before dereferencing its fields 4d6fe49fa3e7f smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer 993e0158331d3 ksmbd: Do not skip lock checks for single-byte ranges 9281eb1e4ea31 hwmon: (emc1403) Drop hysteresis for low limit temperature e43ba8be636ab hwmon: (emc1403) Rely on subsystem locking 5efc8eeb33183 hwmon: (emc1403) Add support for EMC1428 and EMC1438. 5eee537872d86 hwmon: (emc1403) Support 11 bit accuracy e33dc202fb6f6 hwmon: (emc1403) Convert to with_info API b92949bc1a099 hwmon: (emc1403) Add support for EMC1442 8283049aa5fcb block: mtip32xx: synchronize ioctls with device removal 7de792b4c48fb null_blk: serialize configfs attribute updates with device setup 88d806d0e1d36 null_blk: serialize configfs attribute stores with the lock fcd53f3e8b758 null_blk: reject per-device queue resize for shared tag set 665c94554ff0d null_blk: free global tag_set on init error path dbcedbe4819ae null_blk: register configfs subsystem after creating default devices b6869f48ddec2 null_blk: add configfs variable shared_tags 349903f7ee72f null_blk: use DEFINE_MUTEX for the file-scope mutex 09372aa5774e3 mailbox: pcc: Fix command timeout due to missed interrupt 81e2b32d1d11d Revert "mailbox/pcc: support mailbox management of the shared buffer" dc14620fe268d mailbox/pcc: support mailbox management of the shared buffer 871b0bf25cc7e mailbox: pcc: Always map the shared memory communication address 82aa56d548f68 mailbox: rockchip: disable pclk on probe failure and unbind 606cbd749ff33 perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() d3231c74c9a9f perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() 4536ff6a67ea9 crypto: hisilicon/sec2 - fix CCM algorithm long packet failure 595dd1c0e1c47 bpf: Fix pending_pos walk on 32-bit ring position wrap f30379b8a4e24 ACPI: scan: fix bus ID cleanup on device_add() failures cd63a1eb677e9 ASoC: SOF: validate topology volume range before allocation 60d98480caafc tracing: Have trace_event_update_all() only handle module that is loading 11755741ff074 tracing: Remove "__attribute__()" from the type field of event format 03c5dabc8f16b ALSA: core: Fix use-after-free in snd_card_do_free() 0441e34ce098c fs/ntfs3: reject out-of-range evcn in mi_enum_attr() f77a8d9fdf58e fs/ntfs3: fix integer overflow in MFT cluster validation b51535ca5eb90 scsi: ufs: core: Set task state before io_schedule_timeout() 5d602d4ebb58c scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR 7612b5d2c00aa scsi: ufs: core: Remove unnecessary wmb() after ringing doorbell afedf35df054b scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers 5b37a7c2270cb selftests/bpf: Fix for veristat file/prog filters processing 3d2f0cb66c909 Squashfs: check block offset is not negative 8d88f52fbbbcc ocfs2: fix circular locking dependency in ocfs2_init_acl() 340821bc169bc bpftool: Fix double close in map dump 23e5b485da229 x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported 89d986897aff7 ALSA: seq: midi: Serialize input teardown with event_input 679087a7acdc4 ALSA: seq: midi: Optimize event_input locking with RCU a3efa5d4eed38 clocksource/drivers/armada: Unwind timer clock on init failure 3cac7e8adb006 clocksource/drivers/clps711x: Do not unmap clocksource MMIO a08b70ed2d1ec s390/debug: Fix deadlock during unregister 57ec8827f414b xenbus: Unregister reboot notifier on init failure 3a6b43ebc0c2e power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address c86a998bd46da power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address 60e5d928081b7 power: supply: bq27xxx: bq27520g4: fix REG_TTES address f1b4447402fca power: supply: bd99954: Drop bad register fields 49e717f3f3d20 spi: img-spfi: don't disable runtime PM on DMA deferred probe 6746ba44cd04d selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM a4e68a4f68c2a selftests/bpf: Add description for running vmtest on RV64 bfeb336e48a96 selftests/bpf: Support local rootfs image for vmtest c4579f1b7fe17 selftests/bpf: Limit URLS parsing logic to actual scope in vmtest 47a7a4443c6e7 kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix 620549b2775e5 UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC 8c38ae4a46569 ASoC: xilinx: formatter_pcm: fix stream_data leak on open error 552e565ed8846 ubi: Fix rollback for explicit UBI device numbers 3f617214c81a2 ubi: fastmap: Add module parameter to control reserving filling pool PEBs d99591caca984 ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs 2d55fd6170613 ubi: fastmap: Wait until there are enough free PEBs before filling pools 087d820d4bc48 UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs 3c5599d3cf1ab UBI: Preserve torture flag when rescheduling failed erasures 3996be3f5b8a9 ubi: Replace erase_block() with sync_erase() d8307a8bc986b ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap 4e0ab4f291a76 ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash 2a623a56b513b ubi: fastmap: Fix missed ec updating after erasing old fastmap data block eaaeabf566c3c ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready 48cece7b287ec ASoC: pxa: Use devm_clk_get_optional() for extclk clock 30c48da114915 ice: clear the default forwarding VSI rule when releasing a VSI 2a63cb9ea862a RDMA/cma: Fix WARNING in res_to_rt f98e894ec029a RDMA/cxgb4: Free debugfs on registration failure 8980385438975 dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal 5487f04c1ccbf nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing c001abaaa35bc nfc: digital: Do not dump a NULL response in command completion 753bdaf3220fe nfc: pn533: hold a reference to the request skb during send_frame 02030f95820c4 nfc: llcp: bound SNL TLV parsing to the skb and add length checks 9030a1bbe2c6b nfc: nci: fix double completion race in nci_data_exchange_complete fe65727a4a21b nfc: llcp: read llcp_sock->local under the socket lock in getsockopt 35573c6cb081a nfc: llcp: avoid userspace overflow on invalid optlen 7084caabc0370 nvme: reject passthrough of driver-managed Set Features c35cd98eed1a8 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() ff28a93a89591 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() ca6b14f01d099 nvme-apple: Drop the PRP null check chicken bit 7256eed48ce7d nvme: apple: Add Apple A11 support eb86b1844a1b4 nvme-apple: Never set the opcode in the NVMMU TCB 5ce74613edd36 nvme-apple: Don't set a DMA direction for commands without a data transfer 5f6f4777b7a86 nvme-apple: Destroy the admin queue on removal 89ff11b72f389 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() cefb177da32fe nvme: Add the DHCHAP maximum HD IDs ac6c240e0f448 nvme: introduce change ptpl and iekey definition cef6c15f8b54d nvme: add reservation command's defines c26fa54201acb ASoC: qcom: q6apm: keep the graph start count in sync with the DSP cd12a36c77fdd spi: sprd-adi: Fix probe succeeding without registering the controller d10e4173d8c2a phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs c653b97b9fefc powerpc/configs: enable CONFIG_RAS to fix EDAC support ed80d009b154a sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE 12bf3e0182ccd SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 3cee888393f6e arm64: Disable KCSAN instrumentation in delay.o e3405bf334b02 m68k: Fix backtraces for non-running tasks 071ac1722fe2e iommu/vt-d: Fix UCTP context table slot when copying root entries e8d4e4cf388da fbdev: kyro: Validate overlay viewport coordinates f3222a7a5e65c fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device() 3d0f487661a69 perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads e7a3768a295a0 perf synthetic-events: Fix uninitialized pthread_join ba7a7e1a41c8e perf stat: Fix evsel_list leak in cmd_stat 518c47e2c59f3 ARM: dts: helios4: add SATA regulator supplies 0fb9acbc7fbd3 ARM: dts: helios4: add vcc-supply to GPIO expander 9f8e9aa4b1231 ARM: dts: helios4: add vcc-supply to EEPROM fb9043b5ce0c8 arm64: dts: turris-mox: fix usb3 phys d9ea72c04a1df riscv: cpufeature: Clarify ISA spec version for canonical order bee2208276c8e net/sched: cls_api: fix teardown of an adopted proto on insert-race loss 83db3f0d7982e iio: light: gp2ap002: re-enable irq if runtime suspend fails 8e76ab8131985 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes e804d54a5a99d Bluetooth: MSFT: validate evt_prefix_len against the response length 416fabca9b723 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled 193182c6467f5 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths 9a2ba69cebe3f Bluetooth: hci_conn: fix the SCO setup context lifetime 50dae81942575 Bluetooth: btintel: Fix diagnostics event detection 0e388d805233a Bluetooth: virtio_bt: avoid OOB read of build info string 90e9eae1b5907 btrfs: retry verity reads for not-uptodate Merkle folios a5add36fd9908 scsi: sd: Fix sd_done() sense handling condition 2cd80d83cc1a2 perf trace-event: Fix integer truncation in do_read() and skip() 5317d73c7876c Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices af6f77f20510d Bluetooth: btusb: Record matched usb_device_id into btusb_data 9b0b4fbb8c863 Bluetooth: btusb: refactor endpoint lookup 61df5d818baf3 Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() 32be97642c514 Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event e60f304c65013 sched/fair: Check CPU capacity before comparing group types during load balance 7ac16ee2d3766 ACPI: video: Release PCI device reference after lookup f1bea8cf618b3 regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling ea4fe6a450210 coresight: etm4x: fix leaked trace id be7b2de5b9a96 coresight: etm4x: fix underflow for usage of (nrseqstate - 1) b822e5966d5a3 coresight: Change syncfreq to be a u8 885d831237337 coresight: etm4x: fix wrong check of etm4x_sspcicrn_present() 668d99ba47210 md/raid1: don't set array_frozen in raid1_takeover() cfb75fae75c96 md: avoid stale clone I/O accounting timestamps 9d7490007707f md/raid5: round bitmap stripes with sector division 9b28287c5dea7 phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend 3ddf41938fee3 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend 602059c5128a7 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend 9e7448bb0e2f0 phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads c9f829195f84a phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*() cf2f1cee7080e soc: fsl: qe: check platform_driver_register() in qe_ic_of_init() 5b7fc7a1ce2a5 hugetlbfs: release subpool on fill_super failure e36eee4fc56cf pinctrl: rockchip: Reset the pin count when recalculating SoC data 5a250bff75a44 firmware_loader: do not queue completed sysfs fallback requests 9b6325fc58ab8 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path b5d1d3e4519dc drm/amdgpu/gfx6: Use PFP on the compute queues too 0d567a5cb347e drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets d5f170189b07a perf trace-event: Fix buffer overflow in read_string() dd9fee2b29e2f phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table 1fce81a40e3b3 phy: sunplus: fix error handling in sp_uphy_init() ba56017b0c04e arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node 9e1efab410a4a ext4: fix spurious message about orphan cleanup on RO fs 4b7623e92545d drm/amdgpu/gfx6: Fixup emit_cntxcntl() e92a83a9a7617 mfd: iqs62x: Reject zero-length firmware records f943448aeae0a mfd: rave-sp: validate received frame payload lengths ad3839fe2114b arm64: hibernate: Restore DAIF state on error 5370853041a3c arm64: hibernate: mask DAIF before restoring hibernated kernel 0ab5739f1f448 wifi: mac80211: skip default WMM setup for AP_VLAN links f82e13c16da63 RDMA/erdma: restrict the driver to little-endian systems b9e7d3d9fdb2b RDMA/siw: Fix use-after-free in siw_accept() b8d5015db908a RDMA/siw: Introduce siw_free_cm_id 9c21a43302221 IB/isert: post the full-feature receive buffers after session registration f84e9adf4d9f4 IB/isert: delay the final Login Response until the session is registered 55864b26c22cb cpufreq: imx6q: fix out-of-bounds write when probed more than once 92e53a5274276 cpufreq: imx6q: fix devres accumulation across driver rebind 53e08b89f7620 drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz 0a3a149d5ac1d drm/sun4i: dw-hdmi: Drop TCON TOP port reference 543cc7dd263b9 drm/sun4i: tcon: Drop remote endpoint reference 1882112124a64 drm/sun4i: crtc: Propagate layer initialization error 4fa22218c2351 drm/sun4i: tcon: Drop TCON TOP device reference 539817f22063d drm/sun4i: tcon: Set output mux for DSI and LVDS f0f5441126f31 of: property: add of_graph_get_next_port_endpoint() afb9faa721d43 of: property: add of_graph_get_next_port() 89a89f7bb2fcc of: property: use unsigned int return on of_graph_get_endpoint_count() 217340d0ebd0f of: property: add missing kerneldoc for of_graph_get_endpoint_count() 24790c3b0d99a drm/sun4i: vi scaler: Fix coefficient selection cbb4efc2f99d6 ocfs2: synchronize heartbeat callbacks with o2net teardown 63e3c958a602d ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults 0e7ba61751490 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ c0a83f29a24c7 RDMA/erdma: Hold CQ references when processing EQ events d7ef87c7daa9e modpost: prevent leak when early return no suffix .o in read_symbols() 16667c8cabe18 scripts/tags.sh: Prevent binary files appearing in cscope.files 81e425fbd8115 arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies f54b00b223954 selftests/mm: fix ternary operator precedence in ksm_tests 1f53972a5bd40 selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes bdef4a404fab5 selftests/mm: ksm_tests: use kselftest framework 6b117e23481d9 ksm_tests: skip hugepage test when Transparent Hugepages are disabled 46f5382b4eeb9 selftests/mm: add new test cases to the migration test 7eb85d07c15ae selftests: mm: support shmem mTHP collapse testing c2b8653d571e8 selftests/mm/khugepaged: enlighten for multi-size THP 7db5a1d597213 selftests/mm: support multi-size THP interface in thp_settings 750575653bd6c selftests/mm: factor out thp settings management e1e07344d8e19 selftests/mm/kugepaged: restore thp settings at exit e26db0d636e4c bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed c82241a9454b2 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() 9ca46a1a3e510 remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() 829c24afec9ce remoteproc: Move resource table data structure to its own header 542a6a3ec77cd drm/omap: dsi: Do not copy isr table e38587d98d1ce fat: release buffer head after rebuilding parent 332591a245de9 rapidio: clear mport->net when rio_add_net() fails a1b1ff469e573 pps-gpio: remove dead capture_clear code c66eb07d65a26 pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler 9ee5b718b2cbd pps: clients: gpio: Bypass edge's direction check when not needed 6bc73694cbee5 pps: don't try to wait for negative timeouts in PPS_FETCH 4957320f54311 lib/string: fix memchr_inv() for large ranges 43b18869f8c8f ublk: check for ublk_unmap_io() returning 0 364030e3eefce block/kyber-iosched: flush per-cpu latency buckets over possible CPUs 92865833e8d81 block/blk-iocost: collect per-cpu latency stats over possible CPUs 28104b1636296 block/blk-stat: drain per-cpu callback stats over possible CPUs 1a267295b1ea6 blk-cgroup: skip dying blkg in blkcg_activate_policy() 056eea1a2068a phonet: pep: do not write beyond optlen in getsockopt cf62dd07b08e9 iio: light: tsl2583: return zero in write_raw() on success d7c5a80939e12 iio: light: isl29028: return zero in write_raw() on success 3f701835d082a iio: light: tsl2772: fix ALS calibscale readback 7ac69e177dffe perf intel-bts: Fix off-by-one in auxtrace_info minimum size check 1bdb0e48e9d87 perf intel-pt: Fix off-by-one in auxtrace_info minimum size check 2d31a6271975a perf auxtrace: Fix queue grow overflow and old array leak aa3045fb5faa0 perf thread-stack: Fix heap buffer overflow on branch stack wrap copy 6be9b1284d0c3 HID: lg4ff: validate report length before fixed offsets 178c369b465b5 HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure d3ccef6fb7133 HID: i2c-hid: Fix "(null)" output when reading report descriptor fails d9caf658694d9 HID: i2c-hid: Revert to await reset ACK before reading report descriptor 0cab98ab1f57a HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor a8a1892d18faf HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling c1e5bbba94e16 HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions 69345da556293 HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset() 9a3da56aae28e HID: synchronize input before cleaning up a failed probe f54c3219db759 HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver d331c63570af6 tty: clear cdev pointer after cdev_add() failure 8369acce013b1 serial: amba-pl011: unprepare console clock on unregister 0ef4365a01cf7 MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL dcc442a49c0f5 powerpc/irq: Fix missing r2 clobber in PCREL inline assembly f89cccf6f5f4f powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass 88027241c1d2c firmware: coreboot: Validate table bounds f8808b7440c72 firmware: google: Add bounds checks in coreboot_table_populate() 5fc32f53f8486 wifi: mac80211: skip unused probe response countdown offsets a749ab2498238 wifi: zd1211rw: reject secondary interfaces to prevent conflicts aa5ff84ca8c39 wifi: mac80211: send TWT teardown to peer after setup TX failure 11b75fc02d842 perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register a6f2a2d867863 iommu/arm-smmu-v3: Convert to use atomic poll timeout eb946595a58de wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump 04d8fd716d0ee wifi: mt76: mt7915: report RX chain signal for all RX paths 6b3d02b422a5d wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1 426825d50c700 wifi: mt76: mt7996: fix reg addr remap when addr is 0 2a434d2637b9c wifi: mt76: mt7915: release hif2 reference on probe IRQ failure ad706fcf62554 wifi: mt76: mt7915: fix ext PHY use-after-free on register error path 927fe8c0eb8c1 wifi: mt76: mt7915: fix double hif2 init on the non-WED path 1bd5c4ed2b904 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement 4f4fada2d3594 perf machine: Check snprintf truncation for guest kallsyms path 718773cdea4ac perf machine: Free scandir entries in guest kernel map creation 6c903f77f50f7 perf machine: Reset errno before strtol in guest kernel map creation cae1adeb69b94 perf machine: Don't abort guest map creation on first inaccessible dir ac436ad9d47dd perf machine: Check snprintf truncation in machines__findnew() 091cd722190cf perf machine: Use snprintf() for guestmount path construction c8b41333e2c89 perf machine: Guard against NULL strlist in machines__findnew() 3d1f6a9f7f300 perf machine: Fix NULL parent dereference in fork event processing 6d0a2c5e210f2 regulator: core: use system_freezable_wq for init complete work 1296cae530528 wifi: ath11k: fix leak in ath11k_service_ready_ext_event() d3e8355a63cea drm/msm/dsi: Drop dev_pm_opp_set_rate(0) e52a884ecbf3c drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0) 78c2c2ae9a8f4 perf: arm_spe: Make wakeup range check overflow safe ccee078503097 ACPI: processor: Unregister cpufreq notifier on init failure 0306624c843dd ACPI: processor: idle: Optimize ACPI idle driver registration 4052a0367fa92 wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields 1d348f96623ec wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV 3106f62809d45 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config a4587f1098c97 wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie 953357433053a wifi: mt76: mt7996: don't report a zero TX bitrate e63c6291ecddf wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss 9fc7b406a7e5e wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset c2c7f16f2c62f wifi: mt76: mt792x: Fix memory leak in SDIO TX path 8eae5e5aa09da wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986 b6e7958602bd1 wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length 1f3e5f4b779d6 fanotify: report full event length for FIONREAD adbdf4837c434 misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() 5c3bff6cf26e6 locking/lockdep: Fix NULL pointer dereference in __lock_set_class() d22ad96f1a0c8 i3c: master: Fix device_register() error path 111f559e5b646 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices 68bf3ebd8e702 swiotlb: Preserve allocation virtual address for dynamic pools 06dffc9669308 iommu/dma: Check atomic pool allocation result directly 9a5a5eafbf168 clk: qcom: Return expected ENOMEM error on dynamic allocation failure 2636569ea7c19 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone a5c936ac90476 bpf: Fix potential UAF when reading bpf link info f4ce6803df409 bpf: Fix potential UAF in bpf_netns_link_update_prog 972d88069050d power: supply: sc2731_charger: cancel work on remove dcc6995b17d11 power: supply: sc2731_charger: Convert to platform remove callback returning void c22a9a539c761 power: supply: isp1704_charger: cancel work on remove 76c695d6e9236 arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries 5c28583f58a48 arm64: dts: qcom: sm8550: Fix the msi-map entries 28bfcbc9b7694 arm64: dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1 de01d783368c5 arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries 4a2efff1ebdbe arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries 9dedefe9d949a arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries 796fcf46d7551 arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries 3c9cbf39055fa arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries 31db9b8610e3f arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries a331e43e9b78f arm64: dts: qcom: sc8180x: drop duplicated PCI iommus property ab813e51988d6 arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID bb7206ebdb1f5 arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en 5a430485d1310 clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration ee4eb4b0db3de arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property 1c3d2e50e7bc4 arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep 29c9c4801f539 rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs d5ba53140ee78 rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs() 1d1903d64ba52 rcu: Remove unused function declaration rcu_eqs_special_set() 11d327f0911d3 selftests/zram: fix kernel_gte() for POSIX sh 590d690a9f668 tools/nolibc/powerpc: mark ctr and xer as clobbered by system call e77c80670f2c2 md/raid5-ppl: fix use-after-free in ppl_do_flush() 3018d86da10b4 md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency 55ee71cb96bd3 bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET aef178ffae542 wifi: rtlwifi: pci: fix error path in rtl_pci_probe() 56989e2a9c292 platform/chrome: cros_ec_debugfs: Unregister panic notifier 5ebfc68217b5a platform/chrome: cros_ec_debugfs: Clean up console log on probe failure f760b7d7e4358 wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event() 1130f6f42f62b wifi: ath11k: implement handling of P2P NoA event 5ddc08ef072db wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc() 98e373dc08187 wifi: ath11k: add firmware-2.bin support aff7ced31b937 wifi: ath11k: qmi: refactor ath11k_qmi_m3_load() 29e37f768f355 spi: davinci: switch to managed controller allocation 5db5c788048eb spi: davinci: Unset POWERDOWN bit when releasing resources 27b0a735ca9f8 spi: davinci: Use helper function devm_clk_get_enabled() acc173608ca7a nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request 44fe800ec1338 IB/isert: reject login PDUs declaring more data than was received 2a6b8f88fb7ee IB/isert: reject PDUs declaring more data than was received 5a21e5114cec4 RDMA/cxgb4: free STAG index when TPT entry write fails 08c4a0dede170 RDMA/mlx5: Send cong param changes to the resolved port mdev 0b0122fcc923a RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs f42f0cb6be2e8 scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. 5166a21b12f54 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch aaee7ff47a47a nilfs2: convert nilfs_page_bug() to nilfs_folio_bug() 25a07d5d97a19 nilfs2: convert nilfs_btnode_commit_change_key to use a folio 62cff5341dfde nilfs2: convert nilfs_btnode_prepare_change_key to use a folio 6fe7f8240fa83 nilfs2: convert to nilfs_folio_buffers_clean() 0787197a858dd nilfs2: convert nilfs_forget_buffer to use a folio 14b101d829fc1 nilfs2: add nilfs_end_folio_io() 7029e70cf86d5 nilfs2: prevent out-of-bounds read in super root block parsing d7afca8e4efbf nilfs2: fix infinite loop in nilfs_clean_segments() b9dd1e691cea8 clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs d9057cb059a50 clk: mediatek: mt8135: Fix inverted gate control for devapc_ck f7bf9b82c77fd clk/x86: pmc_atom: add kasprintf return value check 297b278cc4fd1 clk: palmas: Manage external-control prepare with devm e86e11c11251a clk: tegra: tegra124-emc: put EMC node on register failure 5dbefaa1bbbb2 arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix aadf3f9b5edb7 RDMA/efa: Fix PBL chunk length computation ecde45cd81dc2 fs/ntfs3: reject restart table growth beyond U16_MAX entries aeb16d9686b35 staging: rtl8723bs: use kfree_sensitive() for key material 47de033918cd7 remoteproc: Prevent crash handling to race with rproc_del() 15673e7195681 remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() 166bc60c8d1db remoteproc: Allow shutdown of crashed processors 48cba5968c148 remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown() 5f25e5c95117b w1: ds2482: Fix signedness bug in ds2482_w1_triplet() 5677737c2cedf isofs: release zisofs block pointer buffer head 42fb8aefffff5 RDMA/mlx5: Fix integer overflow of user QP buffer size 0afd2a1d8fd3d crypto: keembay - publish OF module alias for OCS AES/SM4 d52a15c4559b6 crypto: keembay - Initialize completion before requesting IRQ 587be18e09356 scsi: ufs: debugfs: Reserve space for a string terminator cd522340b777c power: supply: sbs-battery: Use a per-device serial number buffer 3b1fa32b00fbf tools/build: Allow versioning of all LLVM tools defined in Makefile.include a241079c175c5 tools/build: Add bpftool-skeletons feature test 903a7cdf63a81 pinctrl: mediatek: free EINT resources on unbind e578bbff98582 pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms e858183aa84e0 pinctrl: mediatek: Fix the invalid conditions 7586766229354 pinctrl: mediatek: Add EINT support for multiple addresses d626407251868 pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP() 68edf359b0b45 cxl/region: Fix use-after-free in find_pos_and_ways() error path dd60d57b1fe73 selftests/bpf: Fix memory leak on subtest_states reallocation 123d67513c828 selftests/bpf: Fix incorrect error checking for pthread_create 3f609fc97f22f ARM: lpc32xx: only run SoC init on LPC32xx hardware cf2e767ba2693 arm64: dts: rockchip: Fix Gru WLAN sideband interrupt 94fce1d3e74fe fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init 810da5a635495 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet 4f10b305da832 drm/tve200: add OF module alias for autoloading 72e12a20e2fe0 leds: pca9532: Fix phantom device registration on missing hardware 0f36ce5987d1f PM: hibernate: Fix memory leak in snapshot_write_next() error path 621871b696b10 xfrm: Fix skb double-free in xfrm_dev_direct_output() 795e59c83c97c perf cs-etm: Avoid truncating AUX buffer sizes to int c2039be327081 perf cs-etm: Flush thread stacks after decoder reset 524e57035af2d firmware: arm_scmi: Unrequest devices if driver registration fails 41714150f3d14 firmware: arm_scmi: Add multiple protocols registration support e75816535da42 ARM: dts: allwinner: a10: Fix PMU interrupt e94676a08af63 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() 74637f7fef030 ext4: fix buffer_head leak in ext4_init_orphan_info 5361fb1e5bc24 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap 2677fc48dd10d wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() 9784faa6afd26 wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() 6ba901a05ca17 wifi: ath11k: Correctly copy the hint BSSID in WMI scan request a7918f70784a7 wifi: ath12k: Correctly copy the hint BSSID in WMI scan request ea2a77682f9f9 wifi: ath6kl: avoid buffer overreads in WMI event handlers 74eee4ff9698a ext4: drain in-flight DIO before buffered write fallback f82a4929d0ef7 ext4: clear stale xarray tags on folios skipped during writeback 08df725b92751 thermal: intel: int3400: clean up ODVP on probe failures 20068f9cce6d4 iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() 4f408943e79c5 iommu/qcom: Remove sysfs device on probe failure path 2ff7713b7308c firmware: arm_scmi: Fix requested device removal race 7647363fa0204 RDMA/core: Fix potential use after free in ib_dealloc_pd_user() 76f2cb4f72181 RDMA/core: Fix potential use after free in ib_free_cq() 6318be2f1bdd1 RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() d5cc211e8c39e RDMA/core: Fix potential use after free in counter_release() d3d0eabe6e39b RDMA/core: Fix potential use after free in ib_destroy_srq_user() 253c2ed71a532 RDMA/core: Fix potential use after free in ib_destroy_cq_user() a608af8cde3dd RDMA/core: Fix use after free in ib_query_qp() 2001cb7bf6864 RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations 7a0cbb5721a1d RDMA/nldev: Fix locking when accessing mr->pd e61ac671304bc RDMA/restrack: Fix typos in the comments d08cfae802141 RDMA/core: Add an option to display driver-specific QPs in the rdmatool 7670a3a09cd1b RDMA/core: Add support to set privileged QKEY parameter 6e129c1310abf RDMA/erdma: Fix CEQ tasklet use-after-free on removal 7d90d2b7bd961 PCI: j721e: Fix incorrect max_lanes for J7200 74fc33e4fbe93 RDMA/srpt: Pass the mapped task attribute to target_init_cmd() b21c003c8a78b libbpf: Search /lib64 and /lib in resolve_full_path() 7ba09330d9ea6 ext4: skip extra isize expansion during mount to prevent deadlock 1a1dea633b724 ext4: fix out-of-bounds read in ext4_read_inline_dir() 452950461241d ext4: fix circular lock dependency in ext4_ext_migrate 6aaf6dbf54fdf ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root 8e67b58c04990 ACPI: processor: validate MADT IOAPIC entry bounds 13a1ba508507a ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer f8e9315236c8b RDMA/nldev: validate dynamic counter attribute length c4643bcb3bdda irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() 47e59177bfcee selftests/bpf: Silence array bounds warning in global_map_resize e967bde356a8a kcsan: avoid unintended access checking in NMIs f65f45dfa1e6e RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters 750bba6ce9bb0 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] fd6dee13f3857 RDMA/hfi1: Propagate sdma_txinit_ahg() errors 7987dd37eaeae arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe afa5719047522 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe 41e92e0caa1fe ASoC: meson: Keep link pointers valid on realloc failure 351eceec64355 dmaengine: dw-edma: Clear stale requests on termination b6293a8a38f4d dmaengine: dw-edma: Serialize channel state checks 075de95d7a7cd dmaengine: dw-edma: Serialize abort state updates 65e387b95d385 dmaengine: dw-edma: Terminate all descriptors without callbacks fe644b89b0a8e driver core: soc: Unregister bus on early device registration failure 4ebf96d5f834a software node: Fix software_node_get_reference_args() with index -1 b604d3f453c99 perf ui hists: Fix uninitialized stack memory free on pstack allocation failure a536eb57be584 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() 0ce48c6ddea1a mtd: mtdswap: Avoid freeing registered blktrans device twice 25cdd2a492d86 vfio/pci: clear vdev->msi_perm after freeing it on init failure ce6c3dd9f1ce7 char: xilinx_hwicap: unregister class on init errors c92ef8fd83452 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove 5246bf384f74b tty: ipoctal: convert to u8 and size_t f53e742743c46 ppdev: prevent overflow when setting port timeout ec713896189fb cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64) 0394902df3827 misc: ad525x_dpot: use driver core groups for sysfs files 362f5e6f8edf3 misc: rtsx: add missing write register handling f7a8f4cbc8ced misc: bcm-vk: Use acquire/release for msgq_inited 2e91ab73f9beb speakup: keyhelp: guard letter_offsets possible out-of-range indexing c5e4c36df3e6a accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() 15340b00e665a uio: Fix stale info pointer in failed registration path 57371e743398e UDF symlink pathComponent header OOB read 0b94b2d1ab3fa tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 fd43eae7d539e usb: gadget: f_uac1_legacy: remove broken string configfs attributes f593c55e3c125 ACPI: processor: idle: Expand _LPI package sanity checks 22a5cf7a4b733 crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping 079e64469bd21 drm/msm/a6xx: Fix stale rpmh votes after suspend 4f9f0afdbdf51 gpu: host1x: Avoid stack over-read in debug output helpers cfe1b2fa40d24 gpu: host1x: Fix offset calculation in trace_write_gather f22ad9d1077c8 wifi: iwlwifi: mei: pass correct argument to function 11dde137f1258 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments b90ebae632318 wifi: iwlwifi: mei: check SAP message length before reading it 2541d4f165960 wifi: iwlwifi: mei: add support for SAP version 4 5bcc933c6d47d wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser 8d74cb5fbb7a0 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs c862282b5f4c3 perf jevents: Add more components to the metric sorting order 489765bfa715e arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table 533a26a2d6b29 arm64: dts: qcom: sm8250: sort out Iris power domains 91b0528b4220a arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO 982caa744fce7 drm/bridge: tc358767: clamp the reported AUX read size to the request 61b393c2de9d8 remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev 63d929c6035ca cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() e9c60c62b3fa8 cpufreq: intel_pstate: Fix setting minimum P-state at init time dbe2842194426 media: i2c: rdacm21: Fix missing media_entity_cleanup() 3d39757ef791f irqchip/renesas-irqc: Fix generic interrupt chip leak on remove aafec4a897d54 irqdomain: Add support for generic irq chips creation before publishing a domain 917c6432f7272 genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips() b359b1fe21434 irqdomain: Introduce init() and exit() hooks 6e6a1e3f3c3f6 irqdomain: Handle domain hierarchy parent in irq_domain_instantiate() c2a5d22b10f42 irqdomain: Handle additional domain flags in irq_domain_instantiate() 2a8a3c8867f08 irqdomain: Introduce irq_domain_instantiate() 804e2374b4cc2 irqdomain: Introduce irq_domain_free() 572624cc59dc4 PCI: xgene: Drop unnecessary OF node reference bff8e14aa442f PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN dc40f9f4f21c6 cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() 0a42180d5410c dax: read holder_ops once in dax_holder_notify_failure() 1c94430cab25f libnvdimm/labels: Bound the on-media label size before the shift 0f860db24ee95 firmware: arm_scmi: Drop handle on protocol bind failures 0f4edd93d7089 firmware: arm_scmi: Protect device request lookup with RCU fe2aeb5c50683 firmware: arm_scmi: Use channel ID for transport teardown 8eb2ab2095705 firmware: arm_scmi: Reject out of range DT protocol IDs aed24a3c63920 firmware: arm_scmi: Avoid IDR updates while cleaning channels ae7980c9af698 firmware: arm_scmi: Free transport channel on IDR failure 70a26b3738984 firmware: arm_scmi: Unregister device notifier before IDR teardown fb7b9a7209f83 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate e20f3b749ad24 hfsplus: validate thread record before delete key rebuild 7e9aee7e4d976 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() 1083c7dca912a fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list 4ff4b6b9e85cf fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() e3256df116f0a fs/ntfs3: Add more checks in mi_enum_attr (part 2) 5b8d40df72c55 cxl/pci: Honor -EPROBE_DEFER from component register setup 4347681957c55 cxl/pci: Store the endpoint's Component Register mappings in struct cxl_dev_state 86771c105293c cxl/mbox: Break poison list loop on an empty payload 48f55b90f0d71 rpmsg: glink: fix deadlock in endpoint destroy during driver detach db196a8962a53 rpmsg: glink: remove duplicate code for rpmsg device remove c7201bd08cad7 media: v4l2-async: Unregister sub-device if asc_list is empty 601eb7f556810 media: v4l: async: Drop useless list move operation 85904076cece7 isofs: fix out-of-bounds page array access on empty zisofs block 648cdd16d633d ASoC: apple: mca: increase SERDES reset delay 554261c9858a4 RDMA/hfi1: Initialize debugfs after probe completes 506e333b1410c RDMA/hfi1: Stop flushing the global IB workqueue 3f5e501f1ac47 RDMA/hfi1: Create workqueues before device initialization 3471c19584d0d RDMA/hfi1: Remove redundant PCI device ID validation 10e5e37495096 RDMA/hfi1: Free RX data on late probe failure 3f1e196eb66b8 RDMA/hfi1: Preserve unit 0 on allocation failure 695562587466d misc: rtsx_usb: avoid USB I/O in runtime autosuspend b0c8786242a77 pmdomain: bcm: bcm2835: handle genpd provider registration errors 0f34ac40201e8 ALSA: hpi: Check transport errors during HPI6000 adapter initialization bdcda866c89f9 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full 9e76202a1befe hwrng: ks-sa - Fix runtime PM cleanup on registration failure 2016f01404c7d hwrng: ks-sa - access private data via struct hwrng c319b986a88ce RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state 7bc08d7f9338c RDMA/ipoib: Drain RCU callbacks during module teardown 2f946e7839f67 RDMA/mlx5: Drain RCU callbacks during module teardown 7853af5f15738 RDMA/core: Wait for RCU callbacks before unloading ib_core 39bb722b7e2c9 iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE 682cb826b1ec5 bus: qcom-ebi2: use managed resources for clocks and children fb9738bf09514 soc: qcom: rpmh-rsc: manage PM notifiers with devres a8e5a6cff427c perf metricgroup: Fix metric expression copy leaks c582d79c8559a drm/panel: samsung-s6d16d0: Power off on prepare failure 02e4a3088f21a usb: renesas_usbhs: Fix power-off ordering on unbind b76061c76d8c6 usb: mtu3: allow system suspend during active gadget connection f276b62f2ce1c platform/surface: acpi-notify: Check ACPI companion before use bf1e0cc5cc1d4 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL 44904468e58d3 usb: fix UAF when probe runs concurrent to dyn ID removal 767ccd38e02eb USB: make to_usb_driver() use container_of_const() 6ee22ab55856e USB: make single lock for all usb dynamic id lists 85c8cb5c0be4a USB: core: Use device_driver directly in struct usb_driver and usb_device_driver 4aaad88f85749 usb: gadget: aspeed_udc: check endpoint DMA allocation bdac0e8594a0c usb: gadget: aspeed_udc: Convert to platform remove callback returning void a28c486434634 usb: gadget: configfs: fix out-of-bounds read of qw_sign 52c423309d461 serial: ma35d1: Fix OF node reference leaks in console init 84a286a72228f hwspinlock: propagate errno when registering single lock a73cfa80f1ec6 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node 62b24e1c338f5 platform/x86: dell-wmi-base: Fix resource leak on module load failure a22beeb90475b platform/x86: dell-privacy: Fix race condition 374e8007ba86c leds: pca9532: Fix inverted GPIO output polarity 6347259f70172 iommu/amd: Fix false positive in SB IOAPIC IVRS validation 9f06a7264aeda iommu/amd: Add support for Hygon family 18h model 4h IOAPIC ae2acdee5f8cf iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors c9dfb82df6fee iommu/msm: Return -ENOMEM on memory allocation failure in probe b201d43112589 iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX 51ddb831a3610 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation 8e1101fc41180 bpf: Fix use-after-free on mm_struct in bpf_find_vma() 68f2007738db7 efi: fix stale reference to efi_recover_from_page_fault() 978524ecfc1c5 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux 8034ddf4751d9 udf: Mark LVID buffer as uptodate before marking it dirty 150d3f3c46134 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path fb7393519908b usb: typec: ucsi: unregister debugfs entries on teardown 810875c5996f7 thermal/drivers/rcar: Fix error checking in probe() 78c5da6150ded perf data convert json: Fix trace_seq memory leak in process_sample_event() 4f65a8939518d arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes 30dfa367086be arm64: dts: qcom: sc8180x: Enable the power key 574a1124ab6fd arm64: dts: qcom: sc8180x-lenovo-flex-5g: move pinctrl to appropriate nodes f43f9bd3ece31 arm64: dts: qcom: sc8180x-primus: Rename regulator nodes 0f4733f5fc6b6 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() 3b110cd72a534 clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains ed07e0adfed4a clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status 0c3104e7ada4d timekeeping: Account for monotonicity adjustment in ntp_error dd29cd572958e y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 4d76e99010940 clocksource: Unregister subsystem on device registration failure 98ea7a6cffa01 selftests: timers: leap-a-day: Fix -w option and update usage comment 8aa8e8f5e236d irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its() 8c701506a3896 irqchip/gic-v3-its: Fix memleak in its_probe_one() 36d2cf0a9044d selftests/bpf: Fix memory leak in msg_alloc_iov fb17bee6b42c6 selftests/bpf: Fix memory leak in msg_alloc_iov error path dd4454dbe038d ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() 4520d673d49da staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() 98f9036b2254c staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown 65374d46e5507 staging: octeon: replace pr_warn with dev_warn in fill and rx paths a082526531f19 staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions 03725a114fb42 staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown b6365e4186322 staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown b631de4efcc17 staging: fbtft: Use sysfs_emit_at() to print to sysfs file 52daf9de692eb greybus: audio: bound the topology section sizes against the fetched size 6ddc6239b80de staging: sm750fb: gate dualview dataflow using g_dualview 7b34f757e63c9 staging: greybus: audio: correct sscanf() return value check c40ba47f2ba19 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain c2d446de9c7d0 bus: qcom-ebi2: Fix clock leak on probe failure aca12925ca316 bus: qcom-ebi2: Simplify with scoped for each OF child loop c75aed7464f63 arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name 8d89d53927ca2 PM: sleep: Fix off-by-one in wakelocks number limit check 9118429571290 bus: ti-sysc: Fix /chosen node reference leak 9584b3c30e4ee nvmet-rdma: fix response resource leak on queue teardown 3220b338d5c79 nvmet-rdma: factor out response resource cleanup d130a12a80ca8 nvmet-rdma: use sbitmap to replace rsp free list 85a79da286b65 nvmet-rdma: avoid circular locking dependency on install_queue() 86782a72c6d8c nvme-apple: Use acquire/release for queue enabled state 27ec91c29ee15 crypto: keembay - Fix AEAD unregister count in error path a22dc48d58ef4 crypto: rk3288 - fail ahash requests on HASH idle timeout 04c46784ec249 crypto: sa2ul - stop probe if context pool creation fails 28cc179252347 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure 6457162f74f45 crypto: atmel-ecc - reject hardware ECDH without a public key 70933a1cac1fc crypto: atmel-ecc - clean up and improve ECDH comments c0615c85eabf9 crypto: atmel-ecc - replace min_t with min 892f34dc1819c crypto: qat - clear AES key schedule from stack a8aa89686e705 perf/x86/amd/uncore: Add group validation e0e7c57c8f654 perf/x86/amd/uncore: Refactor uncore management 64463f1901d33 perf cs-etm: Fix thread leaks on trace queue init failure 99d3245941659 perf cs-etm: Queue context packets for frontend 8e5df43a45788 perf cs-etm: Create decoders after both AUX and HW_ID search passes 96d80b8319b3d perf cs-etm: Fix incorrect or missing decoder for raw trace 655c4401c18d7 wifi: rtw89: fix HE extended capability length check 7780d93ae28f3 platform/chrome: sensorhub: Fix memory overread in ring handler c3d0e87485242 selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check e71a3dc5b8d2e csky: Fix a4/a5 restoration in syscall trace path 8d32795f0a49f iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure f80c31231f85e soundwire: qcom: Fix port exhaustion check in stream_alloc_ports aaff22cc321a3 dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe fdaf297ab275c dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers 2c6bb2f286369 dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure 953e85da53541 bpf: Copy per-CPU map value padding in copy_map_value_long() 9004fc411a4c5 tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands c2dae438fe530 tools/bpf/bpftool: Reset vmlinux BTF after map commands b349dcf061a6d drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup 745297208d312 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup 28f70e0aa767a regulator: tps6594: Fix device node reference leaks in multiphase loop 017cee438fff6 regulator: tps6594-regulator: refactor variant descriptions e8d3e15b9dd68 regulator: tps6594-regulator: remove hardcoded buck config 23a18b7506a10 regulator: tps6594-regulator: remove interrupt_count 75ab28f275538 regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type ac25127d2f353 regulator: tps6594-regulator: Fix the number of irqs for TPS65224 and TPS6594 54308f24ce510 regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators d9c48f4e68615 mfd: tps6594: Add register definitions for TI TPS65224 PMIC 1f27602b20119 perf tests: Fix flakiness in BPF counters test on hybrid systems a223216745ed4 perf test: Fix perf stat --bpf-counters on hybrid machines c292f2c183254 perf test: Use sqrtloop workload to test bperf event ff43d641b3bfb perf test stat_bpf_counter.sh: Stabilize the test results 30db36f6e1503 perf test bpf-counters: Add test for BPF event modifier a04531eb40eb9 perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test 203514384ea3c perf tests: Skip metrics validation if system-wide recording lacks permission 6ccaa141be258 perf test: Do not skip when some metrics tests succeeded db1ce7949a1cc perf test all metrics: Fully ignore Default metric failures ce09d02a597cb perf test metrics: Update all metrics for possibly failing default metrics e386dedc41094 perf tests metrics: Permission related fixes 1437d124d2ede perf test stat_all_metrics: Ensure missing events fail test a379a49b88d14 perf test: Update all metrics test like metricgroups test 361c06583eb3b perf test: Simplify metric value validation test final report 3db8b4f7f4eaf media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define 68f283e4d2202 media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define 3b978fd0a3092 pinctrl: bcm2835: Don't remove an unregistered GPIO chip ff48a41a242f2 perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails 69fafae4eb2c9 sched/fair: Fix overflow in update_tg_cfs_runnable() f5ec164e733b9 mm/mm_init: fix incorrect node_spanned_pages 788917ba77f5d drm/lima: call drm_mm_init() with a valid allocation range 0c90fe8d8039f clk: imx: scu: drop redundant init.ops variable assignment 3f0ebe8f8ae31 ARM: imx: fix device_node refcount leaks in imx7_src_init() 01a854226f5d1 ARM: imx: fix device_node refcount leak in imx_src_init() d3d51e874f7c0 clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller 1bb23c9d68312 ASoC: rt700-sdw: always drain jack work on remove b550b77f34f19 clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic 25f46d2536332 clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate() 418401f2a872d clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc 828a90dadda6c clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation 6956464d233a7 clk: moxart: remove unused variables, fix refcount leak 909f1b54d5a09 clk: versaclock7: Fix APLL clock leak on probe failure b37e82a046e73 media: cec-pin: Fix event FIFO ordering 111f1311bbdbe soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() 4b29be4b23bc2 HID: roccat: bound device-supplied profile index e45631bf607fa HID: nintendo: Fix imu_timestamp_us double increment per report 92cca302a4eaf HID: core: quiesce input in hid_hw_stop() to prevent use-after-free 4e37371cb4e3b platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count c0e090bd67085 x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE() 02e095247f0a9 smack: restrict smackfs/{direct,mapped} values to 0-255 c7bb74fa9c382 smack: deduplicate smackfs/{direct,mapped} file_operations 6d4addf839b94 smack: simplify write handlers of sysfs entries ec47f4177046d smack: fix incorrect task context in smack_msg_queue_msgrcv 139460b7723ca drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure a008506e55e33 drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format 8504b0e1acef9 drm: lcdif: Wait for vblank before disabling DMA 9ed9a94c1a41d drm: Remove unused header in drm_dumb_buffers.c 6d79a939e284e mm/damon/core: skip aging from repeated aggressive merging a886ad5f6348f usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion 404079d124d75 clk: meson: align gxbb_32k_clk_sel number of parents with actual count 29639f00bfa49 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON a3e07db74f22a batman-adv: bla: avoid CRC corruption due to parallel claim add 1674855a5b6ea batman-adv: dat: atomically update mac addresses d161c4456672f ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size 5e641e4ee0bc1 ksmbd: fix durable reconnect error path file lifetime f0ff7f12398e8 ksmbd: fix use-after-free in smb2_open during durable reconnect 64eaf4ecda007 bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops 2120bd8546cd6 bridge: mrp: reject zero test interval to avoid OOM panic de6601f1374fa netfilter: nft_counter: serialize reset with spinlock e2e9599f3503d bpf: Reject narrower access to pointer ctx fields c9a129c82ddf8 ceph: fix oops due to invalid pointer for kfree() in parse_longname() 4b9aee707c458 parse_longname(): strrchr() expects NUL-terminated string 0afd48b173beb net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads 97aabdbf7ba82 ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING" 73f074fb5e139 ksmbd: fix overflow in dacloffset bounds check 9c6c85ae77efb net: libwx: fix Tx L4 checksum 5eaf57fdfa37c md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb 7493b9baf0e54 wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path 9d213ca0cb49e net: hns3: fix kernel crash when 1588 is sent on HIP08 devices 7f1fe43907a63 net: hns3: don't auto enable misc vector 2b844d952e23d mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of() 1acb6d1ece3bc mm/damon/core-kunit: handle region split failure in filter_out() 9b7cf02158d93 mm/damon/vaddr-kunit: check region count in three_regions test 072d538e9d8c5 mm/damon/paddr: drop last same folio access check reuse optimization 2b48a84d31dc3 mm/damon/vaddr: drop last same folio access check optimization 94c4828bee3da mm/damon/core-kunit: check region count before testing in split_at() c3c126a6142a1 nvmet-auth: Synchronize timeout work during SQ teardown f3d8c2fd591bb net/mlx5e: xsk: Fix unlocked writing to ICOSQ 9fffa6465851a tcp: clear sock_ops cb flags before force-closing a child socket 43239fc6dfb62 xhci: fix lost bounce buffers on TDs spanning several ring segments a129b2b875c14 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE ba42d8a1c2c76 drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE f02aefbc43bd7 drm/nouveau: Use write-combined maps for coherent 0f47c47b45738 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving b4c90c78f420c drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT 5d501f7279451 drm/amdgpu: fix autosuspend cleanup during removal 84a8012601b9a drm/amdgpu: check thunderbolt before switcheroo registration e2f27b5ed9084 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used 4f966558c188b drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value 082e378886547 drm/gud: validate TV mode names before creating enum property 89210cb5ff8fd drm/gud: NUL-terminate TV mode names read from the device 6dceaeceaa7c8 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check 4d5ee095a5846 drm/amd/display: avoid divide-by-zero in __is_lut_linear() 6fa33b32783e9 drm/hibmc: Use drm_atomic_helper_check_plane_state() 1f0b71afd81de drm/hibmc: Fix list of formats on the primary plane 5296c567cbacc drm/sun4i: fix refcount leak in sun4i_backend_init_sat() 4a0236fe97732 drm/i915: Guard against NULL driver_data in i915_pci_probe() a0a7e2e177f2f drm: fix race between partial drm_dev_register() failure and ioctl 8d9e6dffaea9b drm/panel-edp: fix i2c adapter leak on probe failure c0cbdb43e0c65 drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure 6882d458d2e40 f2fs: fix to zero post-EOF data when extending file size d7a07c9ac1e71 f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page() e601926015e03 f2fs: fix i_size when pinned fallocate partially fails 694565c0c14c9 f2fs: return writeback error from collapse range 4c0c610b480cf f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() ca1a602d4f73c f2fs: reject overlapping move range after len expansion 4aa12ba10cbff f2fs: return symlink writeback errors 2935b730211c5 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started 947c6bfcf7f5e scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak 9c00b89160406 scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics e8f1b0cb97823 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition e72c9eb93c5f1 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition af8650037eec2 scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort d79376fbd2a07 scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() be75ab791c9b3 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read 6e217a9482eab scsi: qla2xxx: Avoid double completion in async IOCB timeout 7ac5be2a86096 scsi: qla2xxx: Quiesce response IRQ before freeing request queue 6e3f129538c32 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb() 8f0e31e7a4137 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path b6a30baa29695 scsi: qla2xxx: Don't query firmware state while chip is down 5762d992dddaf scsi: qla2xxx: Fix FCE trace enable parsing in debugfs 2f847f06bb223 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() 6003e79148eca scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump ae09260be7454 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown 9cef42a073a0b scsi: qla2xxx: Serialize flash version read in reset handler e80adfeac61b4 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation 7eb618877503e scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject 047f1f7ee6f85 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() 5b8ed910c392c scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() b403700ac62fb scsi: qla2xxx: Initialize NVMe abort_work once at submission f8d2eb510c063 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() 55f8698a6caf8 scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters de0c8ef3b900c scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check 9a756f277eb89 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers 84bde5ce4038d scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers c4acac8cdc005 media: zoran: Avoid freeing a registered video_device twice ca87a19381ae6 media: vimc: fix pixel format lookup in enum_framesizes 3d1b10d81fe54 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure 7c0212041fab2 media: venus: fix payload size calculation in parse_raw_formats() fdf1eb47a60db media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() ef609b3ce456f media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link ea5a921d4d277 media: v4l2-ctrls: Allow unknown HDR10 white point and luminance d273571e53140 media: v4l2-async: avoid deleting unlinked ASC entry on link error 593b1172e5d54 media: tda18250: fix possible integer overflow 77f216f8de622 media: saa7164: fix cleanup on resource allocation failure 5626785b0e466 media: s2255: check firmware size before reading trailing marker 79f58f900dd22 media: s2255: bound JPEG frame size before copying into the buffer c91e8ae2b39c6 media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure 053581d4657c6 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak 826763adbd8bd media: rc: sunxi-cir: Unregister rc device on probe failure c817f24410626 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks e9fe8e3f758f8 media: nxp: imx8-isi: Correct color map between V4L2 and ISI 94666ec4ae770 media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing 680a89683197c media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common 7512838a19af0 media: i2c: ov7740: fix use-after-destroy in remove 4c2988bf1ad27 media: i2c: ov02a10: fix endpoint parsing use-after-free 1c9fdd9465211 media: go7007: defer the ALSA v4l2 put until card release 20aacd87550be media: em28xx: fix use-after-free of dev_next->devlist on disconnect 4e11c45dfdc72 media: em28xx: defer audio-only extension registration ec82b0cf7f75f media: cx23885: cancel NetUP CI work before teardown 54ac6df8b8d97 media: cx231xx: reject geometry changes while the VBI queue is busy 42e00371f83c3 media: cobalt: Avoid freeing ALSA private data twice 22441be29ec27 media: cedrus: fix memory leak in cedrus_init_ctrls() 271e57a936dcd media: cec: Serialize exclusive follower delivery cf3bf86f32371 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash 954ee95a03b4d media: cec: core: Fix kmemleak due to missed rc_free_device() call 6e4ea90fdc660 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref ff40e597d5d98 LoongArch: Avoid preempt count underflow without probe a03b5e7483ad2 LoongArch: Do not save/restore percpu base register in rethook trampoline 9c55a7d4e521c KVM: s390: Restore sigset on error path 1914499556464 KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP 934b7b2b76d34 KVM: s390: Zero initialize irq in reinject_machine_check f8e3a9997d5ec KVM: s390: Take srcu when importing watchpoint data 544a5a665019c KVM: s390: Free guest debug data on vcpu destroy 5fbf319137735 KVM: s390: Fix old_data leak in guest debug error path 5940418e4232a KVM: s390: Fix memory leak in guest debug handling fec89d327d9b2 KVM: s390: Fix length check __import_wp_info() 8e19ded843368 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock 312cdb6d89408 KVM: nVMX: Service local TLB flushes on failed nested VM-Enter 62604376c3131 KVM: nVMX: Always flush vpid02 on first use ee2d20a386668 iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask 7a1be6e7a857e iio: light: opt4001: Reject integration times with a non-zero seconds part 0f9f6d0ee5a59 iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() 170904917dc8d iio: light: opt4001: Fix power down clearing bits of the wrong register 9b75d89fd1e3d iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() e44b2af0c14e2 iio: srf04: fix pm_runtime handling on probe error path d97f4e012ba37 iio: pressure: mpl115: Fix runtime PM cleanup a32a39da18e01 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe da41c3e0e67a3 iio: light: gp2ap002: Disable regulators on resume failure 82c27dabc391b iio: light: cm32181: return zero after writing calibscale 7dfbbb2f219fd iio: gyro: mpu3050: fix sign of raw angular velocity readings f5acb824277a9 iio: dac: m62332: Fix regulator reference count imbalance 3462c13bb0f50 iio: chemical: sgp30: Handle IAQ thread creation failure f64b437641b5a iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF 72daa7eb7fc62 iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable ed43e34f431d1 ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get 4dc91d0dadfe2 AsoC: intel: sst: fix PCI device reference leak on probe failure 6150b04ce8474 ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure f4bfd755c52df ASoC: cs35l34: drain threaded IRQ before runtime suspend 614c2616ea677 ASoC: cs35l33: drain threaded IRQ before runtime suspend 52f7ce8896d6e i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure 0c4c642b4d03e clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks ad3436ad31b83 clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk c93a8c7064b33 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk 0c0609c1da0df clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src 0944e2cd198f6 clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src 1e2465ee57a3a clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src ce6f40f8dc66b clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk a2c156d22c3db clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk b89701e1fae14 batman-adv: bla: prevent CRC corruptions after claim flush 76aedcde5a248 batman-adv: bla: fix freeing of claims on meshif deletion c74a4acf41d19 batman-adv: dat: avoid unaligned fault in IP extraction 6df64825f8b19 batman-adv: fix stale receive device on merged fragments ddb6ddf5be742 mtd: rawnand: validate ONFI extended parameter page sections f25c804947e0a mtd: mtdoops: free page bitmap when the backing MTD is removed da740539e8f37 mtd: afs: validate v2 image info bounds 58f6f9125e74d s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object 4ba8a08f5f26e s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap 31fa0a8a3c337 s390/vfio-ap: Fix NULL deref in status_show() during queue probe 3a9b049bbdc40 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed 5e932abfcce61 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL 02e72909453de s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove 1f54efd800320 s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove eb6cc898501a0 s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() 114b6ce2cf864 powerpc/crash: stop watchdogs before booting kdump kernel 9c8e0e526b769 powerpc/pseries: Move H_WATCHDOG definitions to a common header b0cf5aceafb4b powerpc/pseries: Handle and log pseries-wdt registration failures b96be860673f9 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population f5e9bea0d7c15 parisc: Fix alignment of asm statements in head.S 62d88e93ef5e1 parisc: eisa: Fix infinite loop when parsing invalid IRQ value f9bf05c63b77d nvdimm/btt: reject an arena whose nfree is below the lane count 6eddedb1a3009 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration 0fb7c549357c1 Revert "irqchip/mbigen: Fix mbigen node address layout" 9fb527103e53f nvmet-tcp: reject unsolicited H2CData PDUs cf5f39d2b58f9 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU 0673a2affe45c nvme-tcp: check the data direction of a C2HData PDU ad29779736cfd ALSA: pcm: Fix race between non-atomic ops and trigger-start 7dc239edb6d58 ALSA: harmony: initialize locks before requesting IRQ 08d931a0a850a arm64: mm: Fix the lockless page-table walk in show_pte() 0927153f2abf4 i2c: mux: Fix channel node leak on adapter add failure f9094ace03e0a i2c: core: fix debugfs UAF on adapter removal ca19a175e89b7 perf/x86/intel: Fix kernel address leakages in LBR stack 341ec28243f16 rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers 5548f41e2f8dc rtc: rzn1: Fix weekday underflow when alarm crosses month boundary a098e2cecd9d2 Input: aiptek - validate raw macro indices before updating state 630ed8734a02b kprobes: Protect kprobe_blacklist with RCU 30b5c0e17dcad ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() 23a969a2df8de ata: ahci: work around lost interrupts on Marvell 88SE61xx 642b76f92bc42 block: flag zoned disks with GENHD_FL_NO_PART a38caa9ed0d5c cpuidle: dt_idle_genpd: kfree() the original name allocation 17ef63843c0fc dmaengine: dw-edma: Initialize IRQ data before requesting IRQs 8bc87a50fd0ea dmaengine: dw-edma: Complete descriptors before pausing 718ee263a60d5 dmaengine: dw-edma: Fix HDMA channel status register access 94f3d399c1ddb dm: fix resume-vs-remove race 0ea6e5ad4a581 dm: fix race when loading and unloading a table 96dd0af7597ab HID: wacom: validate report length in wacom_intuos_pro2_bt_irq a8be8bbf0952b HID: rmi: fix OOB access with undersized RMI reports 81aadbd09bf1d futex: Prevent rcuwait use-after-free during requeue PI 2bf705699fd72 mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs c97ded32334d9 mm/damon/sysfs: kobject_del() region and target (error) dirs ffab414fc5e06 mm/damon/sysfs-schemes: kobject_del() scheme region dirs 0e4aa31ab32a3 mm/damon/sysfs-schemes: kobject_del() scheme filter dirs b33f9b0184159 mm/damon/sysfs-schemes: kobject_del() scheme dirs 2853ce9c88e0e scsi: pm8001: Use rollback index when freeing MSI-X vectors 6b589ef9d5f6c scsi: target: iscsi: Reserve a terminator byte for the login payload 635b2bddea565 spi: bcmbca-hsspi: disable clocks on resume failure d45f27903f945 spi: bcm63xx: disable clock on resume failure 5597b4ffd0bec spi: bcm63xx-hsspi: disable clocks on resume failure be41733c24be5 ublk: clear VM_MAYWRITE on read-only ublk char device mmap d3018aaa5e3b1 thermal/drivers/qoriq: Disable clock on resume failure 03ff03e5c95a5 thermal/drivers/imx: Disable clock on runtime resume failure 0b7f64c7bb966 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() fd5e24ea83733 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() 7a4f4ca7ff32a usb: gadget: fix null pointer dereference in usb_put_function_instance() 162178ca83c3d USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() f9bdf4c4f6410 usb: gadget: f_midi2: fix use-after-free in string attribute show path 51ddc55c75087 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs 58e0ee293ec5e usb: typec: ucsi: displayport: Fix OOB altmode array index 0b69b166852db usb: typec: qcom-pmic: cancel reset_work on stop dbbb3bb0bf2f3 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() 9481bc04a8c35 usb-storage: ene_ub6250: fix race between scan work and probe 67374e3a00814 media: usbtv: keep device alive while ALSA card exists d91993f4c7635 clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset 1d4add2b832b5 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() 553c375e86a49 usb: image: mdc800: change kmalloc() to kzalloc() 4c5b61b9df6ab drm/amd/display: fix division by zero in get_estimated_bw() 28ed5343666ff scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() 2df964d141270 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions 517ed2f9ea7d9 tracing/mmiotrace: Remove reference to unused per CPU data pointer 7ab40f7577d88 net: ntb_netdev: Fix TX busy and drop handling 23001ee5d8631 entry: Fix seccomp bypass after ptrace with TSYNC cd644e6dc72ee tcp: fix potential race in tcp_v6_syn_recv_sock() 343ae18e960f6 fsnotify: Fix stale object mask after concurrent mark updates b4bf67cc0871b wifi: mt76: mt7996: validate default EEPROM firmware size dfb10d9890561 landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation 680f20d5937fa openvswitch: Fix CT limit teardown use-after-free d7c2b66bc5527 net: openvswitch: fix kernel-doc warnings in internal headers 8069643ae64df net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() e34ff3f882292 platform/chrome: sensorhub: Fix dropped timestamp events and log spam 8395cff0b286d udf: Fix i_lenExtents truncation on 32-bit kernels 51e368f723aa5 timer: Keep debugobjects state consistent in migrate_timer_list() 2252f8ccc3085 taskstats: fix cpumask parsing cutting off the last character f9c7b1f2b9d8f smack: fix cred UAF in smack_file_send_sigiotask() 6b1de022304ef signal: avoid shared siginfo namespace rewrites 262b805219157 sticon/parisc: Detect default STI graphics card for console output b0dc3f18af01b tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout 6c1a8685be6a7 xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc() 0f6496b34cc29 w1: ds28e17: reject an oversize length on an I2C block read b9cb4e8ba71c9 vsock/virtio: flush works in dependency order ef2ec8b537c3a wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex c86199357a93b wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() 2610885f70861 wifi: rtl818x: initialize eeprom_93cx6 struct to zero f2134d6ff30cd wifi: mwifiex: Detach sync cmd buffer on interrupted wait 7704f6ba2a8c4 wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() 35aa6730b8c56 i3c: master: svc: bound IBI payload to the requested max_payload_len ef72ff6650c4e i3c: master: Fix info leak and UAF in device unregister path 42ea423a50ae1 dm-switch: use WRITE_ONCE() in switch_region_table_write() 389a50d094e13 dm-stats: fix a crash if allocation of per-cpu data fails d1361d4a42bbd arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map() d18bbf8262516 x86/tdx: Fix zero-extension for 32-bit port I/O 0444f2803b963 PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip 342d8d63f653c cgroup/cpuset: Fix misplaced DL migration reset 368c521503e38 ALSA: virmidi: Check card index validity at probe 487ede9b648fc ALSA: serial-u16550: Check card index validity at probe 64898e9bd8b7b ALSA: portman2x4: Check card index validity at probe ede25b7fea0d7 ALSA: pcxhr: initialize mutexes before requesting threaded IRQ 9cd7c59a106e7 ALSA: mts64: Check card index validity at probe 26a25fb4ef4ba ALSA: mpu401: Check card index validity at probe 6c07aad8a7c9e ALSA: bcd2000: clear the URB pointers on disconnect 6fe7d13608a9d ALSA: aloop: Check card index validity at probe 00e84a9ff2d43 ALSA: 6fire: bound the MIDI event length from the device 96c74420ac929 seg6: reset IP6CB after IPv6 decapsulation 6ec22afc82a3c net: skbuff: don't touch shared zerocopy state in skb_tx_error() bfb1c9e6297b4 net: fix spurious TX timeout after dev_activate() 84783961cb8bd net: cap advertised IP tunnel headroom b6b6ac713ee82 net/smc: unregister the connection before draining the rx tasklet df441f3efbb50 net/smc: fix use-after-free in smc_rx_pipe_buf_release() 09d7a9e162ee1 net/smc: fix socket refcount leak in smc_switch_conns() ab26e12dd5d2f net/smc: do not dereference an unset send buffer on the SMC-D teardown path 746681f9e8773 net: ntb_netdev: Count packets dropped on RX refill failure 965c4452bfe34 net: ntb_netdev: Avoid double-accounting netif_rx() drops b6db88cde0fb5 NTB: ntb_transport: Reject oversized TX buffers e6cc541fab010 NTB: ntb_transport: Fail TX enqueue when the QP link is down 81fbd4021ca93 NTB: ntb_transport: Recycle TX entries before client callbacks e0d4a17afde5a net: thunderbolt: Mark the connection down when bringing it up fails 47981eb66461b net: thunderbolt: Release the Rx HopID that was handed out on mismatch bf3308416a2be net: ravb: avoid dereferencing an invalid PTP clock 06323666c4e2b net: openvswitch: fix nf_connlabels leak in ovs_ct_init 64051fe200c7c net: openvswitch: fix flow mask use-after-free on flow deletion 010eee265d6bd net: tun: bound receive headroom 98610769784d0 net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition 70e20456bcbf7 slip: fix use-after-free in sl_sync() 6de17275b3ccd xdp: fix zero-copy frame layout 0a5af67e7184c net/iucv: filter frames in afiucv_hs_rcv() by ingress device d377bf743f29b ipmi: si: Fix NULL pointer dereference after failed registration 7d66d54b974cf ipmi: ipmb: validate write message length fedea72e8f312 interconnect: Fix use after free in icc_get() and of_icc_get_by_index() dfdee7ceff6a5 platform/x86: hp-bioscfg: warn on element type mismatch instead of failing 467e53f231f77 platform/x86: hp-bioscfg: pass validated element count to package parsers fe837a99e4e31 platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed 8f5aa1506cddd platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() 62f6f04abc64a platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password 21243c15e1d31 platform/x86: hp-bioscfg: fix heap OOB read on empty password write 81db79fed1156 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() 1bf0a07a2ea4b platform/x86: hp-bioscfg: bound ordered-list parsing by the package count 27a93d0fe2398 platform/x86: hp-bioscfg: advance elem past consumed array elements d8690d44f1b0d platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS d1b4add68dabf platform/chrome: sensorhub: Bound the EC-reported sensor number f2a9289a65d35 platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path 0d601126c7afd platform/x86: ISST: Validate logical CPU id and clos id 649024043d23f platform/x86: ISST: Just allow 2 bits for SST feature enable dde5b9c91e9fc mmc: via-sdmmc: stop card-detect handling on probe failure c847ea4851ecf platform/x86: ISST: Validate socket ID in clos_assoc ioctl beb22ebf76c04 platform/x86: ISST: Validate level in perf mask ioctls 44ec7f1113309 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer 579eb867d3da6 iommu/vt-d: Force requesting ACS when tboot is enabled d5db80b68ee5c iommu/vt-d: Fix no_iommu to disable platform opt-in a6a4cee09b154 PCI/proc: Warn on writes to kernel-exclusive config space regions e7730acd6a01c PCI/proc: Use file_ns_capable() when checking config space read access d6895710703ea PCI/proc: Avoid spurious runtime PM wakeup on config space accesses d0631a0ab18ad PCI/MSI: Enable memory decoding before restoring MSI-X messages 131900a246137 PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses 838e146ae4cd8 PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608] 5a072fc80a753 PCI: meson: Fix GPIO state while requesting PERST# dcaf13f2f4688 PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk f735b9710f0c8 s390/dasd: Propagate partial completion length across ERP recovery 57db27ccc162a s390/dasd: Guard sysfs discipline callbacks against unallocated private data 55f4df40178cd s390/dasd: Do not complete a failed ESE read as successful 991be92489bc7 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks 23783db5642a7 power: supply: max17040: synchronize work cancellation on suspend f46465aefa911 power: supply: max17040: drop incorrect I2C functionality check 2ec4d203ecb06 power: supply: ucs1002: fix use-after-free on remove c46c205bab0df power: supply: twl4030_charger: cancel workers via devm 442c60c08ec23 power: supply: rt9455: quiesce delayed work before teardown c06028db62085 power: supply: qcom_battmgr: terminate the strings from firmware 6f0ce09d60a0e power: supply: lp8727: fix use-after-free in lp8727_release_irq() 3262977a05b23 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS 2746d502b12b3 power: supply: cros_usbpd-charger: bound the EC-reported port count 976c10d883a02 power: supply: bq25890: Fix power_supply reference leak 2cfb59dc9df8b power: supply: bq256xx: drain usb_work before freeing the charger 6d2eb93975c07 power: supply: bq24257: fix use-after-free on remove 092acd3c55a40 sctp: fix stream->outcnt underflow on duplicate RECONF responses b55c2561d3fec sctp: distinguish sequence zero from wildcard in reconf lookup b2d6d873b4dfb sctp: fix NULL deref on untransmitted RECONF completion 928fd7920ba37 sctp: drop a chunk if its transport was removed 5c0b2dbbdafc9 sctp: stop processing a packet once its association is deleted fca3ebb63e5c8 nvme-tcp: reject a read that transferred too few bytes bc4013c7cce58 nvme-tcp: fix host memory disclosure on R2T for a read command b96e1ff75e5c0 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone 313b05de246a1 nvme-pci: disable controller on admin queue IRQ setup failure 66b5af23b6f95 nvme: zero the discard fallback page da7555248e9bb nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path 350087f231c11 lockd: pin next file across nlm_inspect_file lock-drop 697d946853e7e hwmon: (max6621) fix temperature clamp range 7d69a2747441f hwmon: (max6621) fix negative temperature offset and crit readings 213a32146337d ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC 9df45b83d6f68 arm64: compat: Fix decrementing LDM/STM alignment emulation 8a2ec0eb2c5b3 ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion 4d5c460ef8754 openvswitch: only skb_tx_error() a packet we are about to drop 574ae2ac2b314 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall f9dd5cad8d091 ocfs2: fix readdir position truncation on 32-bit kernels 1507c5586ebd3 ocfs2: cluster: fix o2hb_dependent_users leak on pin failure da279037473ae ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item c9be4de77f97f ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() 97584e93fc49a ocfs2: validate rl_used against rl_count in refcount block validator 77686fa5bba13 ocfs2: validate lengths in dlm_mig_lockres_handler 24989909d3413 ocfs2: bound namelen in dlm_migrate_request_handler a4adaa722977f ocfs2: always run deallocs on copy-on-write completion ce748ae1181d0 orangefs: skip leading spaces before parsing client debug masks 9c9eacc47c618 orangefs: fix double-free of trailer_buf on readdir copy failure c4c338dcd38b9 regulator: qcom-refgen: correct the regulator type to CURRENT c998890091065 regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata eda08b6bd64f0 regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer 71dc206f2e2a6 RDMA/ucma: Lock the handler in ucma_set_ib_path() 3265d558dfafa RDMA/cxgb4: Cancel reg_work before freeing device on remove a5e1fdc126ab3 qede: Fix NULL pointer dereference in TPA fragment processing 6ca338cf2d386 remoteproc: scp: Fix device reference leak on failed lookup a2e0e01a7fbf0 arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio bfc3e5fe778c9 arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck 28cf91db44ce1 rpmsg: glink: smem: order FIFO read after availability check 46101fb96aff2 staging: media: tegra-video: vi: fix probe failure on skipped last port a3783800c9475 staging: media: tegra-video: fix of_node_put() on VIP parse errors 6deb4d7a0c3d9 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets b77b83f5529a2 udf: reject VAT indexes equal to the entry count 06d0390c37fa6 svcrdma: Fix pcl_for_each_segment for empty chunks cba8543c18cf4 svcrdma: Fix offset arithmetic in read_chunk_range fb43997407bc1 SUNRPC: wait for in-flight client TLS handshake callback 4abb44a29bb51 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field 89c8e0733e8c4 sunrpc: init gssp_lock before publishing proc entry 81fd7654a8429 SUNRPC: harden gss_unwrap_resp_priv length checks f2591660e0eb2 SUNRPC: harden gss_krb5_unwrap_v2 against short tokens ef948257d1211 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat 57ac7d899409b SUNRPC: Check svc pool percpu counter allocation 6d74ecc2be120 SUNRPC: always drain cache_cleaner before destroying a cache_detail edb20e8c03aeb sunrpc: route to a populated pool in svc_pool_for_cpu() 0ea5b0c7f212c SUNRPC: svcauth_gss: enforce krb5 token minimum length 56b29d62017c7 SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry 4bf59cb0ea5b0 SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow e05c28bd6043d nouveau/gem: reserve the bo in the info ioctl around the vma lookup 9df36a4846375 mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction d9640239827d6 mpls: reload header after pskb_may_pull() 0a03f9541c06f md: do overflow check for sb->bblog_shift in super_1_load() 792515b2b77cc mailbox: qcom-ipcc: fix duplicate channel allocation across holes 93967bfb17dab libnvdimm/labels: Prevent integer overflow in __nd_label_validate() 3665abc3d2ae8 ipv6: use RCU iterator to dump route exceptions c3457a5aae5fb ip6_gre: fix hardware header length for NBMA tunnels defa0adeff132 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() c4dc23de4cc75 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails 7cd164f0e1bab kasan: fix cache shrink race with CPU hotplug d90a166ac55c1 Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request faf331d3f2145 Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative 7df825df95cf9 Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative 6ebb6d1756820 Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection d5eef07470719 Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb ff76a63e9524b Bluetooth: hci_conn: re-enable advertising only for peripheral role 82425b14f0fb2 Bluetooth: RFCOMM: serialize security confirmation handling d47b8f8c02a3d Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready 1a7196c4fffb3 Bluetooth: hci_uart: Fix false success return in hci_uart_setup() 1c4b02a810329 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative 1353679268b3c cxl/pmem: Format the nvdimm serial number as unsigned decimal aa436b021e505 cpufreq: schedutil: Fix rate limit overflow 522fa26da24cc dm array: reject an array block whose value size is not the caller's 01a0276706c7b dm raid1: reserve space for NUL-terminator in build_constructor_string() dc731d7fddfd6 dm-era: fix shadowed superblock leak on take-snap failure 80551bf8912c4 bpf: Harden bloom filter sizing and indexing on 32-bit kernels ac280f6872e75 bnx2x: fix double free in bnx2x_init_firmware() error path 1a28aae7f1fc8 Bluetooth: eir: Fix OOB read in eir_get_service_data() 0725f93b395f7 Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU 1b5fb9c40e301 Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU 958cfdc655f7c block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() 6eaed64a32e55 auxdisplay: charlcd: cancel backlight work on registration failure 977554ed91b54 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes 3a6f8d3adbd6f ARM: 9477/1: Disable broken eBPF JIT on the Risc PC 1712e99ddeb19 alpha: marvel: Fix lock ordering in init_io7_irqs() 748d3e1dcecf5 alpha: marvel: Fix irq_set_status_flags to use correct IRQ number a12408ff9a948 alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() c5a31b4e7e37c ACPI: pfr_update: fix stack buffer overflow in query_capability() 9963a65be2bef hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device 827ded884dbd6 fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration c4d5953582463 forcedeth: fix off-by-one when saving/restoring non-PCI config space 9eb7b3cbe99c9 fbdev: uvesafb: unregister connector callback on init failure 237924f5b9afc fbdev: ssd1307fb: defer I2C transfers from damage callbacks 74de052b4399d fbdev: pvr2fb: correct user pointer annotation and sentinel initializer 302d19fbc7dc7 fbdev: omapfb: panel-dsi-cm: initialize lock before registering display 35b3334800103 fat: restore original value when fat_ent_write failed 3cd611c9f1dbc efivarfs: Rate limit statfs() handler a980ac04ada51 ecryptfs: show filename encryption options 30845ed227475 ecryptfs: release message context on send failure 414a0f04feb06 ecryptfs: reject too-small tag 70 packets 33e050cac8414 ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet 749fa08d8f1b3 ecryptfs: pass packet set buffer size to parser ec1627bcb5b51 ecryptfs: hold msg ctx list lock when cleaning daemon queue 7abf2992c61e8 ecryptfs: fix tag 11 packet exact-fit size check 70fa0cf82e435 eCryptfs: bound the packet-length peek to the user buffer 61ca8cbbf68f7 fs/ntfs3: bound page_lcns[] index by the log record 77d8efd04745c fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() d23155634a4bc fs/ntfs3: validate dirty page table on log replay 069729282fbec eventfs: Initialize ei->children and ei->list in init_ei() c1c508e892391 HID: mcp2221: validate report size in mcp2221_raw_event() 85d963499f1fe HID: mcp2221: stop device IO before hid_hw_stop 2409779f3096f HID: sensor: custom: Fix field sysfs group cleanup on failure 4cb3ff31d237a HID: roccat: free buffered reports when destroying device 4daf432c94a42 HID: picolcd: clamp eeprom debugfs read to bytes actually received 6cb7f9fed8f40 smb: client: harden DFS cache against invalid target hints 735abe4932355 smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV b89d678f9eafc smb: client: fix ALIGN() overflow in symlink_data() error context loop 3ff9462bb7a06 smb: client: clear ce->tgthint in free_tgts() 7f62817fe049b cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 01b0ec8c397be audit: avoid dropping live tree ref on fsnotify rule autoremove 61f085cb8976c ceph: bound xattr value length in __build_xattrs() eb3e1a1cb1634 ceph: bound num_export_targets array for mds info v2/v3 a294064e0e0f8 ceph: bound copied dentry name length in NFS export get_name c4addccd05bac ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode 19f16f04c2b01 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock 6e5c6ce252b1e libceph: reject buckets with mismatched CRUSH ids 94ae5145c5206 libceph: validate OSD extent maps before cursor advance 1ce74d1b7770e NFSD: Prevent lock owner use-after-free during client teardown caddbeffab1ea nfsd: revoke copy-notify stateids before dropping their reference 70290db6c9802 nfsd: reject reclaim LOCK after RECLAIM_COMPLETE 1db456ffc22e0 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE 9caad13b7cfe9 nfsd: initialize copy-notify stateid before publishing it 3be1d8611dae4 nfsd: gate nfs3 setacl by argp->mask 8e4422b05f410 nfsd: gate nfs2 setacl by argp->mask 88bce7e326c36 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo bee826c00ac90 nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget 59416992d1f58 nfsd: fix version mismatch loops in nfsd_acl_init_request() bfeac42d9074e nfsd: fix cpntf publish race in nfs4_init_cp_state 75268f6cfe26b nfsd: check client ownership when cancelling a copy-notify stateid 977e6f006a7a3 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref 9e8924bef5b50 nfsd: add filehandle match check to nfsd4_delegreturn() d823bf9285cdf nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() 3ef5e7a01a4d7 nfsd: validate symlink target length in NFSv4 CREATE 322422d66d1a0 nfsd: sample writeback error cursor before async COPY loop f8914ba102d7e nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types 6b13d26cc21b6 nfsd: Reset write verifier when async COPY writeback fails 085cfde7c2186 nfsd: release path refs on follow_down() error a080bb69d30f1 NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path 2ef1313239995 NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check 60680ae7243b2 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock bfd1004ab1237 NFSD: Fix off-by-one in DRC bucket pruning limit 07615c1eb1d00 NFSD: Encode only the status in NFS-ACL v2 GETACL error replies 37a9d25a563f5 ubifs: fix out-of-bounds read in signature length check da7a80ddc610a of: fix out-of-bounds read in of_alias_scan() stem parser b313edfbc0c2a nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation e21cccc29b840 media: vicodec: fix out-of-bounds write in FWHT encoder 1b4fdefd788db media: cec: stm32: prevent out-of-bounds write on RX overflow 60c74f42f5abd lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() c5c60260a07e6 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature 8f3365ed2a5db fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write b0a6bfac0c3c3 usb: gadget: f_fs: Prevent deadlock during ep0 read loop bec7708eb3b52 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() eef3e62f90d86 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() 79dbedf40ad93 usb: gadget: midi2: remove default configfs groups on teardown 95cf1b50ba6b7 usb: gadget: snps_udc_plat: clean up PHY on probe deferral 891a8d11f4d5e usb: gadget: u_audio: Fix use-after-free on sound card disconnect d82cfb853c5d4 USB: phy: fsl-usb: fix missing static keywords f09b3f48ff650 usb: dwc2: gadget: Exit partial power down state when changing USB pull-up c881f5b175fdb staging: greybus: hid: fix SET_REPORT return value 2ac009a65d238 Revert "media: v4l2-dev: fix error handling in __video_register_device()" bd8881c24a952 rapidio: mport_cdev: fix use-after-free in dma_req_free() 261c958b6acb1 powerpc/powermac: fix OF node refcount f4ae79b5f0013 device property: fix infinite loop in fwnode_for_each_child_node() 3a8534664426c tracing: Fix use-after-free with same-name named triggers ceb1707aef582 tracing: Fix crash passing ERR_PTR to kthread_stop() 33ce55b368b64 tracing/user_events: Clear copied tracing state before fork duplication 3eaf78e6571d2 hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start() f3ed36a608d8b x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() 220011fe95fc7 x86/tdx: Fix off-by-one in port I/O handling f668affa147a5 tools/compiler: match glibc 2.42 definition of __attribute_const__ 8bf21ad365730 mm: memcg: stop reclaim when a limit update is superseded 029c9408049f7 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() 4757542649af5 mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() f93f15541f224 include/linux/list.h: mark list_add and __list_add as __always_inline bdfda99c57638 timers/itimer: Zero-init old itimerval before copy to userspace da268a44d773a powerpc/pseries/iommu: switch to Default DMA window during kdump ebba4d0aeba0e clocksource/drivers/timer-sun4i: Advertise a real minimum delta 7b5771d0bf176 alpha: don't leak hardware-fabricated FP exception bits to user space e5038d7f36037 alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally 184870af0e73f perf/x86/intel/uncore: Fix die ID init and look up bugs d258cdce50ff3 ALSA: aloop: Fix peer runtime UAF during format-change stop 0e6245b2424d1 ALSA: aloop: Fix racy access at PCM trigger e150f273cd8ed ipv4: start using dst_dev_rcu() 40acb0537963f net: dst: introduce dst->dev_rcu 49b02a9d11c73 ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] 19ccd78a4e7c0 net: dst: add four helpers to annotate data-races around dst->dev 73b7a11814838 Revert "arm64: mm: Don't remap pgtables for allocate vs populate" Signed-off-by: Bruce Ashfield Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index e8d1f9da078..8a31bbfd09a 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "f92c1779022032aac8134ccb9e75365b19f6c596" -SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" +SRCREV_machine ?= "9b87590f4fb1e0d54ae9153f9e4fe84cec61f13e" +SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.156" +LINUX_VERSION ?= "6.6.157" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index 03889d329ec..3904ba1d1c6 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.156" +LINUX_VERSION ?= "6.6.157" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "d9da23dffd2dea6dcfa986e0aad77898a7b373da" -SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" +SRCREV_machine ?= "a56c1dbe33dcd7b71df3b2703ceb95692edd9579" +SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index 2632a4ef2fc..da3c5dd6ea6 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "f05eb652ce405932e2f47a78f721d1c2c5859e80" -SRCREV_machine:qemuarm64 ?= "2f7ef6e4d70eadf8f8b110cd81cfcafb2bb038fb" -SRCREV_machine:qemuloongarch64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemumips ?= "1434d63083252688215ad6f5f6af122ead5865ee" -SRCREV_machine:qemuppc ?= "fc69e9d8f99c5c151415f6ba9f1e0428bb7e8e84" -SRCREV_machine:qemuriscv64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemuriscv32 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemux86 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemux86-64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_machine:qemumips64 ?= "7969f6574cf5b126fa6eb28f33d0f2bcd8e7da5e" -SRCREV_machine ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5" -SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a" +SRCREV_machine:qemuarm ?= "f762f9a437240aebfb663b9f08166b6978411ad3" +SRCREV_machine:qemuarm64 ?= "efde6579b1968f396f4718ad939aeb6859f17012" +SRCREV_machine:qemuloongarch64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemumips ?= "d7bc8d3db82714ebe46bde3e69f9dcbef7ae6e48" +SRCREV_machine:qemuppc ?= "b8bafdf6f040163a1fe0eb91c7b419452e3590b4" +SRCREV_machine:qemuriscv64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemuriscv32 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemux86 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemux86-64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_machine:qemumips64 ?= "fa48e020815730c4ff228c0e8d42836d68ac4b4b" +SRCREV_machine ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" +SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "8b73de7da85fde281a385e0b26eda9bffd3ca477" +SRCREV_machine:class-devupstream ?= "79643295eba17affbd16ca97f3ef04c90266b28c" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.156" +LINUX_VERSION ?= "6.6.157" PV = "${LINUX_VERSION}+git" From patchwork Sat Oct 31 00:15:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102562 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3756.1793405771796686779 for ; Fri, 30 Oct 2026 17:16:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=bQpG6C1m; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a7992e2f7dso13602115e9.3 for ; Fri, 30 Oct 2026 17:16:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405770; x=1794010570; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=1WOaILNBuHJozcCg4aPVOyId3yNqlkXiw+42viHTeOM=; b=bQpG6C1mk9I/wTJLyyiSzcnFhvqy6Pxwzujo38gYUR8B56bDbTMnEM9RDW2eecvL5Y pLM23T369+98OezKmzBc+oMJkbq7CAUhRqWvR3m68Wdr9nHY9nqlgXhZuhFFvLwvkz3C k6Lv3AWBKZeSoQ7u3LCys2Kzsy9oofiDmtHf+QE8PC+xJ0ikwXXi0AkIPEhW5Jj+1cAJ 9pkaBsdPWnScNvdgqCKjKQhHl771kw1X+CJ8P2TJ3C5bxipDflkzPF29jKyDrOcu6lX9 MagU01+/GNGstVtFACj+zPIcgn93b9zHpjmkORqrhMD82T0PF2oZh7v0LoYPkJOfrr0A 9WWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405770; x=1794010570; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=1WOaILNBuHJozcCg4aPVOyId3yNqlkXiw+42viHTeOM=; b=R8jeR870XK5QoXnk+avchLLHnsPeLgZsA44xTZECxIhzJ8h5Mw25BF20QvuKMUYoPY LwzVP+1KVjOXuJPRAbcPbzx2n63CjP08poay7aF5WcmMaZvkFVhabqoIpCsQJNX9SoA4 RNlkJob3n3N/DoPSEiPSio9R5m7g7NsYckz5V44z4mr6UlGlYfeu9og5ZXEIYoylcOn9 Gjy4+1CtJwiATRRehZOsEyUHHc7FItyBIQn7ENrV7B5OwQfPiAA4qrdWUXdxu3LjmKer Tjo/fzsAvfAvb1ZSEm3v7+xW3cT0Wt88d0ZDqn9f9R4Ihf7sJ95fHSq/k7nEw1OW4kTC 0PAA== X-Gm-Message-State: AFq9FYIdLzc5J5MdTaAnbxxHDnonLHlawywCgoh1kP07WtUC5sB7CRvd rCT7DtQB7gYl8Ol12a9fv82IdbdO18GNR9IcfXYNHndjGLoPXbJuSPEGSpENGgqE+orCF0UQoeo 0sQdORT8= X-Gm-Gg: AYBFou2u6TBYQkzxFzB7lpgzdc9WL6kPxDeaIHa6aEf64RebX3ZxyAuVlj0e3GD3Xzp FZJr1T3sytKks26x8PMBI69brqqLf8zzcVf6f6o/H8FIChUIvzJuqIUvHAb71TtvIOXTANGB7Jx g41tsL/R5DqB35qPqcnLRhGZyZjqTGiB6aiYNCEjHDh0rDxSmq3GoGsj+6ANSY3/z3AmYhPXH1X KnnQKiD10ghwsG030ax4f4avsQMuzh+0sOEBg93/kn0rLFOlZJzY08gmkbi3uxa3cOI/YDWiBBq rUnocRlPHvL7ROvzpXHTpK/SUQBj6zgdK0x8uJAVFXIxG8Lng7WhuujXOKYvAKpmFHitjGRnjw5 pJArR5asiFmRA/9xTTpFz6ItYh4fixme4YZyuPlvfAl6CZHPRqJ2BRWO5FQa9v22x3iOIRCFEaG C15z2Y+wVZSv54l6qmsdkOs/diV5bNiVAVJCXACXdh23IFy441P6aXJHmB3G8EzA2ZR6C/laK9o CNIcxHxpQ806/tK5/nXvm4VcQBtGIsqOwHPDXNz3GXiZ92knGtorjMA14MzgeEpvM+QnIwIwpCg iEeECjRh5kTObQV2qCV1Hbq1S7quTjlKg88vIdO0iqWPZyul28vsz4PIJhPilqjAx/jcIaXznCU 6wGAet1fX/VnmA2sZVIrWR5ATFTC9 X-Received: by 2002:a05:600c:8706:b0:4a1:e0d5:293e with SMTP id 5b1f17b1804b1-4ac1765d3ddmr94015605e9.21.1793405768550; Fri, 30 Oct 2026 17:16:08 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:07 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 43/55] linux-yocto/6.6: update to v6.6.159 Date: Sat, 31 Oct 2026 01:15:04 +0100 Message-ID: <2cda6e8e07e5a698a94cf004355470882dfccb59.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249119 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: cecd39af8a1ab Linux 6.6.159 742f73df544e0 ipv4: free inet_opt and ireq_opt after an RCU grace period a65f69e0f38ff ipv4: validate checksum_start before completing checksum 33aa3b7f4afbd netfilter: nfnetlink_queue: unbreak SCTP traffic a91a6aa9253c6 Linux 6.6.158 81e82340170ae net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling 3c83e90204359 crypto: atmel-ecc - avoid stale fallback key after set_secret failure 6989f298103f5 netfilter: nf_tables: don't queue packet path object notifications f268099fc0e38 netfilter: nf_tables: place base_seq in struct net 7b74a4f71ca50 netfilter: nft_set_rbtree: Remove unused variable nft_net bd33cb19bcb43 crypto: virtio - bound the akcipher result length ca84bef594538 crypto: virtio - Drop superfluous [as]kcipher_req pointer 895ab908ade68 crypto: virtio - Drop superfluous [as]kcipher_ctx pointer ba7b5b5e35407 crypto: virtio - Drop sign/verify operations 9efc6119bfbe1 crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection b38d7a4bc9c17 vlan: fix skb_under_panic and races when toggling HW VLAN offload 7eca6b809c1d4 vlan: defer real device state propagation to netdev_work debf9f50140b3 net/packet: defer vmalloc TX_RING free until skbs finish b4ac2a5ce5a96 gtp: serialize PDP context updates 301f4a3303b21 usb: xhci: bail out of setup if the controller is inaccessible 9e85ecc77ffa0 usb: xhci: simplify handling of Structural Parameters 1 values 608efac1ba6fb usb: xhci: use cached HCSPARAMS1 value aa709b4f370e0 usb: xhci: implement USB Port Register Set struct 4687b927c6ab5 usb: xhci: add USB Port Register Set struct c02a85ecd92db usb: xhci: add helper to read PORTSC register ade5ca589d2f5 usb: xhci: add tracing for PORTSC register writes 1c3f4b15eb185 ALSA: hda: Fix missing pointer check in hda_component_manager_init function 73853208a497a drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() 6b38ca1c9dd47 lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected 0c5b7a12e1751 lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected b4a3e1bb94091 tools/thermal/tmon: Fix compilation warning for wrong format cc91c461cf390 nvme-fabrics: use reserved tag for reg read/write command a99d4f0c43eaa perf test: Change all remaining #!/bin/sh to #!/bin/bash fb05e973698f4 drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() e2379b2e343e3 drm/amd/display: Validate function returns 336bc3461b1c7 drm/amd/display: Check null pointers before using them 15403445b873a drm/amd/display: Ensure array index tg_inst won't be -1 3218df42ff3b1 drm/amd/display: Add a dc_state NULL check in dc_state_release 9a38ba5561d96 wifi: ath12k: check M3 buffer size as well whey trying to reuse it 7e323cb557053 wifi: ath12k: fix kernel crash during resume 8c78593cf1229 net: tls: fix silent data drop under pipe back-pressure bc262c6d32b6c cxl/mem: Fix no cxl_nvd during pmem region auto-assembling 5eaa11c500ed0 bpf: Defer work in bpf_timer_cancel_and_free 4b48228eebce2 bpf: Fail verification for sign-extension of packet data/data_end/data_meta 5be32f1ca915c xfs: fix blockgc group quota scanning when usrquota isn't enforced a40671025e915 smb: client: validate POSIX create context length e4c49012708c9 smb: client: fix create context out-of-bounds reads 84ae3cfd7d3a6 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO 524e0450dd9a3 Bluetooth: mgmt: fix race in read_unconf_index_list() 8c7556c7cd17e Bluetooth: L2CAP: validate frame length before control and FCS access ff28e6c67143c Bluetooth: ISO: balance the parent hold in hci_bind_bis() 68f0bcc4e16e3 Bluetooth: hci_sock: reject out-of-range OCF values dca25c204f71b Bluetooth: hci_sock: validate event length before filtering 10f959cb43521 Bluetooth: hci_conn: fix CIS hold ownership on reuse c5efcbf06d648 RISC-V: KVM: Fix HSM hart status error propagation 2af03b606aada RISC-V: KVM: Synchronize hrtimer callback during teardown dbf30e661ceb9 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() c0ba61180d153 pinctrl: single: free the IRQ on domain creation failure de96dc11aee0d scsi: libiscsi_tcp: Check the data direction of a Data-In PDU 144ad477c381e nfc: port100: reject frames whose declared length exceeds the received data 066205553a010 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() 19bcfc2a56d0b nfc: fix use-after-free in nfc_get_local_general_bytes b89249819a7d6 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read f49da48bd679c netfilter: ip6t_rpfilter: reject routes without inet6_dev b895bd3267e5a net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs() 9a7140ea89a09 net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist 1d8c85359b507 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read 57b55367b6e3a net: atl1c: fix soft lockup on out-of-range tpd_cons read de41ee24f77b0 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry 2f57cef1a17cb net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() 632cd7b81cb7b net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read 1b08c5c3ac27c net: arp: terminate device name before lookup 6c9f07bf88001 net/sched: reject IDR error pointers when deleting actions ff384b1bd7228 net/mlx5e: advertise MACsec offload only when supported 288721013605b net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() 65e7c4b5366b7 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() f4c21a259b4f3 HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard 5a8ad63158165 HID: alps: fix use-after-free on input2 registration failure ccd32fa3489cb PCI: of_property: Omit bus properties without a subordinate bus 822e8a473391e gpio: tps65219: Fix GPIO input value reads 9571ab7493561 drm/virtio: fix NULL pointer dereference on fence allocation failure 43bfe2b60c149 drm/virtio: fix memory leak of fence event on execbuffer failure 9924c1d64405b drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() 74485cdc34306 drm/nouveau: Fix gem reference leak in validate_init() f09f4a536935b drm/nouveau: fix double-free in nvif_vmm_dtor ac4f1d28498b9 drm/nouveau: Fix bridge reference leak in nv1a_ram_new() 1971720e6a979 drm/nouveau: fix autosuspend cleanup during teardown 5c857b2e6e755 drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init() 2c1a643942caa drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() 96833fbf28c03 drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init() daeac72644124 drm/amd/display: Fix dc stream excess put in dm_update_crtc_state() c53db9cc24521 drm/i915: fix incorrect RCU teardown order 49ba5ed012990 rds: ib: Clear the sg list when mapping an MR fails 1937222c2511a llc: reserve device headroom for allocated frames 25c08be2a5e77 gpio: zynq: fix runtime PM leak on request error path 9d8d6cddcb7c0 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() 66bf65fa10932 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST dc92cb972e867 ipv6: do not let ipv6_find_hdr() return an offset past the packet end e560bdf62b11d fsl/fman: Fix clk reference leak in read_dts_node() ebf1555ad2821 writeback: report a Tasks-RCU quiescent state per cgwb drain pass 513121e693886 workqueue: Fix NULL current_pwq deref in flush dependency check c96b4d1628868 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes 3bcc1624cc1cd fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT c698f6deabf68 ata: libata-scsi: bound the ATA passthru sense descriptor writes be1aacff399d5 af_packet: fix integer overflow in prb_calc_retire_blk_tmo() 1cd246b214dc9 sctp: discard the rest of the packet on a stale-cookie error 80a9ccfc24d37 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow fc8df272af64f x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 301bdc558a5eb af_unix: Drop all SCM attributes for SOCKMAP. 00e370627f2e1 netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase 3c5a6fa3fa004 rculist: add list_splice_rcu() for private lists d989c14cd70ab mptcp: return sk_wait_data() errors from recvmsg() a8f50c545ea5f perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs() 599491e83e459 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused ed7ba11ed0859 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED 5bce700da0580 perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits a58593b501b7b autofs: fix sbi->pipe file reference leak in autofs_kill_sb() ca797491f0ae4 vlan: ensure sufficient headroom in vlan_dev_hard_header() f623fe69f210d net/sched: sch_teql: fix shadowed err in __teql_resolve() 1f4ac6ef54579 bridge: check llc_mac_hdr_init() return value in br_send_bpdu() d360b31f1a366 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure b7d285a28a6dd net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails c691d78c33da5 tipc: Fix a data race on mon->peer_cnt in mon_timeout() 00a59600ae72d net/smc: fix UAF on lgr list traversal in smcr_port_err() c1b1639fb138d nfp: hold IPsec RX state under the XArray lock 71d45049b0d63 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() bd172580e624b net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 90464d595eb95 bonding: crypto offload enabled, non-offload slave failover, rekey failed 9e841723ba482 net: xps: reject an out of range traffic class 45a67662bf8ce vxlan: use one headroom snapshot for neighbour replies da2e0cfbb620b ip_gre: Reject enabling collect metadata through changelink 97bb73b5a4672 net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT 075dca2b60dae net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr f1fd173aea9b7 net: bcmgenet: do not skip WoL power up on GENET V1 8055a4c6b9e38 net: bcmgenet: allow return of power up status b086fb2c4952e net: bcmgenet: move bcmgenet_power_up into resume_noirq ad0660587da4f net: bcmgenet: initialize u64 stats seq counter for all queues a61c0324e6187 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems f187490352414 tg3: use random MAC address when tg3_get_device_address fails 4092f59d1ce47 driver core: Add device probe log helper dev_warn_probe() 7a527c6b27ba9 driver core: Make dev_err_probe() silent for -ENOMEM 65451eb5a4599 driver core: Better advertise dev_err_probe() edf51b8dea6e9 bpf: Fix BSWAP 32 and 16 on MIPS64 beeae92e70e70 bpf: Fix immediate JMP JEQ/JNE on MIPS32 7d20eab09eb43 vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets b2da5ed3d8c75 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() f0e8dba8c2249 veth: manage XDP program pointers during channel resize 290c4a021dd59 net/sched: act_gate: budget the per-entry list in get_fill_size ea82b75767932 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() 75bfd9ef4da2f nfc: llcp: fix slab-out-of-bounds reads when logging service names 6fad2c34d451d nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() 6295a085cb91d nfc: llcp: fix -ENOMEM on connect with zero-length service name 9fa21b0f78adb nfc: st21nfca: validate ISO15693 inventory length e43ec0191c163 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure f3083512a5bb5 nfc: virtual_ncidev: Add missing ioctl compat handler 9ba32ddb1cf91 selftests/nci: Fix out-of-bounds store on thread join 3b52335611593 selftests: nci: Fix uninitialized family ID on missing attribute 41256821762a7 nfc: llcp: Fix race condition in accept_queue lifecycle f2550d8a37878 selftests: nci: Correct pthread_create return value check c1e9ed52a6697 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() d4008c3499dba nfc: st21nfca: validate received frame size a4e56f57dd04d nfc: nfcmrvl: validate helper command length before pull e57f041943615 bpf: Reject dev-bound-only programs on other devices ad5b7fd1434a2 net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K 1d1d9e4f9541e net: stmmac: selftests: Capture all packets for vlan checks 27bd3b0ce2001 net: stmmac: selftests: Check the dev->features for S-TAG offload testing ddcc8b626b08d net: stmmac: selftests: Support running selftests on DSA conduits 9d3d39da05447 sctp: hold asoc or transport before mod_timer() in timer handlers 66ae85e15f1c6 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports 6020d85204742 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports 909f761868fda bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc ea4dc96c902cc bpf: Fix bpf_sock context code generation 1b923538598be bpf: Fix bounds check for skb-backed dynptrs 062849d19dd31 genetlink: report the real command id for dump-only ops in policy dumps 91be8331501f1 net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error 33f706884821d s390/debug: Fix NULL pointer dereference in debug_info_copy() 34cf1535a78b9 s390/debug: Do not register views for failed static debug areas e766321288b50 tg3: clean up PHYLIB resources on probe failure e1f5b74edccf4 net: usb: sr9700: include receive overhead in the length check c25587fa26761 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() 035f9b1809861 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough 77a43e00c5748 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach a9bb8f8fd5694 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors 88c60c06a2a52 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() 77dee8e9106d6 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() e2edd2d78d2cf drm/virtio: fix object leak when drm_gem_handle_create() fails e8f9979286f70 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget 21e206dd88b3d net: usb: catc: bound the RX packet length in catc_rx_done() 83b1a7f9e7188 sctp: avoid livelock while updating retransmit path 2731601ad277a ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). 245bea0c7ab27 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure d5d57501f543f net: mediatek: mtk_eth_sock: allocate dummy net_device dynamically 34c6214d0df49 net: create a dummy net_device allocator 88530b58fe0b3 net: core: Fix documentation 9767e57504739 net: Do not return value from init_dummy_netdev() 1d664be4ca49d net: gue: reject invalid REMCSUM offsets d512c484bd93a net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure 999a6c71a6aa0 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan a867abcfa85ab drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update 15f52cbc35d4c ocfs2: make ocfs2_calc_xattr_init() return void fddc90d4af455 arm64: io: Reject non-user protection in ioremap_prot() 5128b8b0bdb24 netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name 2c23d95517547 ipvs: revalidate ihl before icmp_send d52caee4f0fcd netfilter: nft_synproxy: use the family-aware checksum helper d559e06a5ab7c netfilter: nfnetlink_queue: hold nfnl mutex in event notifier caa82500e231e netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation e20701843032c netfilter: flowtable: publish HW_DEAD after worker is done e87687b967dcd libbpf: Reject truncated ldimm64 CO-RE relocations a0b79cdfcf34b bpf: Restrict CO-RE poisoning to relocatable instructions 0fac292d93fdb net/sched: cls_u32: fix manual hash table handle IDR aliasing c251ed48bd906 bpf: Skip unsettled links in link iterator 123f90f394ca4 xsk: Use a 32-bit compare in xsk_map_gen_lookup 937cbeca0554a s390/cio: Guard PMCW field accesses with dnv check e364f5c677e81 s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points 0f0e459ccf390 s390/cio: Fix cio_update_schib() to not cache invalid schib 396d4b0be238a s390/pci/docs: Fix sriov_numvfs attribute name 5cf766c9cca44 docs: s390/pci: Improve and update PCI documentation 77d5f05ef79be scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume() f8174bd3822c5 selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode 8fd91aa0cf78a cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c 718a8ffa180d4 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel 5b467087928c5 Bluetooth: SMP: reject Security Request over BR/EDR c68e0068a236f squashfs: Add dictionary size range check to prevent shift-out-of-bounds 144d60ed22735 KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 62cdbb3e096f9 KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save 2df1bc50a6633 KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes 5ff24aa7af0bc HID: amd_sfh: Validate PCI BAR size before mapping a78414ede1dc6 pinctrl: meson: Fix typo in s4 group name dc98def81e3c6 bpf, sockmap: Fix self-redirect copied_seq double-counting a8a9becbac93a bpf: Fix out-of-bounds read of rtt_min in sock_ops 77a3b52b4455e bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() 911818b449196 HID: elecom: fix bus type for M-XGL20DLBK 23da88d1597ee tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context 5b4eb82475ae1 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() 934e9ba9f8d05 bpf: Fix divide-by-zero in btf_struct_walk() f831c7bf53e91 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc df0072be6fc37 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL 7e748e6e007b5 bpf: Fix bpf_skb_change_tail wrt csum partial skbs 1572c4a24120f remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage 670fb8b0dbe0f netfilter: nf_tables: Simplify chain netdev notifier becc1f5adc77c netfilter: nf_tables: Tolerate chains with no remaining hooks 0c415aaaffbf8 apparmor: Fix 8-byte alignment for initial dfa blob streams 662e391e85af5 apparmor: Fix memory leak in unpack_profile() 7e3717466403b apparmor: free the allocated pdb objects 0b895b8faca11 erofs: fix large folio race in erofs_fscache_req_complete 17309187f12d7 spi: zynqmp-gqspi: Use devm_spi_alloc_host() 1ba2ffa759c5b selftests/landlock: Add layout1.refer_mount_root 8706e18922fb9 spi: spi-zynqmp-gqspi: stop the controller on shutdown 57230a74cf07d ksmbd: fix partial normalized name responses c3343cd7ec870 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() ac51321d3b239 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() 5b24c8f815a44 ipv6: mcast: Don't hold RTNL for MCAST_ socket options. 776668d3424c3 ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. 7157a0865debe ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. 8355220e6166a ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). d91b9a3b2b38e smb: client: fix missing iov bounds check in parse_posix_sids() 6f5f4785b98c9 smb: client: fix missing lower-bound check on DFS referral string offsets e78fc1d240b27 smb: client: fix server->total_read for compound encrypted PDUs 74995ee8305a7 smb: client: fix potential OOB read in smb3_enum_snapshots() 491e33144dee8 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs e3344bb0ff5ec smb: client: fix smbd_connection leak on cifs_get_tcp_session() error 53d82794f890a smb: client: reject short Next offsets in parse_server_interfaces() b5f924ffbfa97 smb: client: fix rlist race and missing initialization 180380272f116 smb: client: cancel reconnect work in clean_demultiplex_info() c46c47aef4982 drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure 48e46ea9b2c6a drm/msm/adreno: fix autosuspend cleanup during teardown 5f5e565410b49 drm/gud: fix out-of-bounds write in gud_plane_atomic_check() 0d1700394e9f5 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver 16abf3f5d727a wifi: mwifiex: validate action frame fixed fields c4943323fda22 wifi: mwifiex: validate scan response extents 2402c9e2644b7 wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length bc83c04be042f wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST 42f4b03971f9d wifi: p54: validate curve data length in the calibration curve converters 612ed9224eae7 wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() 491df93b10d76 wifi: wilc1000: fix out-of-bounds read in P2P public action frames 05b5e297bbf46 wifi: wlcore: release runtime PM ref on regdomain config failure 00bea35892556 wifi: rsi: fix heap OOB write on key removal 41b1a4d545ec3 wifi: libertas_tf: fix UAF in lbtf_free_adapter() 85d847ff71fe7 wifi: iwlegacy: fix broadcast stations deallocation 856dabd5f2617 wifi: brcmsmac: fix UAF in brcms_free_timer() ef3c2aef001a6 watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start() 135cf929db55d watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() 757c721545b9f watchdog: rtd119x: Avoid division by zero c52ba8375ff9c watchdog: msc313e: Propagate error code in resume() 1c4aabc88fee1 watchdog: msc313e: Fix premature reset during timeout update 08c58739c9984 watchdog: digicolor: Avoid division by zero c30b419c7e6fb watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog b81989ecf97d1 hwmon: (w83793) release probe data through kref f6e2ab72f32d1 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove 3040bfd935599 hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676 1209d2330bab3 hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding 66368f682a53f hwmon: (pmbus/core) increase number of phases and add new mask b6b2a638aa36c hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() c5e573bb095d5 Input: zero ff_effect before compat copy in input_ff_effect_from_user e2b6703465c1c Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound d06f72350d5d5 Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) 42c7afc0e5f5b Input: soc_button_array - check btns_desc->package.count fd9bc6c1e5c0d Input: soc_button_array - fix MS Surface Pro 11 probe failure 50dd585bee766 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() 84f863866adb0 Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P af5f7130cbf39 Input: evdev - zero absinfo before partial copy in EVIOCSABS b172c69e67bc7 Input: cyttsp5 - clamp the HID report size before memcpy e08c459870a65 Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 b266cbbad1a7a Input: adp5588-keys - cache GPIO state before registering the gpiochip 7e1c98cb7249e mmc: sdhci_am654: Reset command and data lines on failed tuning da4929ee78ee7 mmc: spi: reset bytes_xfered before retrying CRC failures 4adbd609686d5 mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt 72f4c2b7a4842 mmc: sdio_uart: fix xmit_fifo leak when the port table is full b84d29f2541c8 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources cd19ae28eb545 mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260 ae10838a7cdf0 mmc: mxcmmc: cancel data work and watchdog on remove c50d6515bffb1 mmc: hsq: Fix use-after-free in retry work ee47e50011c20 mmc: core: Fix OF node reference leak on card add failure 0bf3d168a2cc2 mmc: core: Cancel SDIO IRQ work before freeing host e77461af13eab selinux: always fill AVC decision in avc_has_perm_noaudit() 4d50ebe5a2772 selinux: recheck intermediate backing files on mprotect() caa1b913d90d5 selinux: preserve user SID across nested backing files 535530bb2ea52 IB/hfi1: Fix the PIO_CRED credit-return mmap 1b352c95a49a3 IB/hfi1: Resolve the credit-return buffer through the send context's node cf20d7476754c IB/mlx4: Fix use-after-free on pkey sysfs registration failure bf0252e908448 i2c: imx: disable autosuspend on remove ad793059a419f i2c: imx: release DMA channels on probe error 2f5e42edbd232 i2c: atr: fix dangling adapter pointer on add failure 3cb8ae257292f i2c: at91: release DMA channels on remove and probe error 3fd487c69ad31 KEYS: trusted: Fix tpm2_load_cmd() boundary check 6ecc3fef3db53 keys: translate request_key_auth pid for the reading procfs instance ce6009f753485 mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio() 19c3da6621a25 memstick: ms_block: destroy io_queue workqueue on removal 937108dc0258d xfrm: serialize state GC with device state flush 39491a1ae9305 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() 6106fb1246ead net/packet: avoid truncating TPACKET_V3 private size 23cd30498891d net/packet: clear RX owner on VNET header error d8e2f1f0263b7 net/sched: hhf: cap hh_flows_limit at change time dd136f1fdd105 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value 19b5e8dd884a5 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain fba45070e25ab net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() a58024835c704 net: lan743x: fix RX checksum use-after-free 60459c670329d ipv6: xfrm: use full sockets in local error paths 89f5414660724 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() aacd1c4cbe06a dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status b4025915131c6 dmaengine: sun6i: fix non-atomic read of DMA position registers 560ed4373c06a Bluetooth: hci_sync: Serialize local codec list cleanup a6da782fefae6 Bluetooth: hci_codec: validate vendor codec count length 3a640fee27ce4 Bluetooth: eir: validate service data length before reading UUID 063d409c54703 Bluetooth: btusb: fix NXP IW610 composite device handling df4920b133343 arm64: percpu: Fix this_cpu_and() mask generation 9397a97eba3d5 arm64: percpu: Fix this_cpu_write() casting 0b2144175502d arm64: dts: renesas: r8a779f0: Set UFS lane count 909e92423db72 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc a8b826076a41e kselftest/arm64: Fix size of thread_data values for pthread_join() 8f282d12550e3 HID: logitech-hidpp: fix race condition when accessing stale stack pointer b2b84e73e0386 net: xfrm: reject unrepresentable espintcp transport headers 579d87ec1e1e8 openvswitch: avoid reallocating confirmed conntrack labels 2fbac8a56004b RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() ae805d204cf1f RDMA/ucma: Serialize join and leave on copy_to_user failure 1c8448db5cf35 tcp: exclude old ACKs from tcp fast path b5c9f2951d330 rds: ib: use rds_conn_drop() on protocol version mismatch 6f1977cea3e85 exec: Cleanup POSIX timers right after de_thread() 0338489960dda cifs: Fix server use-after-free in cifs_chan_skip_or_disable() a5a8b4737f68b ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY 6507055733a9d ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type 830012feadc22 ALSA: virtio: reset device before deleting virtqueues 5658739b54f5e Input: xpad - fix PDP Marvel Xbox 360 controller 1fb92056c8fcc Input: xpad - add support for Azeron devices 2e74f1f22a0e3 Input: xpad - add support for Victrix Pro BFG Controller 93e3eb481be0f wifi: rtw88: Fix the random "error beacon valid" messages for USB f689260c48fb4 wifi: rtw88: TX QOS Null data the same way as Null data fa252fe7dc329 net: cpsw: Execute ndo_set_rx_mode callback in a work queue 74852715757d9 net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue 7e22e5bcbfacf mm/huge_memory: use folio's memcg inside __folio_split() 2605eb9ba3bbd btrfs: abort transaction on failure to update inode for hole punching and reflinking 71d45a04ea99c btrfs: remove redundant root argument from btrfs_update_inode() a66b626d3b4b7 btrfs: simplify error check condition at btrfs_dirty_inode() b7c7f07a40037 drm/amdgpu: check ras and obj before dereference 6569fd85b0ef9 net: mvpp2: prevent buffer overflow in page_pool allocation afaddc3fbf2ae net: macb: fix ordering around PTP timestamp read 472493d1d3334 net: ethernet: cortina: Ack RX overrun interrupt correctly 17b2a1eb97fdb net: lock the socket in sock_gettstamp() c10101baba9d3 net: netsec: fix device_node reference leak on phy_np aeec38e773c66 ASoC: hdmi-codec: Report a change when the channel status moves 9cc2fae796b79 ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments d6a1779129d93 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba c41088b2765af KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure e37fba1ba6938 KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() d54a044136b12 drop_monitor: fix out-of-bounds write in reset_per_cpu_data() 86f1151aa6ac3 drop_monitor: synchronize tracepoint unregistration on error path ffc448eb54f5b pppoatm: ensure a writable skb header and linear data c741977e413f5 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup 3b00027c71345 Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown ad13c739dedcc Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events ea8a262662be6 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() 4a33886057e6d dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() a444c0115665a ksmbd: keep compound responses on query info errors 2107d60053c88 ksmbd: fix partial file information responses 39685131e5bda ksmbd: return buffer overflow for partial filesystem info 9a4f49bf8d2da tcp: do not let tcp_rmem be set below 4096 b727e3d58cb90 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). 6b431b6321985 net: bridge: mst: move switchdev call outside rcu 50b1adbb39fc0 wifi: brcmfmac: fix lost 802.1x TX completion wakeup 822903ed99197 net: fddi: skfp: fix NULL deref when setting the MAC address while down 83aa83f81a8fe ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup 5130afa025c95 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation 35cbe34c3704c drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL a7cd161e4ba2b btrfs: tree-checker: print dev extent offset in error message 0a52ba6d3b268 ALSA: hda: trace PCM open only after assigning a stream b6beee927e7f4 drm/vc4: Use managed KMS polling to fix UAF on unbind f1a232fdc1012 drm/ast: Automatically clean up poll helper e8304e25c6dab wifi: virt_wifi: don't transfer operstate before register 246de677552fe ALSA: 6fire: fix OOB write from device-reported iso length 8b8559aeaba2e ALSA: usb: 6fire: Avoid embedded URBs 910bde5a7f188 ALSA: 6fire: Clean ups with guard() aff058605007c Input: trackpoint - fix the inertia attribute name in the ABI document 686c7a6af1eea ALSA: pcm: set timer->private_data before registering the PCM timer d54a90f2b9376 phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting 5d6c7370d515e phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow c83d6b0a65f7b ALSA: bcd2000: Fix race between rawmidi and disconnect 3d5f7e77b2e1b keys: fix lost wakeup when reaping a dead key type 780716e2e0191 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr 136cb27bf8f5b perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations a43cd2b67b91e netfilter: flowtable: hold reference on ct until flow is released e4982c489ee35 netfilter: nft_nat: fully initialise new_addr in netmap setup eb4d7a9469704 RDMA/siw: Bound fragmented header copies by the remaining length c767e2812cac8 RDMA/efa: Keep EQ resources alive while IRQ is registered 00f7df59543cc RDMA/efa: Keep admin queues alive while IRQ is registered 87793933dc54f dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA 209cf79a4f8a6 dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order aaf4ae1730d40 scsi: qla2xxx: Fix the ql2xfc2target parameter description 7343f2575868f mm: memblock: show all region flags in debugfs 420fcc2fdeae6 wifi: mac80211: set up the TX info early to fix failure paths 7e32c6ed25548 wifi: mac80211: rework ack_frame_id handling a bit b51f5a310bd68 wifi: mac80211: mesh: release the channel if start fails be7bfdea1ec9b wifi: mac80211: add HE 6 GHz capability in the scan elems len f17a3fb26beca wifi: mac80211: don't access the TSF of a down interface e4bb995f61e23 wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set ed8d5f5b74d0f wifi: mac80211: don't allow link changes when iface is down d0afa5395c46d wifi: mac80211: require a peer station for TDLS setup confirm 7775759e3cb35 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown c4e4fe330294e wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping 20a56e96a6f7b wifi: mac80211: unlist vifs when their netdev is unregistered 06f1c819700db wifi: mac80211: suppress chanctx warning for debugfs reset 790221efbfece wifi: mac80211: don't offload TC setup on AP_VLAN interfaces 65fdb973bd905 wifi: cfg80211: don't filter by BSS type when removing stale entries 73365b81630b5 wifi: cfg80211: only group hidden BSSes with beacon entries 8577a5ec4f7e0 dmaengine: wait for RCU readers before releasing dma_device 07eb075b60d56 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() 7c3f4ce651d43 dmaengine: Fix device kref underflow in dma_chan_put() cee7e641245c3 dma-coherent: report a failed reserved memory assignment c9cee0989b55d dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask dd579fd27593d MIPS: Octeon: apply USB FDT fixups also when USB is modular c58a21667bd5e soundwire: cadence_master: wait and cancel cdns->work before clock stop 12c0abd4d1c1b wifi: cfg80211: check IP header size in cfg80211_classify8021d() 326f7d34bd7e6 IB/IPoIB: Avoid restoring OPER_UP after multicast flush 46aa75291056b wifi: libipw: reject too-short association responses 14ae269c13060 wifi: libipw: reject too-short beacon and probe responses 2761b21cb896b wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 36727a702cf8e wifi: virt_wifi: free skb when disconnected 3eff16074d061 dmaengine: sprd: Fix runtime PM reference leak in probe 6f8020fe7465f RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted aacfef2480876 RDMA/irdma: Enforce local fence for IB_WR_REG_MR 752b30e9d3390 RDMA/mad: Fix receive buffer leak when PKey enforcement fails 505b242d93516 IB/isert: wait for deferred control PDU completions before releasing the connection 9d145a2d8d6f8 IB/iser: reject a remote invalidation of an unregistered direction 45c60ffc79771 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed 1c4cc9f0d8f45 net: convert dev->reg_state to u8 c79a789aa1518 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds 56b7a9d89c679 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate f17865332cc4c firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS b7d2118660545 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access 08f12745cb729 RDMA/rxe: validate access flags before swapping the MR's PD 030306bbb9273 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept 70d509b6bdf74 RDMA/siw: Cleanup siw_accept 0b6ac53b6bd5f RDMA/siw: Introduce siw_cep_set_free_and_put 5219c5652b2f3 ARM: socfpga: select the PL310 erratum 753970 workaround 69a768c12398c esp: downgrade zerocopy managed frags before mutating skb frags 0cda8273265d3 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() 2b63341e2ebc9 xfrm: fix compat ALLOCSPI request use-after-free 60610a5dab6ed xfrm: avoid RCU warnings around the per-netns netlink socket f1fde49cabc90 ipv6: Honor oif when choosing nexthop for locally generated traffic 8a13003b50b97 ipv6: Select best matching nexthop object in fib6_table_lookup() 4bc97d3bf5d72 media: video-i2c: fix buffer queue ordering 04317f3fb8be2 sunvdc: fix -EIO issue due to lack of retries 9a622ea3662c8 selftests/landlock: Add tests for whiteout object creation b6e45216aecc8 Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally" f5d1ea9bb08d9 Revert "alpha: don't leak hardware-fabricated FP exception bits to user space" c337c14afcf7e selftests/landlock: Add disconnected leafs and branch test suites b15ec9fef1b16 selftests/landlock: Add tests for access through disconnected paths 82e198df9c252 Revert "hwmon: (emc1403) Rely on subsystem locking" e08063fb0d02f Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature" 0a926b5df8efd mptcp: close race between scheduler and state change 1962841387087 mptcp: avoid unneeded actions on subflow reset ddbf9f03c1cc7 mptcp: fix bad accounting in __mptcp_subflow_push_pending() cf6e04377bdde Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config 9107e43ba1e03 workqueue: Update documentation as per system_percpu_wq naming 1100e075a0e09 netfilter: nft_set_pipapo_avx2: add missing vzeroupper 2c8fa22997892 crypto: sun8i-ce - Remove crypto_rng interface a41e4ba94ad45 crypto: sun8i-ss - Remove crypto_rng interface 99f4d3120b244 fou: Fix use-after-free in fou_create() 542c1dd41e1b0 net: appletalk: fix NULL pointer dereference in aarp_send_ddp() df077253f6405 i2c: smbus: reject oversized block transfers in the common path 938e8d6cee8d3 ALSA: us122l: Prevent write upgrades for read mappings 05d47f540d85c net: usb: pegasus: don't rely on id table pointer arithmetic be5996349328b media: as102: do not rely on id table address comparison 0bbcbe9f7cfce usb: serial: spcp8x5: don't store usb_device_id 367af2b4d5168 usb: usbtmc: don't store usb_device_id 8cb99d4a71593 wifi: ath9k_htc: don't store usb_device_id 5086f5639197f usb: xusbatm: don't rely on id table pointer arithmetic 8f4422c14d6a2 perf evsel: Add per-thread warning for EOPNOTSUPP open failues 44441aa9630fa Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems" a3ca496b63fb9 Revert "selftests/mm: report unique test names for each cow test" 289dfa824fb24 Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported" ad1be9fe255b4 Revert "nvme: apple: Add Apple A11 support" 187187eea3441 Revert "nvme-apple: Drop the PRP null check chicken bit" eb51cbf1b091c Revert "nvme-apple: Prevent shared tags across queues on Apple A11" b66ef13b72f4f Revert "nvme-apple: Reset q->sq_tail during queue init" f91df9f3ed6ca Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries" bddd4544e80b2 Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries" 492c1a89a5c94 Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries" a0441be048ddd Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries" 654a2e749883b Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries" 91d04c96ef14b Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries" 6805046d2db02 Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries" c2bf1299aeff6 xfs: bail out on bitmap errors in xrep_agfl_fill 2cc0af2204070 xfs: count escaped corruption errors in scrub stats 201995b1e9839 xfs: signal inode btree xref error if get_rec returns an error 6e55aac5a1008 xfs: snapshot old AGFL before rewriting it e0873cce0e132 xfs: snapshot scrub stats when rendering them d5cea6766ae18 smb: client: fix heap overflow in DACL owner/group rewrite e9c5bcc88b833 smb: client: avoid leaking refcount when cifs_sb_tlink() fails de2a6bcff2659 smb: client: avoid leaking refcount in cifs_queue_oplock_break() f73341e1ef134 smb: client: fix file type corruption in wsl_to_fattr() 0f723c20d2ced smb: client: fix file type corruption in cifs_reparse_point_to_fattr() ff411fcbfc55e smb: client: fix one-byte OOB read in smb2_parse_native_symlink() 3c9acc9835c30 smb: client: pin DFS superblock in iterator callback 17c93bcd17755 smb: client: reject userspace cifs.idmap descriptions f00c31be52f5c selftests: mptcp: fix an UAF in mptcp_connect.c 360d99258a640 mptcp: syncookies: remember the request backup flag a2431bea521ef mptcp: subflow: no need to copy thmac during ulp_clone 654381b0b176e mptcp: options: handle MPC data + csum reqd + no csum c3eb07e78e628 bnxt_en: Propagate RX ring init failures in bnxt_init_nic() cfec9e7f15a56 bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() aae9a450af63e bnxt_en: Only restore LRO if the device supports TPA 1afaf85c4990f media: v4l2-ctrls: validate AV1 tile counts 724915535558b media: v4l2-ctrls: validate HEVC tile counts 95ee48eb17c91 media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity 8659e5fc21a82 media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer 279fb47254f37 media: v4l2-h264: Fix memcmp() size in B1 reference list comparison f19acf00818a9 media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity 2887a98c03d97 media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity 98018ea5a682a media: hevc: add bounded tile-count helpers 137c1b88507a4 hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS e9fc7d53b2eb3 hwmon: (gpio-fan) Fix use-after-free in alarm work 716beceaf70c1 hwmon: (applesmc) fix key backlight workqueue leak on register failure 991c875310254 s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm b3f8200ec5285 s390/qeth: allow bridgeport queries despite OS_MISMATCH 5f33ae947f52f KVM: PPC: Book3S HV: Set irqfd->producer only on success 4826fd8373f68 mac802154: fix use-after-free of sdata via queued RX frames 652d9caa5ac92 ipvs: reject invalid states in connection template sync records 3080f9e653d8c ipv4: fib: bound automatic table ID allocation e3b4681197aa0 ieee802154: hwsim: serialize pib updates to fix double-free 543994fa03c36 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink ff83367cda8ee inet: frags: invalidate queues before flushing them de5a0eda59fe4 fbdev: vfb: defer cleanup until the last reference b534dca2db93c scripts/sorttable: Mark long_size as __maybe_unused f464fde4fd880 vdpa: solidrun: Free IRQs after request failure 123acfd63d767 vdpa: ifcvf: Put device on unsupported feature error b6204011c79eb netfilter: report NLM_F_DUMP_FILTERED when all is filtered out 90166834b7dc6 netfilter: nf_log: unregister loggers before per-net teardown 76678217cdabc net: openvswitch: fix use-after-free of the flow table mask array 0b3425fd0ecd5 net: mpls: clear inner_protocol when the last label is popped f7d76b84b9206 net: mana: Reserve extra CQ slot for the fence completion CQE 84ba968d7b35c net: hso: fix TIOCMIWAIT race 9e28471d22a49 ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() 362c42720259f drm/i915: Fix memory leak in query_perf_config_list() 506cfed91e50c drm/drm_exec: fix up contended obj when num_objects is 0 3feb4020bfb7c exec: do_close_on_exec() before taking exec_update_lock b22193eea2ce3 cpufreq: initialize policy rwsem before sysfs publication 06f273d29e5e0 cpufreq: zero-initialize policy cpumask before sysfs publication ba96047bba4a6 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 45021eb562114 ASoC: sti: initialize IRQ lock before requesting IRQ 1467e3989c6ed ASoC: sprd: validate compress buffer sizes against fixed allocations fe05eeed27128 tracing: Keep the entry count when the histogram stats allocation fails 01966c9569230 tracing: Let histogram values keep the percent and graph modifiers 3d42fed18b2c5 tracing: Free histogram the field rejected for a bad modifier b513a4c60a7aa tracing: Free histogram var refs regardless of how often they are referenced 4924328d6991f tracing: Free histogram the var ref when its initialization fails a3d9b8b7c8f36 tracing/user_events: Don't destroy fields when event removal fails 757aa9f548c18 tick/broadcast: Plug clockevents replacement race 7cd398799eeb6 tunnels: Drop stale dst when building an ICMP error for PMTUD 58c0c414b2b8d ufs: validate cylinder group metadata before caching it cd21f1ff74b1c ufs: create the root dentry after loading cylinder metadata c9e4a2c11ff61 watchdog: sunxi_wdt: preserve boot-enabled watchdog c42eadbcf68ca dm/amdgpu: fix malformed link_settings debugfs output d170cfbe38c88 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf 3570468cc34e7 ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough 98da3379cdee3 tracing: Fix memory corruption from the histogram stacktrace modifier 14fdaba201fdf ipv6: fix fib6 walker UAF on seq stop b5dec6dfb593d x86/mm: Fix user-space data loss with MADV_FREE and THP b0c201a596816 crypto: x86/aria - add missing vzeroupper in AVX-512 code 3dee28df79cb7 crypto: x86/aria - add missing vzeroupper in AVX2 code 460fab22b6513 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver e52bf7c4f2b2e powerpc/ps3: Fix repository.c build failure fd636a87161de ksmbd: prevent out-of-bounds reads in share config responses 9c777f8e0cb04 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands b0de6463667e9 sunvdc: unmap LDC cookies when the descriptor send fails 4cd165b5f3eae openvswitch: fix wrong flag value in get_ipv6_ext_hdrs() 348492de88bc6 net/rds: fix tcp stream corruption with large pages 5c353c5a76e30 octeontx2-af: fix PF/CGX debugfs PCI bus lookup c622bbc212207 net: hinic: fix mailbox segment buffer overflow 5aab3e8d71644 net: sun4i-emac: fix missing of_node_put() for phy_node 96c2fc5daf983 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). 2cad4a521942d net/sched: cls_route: Fix in-place replace 3d4c403aa780b net/sched: cls_route: make netlink errors meaningful cec2052fcecc2 net/sched: cls_route: Reject handle aliasing 41e94079200aa net/sched: cls_route: free emptied bucket on filter move 7fd4a45ee721d perf/x86/intel: Correct pt_regs->flags update for PEBS path 82e79fdbf68ca perf/x86/intel/ds: Factor out PEBS group processing code to functions e2e2ca292449e perf/x86/intel/ds: Remove redundant assignments to sample.period 421bc24582a36 perf/x86/intel/ds: Clarify adaptive PEBS processing 85382012bbc33 perf/core: Check sample_type in perf_sample_save_callchain b799264c7b1f7 selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value 79fb5bcc50996 net: stmmac: initialize ptp_lock at probe time 7953946f68262 ppp_synctty: ensure a writeable skb header 16c5c8ea50179 octeontx2-pf: reset HTB scheduler topology before freeing queues 3b90136e3df4f hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors 4a641ec4a73a6 hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() ce3479e4a647b net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down 01a3ec43ad635 net/micrel: Fix typos in micrel driver code comments 4afef977f36da watchdog: msc313e: Sync timeout value if WDT was running at boot 079c8c2891d35 watchdog: msc313e: Fix undefined behavior aea1af21e3028 watchdog: msc313e: Fix spurious reset on suspend b4f3a54fd1949 watchdog: msc313e: Enable clock before accessing hardware registers a1dd0817776ea watchdog: msc313e: Fix clock leak and spurious timer in settimeout() 660571b082331 watchdog: msc313e: Avoid division by zero 0a1c1f26c68b1 watchdog: fix hrtimer start when pretimeout is zero c1de1e7b51ab2 net: macb: destroy the phylink instance on the probe error path 5242050195a71 Bluetooth: btusb: Fix UAF of btusb_data by rx_work c075a91fe5762 ice: add missing xa_destroy for sched_node_ids e56a339e3de5e ALSA: hda: Report a change when only the channel status bytes move 621a4bb3ec3c2 ALSA: hda/common: Use guard() for mutex locks 934b404b6063d ALSA: hda/common: Use cleanup macros for PM controls 3fe9102ae0a82 ALSA: hda: Introduce auto cleanup macros for PM 4bc6df61a100a drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER f2de9df262c47 net: ethernet: cortina: Count RX descriptors for freeq refill 742f06928960c net: ethernet: cortina: Count RX drops once per frame dd792f4154b69 net: ethernet: cortina: No mapping is a dropped rx e858b9b1ea3cb net: ethernet: cortina: Count dropped frames as NAPI work d2541cfbd41cd net: ethernet: cortina: Finish RX updates before NAPI completion 4ca84049c6428 net: ethernet: cortina: Fix budget accounting 565be2ffa33fe net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward 1dd562f301901 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU 550aa32d46f2a ipv6: lockless IPV6_MTU implementation 20c41165e8efd ipv6: lockless IPV6_MULTICAST_HOPS implementation c79c67de42d6e ipv6: lockless IPV6_MULTICAST_LOOP implementation e6c6b0059d624 ipv6: lockless IPV6_UNICAST_HOPS implementation 81073bca2062c virtio_input: stop callbacks before unregistering input device 16c90260ae7ae virtio_input: reset device if input_register_device() fails fa2ec3f48a679 virtio-pci: return IRQ_HANDLED after non-zero ISR 1b803d382cde6 vdpa_sim_net: check TX pull result before RX copy 000c6300776ce vdpa_sim_blk: reject out-of-range sector starts 59fc7c1c6b4d3 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx 4875c65ca5379 vhost/vdpa: reject VRING_NUM larger than device max bd94e2ba56d02 vhost-vdpa: clean iotlb map during reset for older userspace b46594205234a vdpa: introduce .compat_reset operation callback dc74887a56e58 vhost-vdpa: introduce IOTLB_PERSIST backend feature bit fde77a9a589f3 vdpa: introduce .reset_map operation callback c147d62316ce0 vhost-vdpa: introduce descriptor group backend feature d76182012a5df vdpa: introduce dedicated descriptor group for virtqueue 2e40c69b9c344 virtio_console: do not free control-out buffers on remove 74bdd312e78d0 ASoC: mt6351: Publish the OF module alias 0f7dcaaff3b24 netfilter: ip6_tables: set F_PROTO when proto value is nonzero 3161186a2ff81 netfilter: nfnetlink_log: cope with concurrent instance destruction 79d93d8b49f05 ASoC: Intel: SST: Publish the PCI module aliases ebae165ad8352 ASoC: bcm: bcm63xx: Publish the OF module aliases 671037b282eb7 ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev 2ff38b3552af5 bpf: Reject non-scalar bpf_loop iteration counts 054ad8e66025e net: macb: fix NULL pointer dereference on unbind with fixed-link 2efc0d08fda24 net: macb: rename bp->sgmii_phy field to bp->phy 94b12a42cf8e8 workqueue: Introduce from_work() helper for cleaner callback declarations 226d2702e74a5 net/sched: ets: clamp quantum in parse and fallback paths b464affe9f9df net/sched: drr: clamp quantum in change class 3685934a0620f net/sched: pie: clamp psched_mtu in pie_drop_early 6570f326a6a96 net/sched: hhf: clamp quantum in change and init paths e4192bcf83aaa net/sched: sfq: clamp quantum in change path 215df1e953ae7 net/sched: fq_pie: clamp quantum in change path 439a3dc17964e net_sched: sch_fq_pie: implement lockless fq_pie_dump() 5a2b87dfceccf net/mlx5: E-Switch, prevent mc_list repopulation during vport disable a5833fdf53350 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put 8267e46d14e84 net/mlx5e: Fix use-after-free race in sample_restore_put() 1886540daeaff net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% 874e90f3d8806 net/mlx5e: Fix setting RS FEC after remapping 6a1b49bb9fdf9 net/sched: defer qdisc freeing after failed creation 04a6cdb3fd13e powerpc/kexec_file: Use inclusive range checks in add_usable_mem() 0bf9f3bae3c4b pds_core: fix cmd_regs access racing BAR unmap on reset c2362c500931e net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations b2a8e165ddb6c vxlan: reject dynamic fdb entries that reference a nexthop id 90f6f5cb331af s390/ism: folio_put() after error 59bf9e94bdc49 net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow e5f4a054b9dc4 octeontx2-af: mcs: Clear stale X2P calibration state before calibration 37cb9a81600da net: bridge: mcast: properly convert mglist to rcu c5b5c52b6524c net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size f5e93162b3dd1 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size f24eb5bd870ca bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() 17acbcd4c5a6c nexthop: Initialize extack in remove_nh_grp_entry() 8d282b2703899 selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0 0ba57948dc23a selftests/bpf: Update tests for new ct zone opts for nf_conntrack kfuncs b843ab43ac9d2 bpf: Mark bpf_btf_find_by_name_kind() as sleepable 990df1ba4d080 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times 1e213ba7cb3b9 net: bcmasp: clear txcb->last before writing each descriptor a16ca1987ce86 ASoC: Intel: avs: Clean up the bus when fetching ML caps fails aec0a9c1579eb bpf: Fix NULL-ptr-deref in btf_var_show() 86d86f9fcf62d bpf: Fix NULL-ptr-deref when showing a void BTF type 75b20534d7a37 ALSA: caiaq: Fix potential double-free at error path 401aedb4632ae selftests/alsa: Fix the step check for INTEGER controls 92748cdff7388 net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset 0ec75c69918b7 net/rds: don't let rds_conn_shutdown() consume a concurrent drop 2e46248e375a5 net/rds: acquire the fastpath locks in rds_conn_shutdown() d184e6dd4b8f3 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() 51164c0597405 net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown b8a8b6d25e742 net/rds: clear cp_flags bits individually in rds_conn_path_reset() 14d0a842e1696 net/rds: use clear_bit_unlock() in release_refill() 3d401934b7edb net/rds: use wq_has_sleeper() in release_in_xmit() 7b435c69a30b4 bonding: do not clear curr_active_slave prematurely when releasing all slaves 8cb75f7ada25b bpf: reject BPF_PSEUDO_FUNC reference to the main program 9379e193826f2 tracing/probes: Fix use-after-free on field name/type of events with multiple probes c6beb08b1a9fd netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() 677ff8ab30a66 ipvs: fix reversed sequence option serialization 7caaae233a55e btrfs: do not force reloc root creation during qgroup_account_snapshot() 02ebc4d4e5d73 btrfs: send: fix lost error return value in will_overwrite_ref() d043c43d2b4eb btrfs: fix the possible bioc_list memory leak during error 81116d3c6b27d btrfs: directly return 0 on no error code in btrfs_insert_raid_extent() 089d9c45ea49f btrfs: fix transaction use-after-free in raid stripe insertion 77a771b5083c7 ASoC: ux500: Program the MSP FIFO watermarks 507f239aacedd ASoC: ux500: Request the MSP MMIO resource 737e29e7dbf6e mfd: db8500-prcmu: Fold dbx500 header into db8500 f30aae1a465f2 arm: Handle KCOV __init vs inline mismatches 3f87eece1edde mfd: db8500-prcmu: Remove needless return in three void APIs 2e5e878e321f1 ASoC: ux500: Validate MSP DAI configuration 054396ce4a4eb ASoC: ux500: Correct MSP frame and bit clock setup 3b2d65cadf1f6 ASoC: ux500: Propagate MSP setup errors 80c65fbc57d21 ASoC: ux500: Fix MSP stream lifecycle handling d6f9af093dc91 ALSA: ump: do not touch legacy_rmidi before it exists d2baaf94766e2 ALSA: ump: Update rawmidi name per EP name update b8ca1a95e9c52 ALSA: ump: Copy safe string name to rawmidi ee432ab0658c8 ALSA: ump: Copy FB name string more safely 5447926ddbe75 ALSA: rawmidi: Show substream activity in info ioctl 210a9fc6678ce ALSA: rawmidi: Expose the tied device number in info ioctl 6bc345f6d81eb locking/lockdep: Invalidate stale class_cache entries for zapped classes c049f114bcb9e perf/core: Skip empty AUX records with only format flags 7bcce856c79c1 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() 7adb1bf25b0c5 bonding: alb: fix uninitialized transport header access in alb_determine_nd() 0a0ee38ad6324 btrfs: restore active device pointers after failed sprout 7fe9dfbca4346 btrfs: detach failed sprout device from transaction update list d356c188a653d ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() d744a26619bc9 ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits 65736547074cb s390/boot: Fix physical memory search range 68e920cb06ddd ALSA: hda: restore MFG widget enumeration after core split 02f8dcb5c9be4 ALSA: hda/core: Use guard() for mutex locks 10cc145b87367 staging: fbtft: make dirty_lock IRQ-safe 2b9fa12fbdbfc af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). af08f62b5a5a4 ipv6: sr: restore network header before routing and forwarding b5344e459996a tipc: fix NULL deref in tipc_named_node_up() on empty publication list f614c83fd7664 ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit faaa80fad1f5d ppp: ppp_async: simplify tty disc_data access 84223baf21bc9 net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted 6245425c04be5 ASoC: ab8500: Validate and program TDM slots correctly 780e00c41886a ASoC: ab8500: Correct digital interface format setup 84ce73fefeb17 ASoC: ab8500: Repair the DAPM capture graph a2db840c01162 ASoC: ab8500: Reset the audio block before configuring it b67584161b7f9 Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() a8841f6653164 Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM 0e1fc7cab95ad Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan 593e64f64a20b Bluetooth: hci_core: Fix race condition during device registration e9cf7f175c00d Bluetooth: btintel: validate version TLV value lengths 17b61f59914b5 Bluetooth: btintel: Export few static functions b9b36a0e3d77a Bluetooth: btintel: Print firmware SHA1 abf3623af5d67 workqueue: reject watchdog thresholds that overflow jiffies 198734bee7945 workqueue: replace use of system_wq with system_percpu_wq 41647864e62b2 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block 030e88812435f s390/ipl: Fix NULL deref in kdump without re-IPL parm block 948d0090e7250 s390/os_info: Introduce value entries b0fc13ff74a13 s390/checksum: provide and use cksm() inline assembly 581896f229b39 s390/checksum: call instrument_read() instead of kasan_check_read() 486876f957456 ksmbd: rate limit unmapped SID errors cbadf2575d25e ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF dcaa77d10ea19 OPP: of: Fix potential multiplication overflow when calculating freq a135415be5683 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks 069d5527bb0f2 vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() c60066fa5e2fe net: amd-xgbe: discard rx packets with bad FCS e3f4ffbde379c raw: annotate disconnect-side IPv4 match writers 4548d843e7b29 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration 377e01e4f3104 smb: client: transport: Fix debug printing in __release_mid() 60a93d9f0fa06 smb/client: mark file sparse before emulating insert range 58e3d2fbc8c91 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() c848a1bbe1104 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() 09e7f9290d631 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START 1ea521961c110 net/sched: act_api: fix skb sizing and action leak on reoffload delete 5fe7f53543e85 net/sched: act_api: conditional notification of events 4587ff1844ebb net/sched: act_api: don't open code max() 8611126b2637d rtnl: add helper to send if skb is not null 52a6bb47ef80d net/sched: act_api: size the RTM_GETACTION reply from the actions 606c29451264d net/sched: act_api: budget all shared attributes in notify skbs 99654b651c6d5 net: icmp: avoid invalid transport header access in icmp_send tracepoint 2a0e7bcff3fa6 drm/cirrus-qemu: Validate BAR0 size during probe 6a8aa0068d476 drm/cirrus: Use video aperture helpers 5b269f6682a7f ufs: do not treat unreadable directory blocks as empty 364e65b2e81ed ufs: Convert ufs_get_page() to ufs_get_folio() 1ca5c166deeac ufs: Convert ufs_get_page() to use a folio f8f3d946fe4b0 ufs: convert to new timestamp accessors 23d2429aecd6f selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter 965804b20c0f0 nvme-rdma: fix -EIO cleanup order in queue_rq 5807a65f301b6 accel/qaic: Address potential out-of-bounds read in resp_worker() 3fe8a33715265 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() 541fc6f733b32 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation 9a5b471f95dd4 EDAC/igen6: Fix channel address decode for non-hash mode c359c9c9c9f8a EDAC/igen6: Fix channel selection hash 149df8bf827f3 EDAC/igen6: Fix interleave boundary condition d019542ed3324 ARM: ensure interrupts are enabled in __do_user_fault() ec9f166e6573c ARM: 9484/1: enable interrupts when unhandled user faults are triggered 881c5b1faf110 Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" 8a69620b23e7b Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" 5b0953f86d658 mm/damon/core: avoid infinite kdamond_merge_regions() internal loop 258d54030481f of: dynamic: Fix overlayed devices not probing because of fw_devlink 6fda5c51b8e43 af_unix: Unlink scc_entry in unix_del_edge(). 5a0367bf5ce42 ksmbd: use memcmp() to compare ClientGUIDs 90703664dbc5a ASoC: meson: aiu: Validate written enum values c405b07246bf1 ASoC: topology: Check PCM and DAI name strings before use 7907a395701b3 ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). ff6c5ee77dcc9 bpf: Guard __get_user acesss with access_ok for uprobe_multi data 00444baa8f74d RDMA/bnxt_re: Proper rollback if the ioremap fails dd3c9e1c9858c coresight: platform: defer connection counter increment until alloc succeeds 43ddbcdc0ed74 sctp: fix err_chunk memory leaks in INIT handling 6181239115e19 bpf: Mask pseudo pointer values in verifier logs 7250b6b5ba9b7 Bluetooth: ISO: fix malformed ISO_END/CONT handling 93580911f02d1 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() 3c0bc7dcc5f92 net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD 0da8f531336b2 drop_monitor: fix size calculations for 64-bit attributes 3454c729ee8aa drop_monitor: perform u64_stats updates under IRQ-disabled section c4bb894362d22 ppp_async: drop the errored frame instead of resetting its headroom 16110d1a0e95a wifi: mt76: mt7921: skip unknown CLC firmware records 740272d46ffc8 wifi: mt76: mt7921: validate CLC firmware records 5ffe08b81a74d tracing/histograms: Simplify last_cmd_set() 9cd6d714d3ca0 ksmbd: remove stale channels from all sessions on teardown a2ac6a057409d firmware: stratix10-svc: fix FCS SMC call kernel-doc 3b9aa62d78ce8 netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state 8138a6951111d ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx 6b450c277c106 scsi: core: Do not block on tag allocation in scsi_eh_lock_door() 7c8b6b4d6f9de ASoC: rt5645: Perform the initial jack detect at probe 64f3ffba03b37 spi: dw: fix wrong RX_SAMPLE_DLY setting after resume 0737441d20b34 hwmon: (corsair-psu) Fix linear11 calculation be2636e1b21fe vhost-scsi: flush backend after device ioctls 37d743def9b6b ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx 887c8a9635dcb Drivers: hv: vmbus: add VTL2 redirect connection ID b44293b1598fa ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) 30d1d9f349546 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame d01f1600e8b07 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() 3a4a34a732e8a cifs: validate idmap key payload length cf8497dc74b3c powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash 07c121859d49e ice: pass the return value of skb_checksum_help() ce1b98bfe0cdb ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx b0cd3daf4710e ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4 f4e8477e7af81 phonet: check register_netdevice_notifier() error in phonet_device_init() 8add43887cca1 drm/gma500: return errors from Oaktrail HDMI I2C reads 4a19bb1c45667 ksmbd: preserve VFS inherited POSIX ACL mask 6f6368b20f8c9 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO 97aa48806d90e regulator: core: clamp voltage constraints before applying apply_uV cf87ef1e62ed3 smb: client: bound dirent name against end of SMB response in cifs_filldir 063b26637dcb2 wifi: mwifiex: replace one-element arrays with flexible array members a273c0336699e ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE 9096509e63ddd wifi: iwlwifi: acpi: validate WGDS table revision index a5af3b3e76760 ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless 4cfadb2e01566 wifi: iwlwifi: bound aligned TLV advance in FW parser e9b2633918c73 ALSA: hda/realtek: Add quirk for HP Pavilion x360 2750f52b58d92 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized c8e84e292ed4c arm64: kprobes: Allow reentering kprobes while single-stepping 35f991d685fea wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif 0f690fd3b5535 wifi: iwlwifi: mvm: add a check on the tid coming from the firmware 861bd61732148 arm64: fixmap: Allow 256K early_ioremap() at any offset 3ea815f401652 wifi: iwlwifi: mvm: fix a possible underflow 216e469586057 smb/client: flush dirty data before punching a hole c3650be82ef6e blk-cgroup: fix leaks and online flag on radix_tree_insert failure 7e307cbae23d9 ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs 05f79cea3b15c wifi: iwlwifi: mvm: fix sched scan IE sizing 7a2d4efea2c41 wifi: iwlwifi: mvm: fix an off-by-1 boundary check 0bc25f0a2d1b3 btrfs: fix reloc root cleanup in merge_reloc_roots() f9938eb95e2dd wifi: iwlwifi: mvm: validate sta_id in BA window status notif 091e097c2f829 spi: dw-dma: Wait for controller idle before completing Tx a01837ae174a2 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() 6d04872f36e83 btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr() 8db6d96ac93f4 ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series 631b292f93a3d smb/client: reduce fallocate zero buffer allocation f08d7f3c91633 wifi: rsi: validate beacon length before fixed buffer copy ecb48c6b9edc7 netfilter: ipset: mark the rcu locked areas properly 0b61c465ea620 wifi: libipw: fix key index receive bound checks fbbdda4753ec3 gpio: dwapb: Mask interrupts at hardware initialization 6bdf4dcff98df wifi: cfg80211: validate rx/tx MLME callback frame lengths before access 9c4ace62a7511 ksmbd: validate SID namespace before mapping IDs e790f72f2c99e ksmbd: mark invalid session responses as signed 47b018dba6ec7 ksmbd: find bound sessions during reauthentication 71be658246c90 wifi: cfg80211: validate assoc response length before status and IE access b657cc98d7936 wifi: libertas: reject short monitor TX frames 5207727e53fba wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers a78689e2beed2 wifi: mac80211: validate deauth frame length before reason access 6acaf2d10ad1c wifi: ralink: RT2X00: init EEPROM properly 319393151367e ALSA: usb-audio: caiaq: validate EP1 reply lengths 58b767c74930a ksmbd: fix credit charge calculation for SMB2 QUERY_INFO 717db0d436875 drm/amdgpu: flush pending RCU callbacks on module unload 4a69504f5d691 ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table 246098a2b8e88 cachefiles: Fix double fput 720554c04acba xen/gntalloc: validate grant count before allocation 7ada9807e3710 freevxfs: don't BUG() on unknown typed-extent type ac97b55d9e989 xen/front-pgdir-shbuf: free grant reference head on errors edc17db830856 ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling aa9bd2c8513e4 ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr 43658ba7f701e drm/arm/komeda: fix error handling for clk_prepare_enable() and callers c866c3314a685 ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr b7f3ee925aee9 netfilter: nf_conntrack_expect: zero at allocation time 223bf70736b49 drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend 4cb41f07685f8 btrfs: tree-checker: validate INODE_REF's namelen 1cc84ca8599b8 spi: core: Abort active target transfer on controller suspend 2b3c4c381fb23 fbdev: pm2fb: unwind WC setup on probe failure 69aea5ee498fb eth: mlx5: fix macsec dependency 42a37f4a89665 rtc: bq32000: add delay between RTC reads e6a404ac2a1e8 blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat() e1b5a13249975 net: au1000: move free_irq out of the close-time spinlocked section 8efa52abbff2e regulator: da9121: Use subvariant ids in the I2C table 249be9b5704d4 PCI/sysfs: Use kstrtobool() to parse the ROM attribute input aa1ad3c1f3976 PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() 4114c357386d7 ksmbd: treat read-control opens as stat opens only for leases 3df8918da4630 ksmbd: break RH leases before delete-on-close 9e2cccbbf3b63 ksmbd: start file id allocation at 1 5c37c7275d757 ksmbd: deny renaming directory with open children 52bceb4629bf4 ksmbd: apply create security descriptor first 58a0a1c399a08 ksmbd: treat unnamed DATA stream as base file 3b64cae18fd79 ksmbd: use connection ClientGUID for lease lookup 3281d27b4d974 ksmbd: align SMB2 oplock break ack handling 223a923582afa ksmbd: validate SMB2 lease create contexts 17699905a3816 ksmbd: fix lease break and ack state handling 52fa4ba4268ce rtc: aspeed: add AST2700 compatible aee4e6de71ca7 f2fs: validate inline dentry name lengths before conversion 2fdc51228d9a8 md/raid5: let stripe batch bm_seq comparison wrap-safe fc0fab337d554 md/raid5: account discard IO 31e33dcc89652 PCI: mediatek: Protect root bus removal with rescan lock 5d566ac3a055f PCI: rockchip: Protect root bus removal with rescan lock 4b69c63cc247f PCI: altera: Protect root bus removal with rescan lock aaf4153caed9f PCI: iproc: Protect root bus removal with rescan lock 53da3557621a3 ALSA: usb-audio: Add quirk for YAMAHA CDS3000 67a5885f846b0 drm/amdgpu: Use system unbound workqueue for soft IH ring 89ed4a0ce8beb drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap d51841bb5ceee drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl af84fb6ac0cb7 mfd: rsmu: Add 8a34002 support 9e54c47bc8407 mfd: tps65219: Make poweroff handler conditional on system-power-controller 31aab1e3d0f3a leds: pca9532: Don't stop blinking for non-zero brightness 9f0d6bb71a6bc leds: uleds: Return -EFAULT on copy_to_user() failure 804302aca977b ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 e26aa709454d4 tls: reject the combination of TLS and sockmap 1d8050de0ca2a ALSA: usb-audio: Add quirk flags for SC13A 359b3442e66c5 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() 12e4118b5b4f8 gpio: pisosr: Read "ngpios" as u32 111b36e7b6dc6 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() f58daade5963a fuse: set ff->flock only on success 5d7637f4d050d HID: hidpp: fix potential UAF in hidpp_connect_event() 97313af1820db ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT 71fcc902af9c2 sparc: Disable compat support with LLD 737a90fcd99d1 i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA cfa09f63e75cf smb: client: fix races in cifsd thread creation ea0af96a1b939 net/sched: act_csum: don't mangle UDP tunnel GSO packets f948534a042fa e1000e: limit endianness conversion to boundary words 76e678bdc5170 vsock: use sk_acceptq_is_full() helper in all transports af16e8f97c622 ptp: ocp: add shutdown callback 74dbb85a6a254 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask 665089ff4f8a2 sparc64: uprobes: add missing break 01e350c0641f5 Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV 98deaf6117195 ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure 1994a4bdaa7fc ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence 7f0fd754c7087 ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt 72e26293a231f Bluetooth: L2CAP: validate connectionless PSM length c8d249de9e97d Bluetooth: btusb: Add support for TP-Link TL-UB250 e86071156ea99 Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV fa9d74b9bb0cd spi: xilinx: let transfers timeout in case of no IRQ 23f05d42f189d hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i 3c8c0c786f3f0 dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc 58d882c723ae9 PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems f2db152beb06c sctp: Unwind address notifier registration on failure 5488e2706c584 nvme-fc: Do not cancel requests in io target before it is initialized 8cd46f24e8411 platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table 4ecbe6a5ac28e ata: libata-pmp: add JMicron JMS562 quirk 58ae36b6f20c7 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8 21730289e0af9 ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC ba180821a4e23 vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add() a432bf58906b7 net: dsa: qca8k: Add support for force mode for fixed link topology 86ace5b321108 hwmon: (adt7462) Add of_match_table to support devicetree 1a6c92aa7242a btrfs: protect sb_write_pointer() with invalidate lock d51ba5fe3459b wifi: mt76: transform aspm_conf for pci_disable_link_state 466e727a3481b platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table 7521c2e260855 tls: Flush backlog before waiting for a new record f0399b3e21274 net: ibm: emac: mal: fix potential system hang in mal_remove() f38f5acb4942f configfs_depend_prep(): pass configfs_dirent instead of dentry 0d099caebc3e0 xprtrdma: Add request-pool slack for delayed recycling b042b4947752d RDMA/rtrs-srv: Fix integer underflow in process_read and process_write f556c3d4d64dc NFS: fix eof updates after NFSv4.2 fallocate/zero-range ba6c4fc662853 btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF 81a664ed8b1a4 btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() 0d5ad732e4fdc netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() 91c97a7969dae ALSA: es18xx: check control allocation before private data setup a7625d408f7f0 net: microchip: sparx5: clean up PSFP resources on flower setup failure 016b8eaca53bf hsr: broadcast netlink notifications in the device's net namespace 8af61d5bd87fd net: cpsw_new: unregister devlink on port registration failure 31377675c3d75 bpf: NUL-terminate replaced sysctl value b1e111f93deef RDMA/mlx5: Fix state and counter desync on loopback enable failure e9bbb5f5349ef RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() 2095eceaedddf wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications 641be20110cdf drm/amdkfd: Unwind debug trap enable on copy_to_user failure 5eade80288a03 ipmi: si: Use platform_get_irq_optional() to retrieve interrupt 3b389d479f831 ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP fd36e829eb3c1 clk: keystone: don't cache clock rate 0e646d3912ff5 net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition 025293b9d0cf6 RDMA/irdma: Fix typo in SQ completions generation 4a1b0a4c5acbe drm/amdgpu: fix buffer overflow during vBIOS update 9b5cb2e4eb297 drm/amd/pm: bound pp_dpm_set_pp_table() memcpy 090b51e2dabf8 drm/amdkfd: fix UAF race in destroy_queue_cpsch fec259e46d443 xhci: Prevent queuing new commands if xhci is inaccessible 97c2c0b1233b3 thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries c996faba71fc4 dpaa2-switch: fix handling of NAPI on the remove path d0e54098c072b net: dsa: sja1105: flower: reject cross-chip redirect 259ad6093204b dpaa2-switch: fix the error path in dpaa2_switch_rx() dc626f2abb305 dpaa2-switch: rework FDB management on the bridge leave path 2922cf2583e59 ALSA: seq: oss: Reject reads that cannot fit the next event a92d497bc768e ASoC: codecs: rk3328: Use managed GPIO and clock helpers 2f7d0ec8c10dc ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() d564a885219a6 fs/ntfs3: validate index entry key bounds fdc9f65aa6631 fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib fce90e41601e3 iommu/rockchip: disable fetch dte time limit 356a4983340df net: wwan: t7xx: Add delay between MD and SAP suspend f76a39c45182d net: qrtr: fix node refcount leak on ctrl packet alloc failure 6b6be7328f2b2 ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach 6d29b91164424 ata: ahci: fail probe if BAR too small for claimed ports 0ccf0d4dddbe5 ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive 43cb6295c3a6d ASoC: qcom: q6apm: return error code to consumers on failures b4ef30f1d107a wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi b511b56f63daa net: ibm: emac: Reserve VLAN header in MJS limit bc6e3444a6d7a libbpf: Also reset {insn,data}_cur on realloc failure da92b1a8560a5 iio: accel: mma8452: switch to non-devm request_threaded_irq() d85b5591ea459 perf/ftrace: Fix WARNING in __unregister_ftrace_function 2c2d63f410557 iio: light: stk3310: Deal with the ps interrupt issue in PM b5fa000eaf6bb mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC 3657383a477ab tracing: Disable KCOV instrumentation for trace_irqsoff.o 345b1dfa73be0 mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC cfc0b65a29b41 mmc: davinci: fix mmc_add_host order in probe 86ac37d42a8b1 soundwire: only handle alert events when the peripheral is attached c8abef7c07c10 gfs2: page poisoning fix 26532163b3cef soundwire: dmi-quirks: Disable ghost Realtek devices 5cdfd851fa205 libbpf: Add __NR_bpf definition for LoongArch 1bdf84bbe14a7 ASoC: Intel: catpt: Complete coredump handling feb1ad41281ae drm/nouveau/gsp: add SEC2 to GA100 chip table c6ad6451f88f0 scripts: modpost: detect and report truncated buf_printf() output 74bd1f05d9ba2 host1x: bus: Fix missing ops null check in error teardown 37acac6d2d6d3 pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP 1ca2411d90c85 hfs: rework hfsplus_readdir() logic 38ee32a9ace6f ACPICA: add boundary checks in two places 50a11e2f3dc8a ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() 08c5dee5da1d8 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() e301b6132be06 ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() 26dd27000e954 ACPICA: Add validation for node in acpi_ns_build_normalized_path() 2442772fd79a4 ACPICA: Add package limit checks in parser functions 254e304f68dc0 ACPICA: validate handler object type in two places 72d75287bc6d6 ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() 4532c9cf006bb ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) c2cf936b07b0a ACPICA: Prevent adding invalid references 6e0d26e6ec903 ACPICA: validate byte_count in acpi_ps_get_next_package_length() 7d97ecf2a4c7a ACPICA: add boundary checks in acpi_ps_get_next_field() 63ca6f67816a2 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() 4c22c9842c53b ACPICA: Fix condition check in acpi_ps_parse_loop() 121352772b326 drm/amd/pm/si: Fix updating clock limits from power states c8bc44a1d86d5 net: thunderx: fix PTP device ref leak in nicvf_probe() f601ec5c92b32 ipv6: addrconf: fix temp address generation after prefix deprecation f5d3088e1a9f3 net: hsr: require valid EOT supervision TLV 52c61420923e4 ALSA: usb-audio: Add quirk for Novation Mininova 4761493dd6634 irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed 566b1fc9a4fb8 iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind df904e01b710f mips: cps: Assemble jr.hb with an R2 ISA level cf82a9d15ae69 drm/panel: simple: Add AM-1280800W8TZQW-T00H a643ce49ddcdb thermal/drivers/tegra/soctherma: Switch to devm cooling device registration 99a1ae9c1e058 clk: socfpga: agilex: implement l3_main_free_clk ff8e9b793effc s390/zcore: Removed unused variables 2e6b5c4b59351 rds: annotate data-race around rs_seen_congestion 65fae4b42269d rds: filter RDS_INFO_* getsockopt by caller's netns 4892962af7896 netlabel: fix IPv6 unlabeled address add error handling 4cf3a3f61c88c wifi: rtw89: pci: enable LTR based on pcie control register df2f6c977a94a rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks() 47850643464ba char/nvram: Remove redundant nvram_mutex cd4f278f30021 usb: host: add ARCH_AIROHA in XHCI MTK dependency 03ed804a0ddc3 serial: 8250: fix possible ISR soft lockup 99fcf2d8daf24 usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue c055449f384b1 USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set a018d4195114c usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log d0291fb4d9198 usb: core: hcd: fix possible deadlock in rh control transfers 517c353e5358b usbip: vhci_hcd: fix NULL deref in status_show_vhci 28d1f6aa14f59 isofs: handle set_blocksize failures 29186cd17bb5f omfs: handle set_blocksize failures 0451927f42b02 hpfs: handle set_blocksize failures 87d6852f06c5a jfs: handle set_blocksize failures f83e416c2242f qnx4: handle set_blocksize failures 8e788c14b72d6 minix: handle set_blocksize failures 8a96010d230a8 bfs: handle set_blocksize failures ea8a4a9f3cc10 affs: handle set_blocksize failures df9dac4dbe557 ntfs3: handle set_blocksize failures ceb89faa8ead6 befs: handle set_blocksize failures 07a348d48e589 net/rds: Don't sleep inside rds_ib_conn_path_shutdown 4fc0430de152f net/sched: sch_drr: make cl->quantum lockless f0018acf0b66f net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() 513cab0e49ebe net: usb: qmi_wwan: add MeiG SRM813Q ac8cc00c0fb60 nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl b4d8264ca70f3 bitfield: wire __bf_shf to __builtin_ctzll 85cbb946b9c59 thunderbolt: Verify Router Ready bit is set after router enumeration 5428342dd66ed thunderbolt: Increase timeout for Configuration Ready bit c0742f23ec13f firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size 1bbe431fc5970 firmware: arm_scmi: Validate SENSOR_UPDATE payload size 7496466121155 thunderbolt: Improve multi-display DisplayPort tunnel allocation a13e408c554be thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host() de4b7f9bfee2c bridge: Add missing READ_ONCE() annotations around FDB destination port 4904370513ad6 9p: use kvzalloc for readdir buffer c2319e1cfb78c arm64/daifflags: Make local_daif_*() helpers __always_inline b6b5175b4da92 9p: invalidate readdir buffer on seek 3167b620815c4 sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity d04cff45c9d2a ALSA: usx2y: Drain pending US-428 pipe-4 output commands 3d2ddfc9b361b drm/amdkfd: Check bounds on allocate_doorbell e2bef0f168be4 drm/amdkfd: Fix OOB memory exposure in get_wave_state() 25e1b29ecc8da drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id c1797a31c5fe8 PCI: Wait for device readiness after D3hot -> D0uninitialized transition bb42eed92e401 mailbox: Make mbox_send_message() return error code when tx fails 91c6fdcdf22bd RDMA/mlx5: Use QP port when decoding responder CQEs 0a996ad14fbbb media: imon: Add iMON VFD HID OEM v1.2 key mappings c4f2d6c924263 crypto: atmel-ecc - add support for atecc608b bec33e03d2244 crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y 3b3ae5517658a scsi: pm8001: Reject non-fatal dump when controller is crashed cb789c65aa703 scsi: pm8001: Reject firmware update in fatal error state e4fe7a56992ee clk: samsung: exynos850: mark APM I3C clocks as critical 959913c0d51e1 soundwire: intel: Move suspend tracking from trigger to pm suspend c0cbb58df7d21 drivers/of: validate status properties in reconfig state changes a6ce8632fbdc0 integrity: Check for NULL returned by asymmetric_key_public_key 32ff92cc9f91e net: dsa: realtek: rtl8365mb: add support for RTL8367SB 72bf6944e336d wifi: rtw89: phy: check length before parsing PHY status IE b7afb0c24a761 media: video-i2c: use vb2_video_unregister_device on driver removal 3d2ac2f6ed2e2 drm/gud: Add RCade Display Adapter VID/PID pair 9eb4ca55f5b61 net: phy: motorcomm: use device properties for firmware tuning bfdb4d0fab516 hfsplus: rework hfsplus_readdir() logic 03505f0c7c277 PCI: intel-gw: Enable clock before PHY init dc4fd6c0d9323 drm/amd/display: Fix CRC open failure during active rendering 3c5e3e5badbf0 mmc: davinci: avoid NULL deref of host->data in IRQ handler a8283f7d93f0d mmc: core: Add validation for host-provided max_segs 120c4c6e07f94 ASoC: ti: omap3pandora: update board check to use DT compatible 38570c33dc367 drm/bridge: tc358768: Set pre_enable_prev_first for reverse order 1b793329699b5 clk: renesas: cpg-mssr: Add number of clock cells check 827c30511b02a crypto: omap - add omap_des_unregister_algs helper 8c37bc8d6a6f7 crypto: ixp4xx - fix buffer chain unwind on allocation failure c75237294a70d media: em28xx-video: fix missing res_free() on init_usb_xfer failure 0d252fe2012d9 net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family 2381e99226b53 net: dsa: mv88e6xxx: define .pot_clear() for 6321 c43bc7bd2e68a PCI: switchtec: Add Gen6 Device IDs d2c97bf5b1ff2 net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family b6327023dcc74 media: dm1105: fix missing error check for dma_alloc_coherent bed89ef877c9e thunderbolt: Don't create multiple DMA tunnels on firmware connection manager 83d1af5b1b6e6 thunderbolt: Set tb->root_switch to NULL when domain is stopped b61a4ae2ec6a0 thunderbolt: Keep the domain reference while processing hotplug 57359bb31526c thunderbolt: Keep XDomain reference during the lifetime of a service 9d6657674919b thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() f5e6286350c86 media: rc: mceusb: Add support for 04eb:e033 d9fa79ccd0920 spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM 71ab6046cb940 soundwire: validate DT compatible before parsing it 827d1eebd5f24 bridge: Do not suppress ARP probes and DAD NS unconditionally b9efc7bdadca8 firmware: stratix10-svc: change get provision data to async SMC call ad65a12f6a0a4 kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() 0b58a5ac9170a wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() adf23deb60387 wifi: mac80211: always allow transmitting null-data on TXQs 8fe5eb7b68d76 wifi: nl80211: reject beacons with bad HE operation 5a46a1b5dcbae hfsplus: fix issue of direct writes beyond end-of-file 0f8a92c198893 PCI: Stop setting cached power state to 'unknown' on unbind 5a99d68c32927 tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang e9260bc729335 tee: optee: Allow MT_NORMAL_TAGGED shared memory 11c633d24780a usb: gadget: udc: skip pullup() if already connected 8c77312728d07 ima: return error early if file xattr cannot be changed c6dfcaea6d3ae ALSA: usb-audio: Propagate write errors in generic mixer put callbacks 5a7c355f83c63 drm/amd/pm: Check SMUv13.0.6/12 metrics integrity e0ae7248bae11 drm/panel: jadard-jd9365da-h3: set prepare_prev_first 3ad0c3cf4a163 drm/amd/display: Fix DPMS using partially updated pipe context 82f51c4addcac bus: fsl-mc: wait for the MC firmware to complete its boot 30cd0f44e983e drm/gem: Consider GEM object reclaimable if shrinking fails 892f643b141ae ksmbd: fix use-after-free in oplock break notification Signed-off-by: Bruce Ashfield Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index 8a31bbfd09a..3c91a4ba7a5 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "9b87590f4fb1e0d54ae9153f9e4fe84cec61f13e" -SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" +SRCREV_machine ?= "aafd2f2dba2b549d89a66f79826d770742d968ab" +SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.157" +LINUX_VERSION ?= "6.6.159" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index 3904ba1d1c6..1b06d1e35fb 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.157" +LINUX_VERSION ?= "6.6.159" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "a56c1dbe33dcd7b71df3b2703ceb95692edd9579" -SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" +SRCREV_machine ?= "7d022d231f699d2c767d88bb1fa305550ca68e01" +SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index da3c5dd6ea6..601eb925955 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "f762f9a437240aebfb663b9f08166b6978411ad3" -SRCREV_machine:qemuarm64 ?= "efde6579b1968f396f4718ad939aeb6859f17012" -SRCREV_machine:qemuloongarch64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemumips ?= "d7bc8d3db82714ebe46bde3e69f9dcbef7ae6e48" -SRCREV_machine:qemuppc ?= "b8bafdf6f040163a1fe0eb91c7b419452e3590b4" -SRCREV_machine:qemuriscv64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemuriscv32 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemux86 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemux86-64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_machine:qemumips64 ?= "fa48e020815730c4ff228c0e8d42836d68ac4b4b" -SRCREV_machine ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6" -SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8" +SRCREV_machine:qemuarm ?= "9d17d5c9ac32b38ca5186199ed824b43f3d4308b" +SRCREV_machine:qemuarm64 ?= "857114866d2445d49024c9ef1ec710a7ef291a5b" +SRCREV_machine:qemuloongarch64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemumips ?= "2349f4c462400a8fb6f95c6bc0fbbdf959b2cb18" +SRCREV_machine:qemuppc ?= "47e791b3b9f786f926e66a672c524c1e858c76c1" +SRCREV_machine:qemuriscv64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemuriscv32 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemux86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemux86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_machine:qemumips64 ?= "a77a45b7cea3e691d2dafca4d9bdbaa60d134617" +SRCREV_machine ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" +SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "79643295eba17affbd16ca97f3ef04c90266b28c" +SRCREV_machine:class-devupstream ?= "cecd39af8a1ab81373fd9fa765b2f7ab73becaad" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.157" +LINUX_VERSION ?= "6.6.159" PV = "${LINUX_VERSION}+git" From patchwork Sat Oct 31 00:15:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102561 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3757.1793405772799195716 for ; Fri, 30 Oct 2026 17:16:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=DzmLntcR; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a35d5d4a20so13645585e9.2 for ; Fri, 30 Oct 2026 17:16:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405771; x=1794010571; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ES7DuhmYunrwlQhy01OKFeCADL3vUjnyusRBaFS48Jw=; b=DzmLntcR/OApyJnlKnTt6blRwzvPKYP1jJFNdHbnlhO8LrIi1f8EwVxlF7w8u9oOGd wdUPWc45VEau9oQSg26ntFPufKfsdBCjTR41bmcluNlhCwNrWbweJP3SRiT7pIQ++TP8 dnG2XWiHz41C/8IDcJhkGedF0wA+d9B9uM1L8673BhhLzyL4/G9NgiUqRl5FTpQ40c/V nZ7UpjrzPkRXt8Kn+5Bsz8s3cplVJ5d2QBCvXCdJpUwUbjcimXa8QodKJzquWKzUma29 NOUrba2AnmqMBFhJRQZRSMGCzg3senrslxC2Nztu7qEaGB7fEYupAo45CC0LFnsEVKZO FnOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405771; x=1794010571; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=ES7DuhmYunrwlQhy01OKFeCADL3vUjnyusRBaFS48Jw=; b=v5lfe+IxnSszIbdLOKODnnJWbkCRRfeJ0wSAzfWG4Vx+DmwzEF2st6wmvj0P4CJ4Tb 6mLRT6NJqJhxXmV1Wkh3w8Hoe2B0TuRDNnk84o7Dt+byqy/9976KddLXJvCcMSrGK+n/ +JMsGd/pdHUEHShu9WkaZbtNABH/Q6PbgRcIQIBSEWk3klgu9ilCgN3uLw4zb4wN79Qj UQ2TglzO/9edgof2v3D9URWJk3INZIyfnllzjCqkcCBHMs5CdhABKgb6Welr6UPk1eD8 cR1TW0qKUvQWqj/zOMPVE4iebBva9Rd7CYErXilQwUZcqSBT11Mm0WF618Du1d/KEhWv nUVw== X-Gm-Message-State: AFq9FYLVoJPiB9SyQLpt68vERoN8VH+sbKubdq8Piq7Bj7opArOkfCby u4v5rauNskvBXXMObpsKDTdkI/4qdegfXOD1ssV63S3Bu38abJc4YgCPQKDDIwb4HLl6u1zwjq5 VnJV/bak= X-Gm-Gg: AYBFou3s51Zf6vcNzhk7fyqyIabHfBrCzMzSimH7TaEN5gMEOR2/oHHop7iUZvnl1DF 3dMOe0YX77SQKAT0tO/Xhs/oKPBqw25ge3OWLQ9/jgyUIcu06YonO8VNKVOxhKocSgOwSX1PlMc rxqrydzqtP+oT74S7nkNft9cR0D7fC3WJRDA/PYCDdKjvqTVSC7/40ScQ3iAe+n9skR+klkD6Xr njd9tprpSxkjKPjx0oiEVL1U0W+9mQFZOP/Y2iO1FrVR5Y+0m0jQcLD25nQSco+9Bebp+HnJ8BP Cy6EG+878vpKaHFkTYW6mek8qpDapnmQZd/BdsIDEV+Xgh5AmiZtsetRQTUVMvZYF3YocD5GVvn MJ58uPllALLitM3k3378Ls9e6/XckC0sQu0AN8vq0ic8QR0RlPfn/QKnh0vPGWNHfLNAzRUun5a oTihcxtfs5csXpCsjumW6kXpSZyb2st/tcniMriPlBaTX2BZuFgX+YvwfuD7snz1b3b5+uZ+3V2 jtG74kMc1GgvhGUST+IxPsi5VyAsovJ63JT0JmmOjnBYkJ22M5uVeYdcUYo9YtZn8Ptyjgrr/QI ztN0XuUo6Njte1Wcw2fX8s9+TX1IlRP/170sSTHMIZ/yvC8cWZRx2Ksg4SokOUnPKTXk1W0WlAZ DZqWbdH5VvOQq4CNZ1iywlQQCjHZQcpvHZS8kzHUdescl6vtwTQ== X-Received: by 2002:a05:600c:19c9:b0:4a1:f377:5c68 with SMTP id 5b1f17b1804b1-4ac18a8911amr86825445e9.34.1793405769562; Fri, 30 Oct 2026 17:16:09 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:08 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 44/55] linux-yocto/6.6: update to v6.6.160 Date: Sat, 31 Oct 2026 01:15:05 +0100 Message-ID: <655c414b1a6ed90886025a17c9b75bb7fcf78c40.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249120 From: Bruce Ashfield Updating linux-yocto/6.6 to the latest korg -stable release that comprises the following commits: 0aebf2870d53a Linux 6.6.160 a63f79d9da946 KVM: x86: Use active memslots for the per-vCPU MMIO cache 59c6dcc5dd9da ksmbd: fix heap out-of-bounds write in krb5_authenticate() db00b8cc243f1 bpf, sockmap: Account for receive queue in FIONREAD without a verdict program cec182231e528 xfs: fix unmount hang with unflushable inodes stuck in the AIL a72b0af5610ce xfs: factor out stale buffer item completion be1999582bd10 xfs: rearrange code in xfs_buf_item.c 67f0af99e2905 xfs: catch stale AGF/AGF metadata dda32083f6393 xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock fb2cc53273997 bpf: abort verification if env->cur_state->loop_entry != NULL 8010212197d4a Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained dbea82c4c81db Revert "mm/filemap: avoid buffered read/write race to read inconsistent data" 791f7e65d6299 Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()" a102a92462b97 ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 f2d8e2e64fb2b r8169: remove original workaround for RTL8125 broken rx issue fa0c45986fc60 smb/server: fix tree connection leak in smb2_tree_connect() 22d1f4dcdc9c6 nvdimm: pmem: keep PREFLUSH before data writes 32e999ccf5f64 drm/virtio: use the DMA API for resource backing on Xen ce7da178f1af4 drm/gud: validate GUD_ROTATION_0 is present in supported rotations d51cd486930f5 bpf: check_cond_jmp_op(): properly infer if register is null b7f2e33d9f5db smb/client: validate new EOF for insert range 5fbd8848f2e25 smb/client: validate new EOF for zero range 52dd721b3de57 smb/client: fix stale page cache in insert/collapse range cc7202a51b877 smb/client: invalidate fscache for fallocate range operations 99ae165acf633 ksmbd: propagate DACL parsing errors fabc5e04f1232 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect 01131daffc4b6 igmp: convert struct ip_sf_list to RCU 0e3e3cec28c4d ipv6: mcast: use rcu_assign_pointer() for __rcu list updates 3dbb628cfc592 tipc: Dont send random pad bytes in RESET/ACTIVATE messages 19cca7c360559 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge 1ac58dab0a83d bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks 433d52b196a68 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails 14d982762945d btrfs: zstd: fix lost wakeup when waiting for a workspace 54772bf503dd0 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace(). 4c85e4a0e8b07 net: plumb extack in __dev_change_net_namespace() dcc5e6c9e4d06 erofs: disable LZ4 rolling decompression for now 9496d857205e6 bpf: Mark syscall helpers as sleepable e6a94b2c4c80a nvme: remove stale namespaces by NSID range during scan c57506918b078 nvme_core: scan namespaces asynchronously 8b414dbe97fce bpf: Don't infer non-NULL from a pointer with an unbounded offset 6e15449865367 bpf: Don't predict JMP32 pointer vs zero comparisons 53ab1d12e52aa bpf: generalize is_scalar_branch_taken() logic ca7ade93a622c bpf: unify 32-bit and 64-bit is_branch_taken logic 4ea5273a22e47 bpf: generalize is_branch_taken to handle all conditional jumps in one place e3991f2c54e7f bpf: move is_branch_taken() down 82798ed5889f0 bpf: generalize is_branch_taken() to work with two registers e97cb20239d10 bpf: rename is_branch_taken reg arguments to prepare for the second one f5b2c23341b79 bpf: Improve JEQ/JNE branch taken logic 86a3171c90bfc bpf: Mark NULL kptr stores precise cf85e4f94d7fe bpf: Preserve inner map identity in callback frames 26ee5f99ffe7a net: reject oversized tx_queue_len at netlink parse time febbb66e682d8 bpf: mark a NULL call argument precise 8b95269d7a43b iommu/amd: Do not reallocate GA log buffers on resume 5ad081761a1f0 virtio_ring: fix stale descriptor flags after a failed packed add 914c7cc2e3d10 vhost-vdpa: protect config_ctx from being freed under the config callback 582fec8ebce99 eventfd: simplify eventfd_signal() 650bac9c73d3b vduse: validate virtqueue alignment 021bf73731f7a vhost: invalidate vring access on IOTLB transitions bd91dc313afe2 af_unix: Update last skb marker in manage_oob(). 385aa7dbc6af1 eth: ice: don't dereference pointers from TP_printk() 55b76500546e5 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() fb78beb64e0e7 vxlan: initialize _md in vxlan_xmit_one() d552beb9d278a net/mlx5e: Move representor vnic reporter to eswitch devlink port 9882068ed242f perf/x86/intel: Prevent drain_pebs() reentry 09c30547da2c4 net: stmmac: fix TX descriptor availability check for TSO traffic a44744454eafb configfs: pin the symlink target's dirent instead of chasing ->ci_dentry bc5f32f36724b configfs:get_target() - release path as soon as we grab configfs_item reference db6d0b2f307f0 path: add cleanup helper b315d86566076 configfs: unhash the dentry before dropping the item in rmdir 0c1a966bc047a reboot: fix cad_pid use-after-free race 61894ea0d2a1a tracing: Take trace_array reference when opening a tracer options file c3576cb77b527 ALSA: usbusx2y: validate URB actual_length in interrupt callback 4d87cf94eba53 ALSA: usx2y: Use standard print API e5c5dad169fb5 tracing: Take the reference before publishing the named histogram trigger 880712b6f4810 tracing: Undo the registration when enabling the histogram trigger fails 962e565f45dbe accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr 07d4190d75021 accel/ivpu: Validate firmware log buffer metadata 3d9365093f16b accel/ivpu: Limit firmware log name prints to field size 97be05f33f793 bootconfig: Fix integer overflow in initrd size check f664e06699829 netfilter: cttimeout: prevent UAF during module unload 0159f716d8adb ipv6: flowlabel: cap duplicate leases per socket 5a1b6379eed5b perf: RISC-V: store available counter mask as bitmap 189d60057e5f3 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 be6eccccec867 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid 284877c6189fd smb: client: fail DACL rewrite when the new DACL exceeds 64K 604feb3e8141b smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() 674d783f2e80d scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size 64a7ed42e9766 f2fs: accurately adjust free_sections during free_segment_range 40dcd4a71a524 scsi: qla2xxx: Skip vport under deletion in report ID acquisition 6c71726cdfda9 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock 925a9129a514b scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error d12e92e72db91 wifi: cfg80211: reject duplicate wiphy cipher suite entries 971b40e3ca127 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() 493a029c205a9 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[] dc5778dbd0b6c ocfs2: validate external xattr entries when reading metadata 45c534c5bf43a firewire: core: fix memory leak in error path of build_tree() e6c3a43d0a41f nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net 3861eeabaebe2 svcrdma: Validate Read chunk positions before reconstruction c4c71368bc5c5 iommu/sva: Set handle->dev before the SVA handle is visible 6e5333ec3bd8f iommu: Pass domain to remove_dev_pasid() op 80eaeae0e4b1e md/raid1,raid10: fix error-path detection with md_cloned_bio() 91d0fc000d8cc md/raid1,raid10: fix bio accounting for split md cloned bios 50d1a47fb3c4f btrfs: fix deadlock cloning inline extent when using flushoncommit bce2eec05bce5 Bluetooth: hci_core: Fix UAF in hci_unregister_dev() 441250eea8460 cxl/region: Resolve region deletion races b869e3e4ce199 net/handshake: hand off the pinned file reference to accept_doit 59db5d8bcc65e erofs: fix use-after-free on sbi->sync_decompress 98cc0403f546c netfilter: revalidate bridge ports 966b941ca469f greybus: raw: fix use-after-free if write is called after disconnect f65a96fe2467a ceph: fix num_ops off-by-one when crypto allocation fails bca0597272f97 KVM: SVM: Add missing save/restore handling of LBR MSRs 1cde96d5d53b9 hwrng: core - use RCU and work_struct to fix race condition aead84bdacd77 netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation f988fbf0536b4 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC 690145822dd73 media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure 0870f10cbdaa7 media: hantro: Disable multicore support 414396c42ef20 ASoC: qcom: q6asm: drop DSP responses for closed data streams 253523cd4dd7d ASoC: qcom: q6asm: handle the responses after closing 8c24b5179af26 RDMA/efa: Fix use of completion ctx after free 127c5e6e2d6fa ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS d4bee74b7cb93 drm/msm: Recover HW before retire hung submit a75e5de593ef1 ACPI: platform: Use acpi_bus_get_primary_device() c4672bdc4730d net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work ba8bc644f1685 xen: fix UAF in dmabuf_exp_from_pages() d3c8519f85b78 HID: nintendo: avoid bluetooth suspend/resume stalls 155bc8f94d52c net: dsa: b53: do not enable EEE on bcm63xx b101fc9ac18d1 scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set 41168ed90f98e bpf: Mark raw_tp arguments with PTR_MAYBE_NULL d02dd7ce8e52b PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() bb2b3e6047163 PCI/sysfs: Demacrofy pci_dev_resource_resize_attr(n) functions a8adf64fe7fd5 genirq/proc: Size interrupt directory names for 10-digit interrupt numbers 482ba972f9638 pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction 8ddda06ae356f drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw 0786b38af822f drm/amdgpu: Bound GPIO I2C table entry count from VBIOS 445835710fd0e drm/amdgpu: rework i2c init and fini 5db7d4e7c980f drm/amdgpu/atombios: drop empty function 079ec13f481cc drm/amdgpu: Remove unused amdgpu_i2c functions d2ea99884793c wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed 68059b6e9f729 tty: serial: 8250: protect against NULL uart->port.dev in register 59442ba701d3a serial: 8250: invert serial8250_register_8250_port() CIR condition d5eb39d6178ca driver core: Avoid warning when removing a device while its supplier is unbinding 6e9e007ee1dfb virt: acrn: Fix irqfd use-after-free during eventfd shutdown 7c9fee40fc8d8 RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() 50bf37362362c wifi: iwlwifi: mvm: fix P2P-Device binding handling 567d7c3f93f8d drm/amdgpu: harden FRU PIA parsing with bounded helpers cf1dadc5d24ee drm/amdgpu: Refactor FRU product information c1f2f34d681a0 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq 6fc7ab7fcd7ee drm/amdkfd: fix SMI event cross-process information leak 84fc3f30b87e0 pds_core: quiesce DMA before freeing resources 29723256fccf4 exfat: fix handling of damaged volume in exfat_create_upcase_table() af3c9c0bf8542 exfat: resolve memory leak from exfat_create_upcase_table() 1d8e1e99b063d perf: Fix addr_filter_ranges lifetime 8e4a07ed82bae wifi: mac80211: ibss: wait for in-flight TX on disconnect 2c5db82778f56 smb/client: zero-initialize stack-allocated cifs_open_info_data c422d5d53f135 wifi: iwlwifi: pcie: null RX pointers after free 5e871c03506c5 wifi: iwlwifi: mvm: validate TX_CMD response layout 88767bf9fd2e7 wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp* 7c293e83d86cf ksmbd: fix maximum allowed access checks d46b67c245229 ksmbd: remove redundant DACL check in smb_check_perm_dacl 190f3bdfaef8d perf/x86/intel/pt: Fix stop/start with no update 7abab59d6c99b remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 e36b1c2eafcaa powerpc/xive: propagate IPI init errors to prevent use-after-free d929980d771f8 powerpc/xive: add error return value to xive_smp_probe() 50ddd82b88b1d ACPI: bus: Introduce acpi_bus_get_primary_device() bf75f14d755f9 memcg: make the v1 soft limit knob inert 28c5a3a572f6c svcrdma: Reject Write/Reply chunks with segcount 0 94b450977c602 nfsd: convert nfsd_net boolean flags to unsigned long flags word e7c1923c5f30a mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() 64b1a9384db9c iommu/arm-smmu-v3: Manage teardown with devm 6640f778aa3d4 i3c: master: Fix recursive locking during device registration 41b2025709ec1 nvdimm: virtio_pmem: refcount requests for token lifetime 1f661f42beb55 drm/v3d: Clear queue->active_job when v3d_fence_create() fails d2d40574b9b27 cxl/mbox: Clamp mailbox output allocation to the payload size cda8af27b787d drm/amd/display: Fix dangling pointer in plane reset function ef3293c87a79f drm/amd/display: Fix dangling pointer in CRTC reset function 4dda09e7ca0bf mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug 06bdccd50bb9a mm: name the anonymous MMOP enum as enum mmop 5b1ebdc12131e mm: change type of state in struct memory_block 2ba67aa183a3c dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout e37c67f768234 hwrng: core - fix rng list on registration error 642648fa75952 cgroup/cpuset: Make nr_deadline_tasks an atomic_t f048044ad2e5f cgroup/cpuset: move common code to cpuset-internal.h 2294a8302bacb cgroup/cpuset: introduce cpuset-v1.c 94033c193bc38 bpf: Reject MEM_ALLOC BTF accesses past object bounds 5b8a40de738b7 time/namespace: Validate nanosecond field in proc_timens_set_offset() 56f92fecd8041 bpf: Reject writes through untrusted BTF pointers 30674a7bbf203 platform/x86: dell-wmi-base: Fix handling of ultra performance key fc45f6e4b86c2 platform/x86: lg-laptop: Fix LED resource handling 2147065d3a4e1 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max 72888d54bae36 usb: gadget: uac: validate rate list length before storing 959ed35f8c8f0 platform/x86: asus-wmi: fix resource leaks on probe failure 0c57c1aede122 platform/x86: asus-wmi: disable USB0 hub on ROG Ally before suspend 201bdf10ae92e esp: do not unref managed frag pages in esp_ssg_unref() b7129930d1ec4 RDMA/rvt: Return NULL after port allocation failure e835bd88ce9dd firmware: arm_scmi: Clean up channels on setup failure d8ecdceeb90cd firmware: arm_scmi: Fix SCMI device destroy lifetimes bd2a5a876904e drm/msm: Only fini scheduler after successful init f3eddc7913e14 drm/sched: Use struct for drm_sched_init() params a6090eeb289c5 bpf: Zero queue and stack outputs on lock failure 7285f004293e7 riscv, bpf: Fix memory leak in bpf_jit_free 28dbc73272283 bpf: remove unused parameter in bpf_jit_binary_pack_finalize 0ee638956cc08 powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data 29a2a166450a3 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() 3886d944b506e RDMA/erdma: complete object teardown when the destroy command fails a5c6316052f0f bpf: Fix WARNING in bpf_tracing_link_release dc6e5d802c884 pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip 566109f1ee4e3 scsi: ufs: core: Validate string descriptors dc884df788e60 scsi: ufs: core: Convert string descriptor format macros to enum 9265fa8190312 spi: oc-tiny: switch to managed controller allocation 6e3e93bc718c4 clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path d867db0a26029 PCI: Fix UAF when probe runs concurrent to dyn ID removal ec023f18ace20 PCI: Fix dyn_id add TOCTOU 65b1fb5670e46 PCI: Make pci_match_one_device() match on ID instead of device e1b23f264f360 PCI: Initialize temporary device in new_id_store() 68c1d2c085f20 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry() d4aec20f3a846 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event() 79c6f4f7d16ee wifi: ath12k: fix stride mismatch in mac_phy_caps_parse() b2ecd548f89a4 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse() c9c1e3da0a206 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published 0b187e14dab45 md/raid1: create serial pool adding rdev to array with serialize_policy=1 5a540ced720b4 misc: sgi-gru: remove interrupt-context page-table walks e086ef5a0e310 mm/treewide: replace pmd_large() with pmd_leaf() 2c321f86846ea wifi: mt76: fix non-AQL packet accounting for MLO stations 7198d8fcfdd3e wifi: mt76: mt7915: unwind state on add_interface failure 3d079589add6e wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface() a582b1d54313d wifi: mt76: mt7915: allocate vif wcid in the same range as stations bc4f4389f439e wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER 5dd845c6388c6 wifi: mt76: cancel reset and rc work on device unregister 7f96bf0d24b2a bpf, x86: Fix trampoline stack size for 128-bit arguments 332c9c1a148d0 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry 5f47c9bc4a62e wifi: nl80211: clean up color-change beacon data on errors 51423d370739a wifi: nl80211: check link is beaconing for color change 66b89c6a7da47 wifi: brcmfmac: fix P2P action frame handling without device vif 9374943fc5a45 wifi: cfg80211: stop PMSR before P2P and NAN teardown e2ddbfd826836 serial: core: do fallible allocations before the console can be registered a9c0ffe5930c9 serial: core: clear freed pointers on uart_register_driver() failure ea3d2fae7c1d6 tty: skip cdev_del() when no cdev is registered 360a49fc53acd HID: logitech-hidpp: Fix FF device cleanup on init failure 37cb84b992718 HID: steam: Reject short reads 17c18a0df70c2 blk-cgroup: fix race between policy activation and blkg destruction 7f97c762b5f6e ublk: check import_ubuf() return value 7dec19f6bafe4 ocfs2: validate inline xattrs during inode block validation df002834cfd88 thermal: hwmon: Remove hwmon class device along with its parent 233f1b7fe2980 RDMA/erdma: Hold QP references for AE and CM processing b672d4de13247 ocfs2: o2hb: quiesce negotiate handlers and timeout work d64708cc119db ocfs2/cluster: keep heartbeat local node stable c0da108b346db ocfs2/heartbeat: fix slot mapping rollback leaks on error paths 4acc761b4e3fe bpf: Clear buf on error in __bpf_get_task_stack a3205bd1f2180 module/dups: Fix use-after-free in kmod_dup_req lifetime handling decea8279bec5 drm/amd/display: Resize MST HDCP per-connector arrays to 32 ba63c62d4252f coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable 710a2448a06a8 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails c97277aa6ce8a btrfs: defrag: fix deadlock between defrag and delalloc space reservation 043b6fd9706e4 btrfs: always wait for ordered extents to avoid OE races 20b2c2f3316e8 btrfs: check if root is readonly when setting posix acl 202ac9e469b78 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() 0fa448369c87e Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind 98666d8feb514 Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero 16c8321ee40c4 bpf, cgroup: Fix storage null-ptr-deref after replacing prog b6c9daf6097f9 bpf: Fix mmap_lock leak in irq_work path 9e71e332fa2c7 NFS: Return a delegation the client fails to record a457ff1189f22 amt: Don't support cross-netns setup. 8f823b47eb889 clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type af811970da4f0 nvmet: fix max_qid race between configfs and controller allocation f535a34831f83 ocfs2: validate orphan slot during inode read eacdd27ca8297 ocfs2: validate DIO orphan slot during inode read 08a31a2cc3d1c null_blk: free zones array on device power-off 53ccb4b967edc blk-iolatency: clear delay state when freeing policy data 6b59f976db5de blk-iocost: clear delay state when freeing policy data 7166d3d60606e blk-cgroup: delay freeing policy data after rcu grace period 5f1fedccf3f7a apparmor: fix deadlock in complain-mode change_hat 67223b1150a9e ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() 7148a6c06ddf1 ksmbd: serialize oplock close with pending break ownership 5ffd180307a5e smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() b68d4bb6b03a6 ksmbd: defer publishing granted locks to prevent UAF/double-free race 795dca34a4154 erofs: fix interlaced ztailpacking pclusters ecdcfa15b3d79 ksmbd: safely discard unregistered deferred locks d20d3f6ad8b0b ksmbd: detach blocked lock requests before freeing 3deefd5fb1368 ksmbd: scope session state changes to bound connections 988f99bfddda4 smb/server: fix session leak in ksmbd_session_register() 51d162dfb618f pnfs/blocklayout: Fix device leaks on parse failure 336b6da10021c NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers e25e5b4a76463 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() 742d0884a1c95 filelock: add some new helper functions 64348c55dd759 vsock: don't check the listener's sk_err in vsock_accept() 45be87c5195f3 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() 793163e134028 ALSA: mtpav: shut down output timer before card teardown 43451ec94fb67 net: qlcnic: validate unified ROM sections before loading 7f8287f606c8c ip6mr: do not clone dst in ip6mr_cache_report() c5ca770248125 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue a23a464fb58eb net_sched: sch_fifo: implement lockless __fifo_dump() 490c72868443f net: bridge: arp/nd proxy: fix reading neigh ha 6093baf2b2c57 vxlan: fix reading neigh ha ed54460caf5b5 NFSv4.1: zero referring call lists before decoding 5fbb06d4f3d4c net/sched: account classifier filter allocations to memcg 4cc1ba2b31065 Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition 19e154d794eb4 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt a78d16530c153 Bluetooth: do not leak an hci_conn when a second LE connect is rejected bdc530baf079e octeontx2-vf: fix workqueue and netdev race in probe/remove b951dd2fd5ede net/sched: act_ife: Only operate on Ethernet frames fd63409b669f9 net/sched: fq: add overflow bounds to quantum and initial quantum e85f039cf271c net_sched: export pfifo_fast prio2band[] 87ec1c55104a1 net_sched: sch_fq: change how @inactive is tracked 3e613afdc2c0c net_sched: sch_fq: struct sched_data reorg 9cbf6da967ec8 netfilter: nf_tables: skip double clone set expressions on element insert 7ee50d42a6d5c HID: sony: clean up device list on probe failure adc34b5df5c5d NFSD: Prevent client use-after-free during close_lru reaping 0d53a47c913d0 NFSD: Prevent client use-after-free during blocked-lock reaping 7a50e138fa28e usb: dwc3: clear forceRM when issuing EndTransfer 5212f8f452b87 usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior 13e9f5a913609 usb: gadget: f_midi: initialize work in f_midi_alloc() 0729ac4976410 usb: gadget: f_midi: Annotate struct f_midi with __counted_by 8cc9c5a8c559d tracing: Take trace_array reference when opening options file ad61defb3e66a dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds 6e904f9e8cb0e mm/huge_memory: transfer the pmd dirty bit to the folio on zap ffbdc2a3834a3 powerpc/kexec_file: Prevent kexec range truncation 22dc712c170ef s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects 4bf5525c6ff4a iio: light: ltrf216a: fix runtime PM reference leak in error path 49ab1dd9051d4 iio: light: ltrf216a: Return floating point values 1759a565a25c8 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU 5c63e2ed840c8 KVM: s390: Fix memory corruption by not reinjecting CK machine checks 50fbc294e4e96 LoongArch: BPF: Refactor jump offset calculation in tail call 22760e3e9cecb f2fs: avoid NULL checkpoint thread access in sysfs ac1284f16d560 f2fs: use new ioprio Macro to get ckpt thread ioprio level d358d2fc6be11 f2fs: fix to migrate all curseg types during free_segment_range 58ca9f0648045 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() 21b7f66716b4f f2fs: fix to clear dirty flag on folio in error path 668cfb8ab3e22 drm/amdgpu: avoid force-completing uninitialized UVD rings 11adb2bae30a3 drm/amdgpu: force complete the KIQ ring fences on reset 5bbd7f283312d drm/amdkfd: Add TLB flush after MES queue eviction/suspension 44cad7ea3532f drm/amdkfd: Fix error path at svm_migrate_copy_to_ram 6e1a6f3ddb87d drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram 5db663fbff7b8 drm/nouveau: unsubscribe the channel-kill event before the fence context 42085d8ff5bbf drm/nouveau: remove chan->drm 5362be1dc65e4 drm/nouveau: remove nouveau_chan.device 2549b61ea1a32 drm/gpuvm: rename struct drm_gpuva_manager to struct drm_gpuvm e79a70c2e97ae bpf: Disable preemption in bpf_get_stackid b4a80e9e639cf PCI: Allow per function PCI slots to fix slot reset on s390 76ca11e31884b PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value 134d980491b43 ksmbd: zero pipe read compound padding ca3a3984bf445 ksmbd: fix tree connection use-after-free in smb2_tree_connect() f1cd6c4c35243 mm/kmemleak: avoid soft lockup when scanning task stacks b1d7c69e6c7d3 mm/mglru: fix and remove redundant unevictable folio handling 92db780dd6445 mm/migrate_device: clear stale mapping after freeing swapcache c2745e657f097 zram: fix out-of-bounds access in writeback_store() a5fda7def04d9 zram: set default primary compressor in zram_destroy_comps() 52d0c5bdfe232 NFSD: check truncate permission under inode lock 64b3baebaf945 nfsd: Pass 'cred' instead of 'rqstp' to some functions. 43943532c105e lockd, nfsd: RCU-protect nlmsvc_ops dispatch d12af460df278 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke 172d038b7c4d3 nfsd: split sc_status out of sc_type 02b0532d4e5a6 NFSD: Clean up nfsd4_encode_layoutreturn() ec55ebe19a4b1 NFSD: Clean up nfsd4_encode_stateid() 2d4f845dffca7 NFSD: Add simple u32, u64, and bool encoders bdce362f49410 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY 98fc1d21a7b80 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops 94f0c73797c30 NFSD: Prevent client use-after-free during delegation revoke 352a278d5a196 ceph: fix UAF in check_new_map() on session freed during unlock 8194d8e61ef0b ceph: cap delegated inode count in ceph_parse_deleg_inos() dd2e9824e5e7d ceph: do not repeat ceph_trim_dentries() if no progress possible 7b8c6af172878 btrfs: drop recovered reloc root refs on recovery failure 772d39c658543 btrfs: rename err to ret in btrfs_recover_relocation() 152610f284de4 btrfs: rename ret to ret2 in btrfs_recover_relocation() 64b870dff9fed btrfs: rename ret to err in btrfs_recover_relocation() cb732d302245b btrfs: fix extent map leak in NOCOW direct I/O write 5463d96cd2e46 cifs: call pagecache_isize_extended() in cifs_setsize() when extending b70bc592afd19 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() d837645a71915 smb: client: reject a tree connect response whose byte count is too small bd146a8ff107c HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes 61f7f4fdc0a83 HID: mcp2221: fix OOB write in mcp2221_raw_event() b879565effd88 ext2: Fix lost inode updates for IS_SYNC inodes 719e69421de28 bpf: Disable preemption in __bpf_get_stack 0e3b8f371c385 dm array: validate array block headers on read de932ab28a17c jbd2: use shrink_type type instead of bool type for __jbd2_journal_clean_checkpoint_list() 882212d317a7c ip: orphan prefetched skbs before multicast forwarding 62b63a505c10e ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() fe3746b41d491 ipv6: annotate data-races around devconf->rpl_seg_enabled f99fedfd1dbff sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir b2e9e10f5a536 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 5bf47bbea3c22 svcrdma: Reject connection when transport allocation fails 5cd069ad1cf7f svcrdma: Handle ADDR_CHANGE CM event properly 8068358f445a1 svcrdma: Reject inline replies that overflow the pull-up buffer beb4e9801f636 svcrdma: Reject Read lists that exceed the page budget 2e35ec558b8ce svcrdma: Use svc_xprt_put to free listener on create failure 38bd18764b766 sunrpc: xprtrdma: Use ERR_CAST() to return 45746d4536ce1 svcrdma: Refactor the creation of listener CMA ID a2a16896ed530 sched/core: Make core-sched flips wait for in-flight selections 6db5af172ccc3 lockd: fix NULL dereference on lockowner allocation failure e5e213ddd69e3 lockd: adapt to breakup of struct file_lock 977ab74712aec filelock: split common fields into struct file_lock_core 6e1645a6ee85d power: supply: charger-manager: register regulators before exposing sysfs 3cda6fe44ec6a power: supply: charger-manager: Convert to platform remove callback returning void 4e3d3923976a9 power: supply: lp8788-charger: fix use-after-free on remove 5625c186f4088 power: supply: lp8788: Use devm_power_supply_register() helper fee7e9a801d1d power: supply: lp8788-charger: Convert to platform remove callback returning void bcdcbef9c5e69 power: supply: max17040: propagate register read errors 6a1ae47211376 iommu/msm: Unwind probe state on registration failure f7c9370dd1d3c platform/x86: ISST: Add a NULL check for sst_inst[] d680ce2b39f9a platform/x86: int1092: Fix potential memory leak in sar_probe() 380b305ad7e34 platform/x86: intel_sar: Check ACPI_HANDLE() against NULL 85ef9d4c384c1 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address 7efe1c31e0903 net: l2tp: do not propagate multicast notification errors b917f37bfcce9 net: ravb: serialize PTP clock teardown 297e96f38d3e4 net/smc: stop killed, freed and out_of_sync sharing a byte 5fa0e71d66636 net/smc: Address spelling errors b78e34ed7e977 mfd: sm501: Fix potential memory leaks during remove b0b8ddaf15110 mfd: sm501: Convert to platform remove callback returning void 7be73911d979b wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() ab403b9db6f71 wifi: iwlwifi: dvm: pair transport op-mode enter/leave d6774f6af3711 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy 3a2d2115ed890 wifi: mt76: mt7915: set correct background radar capability d0c240f25e654 io_uring: defer eventfd signaling when queued from a wakeup handler c0376820922d2 net: tap: fix wrong transport_header when sending VLAN-tagged frame 11ff7642740e6 tap: Keep hdr_len in tap_get_user() 2b9ddb7311c79 ntb: Store original DMA address for future release 4a62c07dd7c15 NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers e85074045bab5 NTB: core: Add .get_dma_dev() callback to ntb_dev_ops 99b82c8452887 tipc: avoid busy looping in tipc_exit_net() 82257379061c0 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp 0464d55734f85 RDMA/rxe: Merge request and complete tasks 603e0ae0bea60 RDMA/rxe: Remove redundant scheduling of rxe_completer 788fbbf7d61f9 tcp: clamp route advmss to TCP_MIN_MSS 3130e7bf43ecf fbdev: Wrap user-invoked calls to fb_set_var() in helper 90be10604936c Bluetooth: ISO: zero the sockaddr before returning it in getname 9a1bd9fd13266 selinux: reject a permission value exceeding the class permission count fef8c8afcb85d drm/amdkfd: Add bounds check for CRAT subtype length 2cbc1fbfc57b1 drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length 5702e4c259809 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie 07b52a4176572 drm/amd/display: use proper context for logging 84cf00b1376c7 dmaengine: idxd: fix double free of wq, engine, and group structs c41fa44be44e4 hwmon: (sht3x) Fix unaligned accesses a9133c4d335e4 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller f0a544ef6e38e Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks a1656234a4a2d Drivers: hv: vmbus: use generic driver_override infrastructure 3d7b808ec3529 netfilter: nf_conntrack_expect: use conntrack GC to reap expectations d031617045dc7 cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size 75ed49f973d79 soc: xilinx: Shutdown and free rx mailbox channel b447688f492b8 soc/xilinx: zynqmp_power: Convert to platform remove callback returning void c305853027c04 scsi: hisi_sas: Add slave_destroy interface for v3 hw 592a0e78ab08f media: atomisp: gc2235: fix UAF and memory leak fa9560b6d3f66 EDAC/igen6: Fix call trace due to missing release() 95cda0446f510 netfilter: synproxy: fix unaligned memory access in timestamp adjustment 370c79e93f0f0 netfilter: synproxy: adjust duplicate timestamp options 1c6cb2838f82e netfilter: synproxy: drop packets if timestamp adjustment fails f03312dad6abe netfilter: make nftables drops visible in net dropmonitor 1b52aeb40c9f0 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag d9b17f9ce67d0 btrfs: lzo: reject compressed segment that overflows the compressed input 30e5ee98e86ad octeontx2-af: npc: Fix size of entry2cntr_map bf862fdee4831 ALSA: seq: oss: Serialize readq reset state with q->lock 31633ba13cc49 coresight: ete: Always save state on power down c67e70202cfd6 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() 24a753a49d068 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg 67a5d905c17a5 drm/amdgpu: reject oversized IBs with per-ring packet limits 1ec5f6aa38ea9 scsi: core: pair EH runtime PM get and put 4a4410de8dc69 sctp: validate cookie AUTH state before use 2512289cbf587 ipvs: revalidate ihl to prevent out-of-bounds access bd897e414451f l2tp: fix tunnel and session refcount leak on seq_file release 3770a4794a143 firewire: ohci: fix NULL pointer dereference in ar_context_release 5d05c4252c09c gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock b87c0d24386ed soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read 5d00c9c1c951a btrfs: lzo: reject inline extents without valid headers fb22bedf0c4f4 bpf: Fix netns reference imbalance in conntrack kfuncs 96da3e1439e7d vhost_iotlb: bound map allocation in add_range ce443f6827b97 hwmon: (pmbus) Fix type confusion in notification logic 4db3b48a966ed netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() 950dac9e8c4e3 s390/ism: Fix UAF of sba and ieq during ism_dev_exit() a9e0efcb1125e watchdog: at91sam9_wdt: prevent timer rearm during teardown 61dd022c55c73 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() cc325ce1c40a1 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx c71bacacd5916 tls: rx: restore msg_iter before TLS 1.3 optimistic retry e3738530ad9c9 selftests: tls: add rekey tests bea345a8d2f02 selftests: tls: add test with a partially invalid iov 25d27d5fa8645 eventfs: Use children field for rcu head and add memory barriers f6cf9832e677e mm/page_table_check: skip special zero mappings ca05d9abde219 btrfs: skip global block reserve accounting for rescue mounts 71714a2cec6c6 netfilter: nf_tables: make nft_object rhltable per table c24b3379c0ff0 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx 724c8edbacf12 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds 52c753b462652 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() 44590dc53c9e9 Bluetooth: ISO: hold sk properly in iso_conn_ready 1106b26e86ac1 octeontx2-af: Block VFs from clobbering special CGX PKIND state dd1a334523ba5 s390/zcrypt: Close speculative mem read possibility f82d42577ee4a wifi: ath11k: cancel SSR work items during PCI shutdown 932ebfad767be OPP: Fix race between OPP addition and lookup a6c5f5d98719e RDMA/hns: Fix log flood after cmd_mbox failure bc963e193b314 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data fc11e3f0daaad nvmet-tcp: fix page fragment cache leak in error path 3f5e8fa9ae290 net: introduce page_frag_cache_drain() bc53b85adb103 nvmet-tcp: allocate socket file cc1c1682fa593 nvmet-tcp: make nvmet_tcp_alloc_queue() a void function 923a6f3172a36 md/raid1,raid10: fix deadlock in read error recovery path d960cd5dbcc6a wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() 0fe5ca2d56f01 vhost: fix vhost_get_avail_idx for a non empty ring 578a4ee936b40 vhost: move smp_rmb() into vhost_get_avail_idx() 9cb2db3791df9 vhost: correct misleading printing information dcabbf7da4382 ocfs2: validate fast symlink target during inode read 394317e96702a ocfs2: add extra consistency checks for chain allocator dinodes 1241e459a1bd1 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount ff584d3735b13 RDMA/siw: Fix endpoint/socket association handling 7b17fdbfb5c9e RDMA/siw: Introduce siw_destroy_cep_sock 628a469d2a73e bpf: Clear rb node linkage when freeing bpf_rb_root f0a49d16804d3 bpf: Reject sleepable BPF_LSM_CGROUP programs at load time ec485257ccbc7 ixgbe: do not configure xps for XDP queues 663f184b51492 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT eae296065ede4 ALSA: seq: Fix kernel heap address leak in bounce_error_event() 7d07df8a200ca ALSA: seq: Drop superfluous filter argument of get_event_dest_client() 8efa9fcc1d31b cxl/region: Block region delete during region creation 3e8f3959a7fd2 bnxt: fix head underflow on XDP head-grow 2fc2c92320272 net: watchdog: fix refcount tracking races ae429220c7f97 ALSA: seq: avoid stale FIFO cells during resize 348a52e50a462 ALSA: seq: Clean up fifo locking with guard a0024ab97592a ALSA: seq: fifo: Use guard() for locking 6b59007d95aee sockmap: Fix use-after-free in udp_bpf_recvmsg() 88baaa8ca3731 RDMA/bnxt_re: Initialize dpi variable to zero 8e59bd37d6d63 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages 7d89bff21c12e RDMA/irdma: Replace waitqueue and flag with completion a2275dce05e6d soundwire: fix bug in sdw_add_element_group_count found by syzkaller a562485c359d0 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE 921e2baa626d1 md/raid1: fix writes_pending and barrier reference leaks on write failures f076460c5205c md/raid10: fix writes_pending leak on write request failures 6d21a3fed9be4 md/raid10: Handle bio_split() errors 80ac31cce5543 md/raid10: fix writes_pending and barrier reference leaks on discard failures 669bc3b345712 bpf: Guard conntrack opts error writes d0282a1546e75 bpf: net: netfilter: drop dead NULL checks 158a5480d5196 md/raid5: avoid R5_Overlap races while breaking stripe batches f49ed02fd8c98 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync 6aeb4ba4fb098 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() 81892d83cc897 sctp: add INIT verification after cookie unpacking cd0e037130806 hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() 5098308ad72f8 sctp: fix addr_wq_timer race in sctp_free_addr_wq() 72e27ef70a202 xen/pvcalls: bound backend response req_id before indexing rsp[] 2e7888bb635d9 afs: Fix reinitialisation of the inode, in particular ->lock_work f72176bde0cc0 HID: bpf: Fix hid_bpf_get_data() range check 268869794170a net/mlx5e: Fix publication race for priv->channel_stats[] 333a39f134dd0 Bluetooth: 6lowpan: avoid untracked enable work e3b20de8d7c06 net/liquidio: drop cached VF pci_dev LUT 3b0aa139ba09a perf/x86/amd/core: Avoid enabling BRS from the SVM reload path db2b40dc12cd6 gpio: mvebu: free generic chips on unbind 2d0effadf8d2c ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() 65d35cb555f40 netfilter: nft_lookup: fix catchall element handling with inverted lookups eb74f3feb68e6 KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling 043c509f24880 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch 6626fb859f4c4 fs: Remove NTFS classic 1dc6653c47147 mtd: maps: vmu-flash: fix fault in unaligned fixup c286319746cef ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec df99ca9b5b8e2 ocfs2: validate i_refcount_loc when refcount flag is set b8fa4d063e3b0 ocfs2: add suballoc slot check in ocfs2_validate_inode_block() f4cd214883d77 ocfs2: correct l_next_free_rec in online check 584d7d14d9b40 nvmet-auth: reject short AUTH_RECEIVE buffers 0bdb510cd7c4b nvmet: Introduce nvmet_req_transfer_len() 374775626c327 dm-verity: fix buffer overflow in FEC calculation face65f80c694 mmc: vub300: fix use-after-free on probe failure 181b46e76a218 wifi: ieee80211: validate MLE common info length d0951ed366710 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey 7e13e5b087375 ovl: check access to copy_file_range source with src mounter creds 98ca831065c4d net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 3b71f51fa3a24 LoongArch: Fix address space mismatch in kexec command line lookup aa24049ce2fc9 loongarch, kexec: change dependency of object files 4927ab8a8acc8 xfrm: fix stale skb->prev after async crypto steals a GSO segment d52ff592abfcd RDMA/irdma: Prevent user-triggered null deref on QP create a5afc00280986 wifi: mac80211: defer link RX stats percpu free to RCU 88f31eac74b9d wifi: cfg80211: add link_station_info structure to support MLO statistics 0246df249c04e wifi: mac80211: refactor populating mesh related fields in sinfo 30c67926d41c4 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock c55590e4c69e0 wifi: cfg80211: use wiphy work for socket owner autodisconnect d312a71b19bb8 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() f6814814b3bdd bpf: Fix UAF in sock clone early bailouts 95ddf04135a78 bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c 8faa3deda8d06 rcu: add rcu_read_lock_dont_migrate() c0131f007dd29 bpf: Disable migration when cloning sock storage bba24ce0e5299 bpf: Disable migration when destroying sock storage 4827c824a203e scsi: core: wake eh reliably when using scsi_schedule_eh 3ff6b534d2082 tipc: serialize udp bearer replicast list updates bac237c2aedb8 pds_core: fix use-after-free on workqueue during remove 895b3f83f030c pds_core: Clean up init/uninit flows to be more readable c004f1985c570 pds_core: Don't assign interrupt index/bound_intr to notifyq c968b2417f6a1 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths 9e904b3608444 cifs: prevent readdir from changing file size due to stale directory metadata 3be8dcc1a5854 drm/vc4: hvs/v3d: Fix null dereference in unbind c8a4acc19dcdc net/mlx5: Fix MCIA register buffer overflow on 32 dword reads 3531910845165 drm/amdgpu: Fix context pstate override handling 2b817c0dfc653 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size dc30139679354 drm/i915/bios: range check LFP Data Block panel_type2 bedeee4612afc drm/i915/gt: Fix NULL deref on sched_engine alloc failure fae63319ad397 drm/i915/mst: limit DP MST ESI service loop 1748043b5114c drm/amdgpu: Release VFCT ACPI table reference 8151bfd641384 drm/amdgpu: Add wrapper for freeing vbios memory 9ed82f9cb1d6c drm/amdgpu: Use dbg level for VBIOS check messages cf55c6f1b62a8 drm/vc4: Shut down BO cache timer before teardown ae6ccae32f51f media: vivid: fix cleanup bugs in vivid_init() 1d0b99ef7fcb6 LoongArch: Move jump_label_init() before parse_early_param() a2516be690488 ksmbd: fix path resolution in ksmbd_vfs_kern_path_create 3350acfa72b2e vfs: make LAST_XXX private to fs/namei.c 3100f7fc873bb ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name a7bf4f5b19965 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state 9174992ee1045 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD 22e371a93563c net/handshake: Take a long-lived file reference at submit 3e339c88b8c30 ALSA: hda/cs35l41: Fix firmware load work teardown eec1dd2586c40 ksmbd: prevent path traversal bypass by restricting caseless retry 2ad5509dd576a ksmbd: use opener credentials for ADS I/O a6a951416b55e ksmbd: validate NTLMv2 response before updating session key 6825a45f6b8ef smb/client: fix chown/chgrp with SMB3 POSIX Extensions 0f012938f2130 cpufreq: qcom-cpufreq-hw: Fix possible double free 203016396f00b cpufreq: Make cpufreq_driver->exit() return void 41401e2f4c175 cpufreq: pcc: Remove empty exit() callback 4e7d3c98fed73 USB: iowarrior: fix use-after-free on disconnect race 8ae9bb92fc9a7 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page 11d48f777cf8f crypto: qat - protect service table iterations with service_lock 02b88fa993582 hwmon: (lm90) Add lock protection to lm90_alert bdad77438cc2b drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() 3812cfe6cb0a5 erofs: fix metabuf leak in inode xattr initialization 8efbea0253b7f ksmbd: validate SID in parent security descriptor during ACL inheritance 5fe97797412aa wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb 55b170713aa54 wifi: mac80211: fix missing RX bitrate update for mesh forwarding path 5ea15e7823225 netfilter: x_tables: allocate hook ops while under mutex 2a5defedd154a netfilter: x_tables: allow initial table replace without emitting audit log message 124f5187c3dd5 netfilter: Use kmemdup_array instead of kmemdup for multiple allocation ff9ecefd488a4 mm/util: Introduce kmemdup_array() 6fe4c808b6cdb netfilter: ebtables: move to two-stage removal scheme 5fc488f46086d netfilter: bridge: eb_tables: close module init race 1fe96176636cb hwmon: (lm90) Stop work before releasing hwmon device b28b862b07257 cgroup/rstat: validate cpu before css_rstat_cpu() access 14dbf22c397b7 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure ee4b2ba9d3015 net/handshake: Drain pending requests at net namespace exit 7b81c1378b79c Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close 6bacd22e1eae7 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers 816c6251409db usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() bbd3a27e4f99f KVM: SEV: Ignore Port I/O requests of length '0' e35cf322897dd drm/amdgpu: fix amdgpu_hmm_range_get_pages 525cc9df65436 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring b0f7bd5eeb903 gcov: use atomic counter updates to fix concurrent access crashes bcc9df992f3cb f2fs: read COW data with the original inode during atomic write 5e10b1747547c fbdev: omap2: fix use-after-free in omapfb_mmap 2d60e3b176a4b fbdev: omap2: fix inconsistent lock returns in omapfb_mmap 01930f94b8b13 drm/msm: always recover the gpu a632474c793b7 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() 9d63dd026644f wifi: mt76: mt7921: Place upper limit on station AID 1cad9afbb2d55 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths 793bf1f4e469c net: mana: Guard mana_remove against double invocation 4255c8f756b78 net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind 7107b047e709a btrfs: only release the dirty pages io tree after successful writes 312ecea13b677 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 87484866cae91 wifi: fix leak if split 6 GHz scanning fails 3bad189a31eb7 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure f51a7b611bd97 tools: ynl: extend netdev sample to dump xdp-rx-metadata-features 8cb3a5ecef999 bpf: make it easier to add new metadata kfunc dd75066882ecc sctp: validate embedded INIT chunk and address list lengths in cookie d95edbbf7830d staging: rtl8723bs: fix buffer over-read in rtw_update_protection 94ea9dc65fae4 staging: rtl8723bs: clean up redundant & parentheses f90cda7f7ae75 Staging: rtl8723bs: Delete dead code from update_current_network() 890083673a623 Staging: rtl8723bs: Remove dead code from _rtw_free_network() 18143799ad51a staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction 6cdcf0d16c809 nvmem: core: fix use-after-free bugs in error paths 38434334a32c6 nvmem: core: Rework layouts to become regular devices cc7ce6736b237 nvmem: Move of_nvmem_layout_get_container() in another header 18ca42f07ad00 of: device: Export of_device_make_bus_id() cbdd6f0fb19a0 fs/mbcache: cancel shrink work before destroying the cache 1034251715a34 btrfs: fix deadlock between reflink and transaction commit when using flushoncommit fdfa287956d00 PCI: use generic driver_override infrastructure 4005cb89139f7 vdpa: use generic driver_override infrastructure dbba371b19129 bus: fsl-mc: use generic driver_override infrastructure 7bedc489611f0 wifi: ath11k: fix memory leaks in beacon template setup e9d197c248e70 powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy 6f571bf37da84 powerpc/64s: Fix unmap race with PMD migration entries a2af91af95369 wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() 533b1a9fa0128 wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() 5895cfc76924a net: pull headers in qdisc_pkt_len_segs_init() 7f0062c40781f sctp: disable BH before calling udp_tunnel_xmit_skb() 166a08644aa50 iommu/amd: Fix clone_alias() to use the original device's devid e4d07fd4e3002 greybus: raw: fix use-after-free on cdev close c260c874a6d57 f2fs: avoid reading already updated pages during GC 0645fa4d48e9b f2fs: fix data loss caused by incorrect use of nat_entry flag 359906450690a ice: fix double-free of tx_buf skb ede973d62d26d netfilter: nat: use kfree_rcu to release ops d8ddbc3330fa6 sched/psi: fix race between file release and pressure write 926ec3937b28d fsnotify: fix inode reference leak in fsnotify_recalc_mask() 759053333a40c libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() 37d028a473b08 tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR 74d33525db50d Revert "net/smc: Introduce TCP ULP support" e327021bd73b1 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE 2405730fde96f netfilter: nf_tables: use list_del_rcu for netlink hooks d8cafd0226d5d selinux: allow multiple opens of /sys/fs/selinux/policy ef8b71a0fc692 iio: frequency: admv1013: fix NULL pointer dereference on str 7afabc08721ec iio: frequency: admv1013: add dev variable f1f4cac657f86 iio: frequency: admv1013: Use devm_regulator_get_enable_read_voltage() 58f9d54a8109f device property: Add fwnode_property_match_property_string() 3e8cdf184646c coresight: tmc-etr: Fix race condition between sysfs and perf mode d772e8570f19a drm/amd/display: Fix dc_link NULL handling in HPD init dd74a790818eb spi: mpc52xx: fix use-after-free on registration failure c6e3b9f5dcb80 spi: mpc52xx: fix controller deregistration 125a7eb177a94 spi: mpc52xx: switch to use modern name 2d8b30b496bc5 RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() d1820a5814ead f2fs: fix fsck inconsistency caused by FGGC of node block 8f3a5dc4055e1 riscv: kvm: fix vector context allocation leak 783dc000b8be6 spi: microchip-core-qspi: control built-in cs manually 03348b440f694 dm-verity-fec: fix reading parity bytes split across blocks (take 3) fcef67506c023 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 165b08d2d1346 KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 b1a45e8a59bcf KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN 2e661773890e6 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT 33deba9bf5c34 RDMA/mlx5: Fix UMR hang in LAG error state unload 4db5e4c8f1103 gfs2: fix memory leaks in gfs2_fill_super error path ab4aeab2d630e iommu/vt-d: Clear Present bit before tearing down context entry 237e0524a5381 erofs: fix inline data read failure for ztailpacking pclusters 107e169f96392 net: stmmac: fix oops when split header is enabled 12addb8ab5eec btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation 8e1623e7d61fa bpf: Fix tcx/netkit detach permissions when prog fd isn't given 11d35b1101344 ipvs: do not keep dest_dst if dev is going down b0dd8637fbaae netfilter: nf_tables: revert commit_mutex usage in reset path c36b0515c6445 iommu/vt-d: Clear Present bit before tearing down PASID entry cde7f709d1025 HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients 63f67e525be21 HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend 53aaf083de197 gfs2: Fix slab-use-after-free in qd_put 32d7120a499d4 list_lru: allow explicit memcg and NUMA node selection 60310ed5d3d3a mm: list_lru: Update kernel documentation to follow the requirements 6451ea47d60a8 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ 1106412414dc3 net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ a71ce398347fe ASoC: amd: acp-mach-common: Add missing error check for clock acquisition baabbd2919151 scsi: qla2xxx: Completely fix fcport double free 73bb6b15f1fd7 i3c: mipi-i3c-hci: Fix race in DMA ring dequeue 04b2853fdbb2e i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue 320942ce316a1 btrfs: reserve enough transaction items for qgroup ioctls 0e77f1c8ebf5b btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() a35b38cb4b0dd btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() 87fc584a72bc4 drm/amdgpu: Skip vcn poison irq release on VF 3cd7a71958c9f drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels 5593c9b255ae7 alpha: fix user-space corruption during memory compaction a91476c7b4091 arch: turn off -Werror for architectures with known warnings aad97c92119cb usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() 480aa6ffd4ac7 9p/xen: protect xen_9pfs_front_free against concurrent calls 566899af05324 vhost: move vdpa group bound check to vhost_vdpa 6f129a251c279 kcm: fix zero-frag skb in frag_list on partial sendmsg error 1cf0ef7399188 team: avoid NETDEV_CHANGEMTU event when unregistering slave c0da84e308a0b wifi: rtw89: pci: validate sequence number of TX release report 5efde07521309 net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query 68fe91df6ea82 netconsole: avoid OOB reads, msg is not nul-terminated 56eab82fa6fb5 ksmbd: fix signededness bug in smb_direct_prepare_negotiation() 5cc021586420c wifi: iwlwifi: fix 22000 series SMEM parsing 759e44a6cba8e xfs: remove xfs_attr_leaf_hasname d60f09d2d16c4 ntfs3: fix circular locking dependency in run_unpack_ex bd5e7ba28a49b fs/ntfs3: Accumulated refactoring changes c939bfa67d221 btrfs: fix zero size inode with non-zero size after log replay cff22dd364b24 btrfs: tree-log: don't use token set/get accessors in fill_inode_item() f03cd10a3513e btrfs: convert to new timestamp accessors 20b98d9ffb097 srcu: Use irq_work to start GP in tiny SRCU 3ff29beb3b82e irqwork: Move data struct to a types header 94ad192f7b9b5 types: move struct rcuwait into types.h f8f3bb89ab677 xfrm: account XFRMA_IF_ID in aevent size calculation 34b8390ac0ba5 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() a05a85779c257 net: ioam6: fix OOB and missing lock 73c2dc2c14d6a x86-64: rename misleadingly named '__copy_user_nocache()' function 3d6de8467236c Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers df966f0def875 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure 218b93b7e284d HID: core: Mitigate potential OOB by removing bogus memset() ca27733152dbd HID: rate-limit hid_warn to prevent log flooding 556a757847aed HID: core: Add reserved item tag for main items 0d377825548fe mpls: add seqcount to protect the platform_label{,s} pair 5057502630fbc net: use skb_header_pointer() for TCPv4 GSO frag_off check dfee8da127baf Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists 1aac6b271e0a8 bpf: Fix incorrect pruning due to atomic fetch precision tracking 1e4b738dd0d0f Bluetooth: hci_event: move wake reason storage into validated event handlers 481f7a463ae4b drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode fdc3aa4c23d3e usb: gadget: f_ecm: Fix net_device lifecycle with device_move b1d854462510f usb: gadget: f_eem: Fix net_device lifecycle with device_move edb0804705188 usb: gadget: f_subset: Fix net_device lifecycle with device_move 9701a98f4459b usb: gadget: f_rndis: Fix net_device lifecycle with device_move ad7d18df7423c ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() 7e345de2e6947 crypto: af_alg - limit RX SG extraction by receive buffer budget 94439cbe478b5 xfrm: hold dev ref until after transport_finish NF_HOOK adc2fe90827e0 xfrm: hold device only for the asynchronous decryption a516594c502fd net: adopt skb_network_offset() and similar helpers a229a4dc87302 net: lan966x: fix page pool leak in error paths 808a34cdbe8ce rxrpc: proc: size address buffers for %pISpc output 3aa77f5da0ecb usb: gadget: f_hid: don't call cdev_init while cdev in use 777a8ebd2da35 KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock f554953cf4fab KVM: SEV: Use long-term pin when registering encrypted memory regions 1eb35c54cd81c s390/mm: Add missing secure storage access fixups for donated memory bac13309339b6 spi: spi-dw-dma: fix print error log when wait finish transaction a8a3fb2888e2c nvmet: move async event work off nvmet-wq 18a4543c1750f ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() b1f62588ab1be cxl/port: Fix use after free of parent_port in cxl_detach_ep() c5e2de193831a net: bcmasp: fix double free of WoL irq d5dcca707f56c iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() 6e8eb467bed6a spi: use generic driver_override infrastructure f69491478e3de drm/amdgpu: prevent immediate PASID reuse case 6ea2a79faed97 drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API 1df0123f96f37 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION 3bba71395ad45 fs: super_set_uuid() c9e845014723d serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN f5a41b61b5faa bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing 44f6b01693b87 bpf, arm64: Enable the inline of bpf_kptr_xchg() f2b29bbe35522 ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz ce6253fe71881 sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting 5e2fc90018635 PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry 3555e41737c0f cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() da5f0166cef3d net: add xmit recursion limit to tunnel xmit functions e873e8c16b2fb tcp: secure_seq: add back ports to TS offset 43ad494ac6e94 ksmbd: add chann_lock to protect ksmbd_chann_list xarray 34614f5dd26c8 btrfs: reject new transactions if the fs is fully read-only b2b9ac2bb2c5b drm/amd/pm: Disable MMIO access during SMU Mode 1 reset 152fc4f7b4a8a ALSA: usb-audio: Prevent excessive number of frames 513587caec66b spi: tegra210-quad: Protect curr_xfer check in IRQ handler 4c7ad40c285ab of: unittest: Fix memory leak in unittest_data_add() 17260b5215d4c staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths 015f9fbcf3382 bpf: Mark bpf_refcount field as unique 11e78304b0113 PCI: endpoint: Add missing NULL check for alloc_workqueue() ab0bdaf7a7f4f net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels d57e31c8df7b8 wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() 13f96c3b73a84 wifi: rtw88: debugfs: support multiple adapters debugging c02b1d244a5d7 wifi: mac80211: don't WARN for connections on invalid channels 863b9b7be824a md: suspend array while updating raid_disks via sysfs 2ad6c244d65a8 md: add new helpers to suspend/resume and lock/unlock array 2284eab166f2d md: add new helpers to suspend/resume array f150854e9a0bc mips: unhide uasm_in_compat_space_p() declaration 9cfda98cf02ea MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits 585a656283c95 functionfs: fix the open/removal races f68515eb8f3cf functionfs, gadgetfs: use simple_recursive_removal() 9aa31e353d9f4 usb: gadget: functionfs: Factorize wait-for-endpoint code 61c3f32b425ab usb: gadget: Support already-mapped DMA SGs 8cf889d45bbc8 Input: lkkbd - disable pending work before freeing device 8fdbc6f9a994e shmem: fix recovery on rename failures b9d8cfd6d77f5 Input: alps - fix use-after-free bugs caused by dev3_register_work 0d0a1a267c1ee scsi: qla2xxx: Clear cmds after chip reset abfbceda0d239 wifi: ath12k: Fix MSDU buffer types handling in RX error path d6028caa0ee39 bpf: Fix stackmap overflow check in __bpf_get_stackid() 5d5d130835b41 coresight: ETR: Fix ETR buffer use-after-free issue dc6d1249ee35c md: fix rcu protection in md_wakeup_thread a17d1bca5aba1 md: fix stopping sync thread 66eb53cecc5f8 gfs2: Prevent recursive memory reclaim 9a8e531543535 scsi: imm: Fix use-after-free bug caused by unfinished delayed work 2eb6a5f6adb7d tty: serial: ip22zilog: Use platform device for probing 79693f738680d serial: ip22zilog: Use port lock wrappers 1c963811b0824 scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3) 51713b285096a scsi: ufs: qcom : Refactor phy_power_on/off calls f0ee42f47cc1b drm/amdgpu: fix gpu page fault after hibernation on PF passthrough 1e00721013ff9 drm/amdgpu: Restore partition mode after reset 1a7865e3e4de2 mlx5: Fix default values in create CQ b68d1f321119b drm/amdgpu: remove two invalid BUG_ON()s e61dfd906ad02 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() 6776866cffbc2 media: nxp: imx8-isi: Fix streaming cleanup on release 0a187ea7a5b4e ASoC: Intel: avs: Do not share the name pointer between components 29c742ff222dd md/raid10: wait barrier before returning discard request with REQ_NOWAIT 3d608e67b966c drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM 8a0fc82502321 drm/amdgpu: Show vram vendor only if available 31d6c9216aa1b Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete 47a92030422d0 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop 69f35d8d17b31 mailbox: zynqmp: Move buffered IPI setup to of_match selected routine 5db5e21b6cd58 mailbox: zynqmp: Move of_match structure closer to usage daa680de4eb91 mailbox: zynqmp-ipi: fix an Excess struct member kernel-doc warning 9f22b5f7f1a32 net: use dst_dev_rcu() in sk_setup_caps() 423895685f367 ipv6: use RCU in ip6_output() 5f75857ed634d crypto: hisilicon/qm - request reserved interrupt for virtual function 7012bea562239 tcp_metrics: use dst_dev_net_rcu() 8b6e327736db0 RISC-V: KVM: Write hgatp register with valid mode bits da513f2ad1b1b ptp: Add a upper bound on max_vclocks dfbff47f120e4 bpf: Check the helper function is valid in get_helper_proto 145b8f1776e5b bpf: add a get_helper_proto() utility function b467ebabf16c9 bpf: improve error message for unsupported helper 3b32cf6e27959 iommu/s390: Make attach succeed when the device was surprise removed 8729dc4eeb502 ice: fix Rx page leak on multi-buffer frames 891ab8c695419 dm-stripe: fix a possible integer overflow 53707bc68fdc7 dm-stripe: limit chunk_sectors to the stripe size fd677c1f51c57 dm: stop using blk_limits_io_{min,opt} fea5d52f89f4f dm-verity: provide dma_alignment limit in io_hints f23d5c6b7540e smb: client: let recv_done verify data_offset, data_length and remaining_data_length dc5aad078abc4 ceph: fix race condition validating r_parent before applying state 9598c83a50a5f mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() 6d40c15d70c2d wifi: mt76: mt7915: fix list corruption after hardware restart e2a6eabe5304a ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog 18e4b315e359f vxlan: Fix NPD when refreshing an FDB entry with a nexthop object 8ba034c41b20d vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects aa977309397fe trace/fgraph: Fix the warning caused by missing unregister notifier dc797a4bbbcac bnxt_en: Fix memory corruption when FW resources change during ifdown 74d3b91f1598e crypto: x86/aegis - Add missing error checks 6758b816ffed5 crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT cbab09ae85675 crypto: x86/aegis128 - improve assembly function prototypes 3223bb62918e5 crypto: x86/aegis128 - optimize length block preparation using SSE4.1 67ddb169e1528 crypto: x86/aegis128 - eliminate some indirect calls f76089018b34d mm/smaps: fix race between smaps_hugetlb_range and migration 1f45a710c82b2 wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() f6510c2eae93e wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data handling 0d9f4f202de15 drm/amd/display: fix a Null pointer dereference vulnerability 7874179a229af drm/amd/display: switch DC over to the new DRM logging macros dcfed7251e23c net/sched: Fix backlog accounting in qdisc_dequeue_internal d26058c2349d7 habanalabs: fix UAF in export_dmabuf() 29a15e06a3d41 drm/amd/pm: fix null pointer access 5c432da1ee191 wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() 3bf99140d7b77 wifi: iwlwifi: return ERR_PTR from opmode start() dcae71222c8b9 rv: Use strings in da monitors tracepoints be27a11a42b21 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() 45be183b9944f drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port 067ca15be8b83 RDMA/hns: Fix double destruction of rsv_qp ea2e6c1503800 wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850 9bcfbd58fc5a0 s390/mm: Fix in_atomic() handling in do_secure_storage_access() e98ce4b70beab Bluetooth: eir: Fix possible crashes on eir_create_adv_data 920c2db46ca44 wifi: ath12k: fix invalid access to memory 2d9a8022009d2 bpf: Do not include stack ptr register in precision backtracking bookkeeping 1b63cdc0d63ae riscv: save the SR_SUM status over switches 1cd09aaf47a57 coresight: holding cscfg_csdev_lock while removing cscfg from csdev 20d00e9b53091 wifi: iwlwifi: don't warn when if there is a FW error 761db4ca3a469 PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops acdfe206be6c7 virtio: break and reset virtio devices on device_shutdown() 3dfbbf72de6b6 virtio: hookup irq_get_affinity callback 9f71fb768d55e driver core: bus: add irq_get_affinity callback to bus_type fc3f1cbf8b1ec virtio: make virtio_bus const b7867e55cbcba bpf: copy_verifier_state() should copy 'loop_entry' field 40d66e0adde4b dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn 47a0da0c80749 clk: sunxi-ng: h616: Reparent GPU clock during frequency changes 8f1b0a4f1ad15 clk: sunxi-ng: h616: Reparent CPU clock during frequency changes c33a7fe6dda59 kasan: avoid sleepable page allocation from atomic context 1c320f6ccc884 um: fix time-travel syscall scheduling hack 52cdc47cf6519 drm/amd/display: prevent hang on link training fail 31dad8d385953 scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue cf3bf87aba2a2 scsi: mpi3mr: Debug ability improvements ae9909d12735b scsi: mpi3mr: Split off bus_reset function from host_reset a9703b006a475 sfc: fix NULL dereferences in ef100_process_design_param() 455a0ba90d0d9 sfc: rip out MDIO support df8a35e8bcea2 sfc: Implement ndo_hwtstamp_(get|set) 9039afe6240ae btrfs: harden block_group::bg_list against list_del() races 53ac3b8ac1d88 btrfs: stop reserving excessive space for block group item insertions 716e065e74f8b btrfs: stop reserving excessive space for block group item updates 9e025844756fd btrfs: remove pointless loop from btrfs_update_block_group() f8f0873dd8975 btrfs: stop doing excessive space reservation for csum deletion 210493962d0ae btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release() 3e8a465bf1ae4 btrfs: reserve space for delayed refs on a per ref basis 85abb0e726cc0 btrfs: allow to run delayed refs by bytes to be released instead of count 25014e3dfa6d2 bpf: Fix kmemleak warning for percpu hashmap 7af81befc0428 fs/ntfs3: Keep write operations atomic 457a034fcb04b fs/ntfs3: Separete common code for file_read/write iter/splice 2bb0e21c84f20 fs/ntfs3: Use function file_inode to get inode from file ab41bf5a211fb ublk: fix handling recovery & reissue in ublk_abort_queue() 08160de2a6522 smb: client: fix UAF in decryption with multichannel c8c6af46286a5 smb: client: allocate crypto only for primary server aae58a39ac4c6 perf: Fix hang while freeing sigtrap event 0554373bc9acc wifi: ath12k: Avoid memory leak while enabling statistics 47297d133eea9 wifi: ath12k: Avoid explicit type cast in monitor status parse handler 2f129230ac7d6 wifi: ath12k: fix incorrect TID updation in DP monitor status path 90c782bc9e8d0 wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info ccb4eaf078697 wifi: ath12k: refactor DP Rxdma ring structure 731e0d5dcbafd wifi: ath12k: avoid explicit HW conversion argument in Rxdma replenish e976114d81746 wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish 27d472b86c19b wifi: ath12k: avoid explicit mac id argument in Rxdma replenish e762406e13446 wifi: ath12k: Remove unnecessary (void*) conversions ce906c4ae5725 RISC-V: KVM: Teardown riscv specific bits after kvm_exit ddfb25dfb16d8 RISC-V: KVM: Add kvm_vcpu_config ec97bd5378c59 wifi: ath11k: update channel list in reg notifier instead reg worker e2f45bfeef5ff wifi: ath11k: fix misspelling of "dma" in num_rxmda_per_pdev 8b7c9c5fec37c wifi: ath11k: add support to select 6 GHz regulatory type 4513843d58d8f f2fs: fix potential deadloop in prepare_compress_overwrite() 9b5e2f1ade251 f2fs: convert f2fs_handle_page_eio() to use folio 77fd40b7ed0c3 btrfs: fix block group refcount race in btrfs_create_pending_block_groups() b6d27f4869c9c ext4: avoid journaling sb update on error if journal is destroying 735c0e603cf25 ext4: define ext4_journal_destroy wrapper f364eb60987a5 ax25: Remove broken autobind b17edabd91714 fs/9p: fix NULL pointer dereference on mkdir 616b4f2d1556c fs/9p: convert mkdir to use get_new_inode 3d0281d071395 net: mctp: unshare packets when reassembling 924ef5959b7cf eth: bnxt: fix truesize for mb-xdp-pass case 9d22cf5cc94cd nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() 6088e11c9aed1 RDMA/mlx5: Fix the recovery flow of the UMR QP 6e59f56161ccc RDMA/mlx5: Fix a WARN during dereg_mr for DM type d63d73d045e48 RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers 50e44aa5f9905 bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT 4ace6fb49c8be btrfs: do proper folio cleanup when cow_file_range() failed 545d6893d3a34 btrfs: do proper folio cleanup when run_delalloc_nocow() failed 6105f0d9cc7be net: ravb: Fix missing rtnl lock in suspend/resume path e2ef3fa31353b net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels 7368f88b2e62d wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion bf66ec718e687 scsi: mpi3mr: Fix possible crash when setting up bsg fails 8458c686d50a8 nilfs2: do not force clear folio if buffer is referenced a306dfff6b76a RDMA/mlx5: Fix implicit ODP use after free 8e2f6ba256dd1 mm: clear uffd-wp PTE/PMD state on mremap() a852466354667 net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue 33b3e09a489a3 rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy 01aaa7935af30 PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() 57d90fe7aab16 powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW 1e9dfe15404dd powerpc/iommu: Move pSeries specific functions to pseries/iommu.c 2855445a1870b udp: Deal with race between UDP socket address change and rehash 6a97bfc0293db RDMA/siw: Remove direct link to net_device 30fc8f6d33bb2 PCI: imx6: Fix suspend/resume support on i.MX6QDL d7dade716905b scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs 465e06ffbb681 vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() e469922fbdf6a udmabuf: fix memory leak on last export_udmabuf() error path 2384a29db79bd udmabuf: change folios array from kmalloc to kvmalloc 0015d54a47995 virtiofs: use pages instead of pointer for kernel direct IO f9f621c5a26e0 fuse: Fix missing FOLL_PIN for direct-io 0335fb698ab04 drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe 1a0aecabff72a io_uring: check for overflows in io_pin_pages 82dc96f0f4eec exfat: fix out-of-bounds access of directory entries 41d73ca1fe161 exfat: convert to new timestamp accessors 9ada9ff6339d4 afs: Fix lock recursion 00872dcc2a3e4 drm/amd/display: Implement bounds check for stream encoder creation in DCN401 64704f231d5de net/ncsi: Disable the ncsi work before freeing the associated structure 98691b2e28a6c l2tp: prevent possible tunnel refcount underflow 692e9a20018da drm/amd/display: Check null pointers before used 4f51f6d23c585 drm/amd/display: Check null pointers before multiple uses 180280f3c4621 drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer 45f2bbe7bc08d bpf: Fix a sdiv overflow issue 7299868253c0e mm, slub: avoid zeroing kmalloc redzone 694eea36e3e16 mm/slub: avoid zeroing outside-object freepointer for single free 6158dbcba6986 slub, kasan: improve interaction of KASAN and slub_debug poisoning f8ba0d22afa61 bpf: Prevent tailcall infinite loop caused by freplace 6fc6ef4cd858a drm/amd/display: Avoid overflow from uint32_t to uint8_t 29ec422b32c69 scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask 6a80b818c63e0 scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock 3543cdaf0185b scsi: lpfc: Change nlp state statistic counters into atomic_t 148b39768ff2b scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs 2d0dfb1f2fad2 scsi: lpfc: Fix failure to delete vports when discovery is in progress 117df33ecfd8a drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range 0c1e8a6f7ce9b drm/amd/display: Use kcalloc() instead of kzalloc() 7eed5b3115ce9 pktgen: use cpus_read_lock() in pg_net_init() 2a0ba376cdf72 serial: sc16is7xx: fix TX fifo corruption 97cee643a8258 PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() 2011c0ebaf710 mm/huge_memory: avoid PMD-size page cache if needed 6d1f6dd02a2d7 mm: simplify thp_vma_allowable_order 88f520120f999 mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" acf609843a848 gve: Account for stopped queues when reading NIC stats 7d5711e03cefd s390/pkey: Wipe copies of protected- and secure-keys 3732398dcf65d s390/pkey: harmonize pkey s390 debug feature calls 1f7f63f7165d1 ice: Fix improper extts handling 1eb6c4a0d83d1 drm/amdgpu: fix double free err_addr pointer warnings 9aa83a5eb013f ice: Don't process extts if PTP is disabled 2bbfffa802adc bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() c20d0fa873039 bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() d35130036d327 sched: fix warning in sched_setaffinity f8005214946fd sched/deadline: Fix task_struct reference leak 251840f22eff3 drm/amdgpu: change vm->task_info handling 2860d59e4ce2b net: nexthop: Increase weight to u16 942ae3d64c3ce net: nexthop: Have all NH notifiers carry NH ID f6dd625053726 drm/msm/dpu: Add mutex lock in control vblank irq fee05f14bf747 drm/msm/dpu: shift IRQ indices by 1 ec2e11c1d36db tty: add break_wait kernel-doc 5e8f3ac8fa3d4 namespace: handle mount locking for automounts correctly 55d7433e26c79 fcntl: refuse F_SET_RW_HINT on an immutable inode b98dd4af91ade namespace: check the target before walking it in do_mount_setattr() 86a2d56b19607 namespace: don't copy an unmounted mount tree db90eecbde319 namespace: unhash a dentry before detaching the mounts on it 013c060b2f122 drm/vc4: Fix firmware reference leak in vc4_drm_bind() 45f2d1a6edf1c scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() 49dd29ce73653 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock() cce865a62cec3 scsi: ufs: core: Add debug log for MCQ command timeout 4813a6624ce48 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe() 40589a91c7b9b scsi: ufs: mcq: Remove unused parameters ec6ecab1b7577 scsi: ch: Do not keep references to data transfer element devices 37a0d6e81a42e scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ 262062c01f5a8 optee: register TEE devices only once fully initialized cf59abb49e91f wifi: ath12k: copy M3 firmware when reusing the buffer 4af250fc84828 wifi: ath12k: fix reusing m3 memory 2be324c89993c ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params 60b5824ae259a ASoC: hdac_hda: Fix hlink refcount leak on component registration failure 3b8a540b36aa0 ALSA: control: Don't add invalid kcontrols to LED layer c17fe25dcb55a ACPI: processor_idle: Mark LPI enter functions as __cpuidle 444b0e44aa430 net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv 7b3b902320214 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv 04474009a2ea7 most: core: fix leak on early registration failure 82f42a13e3d7a most: core: fix resource leak in most_register_interface error paths a56d4f8f8f4c5 namespace: check the mounts before reading their parents in pivot_root() 99698cfa34e49 namespace: don't inherit MNT_UMOUNT in clone_mnt() 9b6ed57eb8c89 Bluetooth: ISO: Serialize concurrent connect calls db6fbc2b77849 drm/vmwgfx: validate pitch coming from userspace 4dc3d5a004b8f Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex f01cbddfb4273 Bluetooth: hci_sync: Fix command skb lifetime during scan setup b21f20320fa2f net: team: stop reusing skb after queue override 9486377e5e971 net: team: fix NULL pointer dereference in team_xmit during mode change 84600e7b30fc1 net: team: Rename port_disabled team mode op to port_tx_disabled 85cf6665154de net: team: Remove unused team_mode_op, port_enabled 4f46ac83d87a4 netfilter: nf_tables: fix bidirectional offload regression 089f10b47843a apparmor: fix cred UAF caused by begin_current_label_crit_section() 20c52a7041409 ALSA: mixer: oss: Add card disconnect checkpoints c937a494901df ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger d9df965284abd ALSA: pcm: oss: Fix setup list UAF on proc write error 8f27d152b2a59 nvme-tcp: sanitize request list handling 604cf76a6a7e8 llist: add interface to check if a node is on a list. 24120e90d4638 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge 522fd1a6efd0a mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP 1f26323565177 ice: fix metadata_dst refcount handling on representor teardown b14a682ad7d45 ip6_gre: remove obsolete ERSPAN PMTU update 578d39ab420b1 tracing: Set the trace clock before registering the histogram trigger cbf9961602ffb HID: steam: Clean up locking 3c2f97343d4df HID: steam: Refactor registration d2587923d50c8 HID: steam: Rearrange teardown sequence 5f135cfc1d68c HID: steam: Fully unregister controller when hidraw is opened 0aa096eec8d87 HID: hid-steam: Make client_opened a counter dd7a39f644373 drm/amd/display: Don't replace a sink mode that shares the native totals 8ed6cf7f77915 can: fix unique skb identifier regression under RPS 2deafd015ea9a dlm: validate length in dlm_search_rsb_tree 99b8bd6323e6f wifi: mt76: mt7603: initialize global station WCID 63ec518b737c4 netfilter: flowtable: fix offloaded ct timeout never being extended 5d3ee9fc5fb08 netfilter: conntrack: fix erronous removal of offload bit b7b80d204abdc net: openvswitch: validate transport header presence in set_ipv6_addr 41ad5bcf0219a mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() 3e531d85b7823 net/mlx5e: Order ICOSQ cc update after CQ doorbell 194685b13dc9e veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down c44c02c930c65 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() 774856241e7dc net/sched: cls_route: reject change with no routing attribute d9e08836d06c8 flow_dissector: avoid u16 truncation of skb->len when computing thoff 2c64c30d493d8 ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM 2cb098262ce2f ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes 58905982b0d91 ASoC: adau1372: allow sleepy powerdown GPIOs 50deef6dc4dd4 wifi: mt76: mt792x: pick the SAR table layout from the table itself 26f0504432add wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit 7a53bb4668b31 btrfs: fix xattr replace when multiple xattrs are packed in the same item 3c231142c4f4b nvmet: use the local P2P device on metadata allocation failure 8739f06e3f82c cxgb4/ch_ktls: disable softirqs around tid_list erases 95114e4211962 amt: send the relay's General Query directly from the receive path 00bcc303000ba net/sched: em_text: reject unterminated algo before autoload bf2848e50bd73 drm/vc4: Free the BO cache size list on teardown ad8a96a9e0fee drm/aspeed: Balance the display clock enable on teardown bf3d841ef12fc gpio: exar: initialize the ID before registering its cleanup f424fc191ec2b drm/dp: don't mark the AUX backlight enabled when enabling failed 95fb7c259b86f namespace: refuse an automount below a mount that is in no namespace 5e6bfd9f249f2 dcache: don't put a mountpoint on a dentry that's being removed f639428183449 namespace: check a submount for references right before unmounting it cae49d34f0cd1 fs: refuse fspick() on internal superblocks d63df57e738a3 drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs b5f813f500c44 drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks 067c88010df80 drm/amdgpu: make Mac FB workaround generic 037796d9ca1da drm/amdgpu: serialize vblank counter reads against GPU reset 8a2b420ee227a drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info 4a86f0a696f48 drm/amdkfd: align SDMA doorbell base for shader doorbell writes 17c5fa371de2d drm/vc4: drain the hangcheck timer and works on V3D unbind 77abc1837c965 drm/i915/gt: Unmask interrupts only when ACTIVE is true 24c04e80c35ff drm/i915/gem: Prevent overstepping exec array boundary a5ce29550386f drm/gud: don't keep a connector without a CRTC as connector_state 4a2006c675758 drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN d5c372ad03330 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown a54ce160e3ef7 Bluetooth: RFCOMM: free the skb when the DLC has no owner 44ce36c5789ac Bluetooth: MGMT: Fix status of pending commands flushed on power off 37cef0c8fb537 Bluetooth: hci_sock: Serialize dead-device detachment 8181a1a45c706 scsi: qedi: Initialize callback state before registration a613e4fafb47c iio: light: Drop ROHM BU27034 7e90b11a4f699 pmdomain: rockchip: propagate subdomain add errors 1b476b9a90ac9 pmdomain: rockchip: fix clock leak on domain probe failure b94c6104c4949 pmdomain: rockchip: don't ignore clock lookup errors on attach 3601dd1cdc97c pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains 1ea151615a82f regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 fd376d8374111 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers c995c52eba192 openvswitch: fix soft lockup in the netlink flow dump ab0d2a6fe87e8 nvme: fix swapped ZRASF zone state values for full and read only c128173919a65 net: usb: ax88179_178a: fix rx frame length for non-last packets 1e4d51d903ecf net: dsa: microchip: fix KSZ8765 fiber detection 695a5a4c69c92 net: bridge: avoid recursive multicast port cleanup e607017a553d2 net/smc: protect clcsock lifetime in smc_getname d8a24b9e1774a net/packet: guard the ll header push in packet_rcv_spkt() 605a59639abb9 mmc: sdhci-sprd: disable runtime PM on remove 9e799f25c420e mmc: mtk-sd: Cancel request timeout work on remove 5d4cdd4a15075 mmc: cavium-thunderx: destroy slot platform devices on remove a1019e0722049 mmc: cavium-octeon: destroy slot platform devices on remove 281f68d6cf8ac dm: fix reading free memory in do_resume bcfb26658e0fa dm-snap: reject the transient exception store for snapshot-merge 9a0dab8a9d997 dm-crypt: reject the lmk IV mode with AEAD ciphers f2c181e1d58e9 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them c3ab92542475d memstick: core: wait for request completion before freeing card 305f1828b871d KEYS: Fix add_key() race with keyring restriction f7bff12d5de4b keys: finalize persistent keyring timeout after link attempt c2e0cbb587a8a ibmveth: fix TX LTB and filter unwind on open-fail decb4d4ead2c7 ibmveth: h_free logical LAN on open-fail after register b07b3925f6766 gpio: xilinx: fix runtime PM leak on request error path ce45166daf6bd EDAC/amd64: Mask UMC chip select to the four implemented selects be0167091542e sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute a545def625860 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts a07d325ebb37a selinux: fix data race on AVC latest_notif af4b3d33f2ff5 Revert "wifi: libertas: reject short monitor TX frames" b60259d4047fb tipc: hold a reference to nodes found by link name 7f796bb3b440d tipc: destroy topsrv workqueues before closing connections dbee987ecf312 swiotlb: fix default_swiotlb_limit() for non-growable default pool a18dd388045dc strparser: make sure __strp_recv isn't running before tearing down the parser 5051df0311447 xen/netfront: don't leak the skb when xennet_fill_frags() fails 3dc61af2998cf workqueue: Fix NULL current_pwq deref in chained work check fb5ce4c7790c3 wireguard: noise: reject response consumption after intermediate initiation b261dbed0c538 wireguard: queueing: preserve tstamp_type when encapsulating packet 7b79131e357c4 wifi: brcmfmac: fix P2P device removal race in brcmf_detach() 3ad7606400f38 usb: f81604: fix struct f81604_int_data size mismatch 98195e822343a dm ioctl: don't let data_start run past the buffer 41cabfbf3532e btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() 496a45b7c6705 ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) e35becbd03191 arm64: irq: exclude the softirq stack switch from KCOV 1eeeb4d315401 Input: xpad - add support for Corsair Novablade Pro 8a3b935b6b603 ipv6: do not warn on route notification size race 088ba80eef85f ipv4: do not warn on route notification size race 72d9d17092bb3 ipv4: stop route notification sizing when nexthop group shrinks 7fd60d3c9a1e1 ipv4: stop PMTU walk when nexthop group shrinks 408c78e50feab crypto: drbg - Fix ineffective sanity check 8f1215a370e89 netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting 80861f424fe5c Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING 45adb04a8ad0c mm/damon/core: fix unconditionally skip last region e3c206de1fcba mm/damon/core: do non-safe region walk on kdamond_apply_schemes() 82ecc6b5af65d f2fs: fix to reset all pinned status during fggc 9f5510b0452ba f2fs: fix to shrink gc_lock coverage in f2fs_gc_range() f4ee42c35022a f2fs: fix to reclaim space in f2fs_allocate_pinning_section() 7d7ad2bea4eed HID: uhid: convert to hid_safe_input_report() b9d2deecddae7 HID: core: introduce hid_safe_input_report() f1dc59675d542 wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie() 909b31661be70 iio: cdc: ad7150: fix OF matching and publish module aliases a2df3f13f00b3 smb: client: only require read lease for size-extending preallocate 55f1cebee909c iio: adc: stm32-adc: fix possible division by zero in processed channel b950ad53ca6ea iio: adc: axp288: Add TS bias override for Haier HV103H f66a164ea6bd4 iio: adc: max1363: sign-extend bipolar differential channel reads 9f503cda04f2c iio: adc: aspeed: propagate reset deassert errors 3d8019516f028 iio: adc: aspeed: Simplify with dev_err_probe 975b09bc680ac iio: adc: ad_sigma_delta: fix use-after-free on unbind 3df27277f8f95 smb: client: discard post-EOF pagecache when extending a file via zero range 6535f7084d958 wifi: mac80211: set info->band for 802.3 encap offload frames 40d7e969b6f15 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit() 84da7a0e92207 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted b1ac8181a59ab mm/hugetlb: fix avoid_reserve to allow taking folio from subpool 6a2baff6fecae net: mana: remove double CQ cleanup in mana_create_rxq error path cd9c62753becf net: mana: Skip WQ object destruction for uninitialized RXQ 263d45141069a net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq() f3a52e2ec2788 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry 32bbb870078d4 net/mlx5e: Prevent stale XSK buffer release on refill retry f1c966eb6ed5e fs: Free any excess xarray nodes in clear_inode() 2a74f30a7bb30 iio: health: max30102: fix NULL dereference in interrupt handler b76f068b2d3d0 iio: core: add accessors 'masklength' 4ae6ed5b6074d wifi: mac80211: count only matching reservations in reserved switch 47864a9092fd6 wifi: mac80211: keep paired old chanctx alive 6b5366ba63a58 jbd2: bound shrinker scans by examined checkpoint buffers dc7ece0b827fe jbd2: check need_resched() when skipping busy checkpoint buffers 6198123cac2ff gpio: rockchip: fix generic IRQ chip leak on remove 77b6ff33c8f56 gpio: rockchip: teardown bugs and resource leaks d4cf99c7ea95a firmware: arm_scmi: Unwind TX receiver mailbox setup failure 50e38091a657a firmware: arm_scmi: Publish channel state before callbacks b1a86a5ab0d44 fbdev: hyperv_fb: Allow graceful removal of framebuffer 3a489c3bbf5ed fbdev: hyperv_fb: Simplify hvfb_putmem 18f9f3ddbf2ed erofs: unify lcn as u64 for 32-bit platforms b18a82503a67a erofs: avoid infinite loops due to corrupted subpage compact indexes 6b6b47c1aa717 ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers 796207e63c51f ASoC: SOF: topology: Parse DAI type token for dspless mode ce220b4cdf62f tty: port: fix tty_port_tty_vhangup() race cf8530a25ae92 bnxt_en: fix DMA mapping length for padded small packets b4f2a7ae80ed4 mtd: spinand: Enable QE on all dies bff83b723e93a mtd: block2mtd: Fix divide error when erase_size is zero 057320c36c5a2 block2mtd: prevent direct access of bd_inode 8736c49d6ff27 mtd: block2mtd: Convert to bdev_open_by_dev/path() de77b0f681421 wifi: mac80211: keep fallback association elements alive d0da6ab1fc53a wifi: mac80211: shut down RX BA session timer on teardown 77c449c9c946f mtd: spinand: fix NULL pointer dereference with no ECC engine 1fbc4b24c7443 apparmor: Fix & Optimize table creation from possibly unaligned memory bd00629b52788 AppArmor: Allow apparmor to handle unaligned dfa tables 122b1fdcd26b5 drm/amd/display: Mark DCE 6.4 as not APU 04c259eaceba4 i2c: xiic: preserve PEC byte length in SMBus block read setup 7b42e4a70f8c4 i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode 4ae00993e6d92 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194 3cdad0c541f89 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() 0af044c47a957 serial: ma35d1: Convert to platform remove callback returning void 2f973fe58d70e serial: fix TIOCMIWAIT race 158a07da2da72 tty: serial: max3100: shut down timer before freeing port b71f75408c466 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2 16032c980d8f7 tty: tty_port: restore TTY_IO_ERROR on activation failure 402b1aceabfb4 usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 5a206e64ae8ab drm/amd/display: Preserve eDP mode on initial ASSR failure 82cc242da6d62 USB: dwc2: shut down wakeup timer before freeing HCD state 4f35e6be2f86b usb: ohci-spear: disable controller wakeup on removal 7037a6a567223 usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() c1e3aed32da03 drm/amdgpu: reset VI ASIC on MacBookPro14,3 79c4721c17fbc drm/amdgpu: reset VI ASIC on MacBookPro15,1 29302964ef583 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend 12dace1387d3c fsverity: add dependency on 64K or smaller pages 0a5c76eb3950a KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP e786386c882d5 arm64: errata: Add Cortex-A725 erratum 3821522 workaround fb8b57d0321f6 arm64: errata: Factor out broken AMU const counter cap 94afa17d6bfd5 Bluetooth: Serialize SMP remote OOB data access f997e03e2ef58 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown 052acee988011 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems 8c38cb055f6a9 perf: Require kernel access for text poke events 6b4e15cccfbe0 tty: fix saved termios reset race 6cd82563bb270 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count bc992b73f7af6 drm/amd/display: Fix fast updates on DCE 8.1 3f3b0898557a9 fs,fsverity: remove check for fsverity being enabled in setattr_prepare() a4ca8102e70e1 fs,fsverity: reject size changes on fsverity files in setattr_prepare 0542d213253ee xen/netfront: drop RX packets with a short Ethernet header 5ea733af79616 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling 424e4d0bc47f0 usb: typec: tcpm: fix debug accessory mode detection for sink ports 0a2f71ccf9c20 usb: gadget: f_fs: Fix Use-After-Free in AIO error path aee2fde0f39e2 USB: gadget: ffs: fix mm lifetime handling 723d73b245843 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed 09ddd44db0a84 usb: gadget: at91_udc: Convert to platform remove callback returning void abc17fd508a51 serial: imx: serialize imx_uart_ports[] lifetime 4663bded2e49a serial: imx: Convert to platform remove callback returning void dd34630226211 net: usb: qmi_wwan: add Quectel EG120K-EA ffac3399bf627 wifi: wlcore: Fix runtime PM leak in wlcore_remove() 8435103a82aa7 wifi: wlcore: Convert to platform remove callback returning void 75b3b30ae4ee6 mptcp: prevent race between disconnect() and rtx 0f7668bcf6685 tcp: introduce icsk->icsk_keepalive_timer 9116b5ef5a5b3 mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages c073d01f6f536 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF 4b5ebb4f91a61 SUNRPC: reject duplicate CREDS_VALUE options 8c56a46db3b75 SUNRPC: fix gssx_dec_option_array error path bugs 574af7c61f2be drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read dd0c3e6c03e3b KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save c873363497808 jfs: fix array-index-out-of-bounds read in add_missing_indices ac5d26a46c90f iio: trigger: cancel reenable_work before freeing trigger 42eb8c2cf1744 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler 2272efb10096e iio: proximity: sx9324: Correct proximity channel resolution 2c8211eef9892 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure 59ab2f302548d iio: proximity: isl29501: Fix return type of isl29501_register_write 05ef1af381a0f iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup 85c20d1cf3f01 iio: light: gp2ap020a00f: drain irq_work after free_irq 8a78224497271 iio: imu: adis16480: fix unprotected debugfs reads d3078aaef8af4 iio: imu: adis16400: fix unprotected debugfs reads b62c3944c006c iio: gyro: adis16136: fix unprotected debugfs reads 2bde96b2857aa iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw() b4f53cec8cc94 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. 6a728408ff522 iio: buffer: serialize buffer teardown with mode claims 012451d72c122 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind d94d2ec25ff26 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls 53473b0556296 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure 01d20048ab0e2 iio: adc: stm32-adc: fix check on internal channel availability 57628402e9cbf iio: accel: sca3000: fix frequency divider condition check 137c35cff4d4d iio: accel: kxcjk-1013: reject duplicate event disable 3b8e7928cf192 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races b270c1074860d thunderbolt: Reject oversized XDomain properties responses 7bca83bf8ba00 thunderbolt: Disable CL states for the Anker Prime TB5 dock b70b9c41f240c thunderbolt: Fix KASAN reported use-after-free when request is canceled 4375b5d91db4d USB: serial: option: add Compal EXC-T1 support 992a471458f96 USB: serial: option: add Quectel RG660QB 85750b58e8d4f USB: serial: option: add Compal EXM-G1x support 9c910016df78c USB: serial: option: add Quectel EG060W bb5487f3aadbe USB: serial: option: add support for SIMCom SIM8260C 24d6edb6bd7f7 USB: serial: fix ioctl hangup race e7ad832b1144d USB: serial: fix driver deregistration order 2917216123615 USB: serial: fix dynamic id driver deregistration race f8e290609546a USB: serial: ssu100: fix baud rate overflow 7ee47aea0baca USB: serial: quatech2: fix baud rate overflow e7fa5128bcc4f USB: serial: cp210x: add Corsair AX1500i Power Supply 0b1e4a7eeb6a3 wifi: mac80211: handle empty FILS association request payload ebb7cba623d38 wifi: mac80211: fix mesh fast xmit path deletion UAF 57bfaa8b28534 wifi: mac80211: release mesh path quota on failed additions eebc70f132041 wifi: mac80211: minstrel_ht: validate fixed rate index c66ab4b94bb04 wifi: mac80211: account proxy paths against the mesh path limit cbff71fe689f3 wifi: mac80211: drain PS delivery work during station teardown 3ebc529726c0c wifi: iwlegacy: 3945: free EEPROM data on remove b66539a4dab12 wifi: cw1200: fix TX padding OOB read leaking heap data to device 951fce1510645 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy 40d855d6ad463 mtd: spinand: fix zero oobavail when no ECC engine is used e238c19826cc9 mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB c69d8aceda362 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ ef4dfad231a78 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() e7188a268c356 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT 3045128294d34 nvme-multipath: fix underflow in ANA log bounds checks 5a2b9cc53719b net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules fdbd83c2d929e net: extend IPv6 exthdr detection of tunneled packets 3776f34fbce99 HID: multitouch: stop the release timer from being rearmed on remove bc9ff8e64771c ipvs: bound LBLCR and LBLC cache growth be58b239d2be5 Bluetooth: btintel: fix buffer over-read in btintel_hw_error() 545fa70f730eb Bluetooth: hci_core: Serialize fragmented ISO packet queueing 780affacd9297 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion b208818492cde Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems 70b55855eecb4 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup ddc9edb244cc8 Bluetooth: hci_sync: Fix inquiry cache use-after-free 55d162aa00d1e Bluetooth: RFCOMM: Fix initial port reference race 48f0e0bcf683f i2c: xiic: don't clobber msg->len to signal block-read completion ada5ded765f05 ALSA: ua101: reject mismatched capture/playback packet sizes 2db234e163f0d ALSA: seq: Serialize compat port-info ioctls 775df6a27e843 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints 30a60e74ee71d ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type a756c93fae312 ASoC: codecs: max98363: fix uninitialized stream_config->type 3d9faec1da7e8 serial: vt8500: Fix clock reference leak in vt8500_serial_probe() 2c4ddc8ed0d87 serial: tegra: don't clear the Tx FIFO on an Rx-only reset dd81650bec58a serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() 6c9c9367351a4 tty: abort break signalling on hangup a42d96e8101ca tty: serial: qcom_geni_serial: Keep console RX functional after deep idle 57753441ef84b tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup 4b59afc8af314 tty: vcc: zero-initialize control packet in vcc_send_ctl() 674b1c890322f tty: amiserial: fix broken TIOCMIWAIT bdda8d889accc tty: vt: fix memory leak in vc_allocate() dbdd0ca9a7eac usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe efdf0ddaed011 usb: cdns3: fix use-after-free in cdns3_gadget_exit() 9a86cdb675949 usb: typec: ucsi: displayport: Current CAM OOB index fixup abe93f73639da usb: typec: ucsi: Get the connector fwnode based on reg value a39d53f70e637 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() ae8aae45a39fc usb: typec: tcpm: recover after failure to start the frs ams 198d74dcfa129 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints 40fef138eb6c1 usb: chipidea: tegra: disable runtime PM on resume failure 06ac8609d6d18 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC 6849e51b89de5 USB: gadget: dummy-hcd: Fix wait for outstanding request completions 0d39ac4f65f93 usb: gadget: aspeed-vhub: cancel wake work on device removal be347590e188d usb: dwc3: am62: Fix runtime PM usage count leak on probe error path a789838675afa usb: typec: anx7411 - stop the IRQ before destroying the workqueue da841c1511a61 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd 18138d9f19cf6 usb: gadget: midi2: Fix the jack descriptor array sizes 61db743284896 usb: ohci-st: disable controller wakeup on removal 203094415f85c usb: ohci-s3c2410: disable controller wakeup on removal 2cf192041c00b usb: ohci-da8xx: disable controller wakeup on cleanup ba0f023cee31c usb: octeon-hcd: fix the FIFO-flush timeout computation e4df763ba3c4f usb: hub: use shorter 120ms post resume hold for SS root hubs 4faaad69f1833 usb: storage: sierra_ms: reject short SWoC info transfers e4a6883ad9b46 USB: serial: fix port tear down use-after-free d86775e79838d USB: cdc-acm: skip URB restart in port_shutdown if disconnected 451ded3b33bef USB: cdc-acm: fix racy TIOCMIWAIT implementation 4cea8e5b6c593 soc: qcom: geni-se: Correct QUP Core ICC vote constants 8bde6f643ab6f nitro_enclaves: fix use-after-free on SLOT_ALLOC failure d74220bb59af0 Input: synaptics - limit T440p InterTouch quirk to LEN0036 a2300ca8797eb Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 9ef8a8de8717d Input: s6sy761 - fix resume ordering and restore sensing dee75ece52b6a Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 a71adc66e8401 Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 69b1ed4acc56c kgdboc: Fix tty driver reference leak in configure_kgdboc() a7329ea53d04f binder: fix leaked fd fixups on TF_UPDATE_TXN supersede e9b364e46d594 binder: fix is_failure flag for superseded transaction cleanup d700c26ed64bd drm/amdgpu: fix ACP MFD device leak on init failure f6364e7284a13 drm/amdgpu: fix IP instance memory leak on kobject add failure 4a0ae61067671 drm/mediatek: Fix pdev reference leak in mtk_drm_bind() 03fb1c657028c drm/mediatek: Fix ovl adaptor platform device leak f0ffb09cf1bf2 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device bc7255b8623de drm/radeon: Read the VRAM VBIOS signature with readb() 2aee72150b0ea drm/amdgpu/gfx6: fix firmware leak on teardown e28008f8d5020 drm/amd/pm/si: Fix updating clock limits on AC/DC 48ab11f054267 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC e0c2f42f7c608 PCI: Accept AtomicOps already enabled by the hypervisor a2047aff72ce5 ALSA: ice1712: Fix the error handling via auto-cleanup at probe 80c7c10debd3a ALSA: core: Define auto-cleanup for snd_card_free() 655acfa713bce perf: Fix race between perf_event_exit_task() and perf_pending_task() 22efeebe688fe i2c: at91: release DMA channels when probe defers 4ab37e4f4a33c ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() 963e11f65c1be net: add and use skb_get_hash_net 68f35f8ffa803 net: sparx5: make ports inherit the switch base mac address type ef82f57fc999e net: microchip: vcap: stop scanning after deleting key field f7e292f3c8c85 netfilter: flowtable: generalize pending status bit 28c2a0ed2657b netfilter: conntrack: rework offload nf_conn timeout extension logic b6aefccb76489 netfilter: conntrack: remove skb argument from nf_ct_refresh 752492947be31 netfilter: bpf: reject invalid NAT manipulation types d7d33c9efa9d1 ipvs: filter some flags received in the backup server 1c68bfde05276 ipvs: do not create invisible templates 0632541dbfa43 ipvs: fix missing counter decrement in lblc 0c52040a3f69f tcp: refresh TS.Recent for accepted old ACKs efc91ab1d97bd net: ethernet: mtk_eth_soc: allocate dummy netdev sooner 213ff02ab26a4 net: bcmgenet: fix NULL dereference in set_coalesce before first open 41583c7d80ea6 net/sched: sch_codel: match the no-drop threshold to the packet size 5172124684e12 net/sched: fq_codel: match the no-drop threshold to the packet size a85a3dce4b6c7 tipc: prevent GCM nonce reuse on peer key changes f9531e8331790 octeontx2-af: mcs: Fix SC resource cleanup loop 5b353908e3be9 net: systemport: Fix RUNT MIB counter register offset calculation 96a2b04205155 net: systemport: Fix buffer overflow in bcm_sysport_get_stats() b11acfcb5925e Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister 71d660ec3c5d4 netfilter: ipset: do not update comments from kernel-side adds 44b6c6a3d10ac ipv6: fix prefix route expiry in modify_prefix_route() 0fc74e7d97d23 net/sched: cls_api: reclaim an empty proto on the error path 288ef37e0c463 net/mctp: publish the mctp_dev only after it is initialised 7df748aa9f9ec Bluetooth: btintel: validate DDC record lengths bb5d897e1c5e8 Bluetooth: hci_core: free the HCI ID if naming fails 0edda2d686666 ASoC: codecs: rt274: Fix format setting for 44100 rate d7b0b90517d23 ASoC: codecs: rt286: Revert delay value for jack setup 2fe08c8ff2684 wifi: mac80211: prevent AP VLAN tx from other interfaces 8c01127f8940e wifi: mac80211: Add 802.3 multicast encapsulation offload support 2d822b7b09828 wifi: mac80211: Add multicast to unicast support for 802.3 path 5617d53288390 wifi: cfg80211: preserve hidden-group beacon IE ownership ab741d1b714b4 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe() a2215eb3cbbd3 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak 60142eb2afda3 wifi: ath11k: reset ar->num_stations on hardware start a7223b725905d ASoC: tegra: Fix ASRC Stream6 input threshold control 819d4c1323e2a wifi: wfx: validate MIB read length before copying to caller c881b1e4e9249 ASoC: wm8903: Move the DRC QR threshold to the register that holds it cd68146459b10 of/overlay: don't create "//" paths for fragments targeting the root 702b5db6e7b38 of/overlay: don't leak fragment references when changeset init fails 287a399310045 nvmet: preserve device path on allocation failure d94731cafa57e mtd: core: call _get_device() with the master MTD 714d8f0b1c616 iio: accel: kionix-kx022a: Fix array boundary check 84f8401d9bc5b mm/damon/core: don't skip damos_adjust_quota() while esz is not zero 4cea59e43e3cc perf/core: Fix WARN in perf_sigtrap() 51fba083e454f mm/secretmem: properly account locked pages 933d8ac23388e ALSA: line6: reject oversized playback packets df2787819bd13 ALSA: caiaq: unregister the input device when probe fails 2fc4e71aefab5 vt: skip screen update for DEC alignment test on backgroup consoles 786b74335c219 rds_tcp: close NULL deref window in rds_tcp_set_callbacks 1130350c8975a wifi: cfg80211: avoid double free if updating BSS fails c6d8cce685d60 scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info 8ec545537c110 scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr 7ceb6f7cb8f8f smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions 1bef1944ef15a sctp: check RCV_SHUTDOWN after the sendmsg connect wait aeda50d645bbb rtc: spear: initialize IRQ state before requesting alarm IRQ e77c5fc1f39fd rtc: ac100: Assign .num before accessing .hws ae169d318d5d2 net/packet: prevent TX_RING byte count overflow 1d27214fd9a4d netfilter: nft_flow_offload: drop flowtable reference on init error path ec96aa3ade2eb net: fix checksum offsets in skb_splice_from_iter() cc688475c56d3 of/overlay: only treat a positive changeset id as registered 936f1ffcb87a1 of/overlay: put property on deadprops only after changeset add succeeds b5f488c2a9ed3 of/irq: Fix remaining refcount leaks in of_irq_init() 3f968dcdf0188 kprobes: Skip disarmed probes when checking optkprobe overlap 9aee3caeff4dd audit: fix exe mark UAF in kill_rules() 8b417c887ac82 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices 7ed1062d154ec mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() 47a948ba653a4 xfs: fix cursor and pointer handling when recovering iunlink buckets 8afc80156b1d9 smb: client: close completed creates on compound wait errors eaa97a196a107 smb: client: close handle after create-context parsing failure 2f8118f4c4313 smb/client: pass cifs_open_info_data to SMB2_open() b63f09fdcb523 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() bd9571812d022 HID: alps: unregister DualPoint Stick input device on remove 37dc19c454191 HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM 74cbf0acf9de5 HID: core: remove #ifdef CONFIG_PM from hid_driver a35160b2c75bf Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table bd06033625ec2 bpf, xdp: move offload check into dev_xdp_install() 43d61b442a0a1 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() d8ec34618e710 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op 045532f920d86 smb: client: use finish_no_open() for non-regular inodes fbe8c7c940a7c perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification 2e4c5400f489e perf/x86/intel: Update event constraints and cache_extra_regsfor ADL 5e20b39aa7844 netfilter: nf_tables: skip expired catchall elements on insert and delete ab8dfb330c907 netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST a0f5fd7a285f4 net: ena: fix MMIO read buffer leak on probe failure 33b32efafb729 net: ena: Remove autopolling mode d4bd24339b505 perf/core: Run sched_task() for PMUs with only CPU-wide events fa360a018369f perf/core: Allow list_del during perf_event_overflow() 98181f9721f75 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() 403d8e4d52f5f perf: Supply task information to sched_task() 38a6a118260eb net: ipconfig: bound DHCP option construction f770bd77c6e15 net: ipconfig: Remove outdated comment and indent code block a9d9819a7d239 PCI: Fix BAR resize for devices on a root bus bf58ea4958118 PCI: Fix Resizable BAR restore order 4ab3655384e1d super: make iterate_supers_type() deletion-safe 6c2bcf6b173d4 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration 3486ce08c383e RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() 18866dc1f525f net: openvswitch: conntrack: fix helper UAF due to extensions realloc 7ecaa9628b05a net: openvswitch: conntrack: remove 'add_helper' dead code 7ce66bca55e37 openvswitch: prepare for stolen verdict coming from conntrack and nat engine c812bb4aea13d net/sched: act_ct: avoid modifying shared unconfirmed ct entry 31f5fe29a5720 net/sched: act_ct: fix helper UAF due to extensions realloc cf73ef2a761df mm/hugetlb: preserve mremap address delta when skipping page tables 465e222815c88 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish 34d9dffaf0ff4 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM 8a8d16d19207d drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc() 070a004d9d752 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities 9e2a2f98e8c01 tcp: prevent collapsing skbs across boundary in rtx queue f04cbdfac9b82 bna: prevent IOC timer rearm during teardown aa00eead258e4 smb: client: fix reparse buffer bounds in cifs_query_reparse_point() ffc88169f4fac smb/client: send lease break ACKs thru correct session for multiuser mounts 15e59e377facc wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown d073d306e587c hwmon: (pwm-fan) Stop RPM timer before freeing tach data 93a025166495c btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() 525c225e23d61 smb: client: fix cifsFileInfo reference leak in deferred close 11cff5518f798 mptcp: do not reschedule the RTX timer for fallback sockets 3fe0b4b1aed10 mptcp: pm: reset retrans_time when ADD_ADDR entry is reused 518fb6a834258 mptcp: pm: userspace: fix address ID overflow c003c9ab21406 mptcp: use sock_kmemdup for address entry f116f8462c8c2 sock: add sock_kmemdup helper 48bf542f03cf0 mptcp: pm: drop match in userspace_pm_append_new_local_addr a92e0910f5fb8 erofs: add sysfs feature entry for xattr prefixes db0c3465b54a1 erofs: preserve LZMA decoders on resize failure 1b5730a1c7def net/sched: act_api: release all action references on NEWACTION failure b2eb38377671a virtio_mmio: disable IRQ wake before free_irq cbfd5d11311bb virtio-mmio: Remove virtqueue list from mmio device 21e0749e8ef27 ipmr: account multicast table and route memory 8ca55a476af2d drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug 0cec951667a62 drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation 110dd054fd4af drm/sysfb: simpledrm: Improve stride validation 52f36434159e4 drm/sysfb: simpledrm: Improve panel-size validation b6c0e77d950bf f2fs: fix dentry folio leak in find_in_level e754120f8ede5 f2fs: limit recovery filename logging to stored length 428e244dd4066 scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature 2df8c86309047 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot 8b6565f19423a scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs 9d69eed95b841 scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate 5e0d6ffabbbd8 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path bbe692466399a media: rkvdec: Propagate platform_get_irq() errors 7cdb1e2d3b0e5 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup d20ef2b13a2e0 mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP 461dbac2056bb clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs 3ce0e9b43f355 nvme-fabrics: fix DHCHAP secret leak on parse failure 68cb1f5d4aa50 rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm 16dbe1300ebad ftrace: Synchronize the initialization of ftrace_ops abdc98e67d7db tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member aa4e177ae7108 staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() f4f0fe3ab47ed usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() 4892be1ef0bbe wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy 027679d613ea7 i3c: master: Fix use-after-free of master->this 7b25b755d5907 i3c: master: Do not treat master device as a duplicate target 73f3697a7b1c1 hwrng: stm32 - Fix runtime PM cleanup on registration failure 35964ed01e10b power: supply: qcom_battmgr: fix use-after-free 98d0b8a1bfd9a platform/x86: ISST: Validate max level for set feature 8bae4ab7a4c84 platform/x86: ISST: Validate parameter for core power state 55d71c70f11d9 mmc: via-sdmmc: cancel card-detect work on remove 4fe2db296c9cd lockd: fix swapped arguments in nlmsvc_match_ip() 730bb75ed5f66 i2c: mxs: fix DMA channel leak on probe error 6c6ec0f6be517 dmaengine: Add devm_dma_request_chan() 2064fdbec82ec ASoC: codecs: aw88261: only check PLL and clock state at power-up c45851fc674be ASoC: codecs: aw88261: reduce log spam 31b41ea8383d5 params: fix charp corruption on allocation failure 29144aa486899 params: Fix multi-line comment style 75f9f1e0b4082 params: Sort headers 641d864ba4d0d params: Use size_add() for kmalloc() 710c30766efd8 params: Do not go over the limit when getting the string length 88b11059bb23f ACPI: TAD: Add locking around AML evaluations d4a76ed0d9b4c ACPI: TAD: Split three functions to untangle runtime PM handling 156fbd020ae36 ACPI: TAD: Rearrange RT data validation checking 12b54e5aab7c0 cpufreq: apple-soc: Fix OPP table cleanup 6b1c1130fcbfa coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior 04c3e4456fe76 nfsd: fix clock domain mismatch in clients_still_reclaiming() 2d8a8ed4f9d86 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() 1c6a4d6c20fd4 nfsd: size fh_verify server sockaddr slot by xpt_locallen f5e9f3a75efc7 zram: fix out-of-bounds access in read_block_state() a5dda540c113c zram: fixup read_block_state() 81dfc6c665547 KEYS: trusted: Fix TPM teardown ordering 7e6ff8c58985f ethtool: fail closed if we can't get max channel used in indirection tables 0e58d7070eef1 media: av7110: fix a spectre vulnerability 705a8b8cc5a44 kvm: s390: Reject memory region operations for ucontrol VMs d233c8da8b70f drm/i915/hdcp: Add encoder check in hdcp2_get_capability df17aa6038f96 drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability 017bea876eca3 pinctrl: sunxi: keep a shadow copy of the data register output latches 3d531429524df vlan: require the MAC header to be present in __vlan_insert_inner_tag() 61812323c037a smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() ee0d8f83d68f6 smb: client: fix use-after-free of iface in cifs_try_adding_channels() d8bc505cabfba smb: mark the new channel addition log as informational log with cifs_info f448b267968d0 wifi: libipw: reject TKIP frames without a full MIC 8b637ab10e40e ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity 72399eb8bfaa2 ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling 48fc1c74052c9 landlock: Fix use-after-free of the source's parent directory 4a1ba62a486a4 ieee802154: cc2520: fix FIFOP work use-after-free 260f99b355a44 net: bridge: use option bits for CFM/MRP frame handlers ed1cead97afb9 io_uring/rw: end write accounting from ->ki_complete 1a345d95e59a9 genetlink: pin family module during policy dump aaa7f676418e1 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev b88e69064588e Bluetooth: btqcomsmd: Convert to platform remove callback returning void c94985e4fd77e tracing: Fix memory corruption from a "STACKTRACE" histogram key cc004a1107e2c f2fs: embed f2fs_gc_kthread in f2fs_sb_info 54c587f3f95ce f2fs: validate MOVE_RANGE destination size 5f33efe046589 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] 9bd063c082ef0 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown 2e6f60adf609c scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking 2ecc30066c228 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak ab1a8a3c99712 KVM: s390: Zero initialize data structures for inject_pfault_token 3868476cd3916 nvme: add missing SRCU grace period in error path 29266da8ee1d9 ftrace: Take trace_array reference before accessing its ftrace_ops 716850842d2f1 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() 5a55352d30ad3 staging: rtl8723bs: fix spacing around operators c1e7e35100eff usb: storage: realtek_cr: fix use-after-free on disconnect 5aade99d72ede udf: Fix data loss when converting inline inodes to out of line 17d5ae5897312 wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop aad3129b8e915 ocfs2: validate directory-index entry counts when reading metadata 1ecc0a9f100a7 ocfs2: validate dx_root extent list fields during block read 66358f5789c9a HID: universal-pidff: stop the device when force-feedback init fails 56ef23198bdd5 HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind 6eb70b78e48b0 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() 23c5cc9652c6e ceph: properly decrypt filenames in vmalloc() buffers ab949252fdf10 nfsd: fix nfsd_file leak on inter-server COPY setup failure b9f5bde07c0f9 x86/xen: fix init of balloon stats again 4a138cd221545 xen/balloon: improve accuracy of initial balloon target for dom0 b17c8f5dcb36a apparmor: fix out-of-bounds write when null terminating a label vec cf79df1770660 x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client edb9a302cc938 net: ena: Add validation for completion descriptors consistency 70eca80d98a44 net/mlx5e: Fix netif state handling 1743d5a678048 ocfs2: Avoid touching renamed directory if parent does not change 08f3e29665c31 xfrm: prevent policy_hthresh.work from racing with netns teardown 7801e616fbe36 dma-direct: return struct page from dma_direct_alloc_from_pool() 9f1262802008b dma-direct: simplify the use atomic pool logic in dma_direct_alloc Signed-off-by: Bruce Ashfield Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.6.bb | 6 ++-- .../linux/linux-yocto-tiny_6.6.bb | 6 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++---------- 3 files changed, 20 insertions(+), 20 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index 3c91a4ba7a5..dbd7894eaba 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,13 +14,13 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "aafd2f2dba2b549d89a66f79826d770742d968ab" -SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" +SRCREV_machine ?= "5d98280cab593fe037ee0dc56c451b48fa549507" +SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" -LINUX_VERSION ?= "6.6.159" +LINUX_VERSION ?= "6.6.160" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index 1b06d1e35fb..ba598063efa 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc # CVE exclusions include recipes-kernel/linux/cve-exclusion_6.6.inc -LINUX_VERSION ?= "6.6.159" +LINUX_VERSION ?= "6.6.160" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}" @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "7d022d231f699d2c767d88bb1fa305550ca68e01" -SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" +SRCREV_machine ?= "67b2cec31617d8d448fdb6b9786a0bf90bb49bcb" +SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index 601eb925955..ac5c593f1b0 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "9d17d5c9ac32b38ca5186199ed824b43f3d4308b" -SRCREV_machine:qemuarm64 ?= "857114866d2445d49024c9ef1ec710a7ef291a5b" -SRCREV_machine:qemuloongarch64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemumips ?= "2349f4c462400a8fb6f95c6bc0fbbdf959b2cb18" -SRCREV_machine:qemuppc ?= "47e791b3b9f786f926e66a672c524c1e858c76c1" -SRCREV_machine:qemuriscv64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemuriscv32 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemux86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemux86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_machine:qemumips64 ?= "a77a45b7cea3e691d2dafca4d9bdbaa60d134617" -SRCREV_machine ?= "f175bcee52358aef9b53e1ddc5300e65735226ac" -SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef" +SRCREV_machine:qemuarm ?= "6f024f9863d3f9bd5a3e40b24e65b355e0ff57f6" +SRCREV_machine:qemuarm64 ?= "edbaaeea3aa5ea133a35962f75ba32fab5ffaa25" +SRCREV_machine:qemuloongarch64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemumips ?= "657fdce3e983f75a5a21e0399651a2bbdc034c12" +SRCREV_machine:qemuppc ?= "75f8fea793b8611a220cfaba666a59a9aecc8f3c" +SRCREV_machine:qemuriscv64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemuriscv32 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemux86 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemux86-64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_machine:qemumips64 ?= "cfed5cc4b70b7c7d59f45b1bc8d58b4f4e4c1a95" +SRCREV_machine ?= "8f55e2a3b837190130b37f52b906396739b6ac24" +SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same # meta SRCREV as the linux-yocto-standard builds. Select your version using the # normal PREFERRED_VERSION settings. BBCLASSEXTEND = "devupstream:target" -SRCREV_machine:class-devupstream ?= "cecd39af8a1ab81373fd9fa765b2f7ab73becaad" +SRCREV_machine:class-devupstream ?= "0aebf2870d53a8d97e02a99e2103ea0b38950c1b" PN:class-devupstream = "linux-yocto-upstream" KBRANCH:class-devupstream = "v6.6/base" @@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46" -LINUX_VERSION ?= "6.6.159" +LINUX_VERSION ?= "6.6.160" PV = "${LINUX_VERSION}+git" From patchwork Sat Oct 31 00:15:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102547 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3752.1793405771799865961 for ; Fri, 30 Oct 2026 17:16:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=kVshOXH2; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4a35d5d4a20so13645535e9.2 for ; Fri, 30 Oct 2026 17:16:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405770; x=1794010570; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=qxFaSi8eigYOgDBRUZbDKZy6IwU79++xsjmIcHeOGIc=; b=kVshOXH2sOi+nYdsPq6WwWBYHqwYSy6d1Sf27O3v04uhzy0mt9jwGHOu8ISpGYEyhW inFwgeRmRURTqhKVH7mU6VZNXYKZpd7N41yBTUFRP68Ul3JAxU0ioQl4MKrre4r/gICX GoIUMUcg2vceThiX6IMMZYgGxYDcHXvQV2+Ux29bdvlEDx2Naw5weojuK/VUed8rIr4m B9lw0iRTAapN3R/jgyVk7XBrPXWo0AYGK9uTqVVLskQYL1NQDvqCGnwQQGSjnzDugWlG YdEscZpmkZlsj8Lqj972PK8D7ndr4WWa8rpyxSFivQQkhBvqxVZegFEHVxJoOzN+XUF6 efPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405770; x=1794010570; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qxFaSi8eigYOgDBRUZbDKZy6IwU79++xsjmIcHeOGIc=; b=ccsB/monHbRSqV2xlYkiXOGHo48L8a5t8sY0nJeFHQZKtW/xtHknOO/At8T61o/3V7 VnHvnXl0LDYII7GfBq8za8D8SaU1PEJpzGMFsnok/swtM1S2MKdoLWY8banZiXg0TrfD Cn16ZKm7hrEsq3jpKFmVSwQEy8fsvQTThfIfBvXVpUmzCU07ltd9DAVROSYVVJ7h4dJt g6Z7jGRY6EAHnJ1A0dtYxtckaA1sE9p8ob415ErtuRunM14F6nYXWs5lxCzY74Dt6/Y6 bVLAvqqRHLz+9AXdjZeR0NeCR/7jf5ZIS3EC53qrmy8pOdt3lwY35ZcUpeM+fJNJWPOc B7oA== X-Gm-Message-State: AFq9FYLMz8+B5KCx4uCl6J4POI2rnjHzOkMHPb2xb5GEbnopb8C7824W dnf5OcyN5WVI+N7nTTsWxnuEGGsW6NeWkIS0+UWPMZnhPeoTSg6GF6K575bbPQIBQzKAwuwgf46 YJ1tj96c= X-Gm-Gg: AYBFou0kC0p/0z7tcTmiQOrzeXFuz24gqB8A2Gb00qZNGpXOXpHdR1T0BNxjKhTgDVV ffLEqpdk5hGdW69evJPd/ABU+I3Hz5g5viE8ChKijkr2reeN56wYNWI0wqwr84RQKBV2nNHlKbJ Y+QG2ehUL25aIf6KQO9aVHxmPfRn9VurUFLLzn2jkmF7W11vdDciOC9VekdI8rRiFeaDkCdlwpI xUisMChlvKod6Xjja6v/LCtP7JdlaN0NLahmflVE+GSWvBljJiouBO+BXQJ1YqEf7u6C/kZ7VQQ iDIRZyAI1kftLaBgJU0BAzIXMR7/Cwi0go6lzINwtm04xqVDu6/kLvZNmRxZbDTeoMU9SiyzF2w /IaiS7p/mX5wVG3H2OKWX0h5ob5Fid8eutaHW2RlPIPdcEtmIgtBAoeKLfxFCbDQim9PXKI2rbJ VaNtNfIHGu0fAeoti0wrva51umjuor3dBG54IJZWKKBmR4g16vgM/4A66Vw2KVVzYZ7rLoRJXa/ HXV/eekvbG7xp4VPB7UZAS3uw4DY+WToKpbH0EjkIn74oKejX3zeuDQvy29gU2GeAqs6Hx0RSiL a4JOzRHppO1Malfkj26CvQab6n0GvCOY3GkHsq4pPy+z2LCV+rtIGKcbhvu77HP+QOfi40Q4HRX O/QxH4wjXLTBzKNBuO+A1eeUo2zu2Zy8sdWqofHNiiUQ6sYfgxQ== X-Received: by 2002:a05:600d:e:b0:4ad:181a:4355 with SMTP id 5b1f17b1804b1-4ad181a44b6mr28639375e9.26.1793405769999; Fri, 30 Oct 2026 17:16:09 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:09 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 45/55] linux-yocto/6.6: aufs: refresh to upstream aufs6.6.84 Date: Sat, 31 Oct 2026 01:15:06 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249118 From: Bruce Ashfield Integrating the following commit(s) to linux-yocto/6.6: 1/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: aufs: update to upstream aufs6.6.84 Date: Tue, 27 Oct 2026 12:19:23 -0400 Refresh the in-tree aufs from the aufs6.5-era snapshot (6.5-20230918) to the current upstream aufs-standalone aufs6.6.84 snapshot (6.6.84-20250414, 31c39fd5). This moves v6.6 onto the native aufs6.6 series, which handles the 6.6 VFS ctime accessors directly and already carries the allyesconfig build fixes in debug.c/sysrq.c, superseding our carried adaptations for those. aufs6.6.84 is the newest aufs6.6 point branch and targets the v6.6.84+ stable API, matching linux-yocto's v6.6 stable base. Signed-off-by: Bruce Ashfield ] 2/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: aufs6: fix magic.mk include path Date: Thu, 6 Jul 2023 11:34:59 -0400 commit 482d7131560c51da3ca [aufs stdalone: make it standalone] in the aufs upstream changes the way that the .mk file is included. This doesn't work properly with all kernel build processes, so we restore the use of srctree/src to locate the file. Signed-off-by: Bruce Ashfield (cherry picked from commit c4342d979bf213fcf2168f60c5f8fbdc76d1ac4d) ] 3/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: mm/mmap: aufs: drop prfile reference on remap_file_pages -EINTR path Date: Tue, 27 Oct 2026 12:19:34 -0400 remap_file_pages() takes references on both vma->vm_file and the aufs vma->vm_prfile via vma_get_file(). Every exit path releases both, except the mmap_write_lock_killable() failure path, which only does fput(file) and leaks the vm_prfile reference whenever the mapping is backed by aufs. Release prfile there as well, matching the security_mmap_file() failure and normal exit paths (upstream aufs6.6.84 uses vma_fput(vma) on this path for the same reason). Signed-off-by: Bruce Ashfield ] 4/4 [ Author: Bruce Ashfield Email: bruce.ashfield@gmail.com Subject: splice: aufs: drop stale do_splice_to() declaration Date: Tue, 27 Oct 2026 12:19:48 -0400 The aufs6 base integration added an extern declaration for do_splice_to() to . Upstream since folded do_splice_to() into vfs_splice_read(), so there is no longer any definition or user of it in the tree, leaving a dangling prototype. Upstream aufs6.6.84 dropped it from its base patch; drop it here too. Signed-off-by: Bruce Ashfield ] Signed-off-by: Bruce Ashfield Signed-off-by: Yoann Congal --- .../linux/linux-yocto-rt_6.6.bb | 4 ++-- .../linux/linux-yocto-tiny_6.6.bb | 4 ++-- meta/recipes-kernel/linux/linux-yocto_6.6.bb | 24 +++++++++---------- 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb index dbd7894eaba..51a4e9703cb 100644 --- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb @@ -14,8 +14,8 @@ python () { raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it") } -SRCREV_machine ?= "5d98280cab593fe037ee0dc56c451b48fa549507" -SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" +SRCREV_machine ?= "bbef8f873c0872eaa717fb9b043b7b428de82c92" +SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef" SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \ git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https" diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb index ba598063efa..14f0a62d797 100644 --- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb @@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native" KMETA = "kernel-meta" KCONF_BSP_AUDIT_LEVEL = "2" -SRCREV_machine ?= "67b2cec31617d8d448fdb6b9786a0bf90bb49bcb" -SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" +SRCREV_machine ?= "ada4ee01eb1897a0f2a46b9b3ceeb94690f9e619" +SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef" PV = "${LINUX_VERSION}+git" diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb index ac5c593f1b0..13fe981462e 100644 --- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb +++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb @@ -18,18 +18,18 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base" KBRANCH:qemuloongarch64 ?= "v6.6/standard/base" KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64" -SRCREV_machine:qemuarm ?= "6f024f9863d3f9bd5a3e40b24e65b355e0ff57f6" -SRCREV_machine:qemuarm64 ?= "edbaaeea3aa5ea133a35962f75ba32fab5ffaa25" -SRCREV_machine:qemuloongarch64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemumips ?= "657fdce3e983f75a5a21e0399651a2bbdc034c12" -SRCREV_machine:qemuppc ?= "75f8fea793b8611a220cfaba666a59a9aecc8f3c" -SRCREV_machine:qemuriscv64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemuriscv32 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemux86 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemux86-64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_machine:qemumips64 ?= "cfed5cc4b70b7c7d59f45b1bc8d58b4f4e4c1a95" -SRCREV_machine ?= "8f55e2a3b837190130b37f52b906396739b6ac24" -SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e" +SRCREV_machine:qemuarm ?= "e67812bab0b383dea8ae786005a5ec642e6b860a" +SRCREV_machine:qemuarm64 ?= "dce83a630a519666f8c5599478cd8db87cf772c2" +SRCREV_machine:qemuloongarch64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemumips ?= "e74bfb3fbb54e475fea2371332942c68ab7edc8e" +SRCREV_machine:qemuppc ?= "a384bf5c01fda52c362015fb31815f41193f9e3b" +SRCREV_machine:qemuriscv64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemuriscv32 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemux86 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemux86-64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_machine:qemumips64 ?= "14d15eae8d97e33895da68333b4347af334e5c65" +SRCREV_machine ?= "0615dc1f6a56bbd35510d527380a9e899adf8707" +SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef" # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll # get the /base branch, which is pure upstream -stable, and the same From patchwork Sat Oct 31 00:15:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102565 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3761.1793405775019895378 for ; Fri, 30 Oct 2026 17:16:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=kYy1ZDMX; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so12081755e9.1 for ; Fri, 30 Oct 2026 17:16:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405773; x=1794010573; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=CQp+OgW96VCUalitgjlWvMlpMOj9/AGHssfw13R4XdU=; b=kYy1ZDMXTuAXyAIdU6kn4fgfzyFtNj+JHYy3K1Ham1lzW8jXfdf+DBBTcrRcYWj1/p OeI9KvOHp16VduN+ExbSRw6/qQEFdZswmCMcsm4eXtdMC9bVcUymJpcsp9o+/VHJ+kvA ZVgj3SylPRbz/wOkrc3VN81M8vHVVbt6THA7yeGAEl6km2LkCbnJHytduwleXqB+NtUr 3R0bXADgNcC2e8U645OkKxsGUnrZ0415HumvX9gbYx5t7mZ1y+4k61m30+e7Aylfyf7y QzPfznHf5Yf/3fDRxkULKR/p4rA0vO6qJMlJKftEJtyYqw7/ZsymB0sGCdFcwZJRUgs8 8SIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405773; x=1794010573; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=CQp+OgW96VCUalitgjlWvMlpMOj9/AGHssfw13R4XdU=; b=qJ+bbjjxJjqT5P/bhPtGUDOQ/alMeKfYnMKoun55tZfNEDkrsh16iR7lzrtrqKQcb7 AwjndHgDySXA9QIFeOQ/mGSrLPgor5dRBJ1AZYqRm7UmtcTgCQiMD14S5zn/Hhp2M9XK kRpQjHYnaU4bbXjx8cz5SgOxDudBISWgmyZDDEAmaT0M2tLIxOxkajZD6xgw5LOZ5t/X SgLoqfufnWEyD4vdOhIwpe7IU/JHc3eO1BXzF8ux2du3IBBepfBqExQfFLG7g2/nK4n8 nx7XS4meXBZRIw9qhfui/dAjTx/l39bJb/N51geDqNTrWcqd451bivmvEIDfRJN3dt7B 9xSQ== X-Gm-Message-State: AFq9FYLK5AvWfIsQNir71NjcksmPhUFU5EmvmC1EhnEazucyrZpd9Am3 JWwms+UEwkjoDo9e/CNMmgBS/aKKTVKi6X8HQU3kolTrmRghksXT+HeAkQxSs+KOFisW80Mx3jb BMeOdzQM= X-Gm-Gg: AYBFou1bMa6JAGfY8r924tftP+c2ZhEgYhrQtndcBXthjwXVJT+5j1TBERtMvUnDzqz dkTNJTnL/4LHvWqq/Ps3PWmwDMYOgQlLRJmUcBzpD8Bz5SUvvuVVi64cz1Qgz3j8R38q01skkJK EmA4tQ/LujbIgmIBTjEsXT+uVDcxHLteYuXKVev+agr/tuUuUg5Po6KZfBhY3tCAPhw7cAWk/oJ rSuSa8o0ye2Z3BRKeirkEqH+xL8HD40GPJmkLwnbC8EQeIhm0c0u6bdlHhgbI2gVUMJklyEllas JEV6xekQ3miJVHzmHtcRMXOP3Z0kvFAxlNzAav/Q2OgQxnB4CEVUGrBj58AjKJkCQdr09H1v84d Hy9DdvBg+caw5cqVaz1kyBsqEFg4RNYOWkmnvwPSYUzVcvncGZh8jjKbuX1QZUwxbQn6xFmSbOb ra94cry/oYPa/3vB+3iT3RNu9TIYP3Ee4Ywtoot/LEnYCqBlN1uwZ7fAIyR74QAEUtuU3wNH4Gy XoV2NEt2v8HWOIPaINs1A2U11Fw28uED7+h99vUEfpj7yhN/rPeYXO0Kz+APXGpfDM91EuKMoHl jy0t+f/ZPlYnYGMLYY2aYitiGbGA37F/f+URuw5739htx4BL4zLy+ZeEaiQGrndOOse045IOqS7 DK2E1ESmcged2rcRlK1+4VjGKHj42 X-Received: by 2002:a05:600c:8b2c:b0:4a7:a5db:a93e with SMTP id 5b1f17b1804b1-4ac150b3dbfmr90057455e9.4.1793405771208; Fri, 30 Oct 2026 17:16:11 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:10 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 46/55] linux-yocto/6.6: update CVE exclusions (6.6.160) Date: Sat, 31 Oct 2026 01:15:07 +0100 Message-ID: <0d162ab7d30c070bd9fc326ba177baddf62da43a.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249125 From: Yoann Congal $ ./meta/recipes-kernel/linux/generate-cve-exclusions.py .../cvelistV5/ 6.6.160 > meta/recipes-kernel/linux/cve-exclusion_6.6.inc Generated at 2026-10-29 13:34:05.293881+00:00 for kernel version 6.6.160 From cvelistV5 cve_2026-10-29_1300Z-1-g135f63d1c5d Signed-off-by: Yoann Congal --- .../linux/cve-exclusion_6.6.inc | 7716 +++++++++++++++-- 1 file changed, 6817 insertions(+), 899 deletions(-) diff --git a/meta/recipes-kernel/linux/cve-exclusion_6.6.inc b/meta/recipes-kernel/linux/cve-exclusion_6.6.inc index d2704e76449..24961f31688 100644 --- a/meta/recipes-kernel/linux/cve-exclusion_6.6.inc +++ b/meta/recipes-kernel/linux/cve-exclusion_6.6.inc @@ -1,11 +1,11 @@ # Auto-generated CVE metadata, DO NOT EDIT BY HAND. -# Generated at 2026-09-10 12:23:31.488006+00:00 for kernel version 6.6.151 -# From cvelistV5 cve_2026-09-10_1100Z-4-g5fc16492753 +# Generated at 2026-10-29 13:34:05.293881+00:00 for kernel version 6.6.160 +# From cvelistV5 cve_2026-10-29_1300Z-1-g135f63d1c5d python check_kernel_cve_status_version() { - this_version = "6.6.151" + this_version = "6.6.160" kernel_version = d.getVar("LINUX_VERSION") if kernel_version != this_version: bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version)) @@ -6054,7 +6054,7 @@ CVE_STATUS[CVE-2023-52584] = "cpe-stable-backport: Backported in 6.6.16" CVE_STATUS[CVE-2023-52585] = "fixed-version: only affects 6.7 onwards" -# CVE-2023-52586 needs backporting (fixed from 6.8) +CVE_STATUS[CVE-2023-52586] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2023-52587] = "cpe-stable-backport: Backported in 6.6.16" @@ -6062,7 +6062,7 @@ CVE_STATUS[CVE-2023-52588] = "cpe-stable-backport: Backported in 6.6.16" CVE_STATUS[CVE-2023-52589] = "cpe-stable-backport: Backported in 6.6.16" -# CVE-2023-52590 needs backporting (fixed from 6.8) +CVE_STATUS[CVE-2023-52590] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2023-52591] = "cpe-stable-backport: Backported in 6.6.16" @@ -9030,9 +9030,11 @@ CVE_STATUS[CVE-2023-54326] = "fixed-version: Fixed from version 6.5" CVE_STATUS[CVE-2023-7324] = "fixed-version: Fixed from version 6.3" +CVE_STATUS[CVE-2023-7356] = "cpe-stable-backport: Backported in 6.6.145" + CVE_STATUS[CVE-2024-14027] = "cpe-stable-backport: Backported in 6.6.133" -# CVE-2024-14040 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-14040] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-26581] = "cpe-stable-backport: Backported in 6.6.17" @@ -9732,7 +9734,7 @@ CVE_STATUS[CVE-2024-26946] = "cpe-stable-backport: Backported in 6.6.24" CVE_STATUS[CVE-2024-26947] = "cpe-stable-backport: Backported in 6.6.24" -# CVE-2024-26948 needs backporting (fixed from 6.9) +CVE_STATUS[CVE-2024-26948] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-26949] = "fixed-version: only affects 6.7.9 onwards" @@ -9852,7 +9854,7 @@ CVE_STATUS[CVE-2024-27008] = "cpe-stable-backport: Backported in 6.6.29" CVE_STATUS[CVE-2024-27009] = "cpe-stable-backport: Backported in 6.6.29" -# CVE-2024-27010 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2024-27010] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2024-27011] = "cpe-stable-backport: Backported in 6.6.55" @@ -10940,7 +10942,7 @@ CVE_STATUS[CVE-2024-38606] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2024-38607] = "cpe-stable-backport: Backported in 6.6.33" -# CVE-2024-38608 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-38608] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-38609] = "fixed-version: only affects 6.9 onwards" @@ -11068,7 +11070,7 @@ CVE_STATUS[CVE-2024-39476] = "cpe-stable-backport: Backported in 6.6.34" CVE_STATUS[CVE-2024-39477] = "fixed-version: only affects 6.9 onwards" -# CVE-2024-39478 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2024-39478] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2024-39479] = "cpe-stable-backport: Backported in 6.6.34" @@ -11290,7 +11292,7 @@ CVE_STATUS[CVE-2024-40977] = "cpe-stable-backport: Backported in 6.6.36" CVE_STATUS[CVE-2024-40978] = "cpe-stable-backport: Backported in 6.6.36" -# CVE-2024-40979 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-40979] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-40980] = "cpe-stable-backport: Backported in 6.6.36" @@ -11328,7 +11330,7 @@ CVE_STATUS[CVE-2024-40997] = "cpe-stable-backport: Backported in 6.6.36" CVE_STATUS[CVE-2024-40998] = "cpe-stable-backport: Backported in 6.6.36" -# CVE-2024-40999 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-40999] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-41000] = "cpe-stable-backport: Backported in 6.6.36" @@ -11346,7 +11348,7 @@ CVE_STATUS[CVE-2024-41006] = "cpe-stable-backport: Backported in 6.6.36" CVE_STATUS[CVE-2024-41007] = "cpe-stable-backport: Backported in 6.6.41" -# CVE-2024-41008 needs backporting (fixed from 6.9) +CVE_STATUS[CVE-2024-41008] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-41009] = "cpe-stable-backport: Backported in 6.6.37" @@ -11376,7 +11378,7 @@ CVE_STATUS[CVE-2024-41021] = "cpe-stable-backport: Backported in 6.6.44" CVE_STATUS[CVE-2024-41022] = "cpe-stable-backport: Backported in 6.6.43" -# CVE-2024-41023 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-41023] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-41025] = "cpe-stable-backport: Backported in 6.6.41" @@ -11418,7 +11420,7 @@ CVE_STATUS[CVE-2024-41043] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2024-41044] = "cpe-stable-backport: Backported in 6.6.41" -# CVE-2024-41045 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-41045] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-41046] = "cpe-stable-backport: Backported in 6.6.41" @@ -11490,13 +11492,13 @@ CVE_STATUS[CVE-2024-41080] = "cpe-stable-backport: Backported in 6.6.62" CVE_STATUS[CVE-2024-41081] = "cpe-stable-backport: Backported in 6.6.42" -# CVE-2024-41082 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-41082] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-41083] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2024-41084] = "cpe-stable-backport: Backported in 6.6.37" -# CVE-2024-41085 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-41085] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-41086] = "fixed-version: only affects 6.7 onwards" @@ -11526,7 +11528,7 @@ CVE_STATUS[CVE-2024-41098] = "cpe-stable-backport: Backported in 6.6.37" CVE_STATUS[CVE-2024-41149] = "fixed-version: only affects 6.12.6 onwards" -# CVE-2024-41932 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-41932] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-41935] = "cpe-stable-backport: Backported in 6.6.66" @@ -11538,9 +11540,9 @@ CVE_STATUS[CVE-2024-42065] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2024-42066] = "fixed-version: only affects 6.8 onwards" -# CVE-2024-42067 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-42067] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2024-42068 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-42068] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-42069] = "cpe-stable-backport: Backported in 6.6.37" @@ -11618,7 +11620,7 @@ CVE_STATUS[CVE-2024-42105] = "cpe-stable-backport: Backported in 6.6.39" CVE_STATUS[CVE-2024-42106] = "cpe-stable-backport: Backported in 6.6.39" -# CVE-2024-42107 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-42107] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-42108] = "fixed-version: only affects 6.8 onwards" @@ -11648,7 +11650,7 @@ CVE_STATUS[CVE-2024-42121] = "cpe-stable-backport: Backported in 6.6.39" CVE_STATUS[CVE-2024-42122] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-42123 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-42123] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-42124] = "cpe-stable-backport: Backported in 6.6.39" @@ -11678,7 +11680,7 @@ CVE_STATUS[CVE-2024-42137] = "cpe-stable-backport: Backported in 6.6.39" CVE_STATUS[CVE-2024-42138] = "cpe-stable-backport: Backported in 6.6.39" -# CVE-2024-42139 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-42139] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-42140] = "cpe-stable-backport: Backported in 6.6.39" @@ -11708,7 +11710,7 @@ CVE_STATUS[CVE-2024-42153] = "cpe-stable-backport: Backported in 6.6.39" CVE_STATUS[CVE-2024-42154] = "cpe-stable-backport: Backported in 6.6.39" -# CVE-2024-42155 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-42155] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-42156] = "cpe-stable-backport: Backported in 6.6.64" @@ -11722,7 +11724,7 @@ CVE_STATUS[CVE-2024-42160] = "cpe-stable-backport: Backported in 6.6.39" CVE_STATUS[CVE-2024-42161] = "cpe-stable-backport: Backported in 6.6.39" -# CVE-2024-42162 needs backporting (fixed from 6.10) +CVE_STATUS[CVE-2024-42162] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-42223] = "cpe-stable-backport: Backported in 6.6.39" @@ -11908,7 +11910,7 @@ CVE_STATUS[CVE-2024-42315] = "cpe-stable-backport: Backported in 6.6.44" CVE_STATUS[CVE-2024-42316] = "cpe-stable-backport: Backported in 6.6.44" -# CVE-2024-42317 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-42317] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-42318] = "cpe-stable-backport: Backported in 6.6.44" @@ -11930,7 +11932,7 @@ CVE_STATUS[CVE-2024-43817] = "cpe-stable-backport: Backported in 6.6.44" CVE_STATUS[CVE-2024-43818] = "cpe-stable-backport: Backported in 6.6.44" -# CVE-2024-43819 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-43819] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-43820] = "fixed-version: only affects 6.7.12 onwards" @@ -11940,7 +11942,7 @@ CVE_STATUS[CVE-2024-43822] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2024-43823] = "cpe-stable-backport: Backported in 6.6.44" -# CVE-2024-43824 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-43824] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-43825] = "cpe-stable-backport: Backported in 6.6.44" @@ -12066,7 +12068,7 @@ CVE_STATUS[CVE-2024-43886] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2024-43887] = "fixed-version: only affects 6.7 onwards" -CVE_STATUS[CVE-2024-43888] = "fixed-version: only affects 6.8 onwards" +# CVE-2024-43888 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2024-43889] = "cpe-stable-backport: Backported in 6.6.46" @@ -12154,7 +12156,7 @@ CVE_STATUS[CVE-2024-44949] = "cpe-stable-backport: Backported in 6.6.46" CVE_STATUS[CVE-2024-44950] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-44951 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2024-44951] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-44953] = "fixed-version: only affects 6.8 onwards" @@ -12328,9 +12330,9 @@ CVE_STATUS[CVE-2024-46679] = "cpe-stable-backport: Backported in 6.6.49" CVE_STATUS[CVE-2024-46680] = "cpe-stable-backport: Backported in 6.6.49" -# CVE-2024-46681 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-46681] = "cpe-stable-backport: Backported in 6.6.160" -CVE_STATUS[CVE-2024-46682] = "fixed-version: only affects 6.9 onwards" +# CVE-2024-46682 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2024-46683] = "fixed-version: only affects 6.8 onwards" @@ -12424,7 +12426,7 @@ CVE_STATUS[CVE-2024-46728] = "cpe-stable-backport: Backported in 6.6.50" # CVE-2024-46729 needs backporting (fixed from 6.11) -# CVE-2024-46730 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-46730] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-46731] = "cpe-stable-backport: Backported in 6.6.50" @@ -12472,7 +12474,7 @@ CVE_STATUS[CVE-2024-46752] = "cpe-stable-backport: Backported in 6.6.51" CVE_STATUS[CVE-2024-46753] = "cpe-stable-backport: Backported in 6.6.87" -# CVE-2024-46754 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2024-46754] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2024-46755] = "cpe-stable-backport: Backported in 6.6.51" @@ -12508,7 +12510,7 @@ CVE_STATUS[CVE-2024-46773] = "cpe-stable-backport: Backported in 6.6.51" CVE_STATUS[CVE-2024-46774] = "cpe-stable-backport: Backported in 6.6.88" -# CVE-2024-46775 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-46775] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-46776] = "cpe-stable-backport: Backported in 6.6.51" @@ -12574,7 +12576,7 @@ CVE_STATUS[CVE-2024-46806] = "cpe-stable-backport: Backported in 6.6.50" CVE_STATUS[CVE-2024-46807] = "cpe-stable-backport: Backported in 6.6.50" -# CVE-2024-46808 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-46808] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-46809] = "cpe-stable-backport: Backported in 6.6.50" @@ -12626,7 +12628,7 @@ CVE_STATUS[CVE-2024-46832] = "cpe-stable-backport: Backported in 6.6.51" CVE_STATUS[CVE-2024-46833] = "fixed-version: only affects 6.10 onwards" -# CVE-2024-46834 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-46834] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-46835] = "cpe-stable-backport: Backported in 6.6.51" @@ -12640,7 +12642,7 @@ CVE_STATUS[CVE-2024-46840] = "cpe-stable-backport: Backported in 6.6.51" CVE_STATUS[CVE-2024-46841] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-46842 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-46842] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-46843] = "cpe-stable-backport: Backported in 6.6.51" @@ -12714,7 +12716,7 @@ CVE_STATUS[CVE-2024-47659] = "cpe-stable-backport: Backported in 6.6.50" CVE_STATUS[CVE-2024-47660] = "cpe-stable-backport: Backported in 6.6.50" -# CVE-2024-47661 needs backporting (fixed from 6.11) +CVE_STATUS[CVE-2024-47661] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2024-47662 needs backporting (fixed from 6.11) @@ -12794,7 +12796,7 @@ CVE_STATUS[CVE-2024-47700] = "cpe-stable-backport: Backported in 6.6.54" CVE_STATUS[CVE-2024-47701] = "cpe-stable-backport: Backported in 6.6.54" -# CVE-2024-47702 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-47702] = "cpe-stable-backport: Backported in 6.6.158" # CVE-2024-47703 needs backporting (fixed from 6.12) @@ -12900,7 +12902,7 @@ CVE_STATUS[CVE-2024-47756] = "cpe-stable-backport: Backported in 6.6.54" CVE_STATUS[CVE-2024-47757] = "cpe-stable-backport: Backported in 6.6.54" -# CVE-2024-47794 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-47794] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-47809] = "cpe-stable-backport: Backported in 6.6.66" @@ -12992,13 +12994,13 @@ CVE_STATUS[CVE-2024-49883] = "cpe-stable-backport: Backported in 6.6.55" CVE_STATUS[CVE-2024-49884] = "cpe-stable-backport: Backported in 6.6.55" -# CVE-2024-49885 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49885] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-49886] = "cpe-stable-backport: Backported in 6.6.55" CVE_STATUS[CVE-2024-49887] = "fixed-version: only affects 6.9 onwards" -# CVE-2024-49888 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49888] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-49889] = "cpe-stable-backport: Backported in 6.6.55" @@ -13058,15 +13060,15 @@ CVE_STATUS[CVE-2024-49915] = "cpe-stable-backport: Backported in 6.6.64" CVE_STATUS[CVE-2024-49917] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-49918 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49918] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-49919] = "cpe-stable-backport: Backported in 6.6.79" -# CVE-2024-49920 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49920] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2024-49921 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49921] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2024-49922 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49922] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-49923] = "cpe-stable-backport: Backported in 6.6.79" @@ -13102,7 +13104,7 @@ CVE_STATUS[CVE-2024-49938] = "cpe-stable-backport: Backported in 6.6.55" CVE_STATUS[CVE-2024-49939] = "cpe-stable-backport: Backported in 6.6.55" -# CVE-2024-49940 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49940] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-49941] = "fixed-version: only affects 6.9 onwards" @@ -13112,7 +13114,7 @@ CVE_STATUS[CVE-2024-49943] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2024-49944] = "cpe-stable-backport: Backported in 6.6.55" -# CVE-2024-49945 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49945] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-49946] = "cpe-stable-backport: Backported in 6.6.55" @@ -13160,7 +13162,7 @@ CVE_STATUS[CVE-2024-49968] = "cpe-stable-backport: Backported in 6.6.120" CVE_STATUS[CVE-2024-49969] = "cpe-stable-backport: Backported in 6.6.55" -# CVE-2024-49970 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-49970] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-49971] = "fixed-version: only affects 6.11 onwards" @@ -13296,7 +13298,7 @@ CVE_STATUS[CVE-2024-50041] = "cpe-stable-backport: Backported in 6.6.57" CVE_STATUS[CVE-2024-50042] = "fixed-version: only affects 6.7.10 onwards" -CVE_STATUS[CVE-2024-50043] = "fixed-version: only affects 6.9 onwards" +# CVE-2024-50043 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2024-50044] = "cpe-stable-backport: Backported in 6.6.57" @@ -13772,7 +13774,7 @@ CVE_STATUS[CVE-2024-50287] = "cpe-stable-backport: Backported in 6.6.61" CVE_STATUS[CVE-2024-50288] = "fixed-version: only affects 6.8 onwards" -# CVE-2024-50289 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-50289] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-50290] = "cpe-stable-backport: Backported in 6.6.61" @@ -13814,7 +13816,7 @@ CVE_STATUS[CVE-2024-52557] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2024-52559] = "cpe-stable-backport: Backported in 6.6.80" -# CVE-2024-52560 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2024-52560] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2024-53042] = "cpe-stable-backport: Backported in 6.6.60" @@ -13834,7 +13836,7 @@ CVE_STATUS[CVE-2024-53049] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2024-53050] = "fixed-version: only affects 6.7 onwards" -# CVE-2024-53051 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-53051] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-53052] = "cpe-stable-backport: Backported in 6.6.60" @@ -13842,7 +13844,7 @@ CVE_STATUS[CVE-2024-53053] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2024-53055] = "cpe-stable-backport: Backported in 6.6.60" -# CVE-2024-53056 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-53056] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2024-53057] = "cpe-stable-backport: Backported in 6.6.60" @@ -13910,7 +13912,7 @@ CVE_STATUS[CVE-2024-53088] = "cpe-stable-backport: Backported in 6.6.61" # CVE-2024-53089 needs backporting (fixed from 6.12) -# CVE-2024-53090 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-53090] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-53091] = "cpe-stable-backport: Backported in 6.6.62" @@ -13956,7 +13958,7 @@ CVE_STATUS[CVE-2024-53112] = "cpe-stable-backport: Backported in 6.6.63" CVE_STATUS[CVE-2024-53113] = "cpe-stable-backport: Backported in 6.6.63" -# CVE-2024-53114 needs backporting (fixed from 6.12) +CVE_STATUS[CVE-2024-53114] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-53115] = "fixed-version: only affects 6.10.4 onwards" @@ -14022,7 +14024,7 @@ CVE_STATUS[CVE-2024-53145] = "cpe-stable-backport: Backported in 6.6.64" CVE_STATUS[CVE-2024-53146] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-53147 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-53147] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-53148] = "cpe-stable-backport: Backported in 6.6.64" @@ -14100,7 +14102,7 @@ CVE_STATUS[CVE-2024-53185] = "cpe-stable-backport: Backported in 6.6.64" CVE_STATUS[CVE-2024-53186] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-53187 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-53187] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-53188] = "cpe-stable-backport: Backported in 6.6.64" @@ -14128,7 +14130,7 @@ CVE_STATUS[CVE-2024-53199] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2024-53200] = "cpe-stable-backport: Backported in 6.6.64" -CVE_STATUS[CVE-2024-53201] = "fixed-version: only affects 6.11.3 onwards" +CVE_STATUS[CVE-2024-53201] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-53202] = "cpe-stable-backport: Backported in 6.6.64" @@ -14164,7 +14166,7 @@ CVE_STATUS[CVE-2024-53217] = "cpe-stable-backport: Backported in 6.6.64" CVE_STATUS[CVE-2024-53218] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-53219 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-53219] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-53220] = "cpe-stable-backport: Backported in 6.6.64" @@ -14280,7 +14282,7 @@ CVE_STATUS[CVE-2024-56542] = "fixed-version: only affects 6.11.2 onwards" CVE_STATUS[CVE-2024-56543] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-56544 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-56544] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-56545] = "cpe-stable-backport: Backported in 6.6.64" @@ -14592,7 +14594,7 @@ CVE_STATUS[CVE-2024-56700] = "cpe-stable-backport: Backported in 6.6.64" CVE_STATUS[CVE-2024-56701] = "cpe-stable-backport: Backported in 6.6.64" -# CVE-2024-56702 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-56702] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-56703] = "cpe-stable-backport: Backported in 6.6.75" @@ -14612,7 +14614,7 @@ CVE_STATUS[CVE-2024-56710] = "cpe-stable-backport: Backported in 6.6.69" CVE_STATUS[CVE-2024-56711] = "fixed-version: only affects 6.11 onwards" -# CVE-2024-56712 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-56712] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-56713] = "fixed-version: only affects 6.10 onwards" @@ -14654,7 +14656,7 @@ CVE_STATUS[CVE-2024-56739] = "cpe-stable-backport: Backported in 6.6.64" CVE_STATUS[CVE-2024-56740] = "fixed-version: only affects 6.12 onwards" -# CVE-2024-56742 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-56742] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-56743] = "fixed-version: only affects 6.12 onwards" @@ -14760,7 +14762,7 @@ CVE_STATUS[CVE-2024-57801] = "cpe-stable-backport: Backported in 6.6.70" CVE_STATUS[CVE-2024-57802] = "cpe-stable-backport: Backported in 6.6.70" -# CVE-2024-57804 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-57804] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-57805] = "fixed-version: only affects 6.11.6 onwards" @@ -14768,7 +14770,7 @@ CVE_STATUS[CVE-2024-57806] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2024-57807] = "cpe-stable-backport: Backported in 6.6.69" -# CVE-2024-57809 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-57809] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-57834] = "cpe-stable-backport: Backported in 6.6.79" @@ -14788,7 +14790,7 @@ CVE_STATUS[CVE-2024-57850] = "cpe-stable-backport: Backported in 6.6.66" CVE_STATUS[CVE-2024-57852] = "fixed-version: only affects 6.11.8 onwards" -# CVE-2024-57857 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2024-57857] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2024-57872 needs backporting (fixed from 6.13) @@ -14946,11 +14948,11 @@ CVE_STATUS[CVE-2024-57953] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2024-57973] = "cpe-stable-backport: Backported in 6.6.76" -# CVE-2024-57974 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2024-57974] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2024-57975 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2024-57975] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2024-57976 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2024-57976] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-57977] = "cpe-stable-backport: Backported in 6.6.80" @@ -14996,7 +14998,7 @@ CVE_STATUS[CVE-2024-57997] = "cpe-stable-backport: Backported in 6.6.76" CVE_STATUS[CVE-2024-57998] = "cpe-stable-backport: Backported in 6.6.76" -# CVE-2024-57999 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2024-57999] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-58000] = "fixed-version: only affects 6.13 onwards" @@ -15010,7 +15012,7 @@ CVE_STATUS[CVE-2024-58004] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2024-58005] = "cpe-stable-backport: Backported in 6.6.78" -# CVE-2024-58006 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2024-58006] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-58007] = "cpe-stable-backport: Backported in 6.6.78" @@ -15022,7 +15024,7 @@ CVE_STATUS[CVE-2024-58010] = "cpe-stable-backport: Backported in 6.6.78" CVE_STATUS[CVE-2024-58011] = "cpe-stable-backport: Backported in 6.6.78" -# CVE-2024-58012 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2024-58012] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2024-58013] = "cpe-stable-backport: Backported in 6.6.78" @@ -15134,9 +15136,9 @@ CVE_STATUS[CVE-2024-58092] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2024-58093] = "cpe-stable-backport: Backported in 6.6.87" -# CVE-2024-58094 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2024-58094] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2024-58095 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2024-58095] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2024-58096] = "cpe-stable-backport: Backported in 6.6.123" @@ -15166,7 +15168,7 @@ CVE_STATUS[CVE-2025-21632] = "cpe-stable-backport: Backported in 6.6.72" # CVE-2025-21634 needs backporting (fixed from 6.13) -# CVE-2025-21635 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2025-21635] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21636] = "cpe-stable-backport: Backported in 6.6.72" @@ -15194,11 +15196,11 @@ CVE_STATUS[CVE-2025-21647] = "cpe-stable-backport: Backported in 6.6.72" CVE_STATUS[CVE-2025-21648] = "cpe-stable-backport: Backported in 6.6.72" -# CVE-2025-21649 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2025-21649] = "cpe-stable-backport: Backported in 6.6.157" -# CVE-2025-21650 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2025-21650] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-21651 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2025-21651] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2025-21652] = "cpe-stable-backport: Backported in 6.6.72" @@ -15286,7 +15288,7 @@ CVE_STATUS[CVE-2025-21694] = "cpe-stable-backport: Backported in 6.6.74" CVE_STATUS[CVE-2025-21695] = "fixed-version: only affects 6.10 onwards" -# CVE-2025-21696 needs backporting (fixed from 6.13) +CVE_STATUS[CVE-2025-21696] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21697] = "cpe-stable-backport: Backported in 6.6.74" @@ -15320,7 +15322,7 @@ CVE_STATUS[CVE-2025-21712] = "cpe-stable-backport: Backported in 6.6.80" CVE_STATUS[CVE-2025-21713] = "fixed-version: only affects 6.11 onwards" -# CVE-2025-21714 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21714] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21715] = "cpe-stable-backport: Backported in 6.6.76" @@ -15336,9 +15338,9 @@ CVE_STATUS[CVE-2025-21720] = "cpe-stable-backport: Backported in 6.6.76" CVE_STATUS[CVE-2025-21721] = "cpe-stable-backport: Backported in 6.6.80" -# CVE-2025-21722 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21722] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-21723 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21723] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21724] = "cpe-stable-backport: Backported in 6.6.76" @@ -15350,7 +15352,7 @@ CVE_STATUS[CVE-2025-21727] = "cpe-stable-backport: Backported in 6.6.76" CVE_STATUS[CVE-2025-21728] = "cpe-stable-backport: Backported in 6.6.76" -# CVE-2025-21729 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21729] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21730] = "fixed-version: only affects 6.13 onwards" @@ -15422,7 +15424,7 @@ CVE_STATUS[CVE-2025-21766] = "cpe-stable-backport: Backported in 6.6.79" CVE_STATUS[CVE-2025-21767] = "cpe-stable-backport: Backported in 6.6.79" -# CVE-2025-21768 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21768] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21769] = "fixed-version: only affects 6.13 onwards" @@ -15488,7 +15490,7 @@ CVE_STATUS[CVE-2025-21799] = "cpe-stable-backport: Backported in 6.6.76" CVE_STATUS[CVE-2025-21800] = "fixed-version: only affects 6.12 onwards" -# CVE-2025-21801 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21801] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21802] = "cpe-stable-backport: Backported in 6.6.76" @@ -15534,7 +15536,7 @@ CVE_STATUS[CVE-2025-21823] = "cpe-stable-backport: Backported in 6.6.79" CVE_STATUS[CVE-2025-21824] = "fixed-version: only affects 6.12 onwards" -# CVE-2025-21825 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21825] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21826] = "cpe-stable-backport: Backported in 6.6.76" @@ -15622,7 +15624,7 @@ CVE_STATUS[CVE-2025-21868] = "cpe-stable-backport: Backported in 6.6.117" CVE_STATUS[CVE-2025-21869] = "fixed-version: only affects 6.7 onwards" -# CVE-2025-21870 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21870] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21871] = "cpe-stable-backport: Backported in 6.6.80" @@ -15652,13 +15654,13 @@ CVE_STATUS[CVE-2025-21883] = "cpe-stable-backport: Backported in 6.6.81" CVE_STATUS[CVE-2025-21884] = "cpe-stable-backport: Backported in 6.6.103" -# CVE-2025-21885 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21885] = "cpe-stable-backport: Backported in 6.6.160" -CVE_STATUS[CVE-2025-21886] = "fixed-version: only affects 6.12.13 onwards" +# CVE-2025-21886 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2025-21887] = "cpe-stable-backport: Backported in 6.6.81" -# CVE-2025-21888 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21888] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21889] = "cpe-stable-backport: Backported in 6.6.81" @@ -15666,7 +15668,7 @@ CVE_STATUS[CVE-2025-21890] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2025-21891] = "cpe-stable-backport: Backported in 6.6.81" -# CVE-2025-21892 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21892] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21893] = "fixed-version: only affects 6.10 onwards" @@ -15736,7 +15738,7 @@ CVE_STATUS[CVE-2025-21925] = "cpe-stable-backport: Backported in 6.6.83" CVE_STATUS[CVE-2025-21926] = "cpe-stable-backport: Backported in 6.6.83" -# CVE-2025-21927 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21927] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21928] = "cpe-stable-backport: Backported in 6.6.83" @@ -15766,7 +15768,7 @@ CVE_STATUS[CVE-2025-21940] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2025-21941] = "cpe-stable-backport: Backported in 6.6.83" -CVE_STATUS[CVE-2025-21942] = "fixed-version: only affects 6.13.2 onwards" +# CVE-2025-21942 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2025-21943] = "cpe-stable-backport: Backported in 6.6.83" @@ -15804,7 +15806,7 @@ CVE_STATUS[CVE-2025-21959] = "cpe-stable-backport: Backported in 6.6.84" CVE_STATUS[CVE-2025-21960] = "cpe-stable-backport: Backported in 6.6.84" -# CVE-2025-21961 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21961] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21962] = "cpe-stable-backport: Backported in 6.6.84" @@ -15826,7 +15828,7 @@ CVE_STATUS[CVE-2025-21970] = "cpe-stable-backport: Backported in 6.6.84" CVE_STATUS[CVE-2025-21971] = "cpe-stable-backport: Backported in 6.6.84" -# CVE-2025-21972 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21972] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21973] = "fixed-version: only affects 6.9 onwards" @@ -15834,7 +15836,7 @@ CVE_STATUS[CVE-2025-21974] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2025-21975] = "cpe-stable-backport: Backported in 6.6.84" -# CVE-2025-21976 needs backporting (fixed from 6.14) +CVE_STATUS[CVE-2025-21976] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-21977] = "fixed-version: only affects 6.8 onwards" @@ -15958,7 +15960,7 @@ CVE_STATUS[CVE-2025-22037] = "cpe-stable-backport: Backported in 6.6.107" CVE_STATUS[CVE-2025-22038] = "cpe-stable-backport: Backported in 6.6.87" -# CVE-2025-22039 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-22039] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2025-22040] = "cpe-stable-backport: Backported in 6.6.87" @@ -16020,7 +16022,7 @@ CVE_STATUS[CVE-2025-22068] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2025-22069] = "fixed-version: only affects 6.12.75 onwards" -# CVE-2025-22070 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-22070] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-22071] = "cpe-stable-backport: Backported in 6.6.87" @@ -16082,13 +16084,13 @@ CVE_STATUS[CVE-2025-22099] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2025-22100] = "fixed-version: only affects 6.13 onwards" -# CVE-2025-22101 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-22101] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2025-22102] = "cpe-stable-backport: Backported in 6.6.92" CVE_STATUS[CVE-2025-22103] = "cpe-stable-backport: Backported in 6.6.117" -# CVE-2025-22104 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-22104] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2025-22105] = "cpe-stable-backport: Backported in 6.6.119" @@ -16098,7 +16100,7 @@ CVE_STATUS[CVE-2025-22107] = "cpe-stable-backport: Backported in 6.6.120" # CVE-2025-22108 needs backporting (fixed from 6.15) -# CVE-2025-22109 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-22109] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-22110] = "fixed-version: only affects 6.14 onwards" @@ -16106,11 +16108,11 @@ CVE_STATUS[CVE-2025-22111] = "cpe-stable-backport: Backported in 6.6.120" CVE_STATUS[CVE-2025-22112] = "fixed-version: only affects 6.12.20 onwards" -# CVE-2025-22113 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-22113] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-22114] = "fixed-version: only affects 6.14 onwards" -# CVE-2025-22115 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-22115] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-22116] = "fixed-version: only affects 6.7 onwards" @@ -16128,17 +16130,17 @@ CVE_STATUS[CVE-2025-22122] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2025-22123] = "fixed-version: only affects 6.9 onwards" -# CVE-2025-22124 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-22124] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2025-22125] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2025-22126] = "cpe-stable-backport: Backported in 6.6.88" -# CVE-2025-22127 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-22127] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-22128] = "fixed-version: only affects 6.8 onwards" -# CVE-2025-23129 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-23129] = "cpe-stable-backport: Backported in 6.6.157" # CVE-2025-23130 needs backporting (fixed from 6.15) @@ -16146,11 +16148,11 @@ CVE_STATUS[CVE-2025-23131] = "cpe-stable-backport: Backported in 6.6.144" # CVE-2025-23132 needs backporting (fixed from 6.15) -# CVE-2025-23133 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-23133] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-23134] = "fixed-version: only affects 6.9 onwards" -# CVE-2025-23135 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-23135] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-23136] = "cpe-stable-backport: Backported in 6.6.87" @@ -16216,7 +16218,7 @@ CVE_STATUS[CVE-2025-37741] = "cpe-stable-backport: Backported in 6.6.88" CVE_STATUS[CVE-2025-37742] = "cpe-stable-backport: Backported in 6.6.88" -# CVE-2025-37743 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37743] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37744] = "fixed-version: only affects 6.14 onwards" @@ -16224,13 +16226,13 @@ CVE_STATUS[CVE-2025-37745] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2025-37746] = "fixed-version: only affects 6.8 onwards" -# CVE-2025-37747 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-37747] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37748] = "cpe-stable-backport: Backported in 6.6.88" CVE_STATUS[CVE-2025-37749] = "cpe-stable-backport: Backported in 6.6.88" -# CVE-2025-37750 may need backporting (fixed from 6.7) +# CVE-2025-37750 needs backporting (fixed from 6.15) CVE_STATUS[CVE-2025-37751] = "fixed-version: only affects 6.14 onwards" @@ -16246,7 +16248,7 @@ CVE_STATUS[CVE-2025-37757] = "cpe-stable-backport: Backported in 6.6.88" CVE_STATUS[CVE-2025-37758] = "cpe-stable-backport: Backported in 6.6.88" -# CVE-2025-37759 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37759] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37760] = "fixed-version: only affects 6.12.19 onwards" @@ -16328,15 +16330,15 @@ CVE_STATUS[CVE-2025-37800] = "cpe-stable-backport: Backported in 6.6.89" CVE_STATUS[CVE-2025-37801] = "cpe-stable-backport: Backported in 6.6.89" -# CVE-2025-37802 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37802] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2025-37803] = "cpe-stable-backport: Backported in 6.6.89" CVE_STATUS[CVE-2025-37805] = "cpe-stable-backport: Backported in 6.6.89" -# CVE-2025-37806 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37806] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-37807 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37807] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37808] = "cpe-stable-backport: Backported in 6.6.89" @@ -16386,7 +16388,7 @@ CVE_STATUS[CVE-2025-37830] = "cpe-stable-backport: Backported in 6.6.89" CVE_STATUS[CVE-2025-37831] = "cpe-stable-backport: Backported in 6.6.89" -# CVE-2025-37833 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37833] = "cpe-stable-backport: Backported in 6.6.157" # CVE-2025-37834 needs backporting (fixed from 6.15) @@ -16430,7 +16432,7 @@ CVE_STATUS[CVE-2025-37854] = "cpe-stable-backport: Backported in 6.6.88" CVE_STATUS[CVE-2025-37855] = "fixed-version: only affects 6.14 onwards" -# CVE-2025-37856 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37856] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37857] = "cpe-stable-backport: Backported in 6.6.88" @@ -16438,9 +16440,9 @@ CVE_STATUS[CVE-2025-37858] = "cpe-stable-backport: Backported in 6.6.88" CVE_STATUS[CVE-2025-37859] = "cpe-stable-backport: Backported in 6.6.88" -# CVE-2025-37860 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37860] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-37861 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37861] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37862] = "cpe-stable-backport: Backported in 6.6.88" @@ -16458,7 +16460,7 @@ CVE_STATUS[CVE-2025-37868] = "fixed-version: only affects 6.12.19 onwards" CVE_STATUS[CVE-2025-37869] = "fixed-version: only affects 6.8 onwards" -# CVE-2025-37870 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37870] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37871] = "fixed-version: only affects 6.13.11 onwards" @@ -16666,7 +16668,7 @@ CVE_STATUS[CVE-2025-37974] = "fixed-version: only affects 6.12.5 onwards" CVE_STATUS[CVE-2025-37975] = "fixed-version: only affects 6.8 onwards" -# CVE-2025-37977 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-37977] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-37978] = "fixed-version: only affects 6.8 onwards" @@ -16768,7 +16770,7 @@ CVE_STATUS[CVE-2025-38027] = "cpe-stable-backport: Backported in 6.6.92" CVE_STATUS[CVE-2025-38028] = "fixed-version: only affects 6.14 onwards" -# CVE-2025-38029 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-38029] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38031] = "cpe-stable-backport: Backported in 6.6.93" @@ -16790,9 +16792,9 @@ CVE_STATUS[CVE-2025-38039] = "cpe-stable-backport: Backported in 6.6.93" CVE_STATUS[CVE-2025-38040] = "cpe-stable-backport: Backported in 6.6.93" -# CVE-2025-38041 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-38041] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-38042 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-38042] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38043] = "cpe-stable-backport: Backported in 6.6.93" @@ -16826,7 +16828,7 @@ CVE_STATUS[CVE-2025-38058] = "cpe-stable-backport: Backported in 6.6.93" CVE_STATUS[CVE-2025-38059] = "cpe-stable-backport: Backported in 6.6.93" -# CVE-2025-38060 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-38060] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38061] = "cpe-stable-backport: Backported in 6.6.93" @@ -16834,7 +16836,7 @@ CVE_STATUS[CVE-2025-38062] = "cpe-stable-backport: Backported in 6.6.93" CVE_STATUS[CVE-2025-38063] = "cpe-stable-backport: Backported in 6.6.93" -# CVE-2025-38064 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-38064] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38065] = "cpe-stable-backport: Backported in 6.6.93" @@ -16844,7 +16846,7 @@ CVE_STATUS[CVE-2025-38067] = "cpe-stable-backport: Backported in 6.6.99" CVE_STATUS[CVE-2025-38068] = "cpe-stable-backport: Backported in 6.6.93" -# CVE-2025-38069 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-38069] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38070] = "fixed-version: only affects 6.13 onwards" @@ -16896,7 +16898,7 @@ CVE_STATUS[CVE-2025-38094] = "cpe-stable-backport: Backported in 6.6.92" CVE_STATUS[CVE-2025-38095] = "cpe-stable-backport: Backported in 6.6.92" -# CVE-2025-38096 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-38096] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38097] = "cpe-stable-backport: Backported in 6.6.93" @@ -16968,7 +16970,7 @@ CVE_STATUS[CVE-2025-38130] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2025-38131] = "cpe-stable-backport: Backported in 6.6.94" -# CVE-2025-38132 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38132] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38133] = "fixed-version: only affects 6.15 onwards" @@ -17108,13 +17110,13 @@ CVE_STATUS[CVE-2025-38201] = "cpe-stable-backport: Backported in 6.6.124" CVE_STATUS[CVE-2025-38202] = "cpe-stable-backport: Backported in 6.6.95" -# CVE-2025-38203 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-38203] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2025-38204 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38204] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38205] = "fixed-version: only affects 6.7 onwards" -# CVE-2025-38206 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-38206] = "cpe-stable-backport: Backported in 6.6.156" # CVE-2025-38207 needs backporting (fixed from 6.16) @@ -17174,7 +17176,7 @@ CVE_STATUS[CVE-2025-38235] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2025-38236] = "cpe-stable-backport: Backported in 6.6.96" -# CVE-2025-38237 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-38237] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2025-38238] = "fixed-version: only affects 6.14 onwards" @@ -17222,13 +17224,13 @@ CVE_STATUS[CVE-2025-38259] = "cpe-stable-backport: Backported in 6.6.96" CVE_STATUS[CVE-2025-38260] = "cpe-stable-backport: Backported in 6.6.96" -# CVE-2025-38261 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38261] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38262] = "cpe-stable-backport: Backported in 6.6.96" CVE_STATUS[CVE-2025-38263] = "cpe-stable-backport: Backported in 6.6.96" -# CVE-2025-38264 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38264] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38265] = "cpe-stable-backport: Backported in 6.6.94" @@ -17244,7 +17246,7 @@ CVE_STATUS[CVE-2025-38270] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2025-38271] = "fixed-version: only affects 6.15 onwards" -# CVE-2025-38272 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38272] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38273] = "cpe-stable-backport: Backported in 6.6.94" @@ -17258,7 +17260,7 @@ CVE_STATUS[CVE-2025-38277] = "cpe-stable-backport: Backported in 6.6.94" CVE_STATUS[CVE-2025-38278] = "cpe-stable-backport: Backported in 6.6.94" -# CVE-2025-38279 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38279] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38280] = "cpe-stable-backport: Backported in 6.6.94" @@ -17284,7 +17286,7 @@ CVE_STATUS[CVE-2025-38290] = "cpe-stable-backport: Backported in 6.6.94" CVE_STATUS[CVE-2025-38291] = "fixed-version: only affects 6.13 onwards" -# CVE-2025-38292 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38292] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38293] = "cpe-stable-backport: Backported in 6.6.94" @@ -17306,7 +17308,7 @@ CVE_STATUS[CVE-2025-38301] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2025-38302] = "fixed-version: only affects 6.10 onwards" -# CVE-2025-38303 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38303] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38304] = "cpe-stable-backport: Backported in 6.6.94" @@ -17418,7 +17420,7 @@ CVE_STATUS[CVE-2025-38357] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2025-38358] = "fixed-version: only affects 6.15 onwards" -# CVE-2025-38359 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38359] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38360] = "fixed-version: only affects 6.7 onwards" @@ -17526,7 +17528,7 @@ CVE_STATUS[CVE-2025-38412] = "cpe-stable-backport: Backported in 6.6.97" CVE_STATUS[CVE-2025-38413] = "fixed-version: only affects 6.11 onwards" -# CVE-2025-38414 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38414] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38415] = "cpe-stable-backport: Backported in 6.6.94" @@ -17712,7 +17714,7 @@ CVE_STATUS[CVE-2025-38505] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2025-38506] = "fixed-version: only affects 6.8 onwards" -# CVE-2025-38507 needs backporting (fixed from 6.16) +CVE_STATUS[CVE-2025-38507] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38508] = "fixed-version: only affects 6.14 onwards" @@ -17860,7 +17862,7 @@ CVE_STATUS[CVE-2025-38580] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2025-38581] = "cpe-stable-backport: Backported in 6.6.102" -# CVE-2025-38582 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-38582] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38583] = "cpe-stable-backport: Backported in 6.6.102" @@ -17878,7 +17880,7 @@ CVE_STATUS[CVE-2025-38589] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2025-38590] = "cpe-stable-backport: Backported in 6.6.102" -# CVE-2025-38591 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38591] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2025-38592] = "fixed-version: only affects 6.15 onwards" @@ -17886,11 +17888,11 @@ CVE_STATUS[CVE-2025-38593] = "cpe-stable-backport: Backported in 6.6.117" CVE_STATUS[CVE-2025-38594] = "fixed-version: only affects 6.16 onwards" -# CVE-2025-38595 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38595] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38596] = "fixed-version: only affects 6.16 onwards" -# CVE-2025-38597 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38597] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38598] = "fixed-version: only affects 6.16 onwards" @@ -17904,7 +17906,7 @@ CVE_STATUS[CVE-2025-38602] = "cpe-stable-backport: Backported in 6.6.102" CVE_STATUS[CVE-2025-38604] = "cpe-stable-backport: Backported in 6.6.102" -# CVE-2025-38605 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38605] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38606] = "fixed-version: only affects 6.14 onwards" @@ -17964,7 +17966,7 @@ CVE_STATUS[CVE-2025-38634] = "cpe-stable-backport: Backported in 6.6.102" CVE_STATUS[CVE-2025-38635] = "cpe-stable-backport: Backported in 6.6.102" -# CVE-2025-38636 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38636] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38637] = "cpe-stable-backport: Backported in 6.6.87" @@ -18004,7 +18006,7 @@ CVE_STATUS[CVE-2025-38654] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2025-38655] = "fixed-version: only affects 6.13 onwards" -# CVE-2025-38656 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-38656] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38657] = "fixed-version: only affects 6.16 onwards" @@ -18012,7 +18014,7 @@ CVE_STATUS[CVE-2025-38658] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2025-38659] = "cpe-stable-backport: Backported in 6.6.102" -# CVE-2025-38660 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38660] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2025-38661] = "fixed-version: only affects 6.15 onwards" @@ -18102,7 +18104,7 @@ CVE_STATUS[CVE-2025-38703] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2025-38704] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2025-38705 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38705] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38706] = "cpe-stable-backport: Backported in 6.6.103" @@ -18136,7 +18138,7 @@ CVE_STATUS[CVE-2025-38720] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2025-38721] = "cpe-stable-backport: Backported in 6.6.103" -# CVE-2025-38722 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-38722] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-38723] = "cpe-stable-backport: Backported in 6.6.103" @@ -18176,7 +18178,7 @@ CVE_STATUS[CVE-2025-39675] = "cpe-stable-backport: Backported in 6.6.103" CVE_STATUS[CVE-2025-39676] = "cpe-stable-backport: Backported in 6.6.103" -# CVE-2025-39677 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39677] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39678] = "fixed-version: only affects 6.7 onwards" @@ -18232,7 +18234,7 @@ CVE_STATUS[CVE-2025-39703] = "cpe-stable-backport: Backported in 6.6.103" CVE_STATUS[CVE-2025-39704] = "fixed-version: only affects 6.13 onwards" -# CVE-2025-39705 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39705] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39706] = "cpe-stable-backport: Backported in 6.6.103" @@ -18286,7 +18288,7 @@ CVE_STATUS[CVE-2025-39730] = "cpe-stable-backport: Backported in 6.6.102" CVE_STATUS[CVE-2025-39731] = "cpe-stable-backport: Backported in 6.6.102" -# CVE-2025-39732 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39732] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39733] = "fixed-version: only affects 6.15 onwards" @@ -18328,7 +18330,7 @@ CVE_STATUS[CVE-2025-39752] = "cpe-stable-backport: Backported in 6.6.103" CVE_STATUS[CVE-2025-39753] = "fixed-version: only affects 6.12 onwards" -# CVE-2025-39754 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39754] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39755] = "fixed-version: only affects 6.13 onwards" @@ -18398,7 +18400,7 @@ CVE_STATUS[CVE-2025-39787] = "cpe-stable-backport: Backported in 6.6.103" CVE_STATUS[CVE-2025-39788] = "cpe-stable-backport: Backported in 6.6.103" -# CVE-2025-39789 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39789] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39790] = "cpe-stable-backport: Backported in 6.6.103" @@ -18438,7 +18440,7 @@ CVE_STATUS[CVE-2025-39808] = "cpe-stable-backport: Backported in 6.6.104" CVE_STATUS[CVE-2025-39809] = "fixed-version: only affects 6.14 onwards" -# CVE-2025-39810 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39810] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39811] = "fixed-version: only affects 6.8 onwards" @@ -18476,7 +18478,7 @@ CVE_STATUS[CVE-2025-39827] = "cpe-stable-backport: Backported in 6.6.104" CVE_STATUS[CVE-2025-39828] = "cpe-stable-backport: Backported in 6.6.104" -# CVE-2025-39829 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39829] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39830] = "fixed-version: only affects 6.12 onwards" @@ -18484,7 +18486,7 @@ CVE_STATUS[CVE-2025-39831] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2025-39832] = "cpe-stable-backport: Backported in 6.6.104" -# CVE-2025-39833 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-39833] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2025-39834] = "fixed-version: only affects 6.12 onwards" @@ -18518,9 +18520,9 @@ CVE_STATUS[CVE-2025-39848] = "cpe-stable-backport: Backported in 6.6.105" CVE_STATUS[CVE-2025-39849] = "cpe-stable-backport: Backported in 6.6.105" -# CVE-2025-39850 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39850] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-39851 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39851] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39852] = "fixed-version: only affects 6.7 onwards" @@ -18536,13 +18538,13 @@ CVE_STATUS[CVE-2025-39857] = "cpe-stable-backport: Backported in 6.6.105" CVE_STATUS[CVE-2025-39858] = "fixed-version: only affects 6.15 onwards" -# CVE-2025-39859 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39859] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39860] = "cpe-stable-backport: Backported in 6.6.105" CVE_STATUS[CVE-2025-39861] = "cpe-stable-backport: Backported in 6.6.105" -# CVE-2025-39862 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39862] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39863] = "cpe-stable-backport: Backported in 6.6.105" @@ -18634,7 +18636,7 @@ CVE_STATUS[CVE-2025-39908] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2025-39909] = "cpe-stable-backport: Backported in 6.6.107" -# CVE-2025-39910 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39910] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39911] = "cpe-stable-backport: Backported in 6.6.107" @@ -18664,11 +18666,11 @@ CVE_STATUS[CVE-2025-39923] = "cpe-stable-backport: Backported in 6.6.107" CVE_STATUS[CVE-2025-39924] = "fixed-version: only affects 6.15 onwards" -# CVE-2025-39925 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-39925] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2025-39926] = "fixed-version: only affects 6.9 onwards" -# CVE-2025-39927 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39927] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39928] = "fixed-version: only affects 6.13 onwards" @@ -18680,7 +18682,7 @@ CVE_STATUS[CVE-2025-39931] = "cpe-stable-backport: Backported in 6.6.108" # CVE-2025-39932 needs backporting (fixed from 6.17) -# CVE-2025-39933 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39933] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39934] = "cpe-stable-backport: Backported in 6.6.108" @@ -18694,7 +18696,7 @@ CVE_STATUS[CVE-2025-39938] = "cpe-stable-backport: Backported in 6.6.108" CVE_STATUS[CVE-2025-39939] = "fixed-version: only affects 6.15 onwards" -# CVE-2025-39940 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39940] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39941] = "fixed-version: only affects 6.14 onwards" @@ -18710,7 +18712,7 @@ CVE_STATUS[CVE-2025-39946] = "cpe-stable-backport: Backported in 6.6.108" CVE_STATUS[CVE-2025-39947] = "cpe-stable-backport: Backported in 6.6.108" -CVE_STATUS[CVE-2025-39948] = "fixed-version: only affects 6.12.14 onwards" +CVE_STATUS[CVE-2025-39948] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39949] = "cpe-stable-backport: Backported in 6.6.108" @@ -18730,7 +18732,7 @@ CVE_STATUS[CVE-2025-39956] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2025-39957] = "cpe-stable-backport: Backported in 6.6.108" -# CVE-2025-39958 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39958] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39959] = "fixed-version: only affects 6.15 onwards" @@ -18794,7 +18796,7 @@ CVE_STATUS[CVE-2025-39988] = "cpe-stable-backport: Backported in 6.6.109" CVE_STATUS[CVE-2025-39989] = "cpe-stable-backport: Backported in 6.6.89" -# CVE-2025-39990 needs backporting (fixed from 6.17) +CVE_STATUS[CVE-2025-39990] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-39991] = "fixed-version: only affects 6.7 onwards" @@ -18820,7 +18822,7 @@ CVE_STATUS[CVE-2025-40001] = "cpe-stable-backport: Backported in 6.6.113" CVE_STATUS[CVE-2025-40002] = "fixed-version: only affects 6.14 onwards" -# CVE-2025-40003 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40003] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40004] = "fixed-version: only affects 6.12 onwards" @@ -18922,13 +18924,13 @@ CVE_STATUS[CVE-2025-40052] = "cpe-stable-backport: Backported in 6.6.112" CVE_STATUS[CVE-2025-40053] = "cpe-stable-backport: Backported in 6.6.112" -# CVE-2025-40054 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2025-40054] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2025-40055] = "cpe-stable-backport: Backported in 6.6.112" CVE_STATUS[CVE-2025-40056] = "cpe-stable-backport: Backported in 6.6.112" -# CVE-2025-40057 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40057] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40058] = "fixed-version: only affects 6.7 onwards" @@ -18942,9 +18944,9 @@ CVE_STATUS[CVE-2025-40062] = "cpe-stable-backport: Backported in 6.6.112" CVE_STATUS[CVE-2025-40063] = "fixed-version: only affects 6.16 onwards" -# CVE-2025-40064 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-40064] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2025-40065 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40065] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40066] = "fixed-version: only affects 6.15 onwards" @@ -18962,9 +18964,9 @@ CVE_STATUS[CVE-2025-40072] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2025-40073] = "fixed-version: only affects 6.16 onwards" -# CVE-2025-40074 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40074] = "cpe-stable-backport: Backported in 6.6.157" -# CVE-2025-40075 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40075] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40076] = "fixed-version: only affects 6.17 onwards" @@ -19008,7 +19010,7 @@ CVE_STATUS[CVE-2025-40095] = "cpe-stable-backport: Backported in 6.6.114" CVE_STATUS[CVE-2025-40096] = "cpe-stable-backport: Backported in 6.6.114" -# CVE-2025-40097 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40097] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2025-40098] = "fixed-version: only affects 6.7 onwards" @@ -19018,7 +19020,7 @@ CVE_STATUS[CVE-2025-40100] = "cpe-stable-backport: Backported in 6.6.114" CVE_STATUS[CVE-2025-40101] = "fixed-version: only affects 6.7.11 onwards" -# CVE-2025-40102 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-40102] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2025-40103] = "cpe-stable-backport: Backported in 6.6.114" @@ -19084,13 +19086,13 @@ CVE_STATUS[CVE-2025-40134] = "cpe-stable-backport: Backported in 6.6.112" CVE_STATUS[CVE-2025-40135] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2025-40136 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40136] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40137] = "cpe-stable-backport: Backported in 6.6.112" CVE_STATUS[CVE-2025-40138] = "fixed-version: only affects 6.17 onwards" -# CVE-2025-40139 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-40139] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2025-40140] = "cpe-stable-backport: Backported in 6.6.112" @@ -19126,7 +19128,7 @@ CVE_STATUS[CVE-2025-40156] = "cpe-stable-backport: Backported in 6.6.112" CVE_STATUS[CVE-2025-40157] = "cpe-stable-backport: Backported in 6.6.112" -# CVE-2025-40158 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40158] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40159] = "fixed-version: only affects 6.8 onwards" @@ -19146,11 +19148,11 @@ CVE_STATUS[CVE-2025-40166] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2025-40167] = "cpe-stable-backport: Backported in 6.6.114" -# CVE-2025-40168 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2025-40168] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2025-40169] = "cpe-stable-backport: Backported in 6.6.112" -# CVE-2025-40170 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40170] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40171] = "cpe-stable-backport: Backported in 6.6.112" @@ -19170,7 +19172,7 @@ CVE_STATUS[CVE-2025-40178] = "cpe-stable-backport: Backported in 6.6.113" CVE_STATUS[CVE-2025-40179] = "cpe-stable-backport: Backported in 6.6.113" -# CVE-2025-40180 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40180] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40181] = "fixed-version: only affects 6.12 onwards" @@ -19236,7 +19238,7 @@ CVE_STATUS[CVE-2025-40211] = "cpe-stable-backport: Backported in 6.6.117" CVE_STATUS[CVE-2025-40212] = "fixed-version: only affects 6.12 onwards" -# CVE-2025-40213 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-40213] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40214] = "cpe-stable-backport: Backported in 6.6.117" @@ -19388,7 +19390,7 @@ CVE_STATUS[CVE-2025-40287] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2025-40288] = "cpe-stable-backport: Backported in 6.6.117" -# CVE-2025-40289 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40289] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40290] = "fixed-version: only affects 6.16.8 onwards" @@ -19460,7 +19462,7 @@ CVE_STATUS[CVE-2025-40323] = "cpe-stable-backport: Backported in 6.6.117" CVE_STATUS[CVE-2025-40324] = "cpe-stable-backport: Backported in 6.6.117" -# CVE-2025-40325 needs backporting (fixed from 6.15) +CVE_STATUS[CVE-2025-40325] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-40326] = "fixed-version: only affects 6.14 onwards" @@ -19486,7 +19488,7 @@ CVE_STATUS[CVE-2025-40336] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2025-40337] = "cpe-stable-backport: Backported in 6.6.117" -# CVE-2025-40338 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-40338] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2025-40339 needs backporting (fixed from 6.18) @@ -19554,7 +19556,7 @@ CVE_STATUS[CVE-2025-68173] = "cpe-stable-backport: Backported in 6.6.117" # CVE-2025-68174 needs backporting (fixed from 6.18) -# CVE-2025-68175 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68175] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68176] = "cpe-stable-backport: Backported in 6.6.117" @@ -19580,11 +19582,11 @@ CVE_STATUS[CVE-2025-68186] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2025-68187] = "fixed-version: only affects 6.17 onwards" -# CVE-2025-68188 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68188] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68189] = "fixed-version: only affects 6.17 onwards" -# CVE-2025-68190 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68190] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2025-68191] = "cpe-stable-backport: Backported in 6.6.117" @@ -19594,8 +19596,6 @@ CVE_STATUS[CVE-2025-68193] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2025-68194] = "cpe-stable-backport: Backported in 6.6.117" -CVE_STATUS[CVE-2025-68195] = "fixed-version: only affects 6.12.58 onwards" - CVE_STATUS[CVE-2025-68196] = "fixed-version: only affects 6.17 onwards" CVE_STATUS[CVE-2025-68197] = "fixed-version: only affects 6.13 onwards" @@ -19606,7 +19606,7 @@ CVE_STATUS[CVE-2025-68199] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2025-68200] = "cpe-stable-backport: Backported in 6.6.117" -# CVE-2025-68201 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68201] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68202] = "fixed-version: only affects 6.12 onwards" @@ -19620,7 +19620,7 @@ CVE_STATUS[CVE-2025-68207] = "fixed-version: only affects 6.12.37 onwards" CVE_STATUS[CVE-2025-68208] = "cpe-stable-backport: Backported in 6.6.117" -# CVE-2025-68209 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68209] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68210] = "fixed-version: only affects 6.10 onwards" @@ -19660,7 +19660,7 @@ CVE_STATUS[CVE-2025-68228] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2025-68229] = "cpe-stable-backport: Backported in 6.6.118" -# CVE-2025-68230 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68230] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68231] = "cpe-stable-backport: Backported in 6.6.118" @@ -19672,7 +19672,7 @@ CVE_STATUS[CVE-2025-68234] = "fixed-version: only affects 6.17 onwards" CVE_STATUS[CVE-2025-68235] = "cpe-stable-backport: Backported in 6.6.118" -# CVE-2025-68236 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68236] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68237] = "cpe-stable-backport: Backported in 6.6.118" @@ -19702,7 +19702,7 @@ CVE_STATUS[CVE-2025-68249] = "cpe-stable-backport: Backported in 6.6.115" CVE_STATUS[CVE-2025-68250] = "fixed-version: only affects 6.16 onwards" -# CVE-2025-68251 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2025-68251] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68252] = "cpe-stable-backport: Backported in 6.6.115" @@ -19794,11 +19794,11 @@ CVE_STATUS[CVE-2025-68309] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2025-68310] = "cpe-stable-backport: Backported in 6.6.117" -# CVE-2025-68311 needs backporting (fixed from 6.18) +CVE_STATUS[CVE-2025-68311] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68312] = "cpe-stable-backport: Backported in 6.6.117" -CVE_STATUS[CVE-2025-68313] = "fixed-version: only affects 6.6.156 onwards" +# CVE-2025-68313 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2025-68314] = "fixed-version: only affects 6.17 onwards" @@ -19820,7 +19820,7 @@ CVE_STATUS[CVE-2025-68321] = "cpe-stable-backport: Backported in 6.6.117" CVE_STATUS[CVE-2025-68323] = "fixed-version: only affects 6.16 onwards" -# CVE-2025-68324 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68324] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68325] = "cpe-stable-backport: Backported in 6.6.120" @@ -19884,7 +19884,7 @@ CVE_STATUS[CVE-2025-68354] = "cpe-stable-backport: Backported in 6.6.120" CVE_STATUS[CVE-2025-68355] = "fixed-version: only affects 6.18 onwards" -# CVE-2025-68356 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68356] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68357] = "fixed-version: only affects 6.17.13 onwards" @@ -19920,15 +19920,15 @@ CVE_STATUS[CVE-2025-68372] = "cpe-stable-backport: Backported in 6.6.120" CVE_STATUS[CVE-2025-68373] = "fixed-version: only affects 6.17 onwards" -# CVE-2025-68374 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68374] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68375] = "fixed-version: only affects 6.16 onwards" -# CVE-2025-68376 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68376] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68377] = "fixed-version: only affects 6.18 onwards" -# CVE-2025-68378 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68378] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68379] = "cpe-stable-backport: Backported in 6.6.120" @@ -19944,7 +19944,7 @@ CVE_STATUS[CVE-2025-68727] = "cpe-stable-backport: Backported in 6.6.120" CVE_STATUS[CVE-2025-68728] = "cpe-stable-backport: Backported in 6.6.120" -# CVE-2025-68729 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68729] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68730] = "fixed-version: only affects 6.8 onwards" @@ -19976,7 +19976,7 @@ CVE_STATUS[CVE-2025-68743] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2025-68744] = "cpe-stable-backport: Backported in 6.6.120" -# CVE-2025-68745 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68745] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68746] = "cpe-stable-backport: Backported in 6.6.120" @@ -20126,7 +20126,7 @@ CVE_STATUS[CVE-2025-68820] = "cpe-stable-backport: Backported in 6.6.120" CVE_STATUS[CVE-2025-68821] = "cpe-stable-backport: Backported in 6.6.120" -# CVE-2025-68822 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-68822] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-68823] = "cpe-stable-backport: Backported in 6.6.124" @@ -20146,11 +20146,11 @@ CVE_STATUS[CVE-2025-71070] = "fixed-version: only affects 6.14.6 onwards" CVE_STATUS[CVE-2025-71071] = "cpe-stable-backport: Backported in 6.6.120" -# CVE-2025-71072 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-71072] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-71073 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-71073] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-71074 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-71074] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-71075] = "cpe-stable-backport: Backported in 6.6.120" @@ -20220,7 +20220,7 @@ CVE_STATUS[CVE-2025-71107] = "cpe-stable-backport: Backported in 6.6.120" CVE_STATUS[CVE-2025-71108] = "cpe-stable-backport: Backported in 6.6.120" -# CVE-2025-71109 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-71109] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-71110] = "fixed-version: only affects 6.18 onwards" @@ -20388,9 +20388,9 @@ CVE_STATUS[CVE-2025-71223] = "cpe-stable-backport: Backported in 6.6.124" CVE_STATUS[CVE-2025-71224] = "cpe-stable-backport: Backported in 6.6.124" -# CVE-2025-71225 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-71225] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-71227 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2025-71227] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-71229] = "cpe-stable-backport: Backported in 6.6.125" @@ -20428,13 +20428,13 @@ CVE_STATUS[CVE-2025-71270] = "cpe-stable-backport: Backported in 6.6.124" CVE_STATUS[CVE-2025-71271] = "fixed-version: only affects 6.13 onwards" -# CVE-2025-71272 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2025-71272] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2025-71273 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2025-71273] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-71274] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2025-71285 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2025-71285] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-71286] = "cpe-stable-backport: Backported in 6.6.128" @@ -20488,12 +20488,32 @@ CVE_STATUS[CVE-2025-71311] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2025-71312] = "fixed-version: only affects 6.19 onwards" -# CVE-2025-71313 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2025-71313] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2025-71314] = "fixed-version: only affects 6.10 onwards" # CVE-2025-71315 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-100070] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-100071] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-100072] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-100073] = "fixed-version: only affects 6.16.3 onwards" + +CVE_STATUS[CVE-2026-100074] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-100075] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-100076] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-100077] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-100078] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-100079] = "cpe-stable-backport: Backported in 6.6.157" + CVE_STATUS[CVE-2026-17523] = "fixed-version: Fixed from version 5.4" CVE_STATUS[CVE-2026-22976] = "cpe-stable-backport: Backported in 6.6.121" @@ -20536,7 +20556,7 @@ CVE_STATUS[CVE-2026-22994] = "cpe-stable-backport: Backported in 6.6.121" CVE_STATUS[CVE-2026-22995] = "fixed-version: only affects 6.18.4 onwards" -# CVE-2026-22996 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-22996] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-22997] = "cpe-stable-backport: Backported in 6.6.122" @@ -20614,7 +20634,7 @@ CVE_STATUS[CVE-2026-23033] = "cpe-stable-backport: Backported in 6.6.122" CVE_STATUS[CVE-2026-23034] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-23035 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-23035] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23036] = "fixed-version: only affects 6.13 onwards" @@ -20818,7 +20838,7 @@ CVE_STATUS[CVE-2026-23135] = "cpe-stable-backport: Backported in 6.6.122" CVE_STATUS[CVE-2026-23136] = "cpe-stable-backport: Backported in 6.6.121" -# CVE-2026-23137 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-23137] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23138] = "cpe-stable-backport: Backported in 6.6.130" @@ -20926,7 +20946,7 @@ CVE_STATUS[CVE-2026-23189] = "fixed-version: only affects 6.12.58 onwards" CVE_STATUS[CVE-2026-23190] = "cpe-stable-backport: Backported in 6.6.124" -# CVE-2026-23191 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-23191] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-23192] = "fixed-version: only affects 6.15 onwards" @@ -20958,9 +20978,9 @@ CVE_STATUS[CVE-2026-23205] = "cpe-stable-backport: Backported in 6.6.124" CVE_STATUS[CVE-2026-23206] = "cpe-stable-backport: Backported in 6.6.124" -# CVE-2026-23207 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-23207] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-23208 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-23208] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23209] = "cpe-stable-backport: Backported in 6.6.124" @@ -20970,9 +20990,9 @@ CVE_STATUS[CVE-2026-23211] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-23212] = "cpe-stable-backport: Backported in 6.6.123" -# CVE-2026-23213 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-23213] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-23214 needs backporting (fixed from 6.19) +CVE_STATUS[CVE-2026-23214] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23215] = "fixed-version: only affects 6.11 onwards" @@ -20996,7 +21016,7 @@ CVE_STATUS[CVE-2026-23224] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-23225] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-23226 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23226] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23227] = "cpe-stable-backport: Backported in 6.6.130" @@ -21038,7 +21058,7 @@ CVE_STATUS[CVE-2026-23245] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-23246] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2026-23247 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23247] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23248] = "fixed-version: only affects 6.14 onwards" @@ -21096,7 +21116,7 @@ CVE_STATUS[CVE-2026-23274] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-23275] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-23276 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23276] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23277] = "cpe-stable-backport: Backported in 6.6.130" @@ -21134,7 +21154,7 @@ CVE_STATUS[CVE-2026-23293] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-23294] = "fixed-version: only affects 6.18 onwards" -CVE_STATUS[CVE-2026-23295] = "fixed-version: only affects 6.19 onwards" +CVE_STATUS[CVE-2026-23295] = "fixed-version: only affects 6.18.57 onwards" CVE_STATUS[CVE-2026-23296] = "cpe-stable-backport: Backported in 6.6.130" @@ -21196,7 +21216,7 @@ CVE_STATUS[CVE-2026-23325] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-23326] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-23327 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23327] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23328] = "fixed-version: only affects 6.14 onwards" @@ -21262,7 +21282,7 @@ CVE_STATUS[CVE-2026-23359] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-23360] = "cpe-stable-backport: Backported in 6.6.131" -# CVE-2026-23361 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23361] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23362] = "cpe-stable-backport: Backported in 6.6.130" @@ -21282,7 +21302,7 @@ CVE_STATUS[CVE-2026-23369] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2026-23370] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2026-23371 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23371] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23372] = "cpe-stable-backport: Backported in 6.6.130" @@ -21294,7 +21314,7 @@ CVE_STATUS[CVE-2026-23375] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2026-23376] = "fixed-version: only affects 6.17.3 onwards" -# CVE-2026-23377 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23377] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23378] = "cpe-stable-backport: Backported in 6.6.130" @@ -21306,7 +21326,7 @@ CVE_STATUS[CVE-2026-23381] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-23382] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2026-23383 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23383] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23384] = "fixed-version: only affects 6.18 onwards" @@ -21458,7 +21478,7 @@ CVE_STATUS[CVE-2026-23457] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-23458] = "cpe-stable-backport: Backported in 6.6.130" -CVE_STATUS[CVE-2026-23459] = "fixed-version: only affects 6.6.153 onwards" +CVE_STATUS[CVE-2026-23459] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23460] = "cpe-stable-backport: Backported in 6.6.130" @@ -21482,7 +21502,7 @@ CVE_STATUS[CVE-2026-23469] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2026-23470] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-23472 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-23472] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-23474] = "cpe-stable-backport: Backported in 6.6.130" @@ -21528,7 +21548,7 @@ CVE_STATUS[CVE-2026-31408] = "cpe-stable-backport: Backported in 6.6.131" CVE_STATUS[CVE-2026-31409] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2026-31410 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31410] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31411] = "cpe-stable-backport: Backported in 6.6.128" @@ -21548,7 +21568,7 @@ CVE_STATUS[CVE-2026-31418] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-31419] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-31420 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31420] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-31421] = "cpe-stable-backport: Backported in 6.6.134" @@ -21632,7 +21652,7 @@ CVE_STATUS[CVE-2026-31460] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-31461] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-31462 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31462] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31463] = "fixed-version: only affects 6.19 onwards" @@ -21682,7 +21702,7 @@ CVE_STATUS[CVE-2026-31485] = "cpe-stable-backport: Backported in 6.6.131" CVE_STATUS[CVE-2026-31486] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-31487 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31487] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31488] = "cpe-stable-backport: Backported in 6.6.140" @@ -21694,7 +21714,7 @@ CVE_STATUS[CVE-2026-31491] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-31492] = "cpe-stable-backport: Backported in 6.6.131" -# CVE-2026-31493 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31493] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31494] = "cpe-stable-backport: Backported in 6.6.131" @@ -21718,9 +21738,9 @@ CVE_STATUS[CVE-2026-31503] = "cpe-stable-backport: Backported in 6.6.131" CVE_STATUS[CVE-2026-31504] = "cpe-stable-backport: Backported in 6.6.131" -# CVE-2026-31505 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31505] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-31506 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31506] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31507] = "cpe-stable-backport: Backported in 6.6.131" @@ -21736,7 +21756,7 @@ CVE_STATUS[CVE-2026-31512] = "cpe-stable-backport: Backported in 6.6.131" CVE_STATUS[CVE-2026-31513] = "fixed-version: only affects 6.12.75 onwards" -CVE_STATUS[CVE-2026-31514] = "fixed-version: only affects 6.12.75 onwards" +CVE_STATUS[CVE-2026-31514] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-31515] = "cpe-stable-backport: Backported in 6.6.131" @@ -21768,9 +21788,9 @@ CVE_STATUS[CVE-2026-31528] = "cpe-stable-backport: Backported in 6.6.131" CVE_STATUS[CVE-2026-31529] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-31530 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31530] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-31531 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31531] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31532] = "cpe-stable-backport: Backported in 6.6.136" @@ -21820,13 +21840,13 @@ CVE_STATUS[CVE-2026-31555] = "cpe-stable-backport: Backported in 6.6.131" CVE_STATUS[CVE-2026-31556] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-31557 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31557] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31558] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2026-31559] = "fixed-version: only affects 6.12.43 onwards" -# CVE-2026-31560 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31560] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31561] = "fixed-version: only affects 6.9 onwards" @@ -21842,7 +21862,7 @@ CVE_STATUS[CVE-2026-31566] = "cpe-stable-backport: Backported in 6.6.131" CVE_STATUS[CVE-2026-31567] = "fixed-version: only affects 6.17.8 onwards" -# CVE-2026-31568 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31568] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31569] = "fixed-version: only affects 6.13 onwards" @@ -21852,7 +21872,7 @@ CVE_STATUS[CVE-2026-31571] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-31572] = "fixed-version: only affects 6.16 onwards" -CVE_STATUS[CVE-2026-31573] = "fixed-version: only affects 6.19.6 onwards" +# CVE-2026-31573 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2026-31574] = "fixed-version: only affects 7.0 onwards" @@ -21890,7 +21910,7 @@ CVE_STATUS[CVE-2026-31590] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-31591] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-31592 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-31592] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31593] = "fixed-version: only affects 6.11 onwards" @@ -21918,7 +21938,7 @@ CVE_STATUS[CVE-2026-31604] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-31605] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-31606 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-31606] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31607] = "cpe-stable-backport: Backported in 6.6.136" @@ -21966,7 +21986,7 @@ CVE_STATUS[CVE-2026-31628] = "cpe-stable-backport: Backported in 6.6.135" CVE_STATUS[CVE-2026-31629] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-31630 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31630] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31631] = "fixed-version: only affects 6.16 onwards" @@ -21996,7 +22016,7 @@ CVE_STATUS[CVE-2026-31643] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-31644] = "fixed-version: only affects 6.12 onwards" -# CVE-2026-31645 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31645] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31646] = "cpe-stable-backport: Backported in 6.6.135" @@ -22032,7 +22052,7 @@ CVE_STATUS[CVE-2026-31661] = "cpe-stable-backport: Backported in 6.6.135" CVE_STATUS[CVE-2026-31662] = "cpe-stable-backport: Backported in 6.6.135" -# CVE-2026-31663 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31663] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31664] = "cpe-stable-backport: Backported in 6.6.135" @@ -22060,7 +22080,7 @@ CVE_STATUS[CVE-2026-31675] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-31676] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-31677 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31677] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31678] = "cpe-stable-backport: Backported in 6.6.131" @@ -22116,7 +22136,7 @@ CVE_STATUS[CVE-2026-31704] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-31705] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-31706 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-31706] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31707] = "cpe-stable-backport: Backported in 6.6.141" @@ -22124,7 +22144,7 @@ CVE_STATUS[CVE-2026-31708] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-31709] = "cpe-stable-backport: Backported in 6.6.140" -CVE_STATUS[CVE-2026-31710] = "fixed-version: only affects 7.0 onwards" +CVE_STATUS[CVE-2026-31710] = "fixed-version: only affects 6.18.53 onwards" CVE_STATUS[CVE-2026-31711] = "cpe-stable-backport: Backported in 6.6.136" @@ -22148,13 +22168,13 @@ CVE_STATUS[CVE-2026-31720] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-31721] = "cpe-stable-backport: Backported in 6.6.135" -# CVE-2026-31722 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31722] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-31723 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31723] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-31724 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31724] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-31725 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31725] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31726] = "cpe-stable-backport: Backported in 6.6.134" @@ -22238,7 +22258,7 @@ CVE_STATUS[CVE-2026-31765] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2026-31766] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-31767 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31767] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31768] = "cpe-stable-backport: Backported in 6.6.134" @@ -22246,7 +22266,7 @@ CVE_STATUS[CVE-2026-31769] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2026-31770] = "cpe-stable-backport: Backported in 6.6.134" -# CVE-2026-31771 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-31771] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-31772] = "fixed-version: only affects 6.12.2 onwards" @@ -22254,7 +22274,7 @@ CVE_STATUS[CVE-2026-31773] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-31774] = "fixed-version: only affects 6.10 onwards" -CVE_STATUS[CVE-2026-31775] = "fixed-version: only affects 6.19 onwards" +CVE_STATUS[CVE-2026-31775] = "fixed-version: only affects 6.18.57 onwards" CVE_STATUS[CVE-2026-31776] = "fixed-version: only affects 6.19 onwards" @@ -22292,7 +22312,7 @@ CVE_STATUS[CVE-2026-43007] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-43008] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-43009 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43009] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43010] = "cpe-stable-backport: Backported in 6.6.144" @@ -22318,7 +22338,7 @@ CVE_STATUS[CVE-2026-43020] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-43021] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-43022 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-43022] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43023] = "cpe-stable-backport: Backported in 6.6.134" @@ -22346,7 +22366,7 @@ CVE_STATUS[CVE-2026-43034] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2026-43035] = "cpe-stable-backport: Backported in 6.6.134" -# CVE-2026-43036 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43036] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43037] = "cpe-stable-backport: Backported in 6.6.134" @@ -22358,7 +22378,7 @@ CVE_STATUS[CVE-2026-43040] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-43041] = "cpe-stable-backport: Backported in 6.6.134" -# CVE-2026-43042 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43042] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43043] = "cpe-stable-backport: Backported in 6.6.134" @@ -22370,9 +22390,9 @@ CVE_STATUS[CVE-2026-43046] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-43047] = "cpe-stable-backport: Backported in 6.6.134" -# CVE-2026-43048 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43048] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43049 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43049] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43050] = "cpe-stable-backport: Backported in 6.6.134" @@ -22392,7 +22412,7 @@ CVE_STATUS[CVE-2026-43057] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-43058] = "cpe-stable-backport: Backported in 6.6.136" -CVE_STATUS[CVE-2026-43059] = "fixed-version: only affects 6.12.59 onwards" +CVE_STATUS[CVE-2026-43059] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43060] = "cpe-stable-backport: Backported in 6.6.130" @@ -22420,7 +22440,7 @@ CVE_STATUS[CVE-2026-43071] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-43072] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-43073 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-43073] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43074] = "cpe-stable-backport: Backported in 6.6.136" @@ -22440,7 +22460,7 @@ CVE_STATUS[CVE-2026-43081] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-43082] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-43083 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43083] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43084] = "fixed-version: only affects 6.12.75 onwards" @@ -22476,7 +22496,7 @@ CVE_STATUS[CVE-2026-43099] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-43100] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-43101 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43101] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43102] = "fixed-version: only affects 6.15 onwards" @@ -22488,7 +22508,7 @@ CVE_STATUS[CVE-2026-43105] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-43106] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-43107 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43107] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43108] = "fixed-version: only affects 6.11 onwards" @@ -22504,13 +22524,13 @@ CVE_STATUS[CVE-2026-43113] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-43114] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-43115 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43115] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43116] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-43117] = "cpe-stable-backport: Backported in 6.6.136" -# CVE-2026-43118 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43118] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43119] = "cpe-stable-backport: Backported in 6.6.145" @@ -22522,11 +22542,11 @@ CVE_STATUS[CVE-2026-43123] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43124] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43125 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43125] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43126 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43126] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43127 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-43127] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43128] = "cpe-stable-backport: Backported in 6.6.128" @@ -22578,7 +22598,7 @@ CVE_STATUS[CVE-2026-43151] = "fixed-version: only affects 6.18.3 onwards" CVE_STATUS[CVE-2026-43152] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43153 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43153] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43154] = "fixed-version: only affects 6.18 onwards" @@ -22616,7 +22636,7 @@ CVE_STATUS[CVE-2026-43170] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43171] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43172 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43172] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43173] = "cpe-stable-backport: Backported in 6.6.128" @@ -22642,13 +22662,13 @@ CVE_STATUS[CVE-2026-43183] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43184] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43185 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43185] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43186] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43187] = "cpe-stable-backport: Backported in 6.6.128" -CVE_STATUS[CVE-2026-43188] = "fixed-version: only affects 6.15 onwards" +CVE_STATUS[CVE-2026-43188] = "fixed-version: only affects 6.12.114 onwards" CVE_STATUS[CVE-2026-43189] = "cpe-stable-backport: Backported in 6.6.128" @@ -22666,11 +22686,11 @@ CVE_STATUS[CVE-2026-43195] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-43196] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43197 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43197] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43198 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43198] = "cpe-stable-backport: Backported in 6.6.157" -# CVE-2026-43199 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43199] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43200] = "cpe-stable-backport: Backported in 6.6.128" @@ -22680,7 +22700,7 @@ CVE_STATUS[CVE-2026-43202] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43203] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43204 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43204] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43205] = "cpe-stable-backport: Backported in 6.6.128" @@ -22698,7 +22718,7 @@ CVE_STATUS[CVE-2026-43211] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43212] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43213 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43213] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43214] = "cpe-stable-backport: Backported in 6.6.128" @@ -22740,7 +22760,7 @@ CVE_STATUS[CVE-2026-43232] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43233] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43234 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43234] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43235] = "fixed-version: only affects 6.18 onwards" @@ -22760,7 +22780,7 @@ CVE_STATUS[CVE-2026-43242] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43243] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-43244 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43244] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43245] = "cpe-stable-backport: Backported in 6.6.141" @@ -22768,11 +22788,11 @@ CVE_STATUS[CVE-2026-43246] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43247] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-43248 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43248] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43249 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43249] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43250 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43250] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43251] = "cpe-stable-backport: Backported in 6.6.128" @@ -22788,7 +22808,7 @@ CVE_STATUS[CVE-2026-43256] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43257] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43258 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43258] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43259] = "fixed-version: only affects 6.15 onwards" @@ -22860,7 +22880,7 @@ CVE_STATUS[CVE-2026-43292] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2026-43293] = "fixed-version: only affects 6.10 onwards" -# CVE-2026-43294 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43294] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43295] = "cpe-stable-backport: Backported in 6.6.128" @@ -22868,9 +22888,9 @@ CVE_STATUS[CVE-2026-43296] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43297] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-43298 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43298] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43299 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43299] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43300] = "fixed-version: only affects 6.7 onwards" @@ -22888,11 +22908,11 @@ CVE_STATUS[CVE-2026-43306] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2026-43307] = "fixed-version: only affects 6.12 onwards" -# CVE-2026-43308 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43308] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2026-43309 needs backporting (fixed from 7.0) -# CVE-2026-43310 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43310] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43311] = "cpe-stable-backport: Backported in 6.6.143" @@ -22906,7 +22926,7 @@ CVE_STATUS[CVE-2026-43315] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-43316] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-43317 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43317] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2026-43318 needs backporting (fixed from 7.0) @@ -22948,7 +22968,7 @@ CVE_STATUS[CVE-2026-43336] = "cpe-stable-backport: Backported in 6.6.135" CVE_STATUS[CVE-2026-43337] = "fixed-version: only affects 6.11.3 onwards" -# CVE-2026-43338 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43338] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43339] = "cpe-stable-backport: Backported in 6.6.134" @@ -22960,7 +22980,7 @@ CVE_STATUS[CVE-2026-43342] = "cpe-stable-backport: Backported in 6.6.134" CVE_STATUS[CVE-2026-43343] = "cpe-stable-backport: Backported in 6.6.134" -# CVE-2026-43344 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43344] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-43345] = "cpe-stable-backport: Backported in 6.6.136" @@ -22976,9 +22996,9 @@ CVE_STATUS[CVE-2026-43350] = "cpe-stable-backport: Backported in 6.6.136" CVE_STATUS[CVE-2026-43351] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-43352 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43352] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43353 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43353] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43354] = "fixed-version: only affects 6.12 onwards" @@ -23100,7 +23120,7 @@ CVE_STATUS[CVE-2026-43412] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-43413] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2026-43414 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-43414] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43415] = "cpe-stable-backport: Backported in 6.6.130" @@ -23154,13 +23174,13 @@ CVE_STATUS[CVE-2026-43441] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-43442] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-43443 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-43443] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43444] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-43445] = "cpe-stable-backport: Backported in 6.6.130" -CVE_STATUS[CVE-2026-43446] = "fixed-version: only affects 6.19 onwards" +CVE_STATUS[CVE-2026-43446] = "fixed-version: only affects 6.18.57 onwards" CVE_STATUS[CVE-2026-43447] = "fixed-version: only affects 6.15 onwards" @@ -23196,9 +23216,9 @@ CVE_STATUS[CVE-2026-43462] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-43463] = "fixed-version: only affects 6.7.3 onwards" -# CVE-2026-43464 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-43464] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-43465 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-43465] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-43466] = "cpe-stable-backport: Backported in 6.6.130" @@ -23326,11 +23346,11 @@ CVE_STATUS[CVE-2026-45857] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-45858] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2026-45859 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-45859] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45860] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-45861 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45861] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45862] = "cpe-stable-backport: Backported in 6.6.128" @@ -23362,7 +23382,7 @@ CVE_STATUS[CVE-2026-45875] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-45876] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-45877 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45877] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45878] = "cpe-stable-backport: Backported in 6.6.128" @@ -23394,15 +23414,15 @@ CVE_STATUS[CVE-2026-45891] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-45892] = "fixed-version: Fixed from version 6.1.168" -# CVE-2026-45893 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45893] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-45894 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45894] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45895] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-45896] = "fixed-version: only affects 6.17 onwards" -# CVE-2026-45897 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-45897] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-45898] = "fixed-version: only affects 6.11 onwards" @@ -23410,7 +23430,7 @@ CVE_STATUS[CVE-2026-45899] = "cpe-stable-backport: Backported in 6.6.130" CVE_STATUS[CVE-2026-45900] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-45901 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-45901] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45902] = "cpe-stable-backport: Backported in 6.6.128" @@ -23442,7 +23462,7 @@ CVE_STATUS[CVE-2026-45915] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-45916] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-45917 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45917] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45918] = "fixed-version: only affects 6.16 onwards" @@ -23472,11 +23492,11 @@ CVE_STATUS[CVE-2026-45930] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-45931] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-45932 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45932] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45933] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-45934 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45934] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45935] = "cpe-stable-backport: Backported in 6.6.128" @@ -23488,15 +23508,15 @@ CVE_STATUS[CVE-2026-45938] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2026-45939] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-45940 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45940] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45941] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-45942] = "cpe-stable-backport: Backported in 6.6.130" -# CVE-2026-45943 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45943] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-45944 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45944] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45945] = "fixed-version: only affects 6.13 onwards" @@ -23506,7 +23526,7 @@ CVE_STATUS[CVE-2026-45947] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-45948] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-45949 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45949] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45950] = "fixed-version: only affects 6.10 onwards" @@ -23530,11 +23550,11 @@ CVE_STATUS[CVE-2026-45959] = "fixed-version: only affects 6.17 onwards" CVE_STATUS[CVE-2026-45960] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-45961 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-45961] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45962] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-45963 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-45963] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-45964] = "cpe-stable-backport: Backported in 6.6.128" @@ -23554,7 +23574,7 @@ CVE_STATUS[CVE-2026-45971] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-45972] = "cpe-stable-backport: Backported in 6.6.128" -CVE_STATUS[CVE-2026-45973] = "fixed-version: only affects 6.12.2 onwards" +CVE_STATUS[CVE-2026-45973] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-45974] = "cpe-stable-backport: Backported in 6.6.128" @@ -23634,7 +23654,7 @@ CVE_STATUS[CVE-2026-46012] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46013] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-46014 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46014] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46015] = "cpe-stable-backport: Backported in 6.6.140" @@ -23670,7 +23690,7 @@ CVE_STATUS[CVE-2026-46030] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-46031] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46032 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46032] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46033] = "cpe-stable-backport: Backported in 6.6.140" @@ -23724,7 +23744,7 @@ CVE_STATUS[CVE-2026-46057] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-46058] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46059 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46059] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46060] = "fixed-version: only affects 6.16 onwards" @@ -23738,7 +23758,7 @@ CVE_STATUS[CVE-2026-46064] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46065] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46066 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46066] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46067] = "fixed-version: only affects 6.19 onwards" @@ -23748,7 +23768,7 @@ CVE_STATUS[CVE-2026-46069] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46070] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46071 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46071] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46072] = "cpe-stable-backport: Backported in 6.6.140" @@ -23758,7 +23778,7 @@ CVE_STATUS[CVE-2026-46074] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-46075] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46076 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46076] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46077] = "cpe-stable-backport: Backported in 6.6.140" @@ -23786,7 +23806,7 @@ CVE_STATUS[CVE-2026-46088] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46089] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46090 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46090] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-46091] = "cpe-stable-backport: Backported in 6.6.140" @@ -23866,7 +23886,7 @@ CVE_STATUS[CVE-2026-46128] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46129] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46130 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-46130] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46131] = "cpe-stable-backport: Backported in 6.6.140" @@ -23902,7 +23922,7 @@ CVE_STATUS[CVE-2026-46146] = "cpe-stable-backport: Backported in 6.6.140" # CVE-2026-46147 needs backporting (fixed from 7.1) -# CVE-2026-46148 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46148] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46149] = "cpe-stable-backport: Backported in 6.6.140" @@ -23920,7 +23940,7 @@ CVE_STATUS[CVE-2026-46155] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46156] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46157 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46157] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46158] = "cpe-stable-backport: Backported in 6.6.142" @@ -23948,7 +23968,7 @@ CVE_STATUS[CVE-2026-46169] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46170] = "cpe-stable-backport: Backported in 6.6.142" -# CVE-2026-46171 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46171] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46172] = "cpe-stable-backport: Backported in 6.6.140" @@ -23956,7 +23976,7 @@ CVE_STATUS[CVE-2026-46173] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46174] = "cpe-stable-backport: Backported in 6.6.139" -# CVE-2026-46175 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46175] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46176] = "cpe-stable-backport: Backported in 6.6.140" @@ -23968,7 +23988,7 @@ CVE_STATUS[CVE-2026-46179] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46180] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46181 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46181] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46182] = "fixed-version: only affects 6.18 onwards" @@ -24004,7 +24024,7 @@ CVE_STATUS[CVE-2026-46198] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46199] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46200 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46200] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46201] = "fixed-version: only affects 6.8 onwards" @@ -24082,7 +24102,7 @@ CVE_STATUS[CVE-2026-46239] = "fixed-version: only affects 7.0 onwards" CVE_STATUS[CVE-2026-46240] = "fixed-version: only affects 6.18.16 onwards" -# CVE-2026-46241 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46241] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46242] = "cpe-stable-backport: Backported in 6.6.144" @@ -24090,7 +24110,7 @@ CVE_STATUS[CVE-2026-46243] = "cpe-stable-backport: Backported in 6.6.142" CVE_STATUS[CVE-2026-46244] = "cpe-stable-backport: Backported in 6.6.142" -# CVE-2026-46245 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-46245] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46246] = "fixed-version: only affects 6.7 onwards" @@ -24108,7 +24128,7 @@ CVE_STATUS[CVE-2026-46252] = "cpe-stable-backport: Backported in 6.6.144" CVE_STATUS[CVE-2026-46253] = "cpe-stable-backport: Backported in 6.6.128" -# CVE-2026-46254 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-46254] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46255] = "cpe-stable-backport: Backported in 6.6.128" @@ -24144,7 +24164,7 @@ CVE_STATUS[CVE-2026-46270] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-46271] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-46272 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-46272] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46273] = "cpe-stable-backport: Backported in 6.6.140" @@ -24164,7 +24184,7 @@ CVE_STATUS[CVE-2026-46280] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-46281] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-46282 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46282] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46283] = "fixed-version: only affects 6.10 onwards" @@ -24204,7 +24224,7 @@ CVE_STATUS[CVE-2026-46300] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-46301] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-46302 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46302] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46303] = "cpe-stable-backport: Backported in 6.6.140" @@ -24248,9 +24268,9 @@ CVE_STATUS[CVE-2026-46322] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-46323] = "cpe-stable-backport: Backported in 6.6.142" -# CVE-2026-46324 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-46324] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-46325 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-46325] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46326] = "fixed-version: only affects 6.9 onwards" @@ -24260,7 +24280,7 @@ CVE_STATUS[CVE-2026-46328] = "cpe-stable-backport: Backported in 6.6.128" CVE_STATUS[CVE-2026-46329] = "fixed-version: only affects 6.12 onwards" -# CVE-2026-46330 needs backporting (fixed from 7.0) +CVE_STATUS[CVE-2026-46330] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-46331] = "cpe-stable-backport: Backported in 6.6.144" @@ -24334,7 +24354,7 @@ CVE_STATUS[CVE-2026-52935] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-52936] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-52937 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-52937] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-52938] = "fixed-version: only affects 7.0 onwards" @@ -24372,7 +24392,7 @@ CVE_STATUS[CVE-2026-52954] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-52955] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-52956 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-52956] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-52957] = "cpe-stable-backport: Backported in 6.6.141" @@ -24380,9 +24400,9 @@ CVE_STATUS[CVE-2026-52958] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-52959] = "fixed-version: only affects 6.13.8 onwards" -CVE_STATUS[CVE-2026-52960] = "fixed-version: only affects 6.15 onwards" +CVE_STATUS[CVE-2026-52960] = "fixed-version: only affects 6.12.114 onwards" -# CVE-2026-52961 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-52961] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-52962] = "cpe-stable-backport: Backported in 6.6.141" @@ -24436,13 +24456,13 @@ CVE_STATUS[CVE-2026-52986] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-52987] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-52988 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-52988] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-52989] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-52990 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-52990] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-52991 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-52991] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-52992] = "cpe-stable-backport: Backported in 6.6.141" @@ -24460,7 +24480,7 @@ CVE_STATUS[CVE-2026-52998] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-52999] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53000 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53000] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53001] = "cpe-stable-backport: Backported in 6.6.141" @@ -24470,7 +24490,7 @@ CVE_STATUS[CVE-2026-53003] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-53004] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53005 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53005] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-53006] = "cpe-stable-backport: Backported in 6.6.141" @@ -24478,9 +24498,9 @@ CVE_STATUS[CVE-2026-53007] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-53008] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-53009 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53009] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-53010 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-53010] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-53011] = "cpe-stable-backport: Backported in 6.6.141" @@ -24490,13 +24510,13 @@ CVE_STATUS[CVE-2026-53013] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-53014] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-53015 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53015] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53016] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53017 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53017] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-53018 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53018] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53019] = "fixed-version: only affects 6.16 onwards" @@ -24508,9 +24528,9 @@ CVE_STATUS[CVE-2026-53022] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-53023] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53024 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53024] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-53025 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53025] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53026] = "fixed-version: only affects 6.18.4 onwards" @@ -24566,7 +24586,7 @@ CVE_STATUS[CVE-2026-53051] = "fixed-version: only affects 6.12.2 onwards" CVE_STATUS[CVE-2026-53052] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53053 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53053] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53054] = "fixed-version: only affects 6.17 onwards" @@ -24600,7 +24620,7 @@ CVE_STATUS[CVE-2026-53068] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-53069] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53070 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53070] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53071] = "cpe-stable-backport: Backported in 6.6.141" @@ -24616,7 +24636,7 @@ CVE_STATUS[CVE-2026-53076] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-53077] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53078 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53078] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-53079] = "fixed-version: only affects 6.19 onwards" @@ -24638,11 +24658,11 @@ CVE_STATUS[CVE-2026-53087] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-53088] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53089 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-53089] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-53090] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-53091 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53091] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53092] = "fixed-version: only affects 6.11 onwards" @@ -24654,7 +24674,7 @@ CVE_STATUS[CVE-2026-53095] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-53096] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53097 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53097] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53098] = "cpe-stable-backport: Backported in 6.6.141" @@ -24664,7 +24684,7 @@ CVE_STATUS[CVE-2026-53100] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-53101] = "fixed-version: only affects 6.9 onwards" -# CVE-2026-53102 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53102] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53103] = "fixed-version: only affects 6.11.2 onwards" @@ -24676,9 +24696,9 @@ CVE_STATUS[CVE-2026-53105] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-53107] = "fixed-version: only affects 6.18.16 onwards" -# CVE-2026-53108 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53108] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-53109 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53109] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53110] = "cpe-stable-backport: Backported in 6.6.141" @@ -24686,27 +24706,27 @@ CVE_STATUS[CVE-2026-53111] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-53112] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53113 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53113] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53114] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-53115 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53115] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53116] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-53117] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53118 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53118] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53119] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-53120 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53120] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53121] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-53122 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53122] = "cpe-stable-backport: Backported in 6.6.160" -CVE_STATUS[CVE-2026-53123] = "fixed-version: only affects 6.7 onwards" +# CVE-2026-53123 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2026-53124] = "fixed-version: only affects 6.14.6 onwards" @@ -24718,7 +24738,7 @@ CVE_STATUS[CVE-2026-53127] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-53128] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53129 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53129] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53130] = "cpe-stable-backport: Backported in 6.6.141" @@ -24772,7 +24792,7 @@ CVE_STATUS[CVE-2026-53154] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-53155] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-53156 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53156] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53157] = "cpe-stable-backport: Backported in 6.6.144" @@ -24814,9 +24834,9 @@ CVE_STATUS[CVE-2026-53176] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-53177] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-53178 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53178] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-53179 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53179] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53180] = "fixed-version: only affects 6.9 onwards" @@ -24898,7 +24918,7 @@ CVE_STATUS[CVE-2026-53218] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-53219] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-53220 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53220] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53221] = "cpe-stable-backport: Backported in 6.6.143" @@ -24906,17 +24926,17 @@ CVE_STATUS[CVE-2026-53222] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-53223] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-53224 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53224] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53225] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-53226 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53226] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53227] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-53228] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-53229 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53229] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53230] = "cpe-stable-backport: Backported in 6.6.143" @@ -24974,7 +24994,7 @@ CVE_STATUS[CVE-2026-53256] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-53257] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-53258 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53258] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53259] = "fixed-version: only affects 6.17 onwards" @@ -24982,7 +25002,7 @@ CVE_STATUS[CVE-2026-53260] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-53261] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-53262 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53262] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53263] = "cpe-stable-backport: Backported in 6.6.143" @@ -25002,7 +25022,7 @@ CVE_STATUS[CVE-2026-53270] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-53271] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-53272 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53272] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53273] = "cpe-stable-backport: Backported in 6.6.143" @@ -25026,7 +25046,7 @@ CVE_STATUS[CVE-2026-53282] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-53283] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-53284 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53284] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2026-53285 needs backporting (fixed from 7.1) @@ -25042,7 +25062,7 @@ CVE_STATUS[CVE-2026-53290] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-53291] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53292 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53292] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53293] = "cpe-stable-backport: Backported in 6.6.141" @@ -25052,7 +25072,7 @@ CVE_STATUS[CVE-2026-53295] = "cpe-stable-backport: Backported in 6.6.141" CVE_STATUS[CVE-2026-53296] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-53297 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53297] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53298] = "fixed-version: only affects 6.11 onwards" @@ -25084,7 +25104,7 @@ CVE_STATUS[CVE-2026-53311] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-53312] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-53313 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53313] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53314] = "cpe-stable-backport: Backported in 6.6.141" @@ -25092,7 +25112,7 @@ CVE_STATUS[CVE-2026-53315] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-53316] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-53317 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53317] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53318] = "fixed-version: only affects 6.11 onwards" @@ -25118,7 +25138,7 @@ CVE_STATUS[CVE-2026-53328] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-53329] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-53330 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53330] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53331] = "cpe-stable-backport: Backported in 6.6.143" @@ -25212,7 +25232,7 @@ CVE_STATUS[CVE-2026-53375] = "cpe-stable-backport: Backported in 6.6.140" CVE_STATUS[CVE-2026-53376] = "cpe-stable-backport: Backported in 6.6.140" -# CVE-2026-53377 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-53377] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53378] = "fixed-version: only affects 6.19 onwards" @@ -25260,7 +25280,7 @@ CVE_STATUS[CVE-2026-53399] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-53400] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-53401 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-53401] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-53402] = "cpe-stable-backport: Backported in 6.6.145" @@ -25302,7 +25322,7 @@ CVE_STATUS[CVE-2026-63809] = "cpe-stable-backport: Backported in 6.6.144" CVE_STATUS[CVE-2026-63810] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-63811 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-63811] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63812] = "cpe-stable-backport: Backported in 6.6.144" @@ -25330,7 +25350,7 @@ CVE_STATUS[CVE-2026-63823] = "cpe-stable-backport: Backported in 6.6.144" CVE_STATUS[CVE-2026-63824] = "cpe-stable-backport: Backported in 6.6.144" -# CVE-2026-63825 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-63825] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63826] = "cpe-stable-backport: Backported in 6.6.144" @@ -25386,7 +25406,7 @@ CVE_STATUS[CVE-2026-63851] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2026-63852] = "cpe-stable-backport: Backported in 6.6.141" -# CVE-2026-63853 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63853] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63854] = "cpe-stable-backport: Backported in 6.6.141" @@ -25436,7 +25456,7 @@ CVE_STATUS[CVE-2026-63877] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-63878] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-63879 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63879] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63880] = "fixed-version: only affects 6.18 onwards" @@ -25558,7 +25578,7 @@ CVE_STATUS[CVE-2026-63938] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-63939] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-63940 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63940] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63941] = "fixed-version: only affects 6.11 onwards" @@ -25602,9 +25622,9 @@ CVE_STATUS[CVE-2026-63960] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-63961] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-63962 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63962] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-63963 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63963] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63964] = "cpe-stable-backport: Backported in 6.6.143" @@ -25626,7 +25646,7 @@ CVE_STATUS[CVE-2026-63972] = "fixed-version: only affects 6.18.33 onwards" CVE_STATUS[CVE-2026-63973] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-63974 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63974] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63975] = "cpe-stable-backport: Backported in 6.6.143" @@ -25634,9 +25654,9 @@ CVE_STATUS[CVE-2026-63976] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-63977] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-63978 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63978] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-63979 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-63979] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-63980] = "fixed-version: only affects 6.7 onwards" @@ -25676,11 +25696,11 @@ CVE_STATUS[CVE-2026-63997] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-63998] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-63999 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-63999] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64000] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-64001 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64001] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64002] = "cpe-stable-backport: Backported in 6.6.143" @@ -25750,11 +25770,11 @@ CVE_STATUS[CVE-2026-64034] = "cpe-stable-backport: Backported in 6.6.142" CVE_STATUS[CVE-2026-64035] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-64036 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64036] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64037] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-64038 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64038] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64039] = "cpe-stable-backport: Backported in 6.6.142" @@ -25818,7 +25838,7 @@ CVE_STATUS[CVE-2026-64068] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2026-64069] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-64070 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-64070] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-64071] = "fixed-version: only affects 6.13 onwards" @@ -25830,19 +25850,19 @@ CVE_STATUS[CVE-2026-64074] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-64075] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-64076 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64076] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-64077 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64077] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2026-64078 needs backporting (fixed from 7.1) -# CVE-2026-64079 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64079] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64080] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-64081] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-64082 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-64082] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-64083] = "cpe-stable-backport: Backported in 6.6.142" @@ -25912,7 +25932,7 @@ CVE_STATUS[CVE-2026-64115] = "cpe-stable-backport: Backported in 6.6.142" CVE_STATUS[CVE-2026-64116] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-64117 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64117] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64118] = "cpe-stable-backport: Backported in 6.6.142" @@ -25954,7 +25974,7 @@ CVE_STATUS[CVE-2026-64136] = "cpe-stable-backport: Backported in 6.6.142" CVE_STATUS[CVE-2026-64137] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-64138 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64138] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64139] = "cpe-stable-backport: Backported in 6.6.142" @@ -25970,7 +25990,7 @@ CVE_STATUS[CVE-2026-64144] = "cpe-stable-backport: Backported in 6.6.142" CVE_STATUS[CVE-2026-64145] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-64146 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64146] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64147] = "cpe-stable-backport: Backported in 6.6.142" @@ -25986,7 +26006,7 @@ CVE_STATUS[CVE-2026-64152] = "fixed-version: only affects 7.0 onwards" CVE_STATUS[CVE-2026-64153] = "cpe-stable-backport: Backported in 6.6.142" -# CVE-2026-64154 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64154] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64155] = "cpe-stable-backport: Backported in 6.6.142" @@ -26056,7 +26076,7 @@ CVE_STATUS[CVE-2026-64188] = "cpe-stable-backport: Backported in 6.6.144" CVE_STATUS[CVE-2026-64189] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64190 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64190] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64191] = "cpe-stable-backport: Backported in 6.6.144" @@ -26072,13 +26092,13 @@ CVE_STATUS[CVE-2026-64208] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-64209] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-64210 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64210] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-64211] = "fixed-version: only affects 7.0 onwards" # CVE-2026-64212 needs backporting (fixed from 7.1) -# CVE-2026-64213 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64213] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64214] = "cpe-stable-backport: Backported in 6.6.142" @@ -26134,7 +26154,7 @@ CVE_STATUS[CVE-2026-64239] = "cpe-stable-backport: Backported in 6.6.143" CVE_STATUS[CVE-2026-64240] = "cpe-stable-backport: Backported in 6.6.143" -# CVE-2026-64241 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64241] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64242] = "cpe-stable-backport: Backported in 6.6.143" @@ -26262,7 +26282,7 @@ CVE_STATUS[CVE-2026-64303] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-64304] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64305 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64305] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64306] = "cpe-stable-backport: Backported in 6.6.145" @@ -26292,7 +26312,7 @@ CVE_STATUS[CVE-2026-64318] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-64319] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64320 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64320] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64321] = "fixed-version: only affects 6.8 onwards" @@ -26334,7 +26354,7 @@ CVE_STATUS[CVE-2026-64339] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-64340] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64341 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64341] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64342] = "cpe-stable-backport: Backported in 6.6.145" @@ -26406,7 +26426,7 @@ CVE_STATUS[CVE-2026-64375] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-64376] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64377 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64377] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64378] = "cpe-stable-backport: Backported in 6.6.145" @@ -26428,13 +26448,13 @@ CVE_STATUS[CVE-2026-64386] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-64387] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64388 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64388] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-64389 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64389] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64390] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64391 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64391] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64392] = "cpe-stable-backport: Backported in 6.6.145" @@ -26452,7 +26472,7 @@ CVE_STATUS[CVE-2026-64398] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-64399] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64400 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64400] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64401] = "cpe-stable-backport: Backported in 6.6.145" @@ -26614,7 +26634,7 @@ CVE_STATUS[CVE-2026-64479] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-64480] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64481 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64481] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64482] = "cpe-stable-backport: Backported in 6.6.145" @@ -26698,7 +26718,7 @@ CVE_STATUS[CVE-2026-64521] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-64522] = "fixed-version: only affects 6.17.4 onwards" -# CVE-2026-64523 needs backporting (fixed from 7.1) +CVE_STATUS[CVE-2026-64523] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64524] = "cpe-stable-backport: Backported in 6.6.143" @@ -26730,7 +26750,7 @@ CVE_STATUS[CVE-2026-64537] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-64538] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-64539 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-64539] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-64540] = "cpe-stable-backport: Backported in 6.6.145" @@ -26814,7 +26834,7 @@ CVE_STATUS[CVE-2026-64579] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-64580] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-64581 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-64581] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-64582] = "cpe-stable-backport: Backported in 6.6.145" @@ -26862,11 +26882,11 @@ CVE_STATUS[CVE-2026-64603] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2026-64604] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-68081 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68081] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-68082 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68082] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-68083 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68083] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68084] = "cpe-stable-backport: Backported in 6.6.145" @@ -26934,7 +26954,7 @@ CVE_STATUS[CVE-2026-68116] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68117] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68118 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68118] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68119] = "fixed-version: only affects 6.7 onwards" @@ -26962,7 +26982,7 @@ CVE_STATUS[CVE-2026-68130] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68131] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68132 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68132] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68133] = "fixed-version: only affects 6.9 onwards" @@ -26970,11 +26990,11 @@ CVE_STATUS[CVE-2026-68134] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2026-68135] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68136 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68136] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68137] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68138 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68138] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68139] = "fixed-version: only affects 6.7 onwards" @@ -26988,7 +27008,7 @@ CVE_STATUS[CVE-2026-68143] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68144] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68145 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68145] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68146] = "cpe-stable-backport: Backported in 6.6.148" @@ -27016,7 +27036,7 @@ CVE_STATUS[CVE-2026-68157] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68158] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68159 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68159] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68160] = "cpe-stable-backport: Backported in 6.6.148" @@ -27030,7 +27050,7 @@ CVE_STATUS[CVE-2026-68164] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68165] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68166 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68166] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68167] = "fixed-version: only affects 7.1 onwards" @@ -27066,7 +27086,7 @@ CVE_STATUS[CVE-2026-68183] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-68184] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68185 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68185] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68186] = "cpe-stable-backport: Backported in 6.6.148" @@ -27102,7 +27122,7 @@ CVE_STATUS[CVE-2026-68201] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-68202] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68203 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68203] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68204] = "cpe-stable-backport: Backported in 6.6.148" @@ -27162,7 +27182,7 @@ CVE_STATUS[CVE-2026-68231] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68232] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-68233 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68233] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68234] = "cpe-stable-backport: Backported in 6.6.148" @@ -27172,25 +27192,25 @@ CVE_STATUS[CVE-2026-68236] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68237] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-68238 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68238] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68239] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-68240] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-68241 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68241] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-68242 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68242] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68243] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68244] = "cpe-stable-backport: Backported in 6.6.148" -CVE_STATUS[CVE-2026-68245] = "fixed-version: only affects 6.9 onwards" +# CVE-2026-68245 may need backporting (fixed from 6.7) CVE_STATUS[CVE-2026-68246] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68247 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68247] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68248] = "cpe-stable-backport: Backported in 6.6.148" @@ -27212,7 +27232,7 @@ CVE_STATUS[CVE-2026-68256] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68257] = "fixed-version: only affects 6.12.59 onwards" -# CVE-2026-68258 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68258] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68259] = "cpe-stable-backport: Backported in 6.6.148" @@ -27242,7 +27262,7 @@ CVE_STATUS[CVE-2026-68271] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68272] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68273 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68273] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68274] = "fixed-version: only affects 6.13 onwards" @@ -27268,13 +27288,13 @@ CVE_STATUS[CVE-2026-68284] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68285] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-68286 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68286] = "cpe-stable-backport: Backported in 6.6.158" -# CVE-2026-68287 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68287] = "cpe-stable-backport: Backported in 6.6.158" -# CVE-2026-68288 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68288] = "cpe-stable-backport: Backported in 6.6.158" -# CVE-2026-68289 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68289] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-68290] = "fixed-version: only affects 6.12.10 onwards" @@ -27282,7 +27302,7 @@ CVE_STATUS[CVE-2026-68291] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2026-68292] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-68293 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68293] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68294] = "cpe-stable-backport: Backported in 6.6.148" @@ -27302,7 +27322,7 @@ CVE_STATUS[CVE-2026-68301] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68302] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68303 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68303] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68304] = "cpe-stable-backport: Backported in 6.6.148" @@ -27320,7 +27340,7 @@ CVE_STATUS[CVE-2026-68310] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68311] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-68312 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68312] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68313] = "cpe-stable-backport: Backported in 6.6.148" @@ -27332,7 +27352,7 @@ CVE_STATUS[CVE-2026-68316] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-68317] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68318 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68318] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68319] = "fixed-version: only affects 6.8.7 onwards" @@ -27342,7 +27362,7 @@ CVE_STATUS[CVE-2026-68321] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-68322] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-68323 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68323] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68324] = "cpe-stable-backport: Backported in 6.6.148" @@ -27488,23 +27508,23 @@ CVE_STATUS[CVE-2026-68394] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-68395] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68396 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68396] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68397] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68398] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68399 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68399] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68400] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-68401 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68401] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68402] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68403] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68404 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68404] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68405] = "cpe-stable-backport: Backported in 6.6.148" @@ -27512,9 +27532,9 @@ CVE_STATUS[CVE-2026-68406] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68407] = "cpe-stable-backport: Backported in 6.6.148" -CVE_STATUS[CVE-2026-68408] = "fixed-version: only affects 6.12.78 onwards" +CVE_STATUS[CVE-2026-68408] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-68409 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68409] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68410] = "cpe-stable-backport: Backported in 6.6.148" @@ -27532,7 +27552,7 @@ CVE_STATUS[CVE-2026-68416] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68417] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68418 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68418] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68419] = "cpe-stable-backport: Backported in 6.6.148" @@ -27548,7 +27568,7 @@ CVE_STATUS[CVE-2026-68424] = "fixed-version: only affects 7.1 onwards" CVE_STATUS[CVE-2026-68425] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68426 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68426] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68427] = "cpe-stable-backport: Backported in 6.6.148" @@ -27558,7 +27578,7 @@ CVE_STATUS[CVE-2026-68429] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68430] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68431 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-68431] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-68432] = "cpe-stable-backport: Backported in 6.6.148" @@ -27566,7 +27586,7 @@ CVE_STATUS[CVE-2026-68433] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-68434] = "cpe-stable-backport: Backported in 6.6.148" -# CVE-2026-68435 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68435] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68436] = "fixed-version: only affects 6.10 onwards" @@ -27578,7 +27598,7 @@ CVE_STATUS[CVE-2026-68439] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2026-68440] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-68441 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68441] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68442] = "fixed-version: only affects 6.8 onwards" @@ -27592,7 +27612,7 @@ CVE_STATUS[CVE-2026-68446] = "cpe-stable-backport: Backported in 6.6.148" # CVE-2026-68447 needs backporting (fixed from 7.2) -# CVE-2026-68448 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68448] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68449] = "cpe-stable-backport: Backported in 6.6.148" @@ -27602,7 +27622,7 @@ CVE_STATUS[CVE-2026-68451] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-68452] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-68453 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68453] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68454] = "cpe-stable-backport: Backported in 6.6.145" @@ -27638,7 +27658,7 @@ CVE_STATUS[CVE-2026-68469] = "cpe-stable-backport: Backported in 6.6.145" # CVE-2026-68470 needs backporting (fixed from 7.2) -# CVE-2026-68471 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-68471] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-68472] = "fixed-version: only affects 6.14 onwards" @@ -27796,7 +27816,7 @@ CVE_STATUS[CVE-2026-72071] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-72072] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72073 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72073] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72074] = "cpe-stable-backport: Backported in 6.6.145" @@ -27846,7 +27866,7 @@ CVE_STATUS[CVE-2026-72096] = "cpe-stable-backport: Backported in 6.6.148" CVE_STATUS[CVE-2026-72097] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72098 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72098] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72099] = "cpe-stable-backport: Backported in 6.6.145" @@ -27910,9 +27930,9 @@ CVE_STATUS[CVE-2026-72128] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-72129] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72130 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72130] = "cpe-stable-backport: Backported in 6.6.160" -CVE_STATUS[CVE-2026-72131] = "fixed-version: only affects 6.18 onwards" +CVE_STATUS[CVE-2026-72131] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-72132] = "cpe-stable-backport: Backported in 6.6.148" @@ -27974,7 +27994,7 @@ CVE_STATUS[CVE-2026-72160] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72161] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72162 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72162] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72163] = "cpe-stable-backport: Backported in 6.6.145" @@ -27986,7 +28006,7 @@ CVE_STATUS[CVE-2026-72166] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72167] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72168 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72168] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72169] = "fixed-version: only affects 6.16 onwards" @@ -28046,17 +28066,17 @@ CVE_STATUS[CVE-2026-72196] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72197] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72198 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72198] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72199] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-72200 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72200] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72201] = "fixed-version: only affects 7.1 onwards" CVE_STATUS[CVE-2026-72202] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-72203 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72203] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72204] = "fixed-version: only affects 7.1 onwards" @@ -28076,7 +28096,7 @@ CVE_STATUS[CVE-2026-72211] = "fixed-version: only affects 7.1 onwards" CVE_STATUS[CVE-2026-72212] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-72213 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72213] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72214] = "cpe-stable-backport: Backported in 6.6.145" @@ -28224,7 +28244,7 @@ CVE_STATUS[CVE-2026-72286] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-72287] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-72288 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72288] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72289] = "cpe-stable-backport: Backported in 6.6.145" @@ -28278,7 +28298,7 @@ CVE_STATUS[CVE-2026-72313] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-72314] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72315 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-72315] = "fixed-version: only affects 6.12.78 onwards" CVE_STATUS[CVE-2026-72316] = "cpe-stable-backport: Backported in 6.6.145" @@ -28288,17 +28308,17 @@ CVE_STATUS[CVE-2026-72318] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72319] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72320 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72320] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72321 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72321] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72322] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72323] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72324 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72324] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72325 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72325] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72326] = "cpe-stable-backport: Backported in 6.6.145" @@ -28306,7 +28326,7 @@ CVE_STATUS[CVE-2026-72327] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2026-72328] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-72329 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72329] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72330] = "cpe-stable-backport: Backported in 6.6.145" @@ -28316,13 +28336,13 @@ CVE_STATUS[CVE-2026-72332] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-72333] = "fixed-version: only affects 6.18.21 onwards" -# CVE-2026-72334 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72334] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-72335] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72336] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72337 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72337] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72338] = "cpe-stable-backport: Backported in 6.6.145" @@ -28330,7 +28350,7 @@ CVE_STATUS[CVE-2026-72339] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72340] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72341 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72341] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72342] = "cpe-stable-backport: Backported in 6.6.145" @@ -28338,7 +28358,7 @@ CVE_STATUS[CVE-2026-72343] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72344] = "fixed-version: only affects 7.1 onwards" -CVE_STATUS[CVE-2026-72345] = "fixed-version: only affects 6.14 onwards" +CVE_STATUS[CVE-2026-72345] = "fixed-version: only affects 6.12.113 onwards" CVE_STATUS[CVE-2026-72346] = "fixed-version: only affects 7.1 onwards" @@ -28352,7 +28372,7 @@ CVE_STATUS[CVE-2026-72350] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72351] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72352 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72352] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72353] = "fixed-version: only affects 7.1 onwards" @@ -28398,7 +28418,7 @@ CVE_STATUS[CVE-2026-72372] = "fixed-version: only affects 6.12.97 onwards" CVE_STATUS[CVE-2026-72374] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72375 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72375] = "cpe-stable-backport: Backported in 6.6.160" # CVE-2026-72376 needs backporting (fixed from 7.2) @@ -28408,13 +28428,13 @@ CVE_STATUS[CVE-2026-72378] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72379] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72380 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72380] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72381] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72382] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72383 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72383] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72384] = "cpe-stable-backport: Backported in 6.6.145" @@ -28442,9 +28462,9 @@ CVE_STATUS[CVE-2026-72395] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72396] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72397 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72397] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72398 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72398] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72399] = "cpe-stable-backport: Backported in 6.6.145" @@ -28452,13 +28472,13 @@ CVE_STATUS[CVE-2026-72400] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72401] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-72402 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72402] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-72403] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-72404 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72404] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72405 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72405] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72406] = "cpe-stable-backport: Backported in 6.6.145" @@ -28474,7 +28494,7 @@ CVE_STATUS[CVE-2026-72411] = "fixed-version: only affects 7.1 onwards" CVE_STATUS[CVE-2026-72412] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-72413 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72413] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-72414] = "cpe-stable-backport: Backported in 6.6.145" @@ -28488,13 +28508,13 @@ CVE_STATUS[CVE-2026-72418] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72419] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72420 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72420] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72421] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72422] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72423 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72423] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72424] = "cpe-stable-backport: Backported in 6.6.145" @@ -28524,11 +28544,11 @@ CVE_STATUS[CVE-2026-72436] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72437] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72438 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72438] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72439 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72439] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72440 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72440] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72441] = "cpe-stable-backport: Backported in 6.6.145" @@ -28586,7 +28606,7 @@ CVE_STATUS[CVE-2026-72467] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72468] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-72469 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72469] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72470] = "cpe-stable-backport: Backported in 6.6.145" @@ -28618,13 +28638,13 @@ CVE_STATUS[CVE-2026-72483] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72484] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72485 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72485] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-72486] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-72487] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-72488 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72488] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72489] = "cpe-stable-backport: Backported in 6.6.145" @@ -28636,11 +28656,11 @@ CVE_STATUS[CVE-2026-72492] = "cpe-stable-backport: Backported in 6.6.145" # CVE-2026-72493 needs backporting (fixed from 7.2) -# CVE-2026-72494 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72494] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72495 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72495] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-72496 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72496] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-72497] = "fixed-version: only affects 6.12 onwards" @@ -28650,7 +28670,7 @@ CVE_STATUS[CVE-2026-72499] = "fixed-version: only affects 6.8 onwards" CVE_STATUS[CVE-2026-72500] = "fixed-version: only affects 6.12 onwards" -# CVE-2026-72501 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-72501] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-72502] = "cpe-stable-backport: Backported in 6.6.145" @@ -28658,21 +28678,19 @@ CVE_STATUS[CVE-2026-74255] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74256] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74257 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74257] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74258 needs backporting (fixed from 7.2) - -CVE_STATUS[CVE-2026-74259] = "cpe-stable-backport: Backported in 6.6.145" +CVE_STATUS[CVE-2026-74258] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-74260] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-74261 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74261] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74262] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74263] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74264 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74264] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74265] = "cpe-stable-backport: Backported in 6.6.145" @@ -28680,17 +28698,17 @@ CVE_STATUS[CVE-2026-74266] = "fixed-version: only affects 6.17 onwards" CVE_STATUS[CVE-2026-74267] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74268 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74268] = "cpe-stable-backport: Backported in 6.6.157" -# CVE-2026-74269 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74269] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74270] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74271] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74272 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74272] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74273 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74273] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74274] = "fixed-version: only affects 6.19 onwards" @@ -28700,7 +28718,7 @@ CVE_STATUS[CVE-2026-74276] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74277] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-74278 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74278] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74279] = "cpe-stable-backport: Backported in 6.6.145" @@ -28722,17 +28740,17 @@ CVE_STATUS[CVE-2026-74287] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74288] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74289 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74289] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-74290] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74291 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74291] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-74292] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74293] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74294 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74294] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-74295] = "cpe-stable-backport: Backported in 6.6.145" @@ -28748,7 +28766,7 @@ CVE_STATUS[CVE-2026-74300] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74301] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-74302 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-74302] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74303] = "cpe-stable-backport: Backported in 6.6.145" @@ -28758,7 +28776,7 @@ CVE_STATUS[CVE-2026-74305] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74306] = "fixed-version: only affects 6.10 onwards" -# CVE-2026-74307 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74307] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74308] = "cpe-stable-backport: Backported in 6.6.145" @@ -28778,9 +28796,9 @@ CVE_STATUS[CVE-2026-74315] = "fixed-version: only affects 7.1 onwards" CVE_STATUS[CVE-2026-74316] = "fixed-version: only affects 6.9 onwards" -# CVE-2026-74317 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74317] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74318 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74318] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74319] = "fixed-version: only affects 7.1 onwards" @@ -28812,7 +28830,7 @@ CVE_STATUS[CVE-2026-74332] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-74333] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-74334 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74334] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-74335] = "fixed-version: only affects 6.13 onwards" @@ -28820,7 +28838,7 @@ CVE_STATUS[CVE-2026-74336] = "fixed-version: only affects 6.18 onwards" # CVE-2026-74337 needs backporting (fixed from 7.2) -# CVE-2026-74338 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74338] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74339] = "cpe-stable-backport: Backported in 6.6.145" @@ -28832,19 +28850,19 @@ CVE_STATUS[CVE-2026-74341] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74343] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-74344 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74344] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74345 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74345] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74346] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74347 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74347] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74348] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74349] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74350 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74350] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74351] = "cpe-stable-backport: Backported in 6.6.145" @@ -28856,7 +28874,7 @@ CVE_STATUS[CVE-2026-74354] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2026-74355] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-74356 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74356] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74357] = "fixed-version: only affects 7.1 onwards" @@ -28880,7 +28898,7 @@ CVE_STATUS[CVE-2026-74366] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-74367] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-74368 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-74368] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74369] = "fixed-version: only affects 7.1 onwards" @@ -28890,11 +28908,11 @@ CVE_STATUS[CVE-2026-74371] = "fixed-version: only affects 6.17 onwards" CVE_STATUS[CVE-2026-74372] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-74373 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74373] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74374 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74374] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74375 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74375] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74376] = "cpe-stable-backport: Backported in 6.6.145" @@ -28916,13 +28934,13 @@ CVE_STATUS[CVE-2026-74384] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74385] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-74386 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74386] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74387] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74388 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74388] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74389 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74389] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74390] = "cpe-stable-backport: Backported in 6.6.145" @@ -28954,11 +28972,11 @@ CVE_STATUS[CVE-2026-74403] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-74404] = "fixed-version: only affects 6.9 onwards" -# CVE-2026-74405 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74405] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74406] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-74407 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74407] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74408] = "cpe-stable-backport: Backported in 6.6.145" @@ -29044,7 +29062,7 @@ CVE_STATUS[CVE-2026-74448] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74449] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-74450 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74450] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74451] = "fixed-version: only affects 6.10 onwards" @@ -29076,7 +29094,7 @@ CVE_STATUS[CVE-2026-74464] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74465] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74466 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74466] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74467] = "cpe-stable-backport: Backported in 6.6.151" @@ -29092,17 +29110,17 @@ CVE_STATUS[CVE-2026-74472] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74473] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74474 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74474] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74475] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74476 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74476] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74477] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2026-74478] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74479 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74479] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74480] = "cpe-stable-backport: Backported in 6.6.151" @@ -29118,7 +29136,7 @@ CVE_STATUS[CVE-2026-74485] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74486] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-74487 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74487] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74488] = "cpe-stable-backport: Backported in 6.6.151" @@ -29132,11 +29150,11 @@ CVE_STATUS[CVE-2026-74492] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74493] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74494 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74494] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74495] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74496 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74496] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-74497] = "cpe-stable-backport: Backported in 6.6.151" @@ -29162,7 +29180,7 @@ CVE_STATUS[CVE-2026-74507] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74508] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74509 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-74509] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-74510] = "cpe-stable-backport: Backported in 6.6.151" @@ -29170,7 +29188,7 @@ CVE_STATUS[CVE-2026-74512] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74513] = "fixed-version: only affects 6.10 onwards" -# CVE-2026-74514 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74514] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74515] = "cpe-stable-backport: Backported in 6.6.151" @@ -29184,7 +29202,7 @@ CVE_STATUS[CVE-2026-74519] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74520] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-74521 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74521] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-74522] = "cpe-stable-backport: Backported in 6.6.151" @@ -29196,7 +29214,7 @@ CVE_STATUS[CVE-2026-74525] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74526] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-74527 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74527] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74528] = "fixed-version: only affects 6.19 onwards" @@ -29208,15 +29226,15 @@ CVE_STATUS[CVE-2026-74531] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74532] = "cpe-stable-backport: Backported in 6.6.151" -CVE_STATUS[CVE-2026-74533] = "fixed-version: only affects 6.11.11 onwards" +CVE_STATUS[CVE-2026-74533] = "fixed-version: only affects 6.12.2 onwards" -CVE_STATUS[CVE-2026-74534] = "fixed-version: only affects 6.11.11 onwards" +CVE_STATUS[CVE-2026-74534] = "fixed-version: only affects 6.12.2 onwards" CVE_STATUS[CVE-2026-74535] = "fixed-version: only affects 6.12.2 onwards" # CVE-2026-74536 needs backporting (fixed from 7.2) -# CVE-2026-74537 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74537] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74538] = "fixed-version: only affects 6.8.9 onwards" @@ -29228,9 +29246,9 @@ CVE_STATUS[CVE-2026-74541] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74542] = "fixed-version: only affects 6.12 onwards" -# CVE-2026-74543 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74543] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74544 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74544] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74545] = "fixed-version: only affects 6.12 onwards" @@ -29262,7 +29280,7 @@ CVE_STATUS[CVE-2026-74557] = "cpe-stable-backport: Backported in 6.6.151" # CVE-2026-74559 needs backporting (fixed from 7.2) -# CVE-2026-74560 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74560] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74561] = "fixed-version: only affects 6.16 onwards" @@ -29272,7 +29290,7 @@ CVE_STATUS[CVE-2026-74563] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74564] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74565 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74565] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74566] = "cpe-stable-backport: Backported in 6.6.151" @@ -29284,7 +29302,7 @@ CVE_STATUS[CVE-2026-74569] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-74570] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-74571 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74571] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74572] = "cpe-stable-backport: Backported in 6.6.151" @@ -29302,25 +29320,25 @@ CVE_STATUS[CVE-2026-74578] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-74579] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74580 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74580] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74581] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-74582 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74582] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74583 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74583] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74584] = "cpe-stable-backport: Backported in 6.6.144" -# CVE-2026-74585 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74585] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74586 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74586] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74587 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74587] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74588 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74588] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74589 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74589] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74590] = "fixed-version: only affects 6.8 onwards" @@ -29330,93 +29348,93 @@ CVE_STATUS[CVE-2026-74591] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-74593] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-74594 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74594] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74595 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74595] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74596] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-74597 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74597] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74598 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74598] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74599 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74599] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-74600 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74600] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74601 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74601] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74602] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-74603 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74603] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74604 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74604] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74605 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-74605] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74606 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74606] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74607 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74607] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-74608 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74608] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74609 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74609] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74610 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74610] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74611 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74611] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74612 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74612] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74613 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74613] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74614 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74614] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74615 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74615] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74616 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74616] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74617] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-74618] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-74619 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74619] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74620 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74620] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74621 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74621] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74622 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74622] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74623 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74623] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74624 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74624] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74625 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74625] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74626 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-74626] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-74627] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-74628 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74628] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74629] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-74630 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74630] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74631 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74631] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74632 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74632] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74633] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-74634] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-74635 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74635] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74636 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74636] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74637 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-74637] = "cpe-stable-backport: Backported in 6.6.154" # CVE-2026-74638 may need backporting (fixed from 6.7) @@ -29424,9 +29442,9 @@ CVE_STATUS[CVE-2026-74639] = "fixed-version: only affects 6.18.39 onwards" CVE_STATUS[CVE-2026-74640] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-74641 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74641] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74642 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74642] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74643] = "fixed-version: only affects 6.17 onwards" @@ -29434,125 +29452,125 @@ CVE_STATUS[CVE-2026-74644] = "fixed-version: only affects 6.12.44 onwards" CVE_STATUS[CVE-2026-74645] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-74646 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74646] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74647 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74647] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74648 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74648] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74649 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74649] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74650 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74650] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74651 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74651] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74652] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-74653 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74653] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74654 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74654] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74655 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-74655] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-74656 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74656] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74657 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74657] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74658 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74658] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74659 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74659] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74660 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74660] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74661 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74661] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74662 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-74662] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-74663 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74663] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74664 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74664] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74665] = "fixed-version: only affects 6.9 onwards" -# CVE-2026-74666 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74666] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74667 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74667] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74668 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74668] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74669 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74669] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74670 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74670] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74671 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74671] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74672 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74672] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-74673 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74673] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74674] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-74675 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74675] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74676 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74676] = "cpe-stable-backport: Backported in 6.6.152" # CVE-2026-74677 needs backporting (fixed from 7.2) -# CVE-2026-74678 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74678] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74679 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74679] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74680 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74680] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74681] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-74682 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74682] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74683 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74683] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74684 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74684] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74685] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2026-74686] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-74687 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74687] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74688 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74688] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74689 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74689] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74690 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74690] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74691 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74691] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74692 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74692] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74693 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74693] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74694 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74694] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74695 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74695] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74696 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74696] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74697 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74697] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74698] = "fixed-version: only affects 6.17 onwards" CVE_STATUS[CVE-2026-74699] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-74700 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74700] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74701 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74701] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74702] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-74703] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-74704 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74704] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74705 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74705] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74706] = "fixed-version: only affects 6.19 onwards" @@ -29564,81 +29582,79 @@ CVE_STATUS[CVE-2026-74709] = "fixed-version: only affects 6.14.2 onwards" CVE_STATUS[CVE-2026-74710] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-74711 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74711] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74712] = "fixed-version: only affects 6.12 onwards" -# CVE-2026-74713 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74713] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74714 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74714] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74715 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74715] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-74716] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-74717 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74717] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74718 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74718] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74719 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74719] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74720 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74720] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74721] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-74722 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74722] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-74723 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74723] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74724 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74724] = "cpe-stable-backport: Backported in 6.6.152" # CVE-2026-74725 needs backporting (fixed from 7.2) -# CVE-2026-74726 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74726] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74727] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-74728] = "fixed-version: only affects 6.9 onwards" -# CVE-2026-74729 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74729] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74730 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-74730] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-74731] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-74732 needs backporting (fixed from 7.2) - -# CVE-2026-74733 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-74733] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74734 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74734] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74735 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74735] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74736 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74736] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-74737 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74737] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74738] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-74739 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74739] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-74740 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74740] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74741] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-74742] = "fixed-version: only affects 6.12.61 onwards" -# CVE-2026-74743 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74743] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-74744 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74744] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74745] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-74746 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74746] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-74747 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74747] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74748 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-74748] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-74749] = "fixed-version: only affects 7.1 onwards" @@ -29646,17 +29662,17 @@ CVE_STATUS[CVE-2026-74750] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-74751] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-74752 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74752] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-74753 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-74753] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-74754 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-74754] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80519] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-80520] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-80521 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-80521] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-80522] = "fixed-version: only affects 6.10 onwards" @@ -29666,13 +29682,13 @@ CVE_STATUS[CVE-2026-80524] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-80525] = "fixed-version: only affects 6.10 onwards" -# CVE-2026-80526 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80526] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80527 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80527] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80528 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80528] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80529 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80529] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80530] = "fixed-version: only affects 6.10 onwards" @@ -29682,119 +29698,119 @@ CVE_STATUS[CVE-2026-80532] = "fixed-version: only affects 6.10 onwards" CVE_STATUS[CVE-2026-80533] = "fixed-version: only affects 6.10 onwards" -# CVE-2026-80534 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80534] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80535] = "fixed-version: only affects 6.10 onwards" -# CVE-2026-80536 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80536] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80537] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-80538] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-80539 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80539] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80540 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80540] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80541 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80541] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80542] = "fixed-version: only affects 6.18 onwards" -CVE_STATUS[CVE-2026-80543] = "fixed-version: only affects 7.1 onwards" +CVE_STATUS[CVE-2026-80543] = "fixed-version: only affects 6.12.114 onwards" -CVE_STATUS[CVE-2026-80544] = "fixed-version: only affects 7.1 onwards" +CVE_STATUS[CVE-2026-80544] = "fixed-version: only affects 6.12.114 onwards" -CVE_STATUS[CVE-2026-80545] = "fixed-version: only affects 7.1 onwards" +CVE_STATUS[CVE-2026-80545] = "fixed-version: only affects 6.12.114 onwards" -CVE_STATUS[CVE-2026-80546] = "fixed-version: only affects 7.1 onwards" +CVE_STATUS[CVE-2026-80546] = "fixed-version: only affects 6.12.114 onwards" -# CVE-2026-80547 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80547] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80548 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80548] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80549 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80549] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80550 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80550] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80551 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80551] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80552 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80552] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80553 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80553] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80554 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80554] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80555 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80555] = "cpe-stable-backport: Backported in 6.6.154" # CVE-2026-80556 needs backporting (fixed from 7.2) -# CVE-2026-80557 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80557] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80558 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80558] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80559 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80559] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80560 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80560] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80561 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80561] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80562 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80562] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80563] = "fixed-version: only affects 6.11 onwards" CVE_STATUS[CVE-2026-80564] = "fixed-version: only affects 6.17 onwards" -# CVE-2026-80565 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80565] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80566 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80566] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80567 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80567] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80568 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80568] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80569 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80569] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80570 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80570] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80571] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-80572 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80572] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80573 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80573] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80574 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80574] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80575] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-80576 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80576] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80577] = "fixed-version: only affects 6.10 onwards" -# CVE-2026-80578 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80578] = "cpe-stable-backport: Backported in 6.6.153" # CVE-2026-80579 needs backporting (fixed from 7.2) # CVE-2026-80580 needs backporting (fixed from 7.2) -# CVE-2026-80581 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80581] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80582] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-80583 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80583] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80584 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80584] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80585 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80585] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80586 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80586] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80587 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80587] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80588] = "fixed-version: only affects 6.18.35 onwards" -# CVE-2026-80589 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80589] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80590 may need backporting (fixed from 6.6.155) +CVE_STATUS[CVE-2026-80590] = "cpe-stable-backport: Backported in 6.6.155" CVE_STATUS[CVE-2026-80591] = "cpe-stable-backport: Backported in 6.6.145" @@ -29828,7 +29844,7 @@ CVE_STATUS[CVE-2026-80605] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-80606] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-80607 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80607] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80608] = "fixed-version: only affects 7.1 onwards" @@ -29836,7 +29852,7 @@ CVE_STATUS[CVE-2026-80609] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-80610] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-80611 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80611] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80612] = "fixed-version: only affects 6.19 onwards" @@ -29846,7 +29862,7 @@ CVE_STATUS[CVE-2026-80614] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-80615] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-80616 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80616] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80617] = "fixed-version: only affects 6.18.33 onwards" @@ -29860,7 +29876,7 @@ CVE_STATUS[CVE-2026-80621] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-80622] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80623 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80623] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80624] = "cpe-stable-backport: Backported in 6.6.145" @@ -29870,25 +29886,25 @@ CVE_STATUS[CVE-2026-80626] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-80627] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80628 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80628] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80629 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80629] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80630] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80631 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80631] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80632] = "fixed-version: only affects 7.1 onwards" CVE_STATUS[CVE-2026-80633] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-80634 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80634] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80635] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-80636] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80637 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80637] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80638] = "fixed-version: only affects 6.19 onwards" @@ -29900,7 +29916,7 @@ CVE_STATUS[CVE-2026-80641] = "fixed-version: only affects 7.0 onwards" CVE_STATUS[CVE-2026-80642] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-80643 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80643] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80644] = "cpe-stable-backport: Backported in 6.6.145" @@ -29914,15 +29930,15 @@ CVE_STATUS[CVE-2026-80648] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2026-80649] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80650 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80650] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80651] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-80652] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80653 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80653] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80654 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80654] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80655] = "fixed-version: only affects 6.11 onwards" @@ -29938,7 +29954,7 @@ CVE_STATUS[CVE-2026-80660] = "cpe-stable-backport: Backported in 6.6.145" CVE_STATUS[CVE-2026-80661] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-80662 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80662] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80663] = "cpe-stable-backport: Backported in 6.6.145" @@ -29950,13 +29966,13 @@ CVE_STATUS[CVE-2026-80666] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2026-80667] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-80668 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-80668] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80669] = "cpe-stable-backport: Backported in 6.6.145" # CVE-2026-80670 needs backporting (fixed from 7.2) -# CVE-2026-80671 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80671] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-80672] = "fixed-version: only affects 7.1 onwards" @@ -29966,7 +29982,7 @@ CVE_STATUS[CVE-2026-80674] = "fixed-version: only affects 7.1 onwards" CVE_STATUS[CVE-2026-80675] = "fixed-version: only affects 6.18 onwards" -# CVE-2026-80676 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80676] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80677] = "cpe-stable-backport: Backported in 6.6.145" @@ -29984,33 +30000,33 @@ CVE_STATUS[CVE-2026-80683] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2026-80684] = "cpe-stable-backport: Backported in 6.6.151" -CVE_STATUS[CVE-2026-80685] = "fixed-version: only affects 6.15 onwards" +CVE_STATUS[CVE-2026-80685] = "fixed-version: only affects 6.12.111 onwards" -# CVE-2026-80686 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80686] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80687] = "fixed-version: only affects 6.17 onwards" CVE_STATUS[CVE-2026-80688] = "fixed-version: only affects 6.13.11 onwards" -# CVE-2026-80689 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80689] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-80690] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-80691] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-80692 may need backporting (fixed from 6.7) +CVE_STATUS[CVE-2026-80692] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80693] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-80694 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80694] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80695 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80695] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80696] = "fixed-version: only affects 6.9 onwards" CVE_STATUS[CVE-2026-80697] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-80698 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80698] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80699] = "fixed-version: only affects 6.19 onwards" @@ -30022,7 +30038,7 @@ CVE_STATUS[CVE-2026-80702] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-80703] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-80704 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80704] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80705] = "fixed-version: only affects 6.11 onwards" @@ -30030,7 +30046,7 @@ CVE_STATUS[CVE-2026-80706] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-80707] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-80708 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80708] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-80709] = "cpe-stable-backport: Backported in 6.6.151" @@ -30044,7 +30060,7 @@ CVE_STATUS[CVE-2026-80713] = "fixed-version: only affects 7.0 onwards" CVE_STATUS[CVE-2026-80714] = "cpe-stable-backport: Backported in 6.6.151" -# CVE-2026-80715 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80715] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80716] = "cpe-stable-backport: Backported in 6.6.151" @@ -30064,51 +30080,49 @@ CVE_STATUS[CVE-2026-80723] = "fixed-version: only affects 6.12.13 onwards" CVE_STATUS[CVE-2026-80724] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-80725 may need backporting (fixed from 6.6.154) - -# CVE-2026-80726 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80725] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80727] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-80728 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80728] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-80729] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-80730 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80730] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-80731 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80731] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-80732 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80732] = "cpe-stable-backport: Backported in 6.6.152" -# CVE-2026-80733 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80733] = "cpe-stable-backport: Backported in 6.6.152" -CVE_STATUS[CVE-2026-80734] = "fixed-version: only affects 6.14.6 onwards" +CVE_STATUS[CVE-2026-80734] = "fixed-version: only affects 6.12.111 onwards" CVE_STATUS[CVE-2026-80735] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-80736] = "fixed-version: only affects 6.9 onwards" -# CVE-2026-80737 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80737] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80738 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80738] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80739 may need backporting (fixed from 6.6.152) +CVE_STATUS[CVE-2026-80739] = "cpe-stable-backport: Backported in 6.6.152" CVE_STATUS[CVE-2026-80740] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-80741] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-80742 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80742] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80743 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80743] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80744 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80744] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80745] = "fixed-version: only affects 6.19 onwards" CVE_STATUS[CVE-2026-80746] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-80747 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80747] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80748] = "fixed-version: only affects 6.17 onwards" @@ -30118,17 +30132,17 @@ CVE_STATUS[CVE-2026-80750] = "fixed-version: only affects 6.18 onwards" CVE_STATUS[CVE-2026-80751] = "fixed-version: only affects 6.19 onwards" -# CVE-2026-80752 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80752] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80753] = "fixed-version: only affects 6.16 onwards" -# CVE-2026-80754 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80754] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80755 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80755] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80756 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80756] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80757 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80757] = "cpe-stable-backport: Backported in 6.6.153" CVE_STATUS[CVE-2026-80758] = "fixed-version: only affects 6.16 onwards" @@ -30136,29 +30150,29 @@ CVE_STATUS[CVE-2026-80759] = "fixed-version: only affects 6.12 onwards" CVE_STATUS[CVE-2026-80760] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-80761 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80761] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80762 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80762] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80763 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80763] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80764 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80764] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80765 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80765] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80766 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80766] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80767 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80767] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80768 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80768] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80769] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-80770 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80770] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80771 needs backporting (fixed from 7.3rc1) +# CVE-2026-80771 needs backporting (fixed from 7.3) -# CVE-2026-80772 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80772] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80773] = "fixed-version: only affects 7.1 onwards" @@ -30174,75 +30188,75 @@ CVE_STATUS[CVE-2026-80778] = "fixed-version: only affects 6.16 onwards" CVE_STATUS[CVE-2026-80779] = "fixed-version: only affects 6.9 onwards" -# CVE-2026-80780 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80780] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80781 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80781] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80782 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80782] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80783 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80783] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80784 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80784] = "cpe-stable-backport: Backported in 6.6.154" # CVE-2026-80785 needs backporting (fixed from 7.2) -# CVE-2026-80786 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80786] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80787] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-80788 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80788] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80789 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80789] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80790 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80790] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80791 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80791] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80792 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80792] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80793 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80793] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80794 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80794] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80795 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80795] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80796 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80796] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80797 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80797] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80798 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80798] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80799 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80799] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80800 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80800] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80801 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80801] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80802 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80802] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80803 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80803] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80804] = "fixed-version: only affects 7.0 onwards" -# CVE-2026-80805 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80805] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80806 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80806] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80807 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80807] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80808 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80808] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80809 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80809] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80810] = "fixed-version: only affects 6.15 onwards" CVE_STATUS[CVE-2026-80811] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-80812 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80812] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80813] = "fixed-version: only affects 6.13 onwards" -# CVE-2026-80814 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80814] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80815] = "fixed-version: only affects 6.10 onwards" @@ -30252,7 +30266,7 @@ CVE_STATUS[CVE-2026-80817] = "fixed-version: only affects 6.13 onwards" CVE_STATUS[CVE-2026-80818] = "fixed-version: only affects 6.17 onwards" -# CVE-2026-80819 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80819] = "cpe-stable-backport: Backported in 6.6.154" # CVE-2026-80820 needs backporting (fixed from 7.2) @@ -30260,73 +30274,73 @@ CVE_STATUS[CVE-2026-80821] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-80822] = "fixed-version: only affects 6.14 onwards" -# CVE-2026-80823 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80823] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80824 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80824] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80825] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-80826 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80826] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80827 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80827] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80828 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80828] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80829 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80829] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80830 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80830] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80831 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80831] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80832 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80832] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80833 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80833] = "cpe-stable-backport: Backported in 6.6.158" -# CVE-2026-80834 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80834] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-80835] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-80836 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80836] = "cpe-stable-backport: Backported in 6.6.158" -# CVE-2026-80837 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80837] = "cpe-stable-backport: Backported in 6.6.158" CVE_STATUS[CVE-2026-80838] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2026-80839] = "fixed-version: only affects 6.8 onwards" -# CVE-2026-80840 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80840] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80841 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80841] = "cpe-stable-backport: Backported in 6.6.158" -# CVE-2026-80842 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80842] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80843 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80843] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80844 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80844] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80845] = "fixed-version: only affects 6.11 onwards" -# CVE-2026-80846 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80846] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80847 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80847] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80848 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80848] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80849] = "fixed-version: only affects 6.7 onwards" CVE_STATUS[CVE-2026-80850] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-80851 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80851] = "cpe-stable-backport: Backported in 6.6.158" -# CVE-2026-80852 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80852] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80853] = "fixed-version: only affects 7.2 onwards" -# CVE-2026-80854 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80854] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80855 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80855] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80856 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80856] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80857] = "fixed-version: only affects 6.18.25 onwards" @@ -30336,17 +30350,17 @@ CVE_STATUS[CVE-2026-80859] = "fixed-version: only affects 6.14 onwards" CVE_STATUS[CVE-2026-80860] = "fixed-version: only affects 6.12.96 onwards" -# CVE-2026-80861 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80861] = "cpe-stable-backport: Backported in 6.6.158" -CVE_STATUS[CVE-2026-80862] = "fixed-version: only affects 6.12 onwards" +# CVE-2026-80862 may need backporting (fixed from 6.7) -# CVE-2026-80863 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80863] = "cpe-stable-backport: Backported in 6.6.156" -# CVE-2026-80864 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80864] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80865] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80866 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80866] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80867] = "cpe-stable-backport: Backported in 6.6.145" @@ -30382,7 +30396,7 @@ CVE_STATUS[CVE-2026-80882] = "fixed-version: only affects 6.12.91 onwards" CVE_STATUS[CVE-2026-80883] = "cpe-stable-backport: Backported in 6.6.145" -# CVE-2026-80884 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80884] = "cpe-stable-backport: Backported in 6.6.160" CVE_STATUS[CVE-2026-80885] = "fixed-version: only affects 6.16 onwards" @@ -30422,47 +30436,5951 @@ CVE_STATUS[CVE-2026-80902] = "cpe-stable-backport: Backported in 6.6.151" CVE_STATUS[CVE-2026-80903] = "fixed-version: only affects 6.12.18 onwards" -# CVE-2026-80904 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80904] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80905 needs backporting (fixed from 7.2) +CVE_STATUS[CVE-2026-80905] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80906 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80906] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80907 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80907] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80908 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80908] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80909 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80909] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80910 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80910] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80911 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80911] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80912 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80912] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80913 may need backporting (fixed from 6.6.153) +CVE_STATUS[CVE-2026-80913] = "cpe-stable-backport: Backported in 6.6.153" -# CVE-2026-80914 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80914] = "cpe-stable-backport: Backported in 6.6.157" CVE_STATUS[CVE-2026-80915] = "fixed-version: only affects 6.11.3 onwards" -# CVE-2026-80916 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80916] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80917 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80917] = "cpe-stable-backport: Backported in 6.6.154" -# CVE-2026-80918 may need backporting (fixed from 6.6.154) +CVE_STATUS[CVE-2026-80918] = "cpe-stable-backport: Backported in 6.6.154" CVE_STATUS[CVE-2026-80919] = "fixed-version: only affects 7.1 onwards" -# CVE-2026-80920 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80920] = "cpe-stable-backport: Backported in 6.6.160" -# CVE-2026-80921 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80921] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80922] = "fixed-version: only affects 6.7 onwards" -# CVE-2026-80923 may need backporting (fixed from 6.6.156) +CVE_STATUS[CVE-2026-80923] = "cpe-stable-backport: Backported in 6.6.156" CVE_STATUS[CVE-2026-80924] = "fixed-version: only affects 6.15 onwards" -# CVE-2026-80925 needs backporting (fixed from 7.3rc1) +CVE_STATUS[CVE-2026-80925] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-80926] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-80927] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-80928] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80929] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-80930] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80931] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80932] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80933] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80934] = "fixed-version: only affects 6.17.8 onwards" + +CVE_STATUS[CVE-2026-80935] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80936] = "fixed-version: only affects 6.14.3 onwards" + +CVE_STATUS[CVE-2026-80937] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80938] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80939] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-80940] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-80941] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80942] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-80943] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-80944] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80945] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-80946] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-80947] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80948] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80949] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80950] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-80951] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80952] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80953] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80954] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-80955] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80956] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80957] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80958] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80959] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80960] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80961] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80962] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-80963] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80964] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80965] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80966] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80967] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80968] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80969] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80970] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-80971] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80972] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80973] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80974] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80975] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-80976] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80977] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80978] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80979] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80980] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80981] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-80982] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80983] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80984] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80985] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-80986] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-80987] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80988] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80989] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80990] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80991] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80992] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80993] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-80994] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-80995] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-80996] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-80997] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-80998] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-80999 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-81000] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81001] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81002] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81003] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81004] = "fixed-version: only affects 6.18.20 onwards" + +CVE_STATUS[CVE-2026-81005] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81006] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-81007] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81008] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81009] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-81010] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-81011] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81012] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81013] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81014] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81015] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-81016] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-81017] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-81018] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-89436] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-89437] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89438] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89439] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89440] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89441] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89442] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89443] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89444] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89445] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89446] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-89447] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-89448] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89449] = "fixed-version: only affects 6.17.3 onwards" + +CVE_STATUS[CVE-2026-89450] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-89451] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89452] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89453] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89454] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89455] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89456] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89457] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89458] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89459] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-89460] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89461] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89462] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89463] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89464] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89465] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89466] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89467] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89468] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89469] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89470] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89471] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89472] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89473] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89474] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89475] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89476] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89477] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89478] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89479] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89480] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89481] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89482] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89483] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89484] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89485] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89486] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89487] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89488] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89489] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89490] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89491] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89492] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89493] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89494] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89495] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89496] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89497] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89498] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89499] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89500] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89501] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89502] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89503] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89504] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89505] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89506] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-89507] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89508] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89509] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89510] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89511] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89512] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89513] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89514] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89515] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89516] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89517] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89518] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89519] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89520] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89521] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89522] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-89523] = "fixed-version: only affects 6.14.3 onwards" + +CVE_STATUS[CVE-2026-89524] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89525] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89526] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89527] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89528] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89529] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89530] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89531] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89532] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89533] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-89534 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-89535] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-89536] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89537] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89538] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89539] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89540] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89541] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89542] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89543] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89544] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-89545 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89546] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89547] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89548] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89549] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89550] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89551] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89552] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89553] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89554] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89555] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89556] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-89557] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89558] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-89559] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89560] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89561] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89562] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89563] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89564] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89565] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89566] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89567] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89568] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89569] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89570] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89571] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89572] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89573] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89574] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89575] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89576] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89577] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89578] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89579] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89580] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89581] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89582] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89583] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89584] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89585] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89586] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89587] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89588] = "fixed-version: only affects 6.12.75 onwards" + +CVE_STATUS[CVE-2026-89589] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89590] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89591] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89592] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89593] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-89594] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89595] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89596] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89597] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89598] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89599] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89600] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89601] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89602] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89604] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89605] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89606] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89607] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89608] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89609] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-89610 needs backporting (fixed from 7.3) + +# CVE-2026-89611 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89612] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89613] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89614] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89615] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89616] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89617] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89618] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89619] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89620] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89621] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89622] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89623] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89624] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89625] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89626] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89627] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89628] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89629] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-89630] = "fixed-version: only affects 6.18.56 onwards" + +CVE_STATUS[CVE-2026-89631] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89632] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89633] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89634] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89635] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-89636] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-89637 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89638] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89639] = "fixed-version: only affects 6.18.44 onwards" + +CVE_STATUS[CVE-2026-89640] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89641] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89642] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89643] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89644] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89645] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89646] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89647] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89648] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89649] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89650] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89651] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89652] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89653] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89654] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89655] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89656] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89657] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89658] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-89659] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89660] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-89661] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89662] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89663] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89664] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89665] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89666] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89667] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-89668] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89669] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89670] = "fixed-version: only affects 6.15.3 onwards" + +CVE_STATUS[CVE-2026-89671] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89672] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89673] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89674] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-89675 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89676] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89677] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89678] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89679] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89680] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89681] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89682] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89683] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-89684] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89685] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89686] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89687] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89688] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89689] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89690] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-89691] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-89692] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89693] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89694] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89695] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89696] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89697] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89698] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-89699] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89700] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89701] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89702] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89703] = "fixed-version: only affects 6.11.6 onwards" + +CVE_STATUS[CVE-2026-89704] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89705] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-89706] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89707] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-89708 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89709] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89710] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89711] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89712] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89713] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89714] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-89715] = "fixed-version: only affects 6.15.10 onwards" + +CVE_STATUS[CVE-2026-89716] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89717] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89718] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89719] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89720] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89721] = "fixed-version: only affects 6.15 onwards" + +# CVE-2026-89722 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89723] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89724] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89725] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89726] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89727] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89728] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89729] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89730] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89731] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-89732] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89733] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89734] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-89735] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89736] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89737] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89738] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-89739 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-89740] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89741] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89742] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89743] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89744] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89745] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89746] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89747] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89748] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89749] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89750] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89751] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89752] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89753] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89754] = "fixed-version: only affects 6.18.21 onwards" + +CVE_STATUS[CVE-2026-89755] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89756] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89757] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89758] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89759] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89760] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89761] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89762] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89763] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89764] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89765] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89766] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89767] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89768] = "fixed-version: only affects 6.12.95 onwards" + +CVE_STATUS[CVE-2026-89769] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89770] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89771] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89772] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-89773] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-89774] = "cpe-stable-backport: Backported in 6.6.145" + +CVE_STATUS[CVE-2026-89775] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89776] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89777] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89778] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89779] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89780] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89781] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89782] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89783] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89784] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89785] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89786] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89787] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89788] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89789] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89790] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89791] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89792] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-89793] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89794] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89795] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89796] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-89797 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89798] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89799] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89800] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89801] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89802] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89803] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89804] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89805] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-89806] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89807] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89808] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89809] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89810] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89811] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89812] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-89813] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89814] = "fixed-version: only affects 6.14.9 onwards" + +CVE_STATUS[CVE-2026-89815] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89816] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89817] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89818] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89819] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89820] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89821] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89822] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89823] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89824] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89825] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89826] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89827] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89828] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-89829] = "fixed-version: only affects 6.18.13 onwards" + +CVE_STATUS[CVE-2026-89830] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-89831] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89832] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89833] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89834] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89835] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89836] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89837] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89838] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89839] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89840] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89841] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89842] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89843] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89844] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89845] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89846] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89847] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89848] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89849] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89850] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89851] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89852] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89853] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89854] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89855] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89856] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89857] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89858] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89859] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89860] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89861] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-89862 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-89863] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89864] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89865] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89866] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89867] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89868] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89869] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89870] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89871] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89872] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89873] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89874] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89875] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89876] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89877] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89878] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89879] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89880] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89881] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89882] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89883] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89884] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89885] = "fixed-version: only affects 6.12.64 onwards" + +CVE_STATUS[CVE-2026-89886] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89887] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89888] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89889] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89890] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89891] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89892] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89893] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89894] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89895] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89896] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89897] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89898] = "fixed-version: only affects 6.12 onwards" + +# CVE-2026-89899 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89900] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89901] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89902] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89903] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89904] = "fixed-version: only affects 6.12.101 onwards" + +CVE_STATUS[CVE-2026-89905] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89906] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89907] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-89908] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89909] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-89910] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89911] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89912] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-89913 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-89914] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89915] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89916] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89917] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89918] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-89919] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89920] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89921] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89922] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89923] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89924] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89925] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89926] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89927] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89928] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89929] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89930] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89931] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89932] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89933] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89934] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89935] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89936] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89937] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89938] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89939] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89940] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89941] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89942] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89943] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-89944] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89945] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89946] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89947] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89948] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89949] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89950] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-89951] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89952] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89953] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89954] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89955] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89956] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89957] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89958] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89959] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89960] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89961] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89962] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89963] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89964] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89965] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89966] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89967] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89968] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89969] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89970] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89971] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-89972] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89973] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89974] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-89975] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89976] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89977] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-89978] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-89979] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89980] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89981] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-89982] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89983] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89984] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89985] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-89986] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-89987] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89988] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89989] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89990] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89991] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-89992] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89993] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89994] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-89995] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89996] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-89997] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89998] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-89999] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90000] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90001] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90002] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90003] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90004] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90005] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-90006] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90007] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90008] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90009] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90010] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90011] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90012] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90013] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90014] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90015] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90016] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90017] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90018] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90019] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90020] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90021] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90022] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90023] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90024] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90025] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90026] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-90027 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90028] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90029] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90030] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90031] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90032] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90033] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90034] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90035] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90036] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90037] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90038] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90039] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-90040] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90041] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90042] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90043] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90044] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90045] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90046] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90047] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-90048] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90049] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90051] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90053] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90054] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90055] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90056] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90057] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90058] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90059] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-90060] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90061] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90062] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90063] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90064] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90065] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90066] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90067] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90068] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90069] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90070] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90071] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90072] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90073] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90074] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90075] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90076] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90077] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90078] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90079] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90080] = "fixed-version: only affects 6.14.9 onwards" + +CVE_STATUS[CVE-2026-90081] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90082] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90083] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90084] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90085] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90086] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-90087] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90088] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90089] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90090] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90091] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90092] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90093] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90094] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90095] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-90096] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90097] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-90098 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90099] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90100] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90101] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90102] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90103] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90104] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90105] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90106] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90107] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90108] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90109] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90110] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90111] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90112] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90113] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-90114] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90115] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90116] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90117] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90118] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90119] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90120] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90121] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90122] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90123] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90124] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90125] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90126] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90127] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90128] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-90129 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-90130] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90131] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90132] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90133] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90134] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90135] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90136] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90137] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90138] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90139] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90140] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90141] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90142] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90143] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90144] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90145] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90146] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90147] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-90148] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90149] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90150] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90151] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90152] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90153] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90154] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90155] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90156] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90157] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90158] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90159] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90160] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90161] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90162] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90163] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90164] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90165] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90166] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90167] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90169] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90170] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90171] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90172] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90173] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90174] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90175] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90176] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90177] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-90178] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-90179] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90180] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90181] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90182] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90183] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90184] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90185] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90186] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90187] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90188] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90189] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90190] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90191] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90192] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90193] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90194] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90195] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-90196] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90197] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90198] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90199] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90200] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90201] = "fixed-version: only affects 6.12.34 onwards" + +CVE_STATUS[CVE-2026-90202] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90203] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90204] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90205] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90206] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90207] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90208] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90209] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90210] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90211] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90212] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-90213] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90214] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90215] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-90216] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90217] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90218] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90219] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90220] = "fixed-version: only affects 6.12.97 onwards" + +CVE_STATUS[CVE-2026-90221] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90222] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90223] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90224] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90225] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90226] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90227] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90228] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90229] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90230] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90231] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90232] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90233] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90234] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90235] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90236] = "fixed-version: only affects 7.2 onwards" + +# CVE-2026-90237 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90238] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90239] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90240] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-90241] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-90242] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-90243] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-90244] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90245] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90246] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90247] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90248] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90249] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90250] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90251] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90252] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-90253] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90254] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90255] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90256] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90257] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90258] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-90259] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90260] = "fixed-version: only affects 6.8 onwards" + +# CVE-2026-90261 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90262] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90263] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90264] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90265] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90266] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90267] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90268] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90269] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90270] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-90271] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-90272] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90273] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90274] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90275] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90276] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90277] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90278] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90279] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90280] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90281] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90282] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90283] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90284] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90285] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90286] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90287] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90288] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90289] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90290] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90291] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90292] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90293] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90294] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90295] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90296] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90297] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90298] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90299] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90300] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90301] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90302] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90303] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90304] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90305] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90306] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-90307] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90308] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90309] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90311] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90312] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90313] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90314] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-90315 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90316] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-90317 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90318] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90319] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90320] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90321] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90322] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90323] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90324] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90325] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90326] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90327] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90328] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90329] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90330] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90331] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90332] = "fixed-version: only affects 6.19.7 onwards" + +# CVE-2026-90333 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90334] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90335] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90336] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90337] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90338] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90339] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90340] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-90341] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90342] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-90343] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90344] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-90345] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90346] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90347] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90348] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90349] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90350] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90351] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-90352] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90353] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90354] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90355] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90356] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90357] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90358] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-90359 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90360] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90361] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90362] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90363] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90364] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90365] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90366] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90367] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90368] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90369] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-90370] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90371] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90372] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-90373 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-90374] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90375] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90376] = "fixed-version: only affects 6.18.33 onwards" + +CVE_STATUS[CVE-2026-90377] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-90378] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-90379 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90380] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90381] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-90382] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90383] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90384] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-90385] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90386] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90387] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90388] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-90389 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90390] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-90391] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90392] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90393] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90394] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90395] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90396] = "fixed-version: only affects 6.16.8 onwards" + +CVE_STATUS[CVE-2026-90397] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90398] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90399] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90400] = "fixed-version: only affects 6.7 onwards" + +# CVE-2026-90401 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-90402] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-90403] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90404] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90405] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90406] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90407] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90408] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90409] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-90410] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90411] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90412] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-90413] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90414] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90415] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90416] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90417] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90418] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90419] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90420] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90421] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90422] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90423] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-90424] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-90425] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90426] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-90427] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-90428] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-90429] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-90430] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-90431] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90432] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-90433] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-90434] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-90435] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92476] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92477] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92478] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-92479] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-92480] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-92481] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92482] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-92483] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-92484] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92485] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-92486] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-92487] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-92488] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-92489] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92490] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92491] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-92492] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-92493 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-92494] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92495] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92496] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92497] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92498] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-92499 needs backporting (fixed from 7.3) + +# CVE-2026-92500 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-92501] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92502] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92503] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-92504] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92505] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-92506] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92507] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92508] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92509] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92510] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92511] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92512] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92513] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-92514] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92515] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-92516] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-92517] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-92518] = "fixed-version: only affects 6.11.6 onwards" + +CVE_STATUS[CVE-2026-92519] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-92520] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-92521] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92522] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92523] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92524] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-92525] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93037] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93038] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93039] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93040] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93041] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93042] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93043] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93044] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-93045] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-93046] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-93047 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-93048] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93049] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93050] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93051] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93052] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93053] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93054] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93055] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93056] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93057] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93058] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93059] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-93060] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93061] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93062] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93063] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93064] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93065] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93066] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-93067] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93068] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93069] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93070] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-93071] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-93072] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93073] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93074] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93075] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93076] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93077] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-93078] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-93079] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-93080] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-93081] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93082] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-93083] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93084] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93085] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93086] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93089] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93090] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-93091 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-93092] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93093] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93094] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-93095] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93096] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-93097] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93098] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-93099 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-93100] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93101] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93102] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93103] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93104] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93105] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93106] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-93107] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93108] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93109] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93110] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93111] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93112] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-93113] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-93114] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93115] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93116] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93117] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93118] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93119] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-93120] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93121] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-93122] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-93123 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-93124] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93125] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93126] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93127] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-93128] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93129] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93130] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93131] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93132] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-93133] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-93134] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-93135] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-93136] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93137] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93138] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93139] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93140] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93141] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93142] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93143] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-93144] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93145] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93146] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93147] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93148] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93149] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93150] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93151] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93152] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93153] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-93154 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-93155] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93156] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93157] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93158] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93159] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93160] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93161] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93162] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-93163] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93164] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93165] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93166] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93167] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93168] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93169] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93170] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93171] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93172] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93173] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-93174] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93175] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93176] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93177] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93178] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93179] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93180] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-93181] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-93182] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93183] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-93184 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-93185] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93186] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93187] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-93188] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93189] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93190] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93191] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93192] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93193] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-93194] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93195] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93196] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93197] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93198] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93199] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93200] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93201] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93202] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93203] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93204] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93205] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93206] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93207] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93208] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93209] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93210] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93211] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-93212] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-93213] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93214] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93215] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-93216] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93217] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93218] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93219] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93220] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93221] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93222] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93223] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93224] = "fixed-version: only affects 6.12.35 onwards" + +CVE_STATUS[CVE-2026-93225] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-93226] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93227] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-93228] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93229] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-93230] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-93231] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93232] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93233] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93234] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93235] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93236] = "cpe-stable-backport: Backported in 6.6.157" + +# CVE-2026-93237 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-93238] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93239] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93240] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93241] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-93242] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93243] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93244] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93245] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93246] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93247] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93248] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-93249] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-93250] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93251] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93252] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93253] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-93254] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93255] = "fixed-version: only affects 7.1.8 onwards" + +CVE_STATUS[CVE-2026-93256] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93257] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93258] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93259] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93260] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93261] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93262] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93263] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93264] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93265] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-93266] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-93267] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-93268] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93269] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93270] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-93271] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93272] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93273] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93274] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93275] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-93276] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-93277] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93278] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93279] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93280] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93281] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93282] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93283] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-93284] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-93285] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93286] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93287] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93288] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93781] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93782] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93783] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93784] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93785] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93786] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93787] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93788] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93789] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93790] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93791] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93792] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93793] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93794] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93795] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93796] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93797] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93798] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93799] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93800] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93801] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93802] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93803] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93804] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93805] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93806] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93807] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93808] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93809] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-93810] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93811] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93812] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93813] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93814] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93815] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93816] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93817] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93818] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-93819] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93820] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93821] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93822] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93823] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93824] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93825] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93826] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93827] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-93828] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-93829] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-93830] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97407] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97408] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97409] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97410] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-97411] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97412] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97413] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97414] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-97415] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97416] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97417] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97418] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97419] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97420] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97421] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97422] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97423] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-97424] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97425] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97426] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-97427] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97428] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97429] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97430] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97431] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-97432] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97433] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97434] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97435] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97436] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97437] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97438] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97439] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97440] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97441] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97442] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97443] = "fixed-version: only affects 6.12.24 onwards" + +CVE_STATUS[CVE-2026-97444] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97445] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97446] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97447] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97448] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97449] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97450] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97451] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97452] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97453] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97454] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97455] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97456] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97472] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97473] = "fixed-version: only affects 6.10.12 onwards" + +CVE_STATUS[CVE-2026-97474] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-97475] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97476] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97477] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97478] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97479] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97480] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97481] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97482] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97483] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97484] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97485] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97486] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97487] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97488] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97489] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97490] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97491] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97492] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97493] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97494] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97495] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97496] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97497] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97498] = "fixed-version: only affects 6.16 onwards" + +# CVE-2026-97499 needs backporting (fixed from 7.2) + +CVE_STATUS[CVE-2026-97500] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97501] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97502] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97503] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97504] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97505] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97506] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97507] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97508] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97509] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97510] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97511] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-97512] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97513] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-97514] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-97515] = "fixed-version: only affects 6.12.31 onwards" + +CVE_STATUS[CVE-2026-97516] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97517] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97518] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97519] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-97520] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-97521] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-97522] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97523] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97524] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97525] = "fixed-version: only affects 6.18.7 onwards" + +CVE_STATUS[CVE-2026-97526] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-97527] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97528] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97529] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97530] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97531] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97532] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97533] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-97534] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97535] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97536] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97537] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97538] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-97539] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97540] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97541] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97542] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97543] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97544] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-97545] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-97546] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97547] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97548] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-97549] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97550] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-97551] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97552] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-97553] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-97554] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97555] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97556] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97557] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97558] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97559] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97560] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97561] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97562] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-97563 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-97564] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-97565 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-97566] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97567] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97568] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97569] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-97570] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-97571] = "fixed-version: only affects 6.12.20 onwards" + +CVE_STATUS[CVE-2026-97572] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97573] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97574] = "fixed-version: only affects 6.12.20 onwards" + +CVE_STATUS[CVE-2026-97575] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97576] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97577] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97578] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97579] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97580] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-97581] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97582] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97583] = "fixed-version: only affects 6.12.101 onwards" + +CVE_STATUS[CVE-2026-97584] = "fixed-version: only affects 6.12.101 onwards" + +CVE_STATUS[CVE-2026-97585] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-97586] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-97587] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97588] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97589] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97590] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97591] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-97592] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97593] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97594] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97595] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97596] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97597] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97598] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97599] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97600] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97601] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97602] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97603] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-97604] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97605] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97606] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-97607] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97608] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97609] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97610] = "fixed-version: only affects 6.18.17 onwards" + +CVE_STATUS[CVE-2026-97611] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97612] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97613] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97614] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-97615] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97616] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97617] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97618] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-97619] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97620] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-97621] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97899] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97900] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97901] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97902] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-97903] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97904] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97905] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97906] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97907] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97908] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97909] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97910] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97911] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-97912] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-97913] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-97914] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-97915] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97916] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97917] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97918] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97919] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97920] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97921] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97922] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97923] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97924] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97925] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97926] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97927] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97928] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97929] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97930] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97931] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97932] = "fixed-version: only affects 7.1.6 onwards" + +CVE_STATUS[CVE-2026-97933] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97934] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97935] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97936] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97937] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-97938] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97939] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97940] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97941] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-97942] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-97943] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-97944] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-97945] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97946] = "fixed-version: only affects 6.17.8 onwards" + +CVE_STATUS[CVE-2026-97947] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-97948] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97949] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97950] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97951] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97952] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97953] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97954] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97955] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-97956] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-97957] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97958] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97959] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97960] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97961] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97962] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97963] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97964] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97965] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97966] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97967] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-97968] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-97969] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97970] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97971] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-97972] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-97973] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97974] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-97975] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97976] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97977] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97978] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97979] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97980] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-97981] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97982] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97983] = "fixed-version: only affects 7.1.5 onwards" + +CVE_STATUS[CVE-2026-97984] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97985] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97986] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97987] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97988] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97989] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97990] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97991] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97992] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97993] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97994] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97995] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-97996] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-97997] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-97998] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98000] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98001] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98002] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98003] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98004] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98005] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98006] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98007] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98008] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98009] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98010] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98011] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98012] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98013] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98014] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98015] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98016] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98017] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98018] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-98019] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98020] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98021] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98022] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98023] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98024] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98025] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98026] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98027] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98028] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98029] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98030] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98031] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98032] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98033] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98034] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98035] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98036] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98037] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98038] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98039] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-98040] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98041] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98042] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98043] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98044] = "fixed-version: only affects 6.12.101 onwards" + +CVE_STATUS[CVE-2026-98045] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98046] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98047] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98048] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98049] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98050] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98051] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98052] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98053] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98054] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-98055] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98056] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98057] = "fixed-version: only affects 6.12.16 onwards" + +CVE_STATUS[CVE-2026-98058] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98059] = "fixed-version: only affects 6.12.6 onwards" + +CVE_STATUS[CVE-2026-98060] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98061] = "fixed-version: only affects 6.18.2 onwards" + +CVE_STATUS[CVE-2026-98062] = "fixed-version: only affects 6.12.6 onwards" + +CVE_STATUS[CVE-2026-98063] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98064] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98065] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98066] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98067] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98068] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98069] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98070] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98071] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98072] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98073] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98074] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98075] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98076] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98077] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98078] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98079] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98080] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98081] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98082] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98083] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98084] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98085] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98086] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98087 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98088] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98089] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98090] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98091] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98092] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98093] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98094] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98095] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98096] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98097] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98098] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98099] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98101] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98102] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98103] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98104] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98105] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98106] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98107] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98108] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98109] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98110] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98111] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98112] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98113] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98114] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98115 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-98116] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98117] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98118] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98119] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98120] = "fixed-version: only affects 6.18.17 onwards" + +CVE_STATUS[CVE-2026-98121] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98122] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98123] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98124] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98125] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98126] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98127] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98128] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98129] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98130] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98131 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98132] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98133] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98134] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98135] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98136] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98137] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98138] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98139] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98140] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98141] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98142] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98143] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98144] = "fixed-version: only affects 6.18.57 onwards" + +CVE_STATUS[CVE-2026-98145] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98146] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98147] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98148] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98149] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98150] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98151] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98152] = "fixed-version: only affects 6.12.96 onwards" + +CVE_STATUS[CVE-2026-98153] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98154] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98155] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98156] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98157] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98158] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98159] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98160] = "cpe-stable-backport: Backported in 6.6.157" + +CVE_STATUS[CVE-2026-98161] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98162] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98163] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98164] = "cpe-stable-backport: Backported in 6.6.156" + +CVE_STATUS[CVE-2026-98166] = "fixed-version: only affects 6.18.57 onwards" + +CVE_STATUS[CVE-2026-98167] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98168] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98169] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98170] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98171] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98172] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98173] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98174] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98175] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98176 needs backporting (fixed from 7.3) + +# CVE-2026-98177 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98178] = "fixed-version: only affects 7.2 onwards" + +# CVE-2026-98179 needs backporting (fixed from 7.3) + +# CVE-2026-98180 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98181] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98182 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98183] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98184] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98185] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98186] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98187] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98188] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98189] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98190] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98191] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98192] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98193] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98194] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98195] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98196] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98197] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98198] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98199] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98200] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98201] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98202] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98203] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98204] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98205] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98206] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98207] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98208] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98209] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98210] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98211 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98212] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98213] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98214] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98215] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98216] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98217] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98218] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98219] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98220] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98221] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98222 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98223] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98224] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98225] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98226] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98227] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98228] = "fixed-version: only affects 6.11 onwards" + +# CVE-2026-98229 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98230] = "fixed-version: only affects 6.12.13 onwards" + +CVE_STATUS[CVE-2026-98231] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98232] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98233] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98234] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98235] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98236] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98237] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98238] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98239] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98240] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98241] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98242] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98243] = "fixed-version: only affects 7.1.5 onwards" + +CVE_STATUS[CVE-2026-98244] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98245] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98246] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98247] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98248 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98249] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98250] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98251] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98252] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98253] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98254 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98255] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98256] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98257] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98258] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98259] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98260] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98261] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98262] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98263] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98264] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98265] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98266 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98267] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98268] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98269] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98270] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98271 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98272] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98273 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98274] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98275] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98276] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98277] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98278] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-98279 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98280] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98281] = "fixed-version: only affects 6.18.33 onwards" + +CVE_STATUS[CVE-2026-98282] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98283] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98284 needs backporting (fixed from 7.3) + +# CVE-2026-98285 needs backporting (fixed from 7.3) + +# CVE-2026-98286 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98287] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98288 needs backporting (fixed from 7.3) + +# CVE-2026-98289 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-98290] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98291] = "fixed-version: only affects 6.10 onwards" + +# CVE-2026-98292 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98293] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98294 needs backporting (fixed from 7.3) + +# CVE-2026-98295 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98296] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98297] = "fixed-version: only affects 6.12.93 onwards" + +CVE_STATUS[CVE-2026-98298] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98299] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98300] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98301] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98302] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98303] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98304 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98305] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98306] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98307 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98308] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98309] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98310] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98311] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98312] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98313 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98314] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98315] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98316] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98317 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98318] = "fixed-version: only affects 6.15.6 onwards" + +CVE_STATUS[CVE-2026-98319] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98320] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98321 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98322] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98323] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98324] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98325] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98326] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98327 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98328] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98329 needs backporting (fixed from 7.3) + +# CVE-2026-98330 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98331] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98332 needs backporting (fixed from 7.3) + +# CVE-2026-98333 needs backporting (fixed from 7.3) + +# CVE-2026-98334 needs backporting (fixed from 7.3) + +# CVE-2026-98335 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98336] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98337 needs backporting (fixed from 7.3) + +# CVE-2026-98338 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98339] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98340] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98341 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98342] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98343] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98344] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98345] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98346] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98347] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98348] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98349] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98350] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98351] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98352] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98353 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-98354] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98355 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98356] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98357] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98358] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98359] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98360] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98361] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98362] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98363] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98364 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98365] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98366] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98367] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98368] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98369] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98370] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98371] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98372] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98373] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98374] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98375] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98376] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98377] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98378] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98379] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98380] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98381] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98382] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98383] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98384] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98385] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98386] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98387 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98388] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98389] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98390] = "fixed-version: only affects 6.17.8 onwards" + +CVE_STATUS[CVE-2026-98391] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98392] = "fixed-version: only affects 6.10 onwards" + +# CVE-2026-98393 needs backporting (fixed from 7.3) + +# CVE-2026-98394 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98395] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98396] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98397] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98398] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98399] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98400] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98401 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98402] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98403 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98404] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98405] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98406] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98407] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98408] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98409] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98410] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98411] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98412] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98413] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98414] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98415] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98416] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98417] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98418] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98419] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98420 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98421] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98422] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98423] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98424 needs backporting (fixed from 7.3) + +# CVE-2026-98425 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98426] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98427 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98428] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98429] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98430] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98431] = "fixed-version: only affects 6.11.11 onwards" + +CVE_STATUS[CVE-2026-98432] = "cpe-stable-backport: Backported in 6.6.159" + +CVE_STATUS[CVE-2026-98433] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98434] = "fixed-version: only affects 7.0 onwards" + +# CVE-2026-98435 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98436] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98437] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98438] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-98439 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98440] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98441] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98442] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98443] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98444] = "fixed-version: only affects 6.12.14 onwards" + +CVE_STATUS[CVE-2026-98445] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98446] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98447] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98448] = "fixed-version: only affects 6.10 onwards" + +# CVE-2026-98449 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98450] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98451] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98452 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98453] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98454] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98455] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98456] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98457] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98458 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98459] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98460] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98461] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98462] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98463] = "fixed-version: only affects 6.18.19 onwards" + +CVE_STATUS[CVE-2026-98464] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98465] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98466 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98467] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98468] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98469] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98470] = "fixed-version: only affects 7.0 onwards" + +# CVE-2026-98471 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98472] = "fixed-version: only affects 6.17 onwards" + +# CVE-2026-98473 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-98474] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98475] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98476] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98477] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98478] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98479] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98480] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-98481] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98482] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98483] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98484] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98485] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98486] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98487] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98488] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98489] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98490] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98491] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98492] = "fixed-version: only affects 6.17.3 onwards" + +CVE_STATUS[CVE-2026-98493] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98494] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98495] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98496] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98497] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98498] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98499] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98500] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98501] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98502] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98503 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98504] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98505] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98506 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98507] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98508] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98509] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98510] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98511] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98512] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98513] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-98514] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98515] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98516] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98517] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98518] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98519] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98520] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98521] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98522] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98523] = "fixed-version: only affects 6.12.19 onwards" + +CVE_STATUS[CVE-2026-98524] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98525 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98526] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98527] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98528] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98529] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98530] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98531] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98532] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98533] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98534] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98535] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98536] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98537] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98538] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98539 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98540] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98541] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98542] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98543] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98544] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98545] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98546] = "fixed-version: only affects 6.12.25 onwards" + +CVE_STATUS[CVE-2026-98547] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98548] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98549] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98550] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98551 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98552] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98553] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98554] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98555] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98556 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98557] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-98558 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98559] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98560] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98561] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98562] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98563] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98564] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98565] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98566] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98567] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98568] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98569] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98570] = "fixed-version: only affects 6.12.16 onwards" + +CVE_STATUS[CVE-2026-98571] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98572] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98573] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98574] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98575] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98576] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98577] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98578] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98579] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98580] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98581] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98582] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98583] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98584] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-98585] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98586] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98587] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98588] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98589 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98590] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98591] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98592] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98593] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98594] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98595] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98596] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98597] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98598 needs backporting (fixed from 7.3) + +# CVE-2026-98599 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98600] = "fixed-version: only affects 6.12.111 onwards" + +CVE_STATUS[CVE-2026-98601] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98602] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98603] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98604] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98605] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98606] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98607] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98608] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98609] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98610] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98611] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98612] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98613] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98614] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98615] = "fixed-version: only affects 6.12.29 onwards" + +CVE_STATUS[CVE-2026-98616] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98617] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98618] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98619] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98620] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98621] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98622] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98623] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98624] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98625] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98626] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98627] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-98628 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98629] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98630] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98631] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98632] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98633] = "fixed-version: only affects 6.15 onwards" + +# CVE-2026-98634 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98635] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98636] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98637] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98638] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98639] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98640] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98641] = "fixed-version: only affects 6.12 onwards" + +# CVE-2026-98642 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98643] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98644] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98645] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98646] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98647] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98648] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98649] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98650] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98651] = "fixed-version: only affects 7.0 onwards" + +# CVE-2026-98652 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98653] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98655] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98656] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98657] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98658] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98659] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98660] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98661 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98662] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98663] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98664] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98665] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98666] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98667] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98668] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98669] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98670] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98671] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98672] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98673] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98674] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98675] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98676] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98677] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98678] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98679] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98680] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-98681] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98682 may need backporting (fixed from 6.7) + +# CVE-2026-98683 may need backporting (fixed from 6.7) + +# CVE-2026-98684 needs backporting (fixed from 7.3) + +# CVE-2026-98685 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-98686] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98687] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98688 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98689] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98690] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98691] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98692] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98693] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98694] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98695] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98696] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98697] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98698] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98699] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98700] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98701] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98702] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98703] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98704] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98705] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98706] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98707] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98708] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98709] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98710] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98711] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98712] = "fixed-version: only affects 6.19.9 onwards" + +CVE_STATUS[CVE-2026-98713] = "fixed-version: only affects 6.9 onwards" + +# CVE-2026-98714 needs backporting (fixed from 7.3) + +# CVE-2026-98715 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98716] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98717] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98718] = "fixed-version: only affects 6.18.55 onwards" + +CVE_STATUS[CVE-2026-98719] = "fixed-version: only affects 6.18.55 onwards" + +# CVE-2026-98720 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98721] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98722] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98723] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98724] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98725] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98726] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98727] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98728] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98729] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98730] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98731] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98732] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98733] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98734] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98735] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98736] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98737] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98738] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98739] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98740 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98741] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98742] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98743] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98744] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98745] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98746] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98747 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98748] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98749] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98750] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98751] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98752] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98753] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98754] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98755] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98756] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98757] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98758 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98759] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98760] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98761] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98762] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98763] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98764] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98765] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98766] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98767] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98768] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98769] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98770] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98771] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98772] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98773] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98774] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98775] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98776] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98777] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98778] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98779] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98780] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98781] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98782] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98783] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98784] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98785] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98786 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98787] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98788] = "fixed-version: only affects 6.17 onwards" + +# CVE-2026-98789 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98790] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98791] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98792] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98793] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98794] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98795 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98796] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98797 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98798] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98799 needs backporting (fixed from 7.3) + +# CVE-2026-98800 needs backporting (fixed from 7.3) + +# CVE-2026-98801 needs backporting (fixed from 7.3) + +# CVE-2026-98802 needs backporting (fixed from 7.3) + +# CVE-2026-98803 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98804] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98805] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98806] = "fixed-version: only affects 6.14.9 onwards" + +# CVE-2026-98807 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98808] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98809] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98810 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98811] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98812] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98813] = "fixed-version: only affects 6.12.112 onwards" + +# CVE-2026-98814 needs backporting (fixed from 7.3) + +# CVE-2026-98815 needs backporting (fixed from 7.3) + +# CVE-2026-98816 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98817] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98818] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98819] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98820 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98821] = "fixed-version: only affects 6.16.8 onwards" + +CVE_STATUS[CVE-2026-98822] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98823] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98824 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98825] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98826 needs backporting (fixed from 7.3) + +# CVE-2026-98827 needs backporting (fixed from 7.3) + +# CVE-2026-98828 needs backporting (fixed from 7.3) + +# CVE-2026-98829 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98830] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98831] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98832] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98833] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98834 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98835] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98836] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98837] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98838] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98839 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98840] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98841] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98842] = "fixed-version: only affects 6.15.4 onwards" + +CVE_STATUS[CVE-2026-98843] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-98844] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98845] = "fixed-version: only affects 6.11.7 onwards" + +CVE_STATUS[CVE-2026-98846] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98847] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98848] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98849] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98850] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98851] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98852] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98853 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98854] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98855] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98856] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98857] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98858] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98859] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98860] = "fixed-version: only affects 6.12.78 onwards" + +CVE_STATUS[CVE-2026-98861] = "fixed-version: only affects 6.18.34 onwards" + +CVE_STATUS[CVE-2026-98862] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98863 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98864] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98865] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98866] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98867] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98868] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98869] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-98870] = "fixed-version: Fixed from version 5.16" + +CVE_STATUS[CVE-2026-98871] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-98872] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98873] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98874] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98875] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-98876] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98877] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98878] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-98879] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98880] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98881] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98882] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98883] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98884] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98885] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98886] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98887] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98888] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98889] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98890] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98891] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98892] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98893] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98894] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98895] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-98896] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98897 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-98898] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98899] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98900] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98901] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98902] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98903 needs backporting (fixed from 7.2) + +# CVE-2026-98904 needs backporting (fixed from 7.2) + +CVE_STATUS[CVE-2026-98905] = "fixed-version: only affects 6.12 onwards" + +# CVE-2026-98906 needs backporting (fixed from 7.2) + +CVE_STATUS[CVE-2026-98907] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98908] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98909] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98910] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98911] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98912] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98913] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98914 needs backporting (fixed from 7.2) + +CVE_STATUS[CVE-2026-98915] = "cpe-stable-backport: Backported in 6.6.158" + +CVE_STATUS[CVE-2026-98916] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98917 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98918] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98919] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98920] = "fixed-version: only affects 6.12.114 onwards" + +CVE_STATUS[CVE-2026-98921] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98922] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98923] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98924 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98925] = "cpe-stable-backport: Backported in 6.6.158" + +# CVE-2026-98926 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98927] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98928] = "fixed-version: only affects 6.14 onwards" + +# CVE-2026-98929 needs backporting (fixed from 7.3) + +# CVE-2026-98930 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98931] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98932 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98933] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98934] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98935] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98936] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98937 needs backporting (fixed from 7.3) + +# CVE-2026-98938 has no known resolution + +CVE_STATUS[CVE-2026-98939] = "fixed-version: only affects 6.18.53 onwards" + +CVE_STATUS[CVE-2026-98940] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98941 has no known resolution + +CVE_STATUS[CVE-2026-98942] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-98944] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98945] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98946 needs backporting (fixed from 7.3) + +# CVE-2026-98947 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98948] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98949] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-98950] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98951 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98952] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-98953] = "fixed-version: only affects 6.7 onwards" + +# CVE-2026-98954 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98955] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98956] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98957 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98958] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-98959] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98960] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98961] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98962] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98963] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-98964] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98965] = "fixed-version: only affects 6.18 onwards" + +# CVE-2026-98966 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98967] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98968] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98969] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98970] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98971] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98972 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98973] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-98974] = "fixed-version: only affects 6.10 onwards" + +# CVE-2026-98975 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98976] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98977] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98978 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98979] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-98980 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98981] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98982] = "fixed-version: only affects 6.9 onwards" + +# CVE-2026-98983 may need backporting (fixed from 6.7) + +CVE_STATUS[CVE-2026-98984] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98985] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98986] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98987] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-98988] = "fixed-version: only affects 7.0 onwards" + +# CVE-2026-98989 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98990] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98991] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-98992] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98993] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-98994] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-98995] = "fixed-version: only affects 6.17 onwards" + +# CVE-2026-98996 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-98997] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-98998] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-98999] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-99000] = "fixed-version: only affects 6.15 onwards" + +CVE_STATUS[CVE-2026-99001] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-99002] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99003] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-99004] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-99005] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99006] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99007] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99008] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99009] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99010] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99011] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-99012] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99013] = "fixed-version: only affects 6.12.6 onwards" + +CVE_STATUS[CVE-2026-99014] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99015] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99016] = "fixed-version: only affects 6.13 onwards" + +CVE_STATUS[CVE-2026-99017] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-99018] = "fixed-version: only affects 6.7 onwards" + +CVE_STATUS[CVE-2026-99019] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99020] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-99021 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99022] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99023] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-99024] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99025] = "cpe-stable-backport: Backported in 6.6.160" + +# CVE-2026-99026 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99027] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99028] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-99029] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-99030] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-99031] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99032] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99033] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99034] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99035] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99036] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99037] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99038] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99039] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99040] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99041] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99042] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99043] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99044] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-99045] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99046] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-99047] = "fixed-version: only affects 6.17 onwards" + +CVE_STATUS[CVE-2026-99048] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-99049] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99050] = "fixed-version: only affects 6.18.6 onwards" + +CVE_STATUS[CVE-2026-99051] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-99052] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99053] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99054] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99055] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-99056] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99057] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99058] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99059] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99060] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99061] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99062] = "fixed-version: only affects 6.12.34 onwards" + +CVE_STATUS[CVE-2026-99063] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99064] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-99065] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-99066] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-99067] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99068] = "fixed-version: only affects 6.14 onwards" + +CVE_STATUS[CVE-2026-99069] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-99070] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99071] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99072] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99073] = "fixed-version: only affects 6.9 onwards" + +CVE_STATUS[CVE-2026-99074] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99075] = "fixed-version: only affects 6.18 onwards" + +# CVE-2026-99076 needs backporting (fixed from 7.3) + +# CVE-2026-99077 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99078] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99079] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99080] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99081] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99082] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99083] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99084] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-99085] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-99086] = "fixed-version: only affects 6.18.16 onwards" + +# CVE-2026-99087 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99088] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99089] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99090] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99091] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99092] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-99093] = "fixed-version: only affects 6.18.53 onwards" + +CVE_STATUS[CVE-2026-99094] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-99095] = "cpe-stable-backport: Backported in 6.6.160" + +CVE_STATUS[CVE-2026-99096] = "fixed-version: only affects 7.0 onwards" + +CVE_STATUS[CVE-2026-99097] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-99098] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-99099] = "fixed-version: only affects 6.15 onwards" + +# CVE-2026-99100 needs backporting (fixed from 7.3) + +# CVE-2026-99101 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99102] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-99103] = "cpe-stable-backport: Backported in 6.6.25" + +CVE_STATUS[CVE-2026-99104] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-99105] = "fixed-version: only affects 6.12 onwards" + +# CVE-2026-99106 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99107] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-99108] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-99109 needs backporting (fixed from 7.3) + +# CVE-2026-99110 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99111] = "fixed-version: only affects 6.18 onwards" + +# CVE-2026-99112 needs backporting (fixed from 7.3) + +# CVE-2026-99113 needs backporting (fixed from 7.3) + +# CVE-2026-99114 needs backporting (fixed from 7.3) + +# CVE-2026-99115 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99116] = "fixed-version: only affects 6.18 onwards" + +# CVE-2026-99117 needs backporting (fixed from 7.3) + +# CVE-2026-99118 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99119] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99120] = "fixed-version: only affects 6.18 onwards" + +# CVE-2026-99121 needs backporting (fixed from 7.3) + +# CVE-2026-99122 needs backporting (fixed from 7.3) + +# CVE-2026-99123 needs backporting (fixed from 7.3) + +# CVE-2026-99124 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99125] = "fixed-version: only affects 6.11 onwards" + +# CVE-2026-99126 needs backporting (fixed from 7.3) + +# CVE-2026-99127 needs backporting (fixed from 7.3) + +# CVE-2026-99128 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99129] = "fixed-version: only affects 7.0 onwards" + +# CVE-2026-99130 needs backporting (fixed from 7.3) + +# CVE-2026-99131 needs backporting (fixed from 7.3) + +# CVE-2026-99132 needs backporting (fixed from 7.3) + +# CVE-2026-99133 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99134] = "fixed-version: only affects 6.8 onwards" + +# CVE-2026-99135 needs backporting (fixed from 7.3) + +# CVE-2026-99136 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99137] = "fixed-version: only affects 6.18 onwards" + +# CVE-2026-99138 needs backporting (fixed from 7.3) + +# CVE-2026-99139 needs backporting (fixed from 7.3) + +# CVE-2026-99140 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99141] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-99142 needs backporting (fixed from 7.3) + +# CVE-2026-99143 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99144] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-99145] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-99146 needs backporting (fixed from 7.3) + +# CVE-2026-99147 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99148] = "fixed-version: only affects 6.16 onwards" + +CVE_STATUS[CVE-2026-99149] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-99150 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99151] = "fixed-version: only affects 7.2.9 onwards" + +# CVE-2026-99152 needs backporting (fixed from 7.3) + +# CVE-2026-99153 needs backporting (fixed from 7.3) + +# CVE-2026-99154 needs backporting (fixed from 7.3) + +# CVE-2026-99155 needs backporting (fixed from 7.3) + +# CVE-2026-99156 needs backporting (fixed from 7.3) + +# CVE-2026-99157 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99158] = "fixed-version: only affects 6.10 onwards" + +CVE_STATUS[CVE-2026-99159] = "fixed-version: only affects 6.12 onwards" + +CVE_STATUS[CVE-2026-99160] = "fixed-version: only affects 6.12 onwards" + +# CVE-2026-99161 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99162] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-99163 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99164] = "fixed-version: only affects 7.0 onwards" + +# CVE-2026-99165 needs backporting (fixed from 7.3) + +# CVE-2026-99166 needs backporting (fixed from 7.3) + +# CVE-2026-99167 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99168] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-99169 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99170] = "fixed-version: only affects 7.1 onwards" + +# CVE-2026-99171 needs backporting (fixed from 7.3) + +# CVE-2026-99172 needs backporting (fixed from 7.3) + +# CVE-2026-99173 may need backporting (fixed from 6.7) + +# CVE-2026-99174 needs backporting (fixed from 7.3) + +# CVE-2026-99175 needs backporting (fixed from 7.3) + +# CVE-2026-99176 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99177] = "fixed-version: only affects 7.2 onwards" + +# CVE-2026-99178 needs backporting (fixed from 7.3) + +# CVE-2026-99179 needs backporting (fixed from 7.3) + +# CVE-2026-99180 needs backporting (fixed from 7.3) + +# CVE-2026-99181 needs backporting (fixed from 7.3) + +# CVE-2026-99182 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99183] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-99184] = "fixed-version: only affects 6.18 onwards" + +CVE_STATUS[CVE-2026-99185] = "fixed-version: only affects 6.19 onwards" + +CVE_STATUS[CVE-2026-99186] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-99187 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99188] = "fixed-version: only affects 6.19 onwards" + +# CVE-2026-99189 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99190] = "fixed-version: only affects 6.12.114 onwards" + +# CVE-2026-99191 needs backporting (fixed from 7.3) + +# CVE-2026-99192 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99193] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99194] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99195] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99196] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99197] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99198] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99199] = "fixed-version: only affects 7.2 onwards" + +CVE_STATUS[CVE-2026-99200] = "fixed-version: only affects 7.2 onwards" + +# CVE-2026-99201 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99202] = "fixed-version: only affects 6.18.44 onwards" + +# CVE-2026-99203 needs backporting (fixed from 7.3) + +# CVE-2026-99204 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99205] = "fixed-version: only affects 7.0 onwards" + +# CVE-2026-99206 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99207] = "fixed-version: only affects 7.1 onwards" + +CVE_STATUS[CVE-2026-99208] = "fixed-version: only affects 6.11 onwards" + +CVE_STATUS[CVE-2026-99209] = "fixed-version: only affects 6.8 onwards" + +CVE_STATUS[CVE-2026-99210] = "fixed-version: only affects 6.18 onwards" + +# CVE-2026-99211 needs backporting (fixed from 7.3) + +# CVE-2026-99212 needs backporting (fixed from 7.3) + +# CVE-2026-99213 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99214] = "fixed-version: only affects 6.11 onwards" + +# CVE-2026-99215 needs backporting (fixed from 7.3) + +# CVE-2026-99216 needs backporting (fixed from 7.3) + +CVE_STATUS[CVE-2026-99999] = "cpe-stable-backport: Backported in 6.6.159" From patchwork Sat Oct 31 00:15:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102563 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3758.1793405773594903771 for ; Fri, 30 Oct 2026 17:16:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=k85M54CN; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a35ac4475dso8900585e9.2 for ; Fri, 30 Oct 2026 17:16:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405772; x=1794010572; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=j7r+AFzZOl0Y5D2cFtRYK6GvQbu22tGxZI0mm+H8kZM=; b=k85M54CN5oyVqDkILXHGssbb9PKBeuy7VXORw5SLrOwDwq9db2v9nXPX1HqiiccQ4n L+EauO5A92RFKDhTQ5nHUU6FbI1TVP2ZA5ic6uQBmAgzHy0G/sYRFEOP9JMuaosSIftO lus4Q+h5OlqqmRI13cKnOW7Bt0/QWxQrO5RGdxDbQDd4dX92j3GCHGlbBV39oxvrq4+f mojGN6OziV+EPO8ljUGK9zj4grGx6ACM9nytTyhG4e4oibWC926fNyu0QM7P52xKmmve pJfLOwyahg9wksw1dQuheWRbKpPmZfuGDj9MMXCeVTvQimr6wswLGBaJgkX41phpujb3 1NNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405772; x=1794010572; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=j7r+AFzZOl0Y5D2cFtRYK6GvQbu22tGxZI0mm+H8kZM=; b=GKJkHsFBnSPLEepAQkVALHbK7wqZ9cF5pkWR6mPuqZj1wq9qDFEDEXeTLl+tyZUepg dOnBqqwTv+LZR01LRVj0sXjRo9voOghXqzKu7gfbhZWNhj6xLxH+zZ9JmbqfyD01Bjo/ PpRH+n6Qo+07bE5lpMkNPIIhfAIQuOoMp8W3C3vdMorn3V/4KDFVbt9ykanmuERGOukN 9uLx0bLVj9/1s8t3j+p1Sx7uak4kTq5SwEaa5290KQUyvu/wXdQhDDk/8LtrWNK3iiy1 x2brB4eifiX3AC5KF9PDQoaXacULoCrEsV5z4b2o1DQA0SMC6vCIY3PAKNbSyz1YoP// STxw== X-Gm-Message-State: AFq9FYJVbAx0Q+0uKLbTEJGqT3SK+Gs+0eG/CojIGZu6h2PI2HARfTBl PFRd8O60FPiYDI+9nzbDATh52QEnQstDZXX4j0NHkcixndQPYBenlIXXwpBvnt1Hbnez2FVSGjA X/U2E8Fo= X-Gm-Gg: AYBFou2kXSJqCfe5B3SmvZOLv02tI8XWegOk4b7kLBUNyzBaUyXXk03xowVInc8/1BV 6i3Nq+M5bh2wFzGfaLCyyr5nTloIb9yyYPwYXh0P7CjiZy+1jt2+H5Vm90vClA4e9IA3sEAzQYI wpkicEj2uY/NZ46ruyS7dAj0MJiBMFCcEpWaq5Vb8lIiDnhoQPSYqzv4B4Ap4WgQeOFd5cpAvNz L3sNJu+XOhAMuI2mOsMbC9ylcKn7+odcXmNoksrd69s0RBYVExhQ3EPpupzAao68x+G2EBmf0zM /xpk2xiTq8DodCa6R0otsgMTHEQqx1sbOGyuTVyLkabiPODtlkilQSnn3o7IMG2Rjj1kFQKcAfO TEVF+8jy75WGFCUf5Fmmp1G+qdgOw0IiSFr9l2Bp6GddA0PwV9qX36LxM6n4IlrKylYYJNeFPKZ vYTL4u5HSCIrQ0wYV5EuHitJ06hZJ0/vzVcbLCSsj8yLnf6RvTdv+4EMnlfi6XCM/aMTf4G99Ya YP+Khtf7tl9/ktVxWGHjcPN7yE4/ck0/4MNEVWK8VzAgy/QvhhHZgtOPUm7fN94WNF0gGQ8bbF0 HvBl/dtlgJqpiNkXkz12tsyj6BaBrb6awbaOu8jcFvP7IFNOrlntcaD4HfquOJ+eQtRaWlL1ucw Yhp1WCf9zkIxE9yahBzfqdxXjiF/8J+llKc1cm/bkfs82/eTJew== X-Received: by 2002:a05:600c:1d1c:b0:49f:fe39:5bc8 with SMTP id 5b1f17b1804b1-4ac1709a1f5mr90207975e9.12.1793405771824; Fri, 30 Oct 2026 17:16:11 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:11 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 47/55] curl: fix CVE-2026-80230 Date: Sat, 31 Oct 2026 01:15:08 +0100 Message-ID: <40da5f7e3f6ce9fb75cb040e8a9e10be3ee623cd.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249121 From: Jaipaul Cheernam Backport the upstream fix [1] as mentioned in [2] [1] https://github.com/curl/curl/commit/5267ed859d545534d0c21 [2] https://curl.se/docs/CVE-2026-80230.html Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal [YC: This commit reformatted SRC_URI to match devtool code generation and avoid a manual step ] --- .../curl/curl/CVE-2026-80230.patch | 63 +++++++++++++++++ meta/recipes-support/curl/curl_8.7.1.bb | 70 +++++++++---------- 2 files changed, 98 insertions(+), 35 deletions(-) create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch b/meta/recipes-support/curl/curl/CVE-2026-80230.patch new file mode 100644 index 00000000000..0473c0922de --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch @@ -0,0 +1,63 @@ +From c14852aaf58042b71f98cf5aebea8d7821f6e5e1 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Mon, 24 Aug 2026 23:37:49 +0200 +Subject: [PATCH] openssl: no server cert is only okay if also not pinned + +Reported-by: Stanislav Fort +Closes #22660 + +CVE: CVE-2026-80230 +Upstream-Status: Backport [https://github.com/curl/curl/commit/5267ed859d545534d0c21] + +Note: logic lives in servercert() in 8.7.1, not in ossl_check_pinned_key +Macro CURL_EASY_STR is not available in 8.7.1 used direct data struct +strict is set based on verifypeer and verifyhost by calling function + +Signed-off-by: Jaipaul Cheernam +--- + lib/vtls/openssl.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c +index 3e130c5..481528b 100644 +--- a/lib/vtls/openssl.c ++++ b/lib/vtls/openssl.c +@@ -4202,6 +4202,18 @@ static void infof_certstack(struct Curl_easy *data, const SSL *ssl) + #define infof_certstack(data, ssl) + #endif + ++static const char *pinned(struct Curl_cfilter *cf, ++ struct Curl_easy *data) ++{ ++ (void)cf; ++ return ++#ifndef CURL_DISABLE_PROXY ++ Curl_ssl_cf_is_proxy(cf) ? ++ data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] : ++#endif ++ data->set.str[STRING_SSL_PINNEDPUBLICKEY]; ++} ++ + /* + * Get the server cert, verify it and show it, etc., only call failf() if the + * 'strict' argument is TRUE as otherwise all this is for informational +@@ -4248,7 +4260,7 @@ static CURLcode servercert(struct Curl_cfilter *cf, + backend->server_cert = SSL_get1_peer_certificate(backend->handle); + if(!backend->server_cert) { + BIO_free(mem); +- if(!strict) ++ if(!strict && !pinned(cf, data)) + return CURLE_OK; + + failf(data, "SSL: couldn't get peer certificate"); +@@ -4424,9 +4436,7 @@ static CURLcode servercert(struct Curl_cfilter *cf, + /* when not strict, we don't bother about the verify cert problems */ + result = CURLE_OK; + +- ptr = Curl_ssl_cf_is_proxy(cf)? +- data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]: +- data->set.str[STRING_SSL_PINNEDPUBLICKEY]; ++ ptr = pinned(cf, data); + if(!result && ptr) { + result = ossl_pkp_pin_peer_pubkey(data, backend->server_cert, ptr); + if(result) diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index e361e6d6b13..ab33d4aa778 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -9,41 +9,41 @@ SECTION = "console/network" LICENSE = "curl" LIC_FILES_CHKSUM = "file://COPYING;md5=eed2e5088e1ac619c9a1c747da291d75" -SRC_URI = " \ - https://curl.se/download/${BP}.tar.xz \ - file://721941aadf4adf4f6aeb3f4c0ab489bb89610c36.patch \ - file://run-ptest \ - file://disable-tests \ - file://no-test-timeout.patch \ - file://CVE-2024-6197.patch \ - file://CVE-2024-7264-1.patch \ - file://CVE-2024-7264-2.patch \ - file://CVE-2024-8096.patch \ - file://CVE-2024-9681.patch \ - file://CVE-2024-11053-0001.patch \ - file://CVE-2024-11053-0002.patch \ - file://CVE-2024-11053-0003.patch \ - file://CVE-2025-0167.patch \ - file://CVE-2025-9086.patch \ - file://CVE-2025-10148.patch \ - file://CVE-2025-14017.patch \ - file://CVE-2025-14524.patch \ - file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \ - file://CVE-2025-14819.patch \ - file://CVE-2025-15079.patch \ - file://CVE-2025-15224.patch \ - file://CVE-2026-1965-1.patch \ - file://CVE-2026-1965-2.patch \ - file://CVE-2026-3783.patch \ - file://CVE-2026-3784.patch \ - file://CVE-2026-5773.patch \ - file://CVE-2026-6276.patch \ - file://CVE-2026-5545.patch \ - file://CVE-2026-6253.patch \ - file://CVE-2026-4873.patch \ - file://CVE-2026-13608.patch \ - file://CVE-2026-8286.patch \ -" +SRC_URI = "https://curl.se/download/${BP}.tar.xz \ + file://721941aadf4adf4f6aeb3f4c0ab489bb89610c36.patch \ + file://run-ptest \ + file://disable-tests \ + file://no-test-timeout.patch \ + file://CVE-2024-6197.patch \ + file://CVE-2024-7264-1.patch \ + file://CVE-2024-7264-2.patch \ + file://CVE-2024-8096.patch \ + file://CVE-2024-9681.patch \ + file://CVE-2024-11053-0001.patch \ + file://CVE-2024-11053-0002.patch \ + file://CVE-2024-11053-0003.patch \ + file://CVE-2025-0167.patch \ + file://CVE-2025-9086.patch \ + file://CVE-2025-10148.patch \ + file://CVE-2025-14017.patch \ + file://CVE-2025-14524.patch \ + file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \ + file://CVE-2025-14819.patch \ + file://CVE-2025-15079.patch \ + file://CVE-2025-15224.patch \ + file://CVE-2026-1965-1.patch \ + file://CVE-2026-1965-2.patch \ + file://CVE-2026-3783.patch \ + file://CVE-2026-3784.patch \ + file://CVE-2026-5773.patch \ + file://CVE-2026-6276.patch \ + file://CVE-2026-5545.patch \ + file://CVE-2026-6253.patch \ + file://CVE-2026-4873.patch \ + file://CVE-2026-13608.patch \ + file://CVE-2026-8286.patch \ + file://CVE-2026-80230.patch \ + " SRC_URI:append:class-nativesdk = " \ file://environment.d-curl.sh \ From patchwork Sat Oct 31 00:15:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102564 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3759.1793405774066926844 for ; Fri, 30 Oct 2026 17:16:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=pios4NPw; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4a215e64962so12490785e9.1 for ; Fri, 30 Oct 2026 17:16:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405772; x=1794010572; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=VLzZo4Ms0wPDxZcEGzrfFwo6bLxwZDVbowDwahiW13M=; b=pios4NPwy7f5fadsFqz/sWJ1VStDaMXDtVO0bk2eN4fl4ueDpo/FduESnN0gCOcd/H BzylB0KzYPxscxq3Gggs1ZBG0BeFJLyLb7Gn0kIptP8I3Mn/wBiPjLCxjT4sEQw66Sd+ C3OeWQ18IdcclE1Xqr/KBim23JfQRIMSl2VkeVV/bi5c11wodbpeKg4n2YAsKoRP38oY wrXIs2pq9g6759+ZiTHLRKz/OCzYTUsQjXRyjCLE7PjTn0qllrDxBz4ANkGJgX8RU/Ey WQD/IzFgs6grUewJVTJsx9xJ5bNqLiGrfkbcVbXJIdzDN0g9EPmeDaLyh8+02txq3OfK Vz5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405772; x=1794010572; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=VLzZo4Ms0wPDxZcEGzrfFwo6bLxwZDVbowDwahiW13M=; b=eRcpwW2veT2nHx0ZVZChJV21hSl77EBM4+FfoB/2nL1wcL6HVKyOUHcfN07JEOxD6W VSbJHTmtu9FWl5ha37K6CrcKnk5tkljCW4klRmGBlvqjYwOnRzL51KAAHd3SC+5ASewE rev+t+52xcdjlJvZrb6+/1y/95mxatlGQKi7K9/SxyO5yYD2rcydEw/gHTotROblvMkz 2Bu1RG5FLOcvV1tMbQ6MU8vgV0+fHCfZ4u1so/OeosRQm1wKBYRaJNwar6cKueT/6Z/4 G1qti1NIZ3BFlaGme9p5RCqYMWXh/NGkc96We60+IbUqrn2OpZq7K5PTynYBQbzDzWqi JfbA== X-Gm-Message-State: AFq9FYI/NfwdS8XIgBpZjO/9IIhvUnKzzpLd+hE0KXhYbBj1rYzavWeJ ZePWTjC+UU0nzqCdPFLpYQvs72f/9F1kPRPSCfWBSs5kEFTR6GUyJTaK8UaDz3R0hP1+3ho3GM4 KUQsyzW0= X-Gm-Gg: AYBFou12mujhr62Ki9M6gd6l7fyBkdI/k3L28mmp4SSzDsg51Arfjt7t7XCjH/LPAmJ UDDIq8X4elKzywxOGPqqsDEl8j/mU0qVzKxW/qPVP9YeNF7BfLEh8wuvTiL6knd2iWAnKlxHwwp j+8yVBVFlQnhOEYE0DWrxzZrwfzhc/8Em/X4FGMvysaEanTV63rorMSEFuWI1JDupPRmbR/1i0E 64+kXfk/xKtrpK1lGbTxBm9vxbOi/KaIe5lypMCa8pUqdtGpLa/BkfgYG382vlt5l3qqbX6Izy8 Qv58oSH2TlW/gXjn9p3GZ/i2QaVkoRS9/bmu/RuYDu25CNXMvrjIfHJv+OPrR/3HwIsLUDb004G P+9G95g5RZtU+AfHdzuwleKjAJUeJsc+y92hkKh0nt9OO/DJ2r5Kg9gTyjCwmVFkhbiI8yEDIpc lFgZAu6VfLhBZS5sNuP3uLX5Miza9Vn3t7RlsnxVAtCrHia45TJItr7F+T9vctSYJXwSFTNOtXC ru4tfJjzZN/YnCladb8AtxjEQM9ovAkBngMf1Kl5/6S9is9/Uy7WhqQjc7Lj+drO6IdBd0TLFfF wW2SVBB1Mia9YePPVBeJZCRJEWW20VlPSfcs9OSUbc7YNtTs4aI46YE4kGOXeSkFBbgVJLmZs56 h/P1iQ9uvxzUsUWuPGqrtchAHBN/8 X-Received: by 2002:a05:600c:19d2:b0:4a6:4d6b:a840 with SMTP id 5b1f17b1804b1-4ac1932a12fmr85932505e9.31.1793405772408; Fri, 30 Oct 2026 17:16:12 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:12 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 48/55] libarchive: fix CVE-2026-15028 Date: Sat, 31 Oct 2026 01:15:09 +0100 Message-ID: <5d629da3bc693df850387d1bd5fe3d03a09e4c31.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249122 From: Jakub Szczudlo (Nokia) Backport patch to fix CVE-2026-15028. References: https://nvd.nist.gov/vuln/detail/CVE-2026-15028 The link in NVD is wrong. Based on project own pull request: https://github.com/libarchive/libarchive/pull/3252 Fixing commit is the below one: https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2 Signed-off-by: Jakub Szczudlo Signed-off-by: Yoann Congal --- .../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++ .../libarchive/libarchive_3.7.9.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch new file mode 100644 index 00000000000..c63fcf22f20 --- /dev/null +++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch @@ -0,0 +1,41 @@ +From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001 +From: datauwu +Date: Mon, 6 Jul 2026 21:51:15 +0800 +Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing + +header_pax_extension() passes PAX attribute values without the trailing +newline to pax_attribute(). The SUN.holesdata parser read one byte past +the supplied value when the last numeric field ended at the value +boundary. + +Handle length == 0 before checking *e. + +CVE: CVE-2026-15028 +Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2] +Signed-off-by: Jakub Szczudlo +--- + libarchive/archive_read_support_format_tar.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c +index e07cfdb63b..1c0441db6c 100644 +--- a/libarchive/archive_read_support_format_tar.c ++++ b/libarchive/archive_read_support_format_tar.c +@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar, + return (ARCHIVE_FATAL); + tar->sparse_last->hole = hole; + } +- if (length == 0 || *e == '\n') { +- if (length == 0 && *e == '\n') { +- return (ARCHIVE_OK); +- } else { +- return (ARCHIVE_WARN); +- } +- } ++ if (length == 0) ++ return (ARCHIVE_OK); ++ if (*e == '\n') ++ return (ARCHIVE_WARN); + p = e + 1; + length--; + hole = hole == 0; diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb index 2eb22e2d61a..3719965eed9 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb @@ -51,6 +51,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ file://CVE-2026-4424-2.patch \ file://CVE-2026-5121-02.patch \ file://CVE-2026-5745.patch \ + file://CVE-2026-15028.patch \ " UPSTREAM_CHECK_URI = "http://libarchive.org/" From patchwork Sat Oct 31 00:15:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102570 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3760.1793405774769881705 for ; Fri, 30 Oct 2026 17:16:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=Q2THjRvq; spf=pass (domain: smile.fr, ip: 209.85.128.47, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so12081735e9.1 for ; Fri, 30 Oct 2026 17:16:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405773; x=1794010573; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=uhlDmis/O4qUPvn112/iokSs+AELTRugTqDd+bFsGDc=; b=Q2THjRvq9u/ijObP5Qb4i0vu3wdX5+Y4b0VdTRM7ASZsj1MEuq9mlAv6ZpX9Y0hNDL jxEzTBuYCAnZp1uFDtTlFZi2w6/JgUIm3QnHs7jw431qqbBbtDbFe+WQCixc+xsjZwzb mxNjhGVnKM8K1NVYmozK2kl8tzZfFmrMeCPmCG4eGfGBrSYKJ3RavdIA6k8KKjfdXZGf uIVP0fWJiIN+djxAPYBcPsQOM6j+xJItuSdt18yInHTnAo9uwbba9Gl+y2zLRv/ifOw8 SzQdIxq61xpeu7SsUGQUdbmITpGnGfRyBE2q3Si8wgoAH616jUaaFC5CZwr1JcPrcGgr YHwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405773; x=1794010573; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=uhlDmis/O4qUPvn112/iokSs+AELTRugTqDd+bFsGDc=; b=hxiPQDpfPIgHwxc4C8XMci4i70/5tgUc9HhbbmOLsOF5WhzyGXM8vez6EduKujodco z3DLvsXxCkWcEbnH4Gb3x6Es2Yibo9MI2vC3RHyCMkozaFlnJFWVbdkUyhZeRV3ZeD4c MuNRnZ3ci6RQV6tk6Qkynm5tfJycYdtCbhLLdsJ/gKnvOi7Yoxd2U4PjK4p9CVgctDJG Tv/DkNPNYwFRelw4opJ/cFE4NDPQWPQqoO4CAbTmhWwme+Us8SoNTypGS0SRX7hrwuwi QbwMELizfgrEkWixkdXUazCwqlOYXoy1R42PqF4DugQEcUcGQozJdINL9yjpgwF4mBws mnNQ== X-Gm-Message-State: AFq9FYIe8eIVmB8YQW3ESdOgHtC8WmMBHKodsaOOqtMpFZxC3SlkodyQ 4GISwiNWPGLLgAgvgTJyOjo/rrUcD9fC3Ls+Of3IC1bgCayJXWhFQaY0UQhtzj+pF+WKIKacx/K /S1xjr9w= X-Gm-Gg: AYBFou08KTvw+j5sSHjoA2y/4u0WBqXKmI/UiVzPi7VsV5XTf/YUYEQuIe5CHvielk/ uwt3gI62oQVdCOPNZcYVRlNT7hADyvFgRAUXGhjyh+FziKokFjnPCuZLCM/8kTcFbLWr6CX/V24 IuJOqCuQjw7kiGo5rrBODh1qV3is8fbRlu2zt9/HvWjSWilK5uebppqxLyADc0YHlSkyKm1Tdlz Lwdk1fRq76cz4IDptRM5BSVaMC1EUn53DKCunwL0pmkAoU5cPx5SJ2xm8B62+tdip8WY/reJbjO mYYShIyNVSWW9WC3cksBA9A7wNq0J2h95njyHWa+74ykbB0QIF11ZE+PPKoh0RUIEI67w9c/1on 5lgvDfaba6pSXMtPJhTX10rNYsaL8uiKIqyQylCO6W9kbeLz1/XDZB3k1RoI8XQT+WLvYFg5mF8 afk9JNDMsibs+UCzkdZgPv/JQhzaoMKZCL+sHtZQ6ujqVpiuAx5Il7weySewJ+CUmAMsBQQPGrg +KYLjs45OfyeNTo3UXH/bi48YmJARl4st8C9wS0QS87hihZ2Op8YIcfQfTCWcVc7MbUAYT82eYV Xva3WzTWY6wH1F1wkisv/fMLNMnO2L5IXhNy/TX7o940aCqizEvdkFlDdnhxHKdqiJ4ld5Jn0M2 eGnX2ntkTWG2iPu0RM7jeweHvLSh9 X-Received: by 2002:a05:600c:34cf:b0:4a7:c366:d791 with SMTP id 5b1f17b1804b1-4ac150b38ebmr89289585e9.1.1793405773075; Fri, 30 Oct 2026 17:16:13 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:12 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 49/55] systemd: try AT_EMPTY_PATH for access_fd() first Date: Sat, 31 Oct 2026 01:15:10 +0100 Message-ID: <2f8965687dd3eaf7ab53e1381b3221c16cd54370.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249123 From: Suresh H A Backport a fix to try AT_EMPTY_PATH which changes access_fd() to use faccessat(..., AT_EMPTY_PATH) instead of validating access through /proc/self/fd/. This fixes a reproducible race during service startup. On Linux 6.6 / systemd 255 (Scarthgap) based platform, affected services may fail to start when systemd-remount-fs.service runs concurrently and remounts procfs. In this window, access_fd() can fail with -ESRCH while resolving /proc/self/fd/, causing systemd to report that the executable cannot be located. The upstream implementation performs the access check directly on the file descriptor, avoiding dependence on procfs path resolution and eliminating the observed race. Signed-off-by: Suresh H A Signed-off-by: Yoann Congal [YC: More details available at: https://lore.kernel.org/all/MAXP287MB42404C1A7233A3D773FFA7DFEE802@MAXP287MB4240.INDP287.PROD.OUTLOOK.COM/ ] --- ...ry-AT_EMPTY_PATH-for-access_fd-first.patch | 34 +++++++++++++++++++ meta/recipes-core/systemd/systemd_255.22.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch diff --git a/meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch b/meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch new file mode 100644 index 00000000000..268ace04c46 --- /dev/null +++ b/meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch @@ -0,0 +1,34 @@ +From 228d4c63102367a757ba4f31c49a148975607a72 Mon Sep 17 00:00:00 2001 +From: Mike Yuan +Date: Mon, 20 May 2024 19:33:26 +0800 +Subject: [PATCH] fs-util: try AT_EMPTY_PATH for access_fd() first + +Upstream-Status: Backport [https://github.com/systemd/systemd/pull/32933/commits/c675851d5fd503c1ae5d244f041d43ae9e3ab79b] + +Signed-off-by: Suresh H A +--- + src/basic/fs-util.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c +index 5bc7d2f..3a7ebd2 100644 +--- a/src/basic/fs-util.c ++++ b/src/basic/fs-util.c +@@ -668,6 +668,14 @@ int unlink_or_warn(const char *filename) { + int access_fd(int fd, int mode) { + /* Like access() but operates on an already open fd */ + ++ if (faccessat(fd, "", mode, AT_EMPTY_PATH) >= 0) ++ return 0; ++ if (errno != EINVAL) ++ return -errno; ++ ++ /* Support for AT_EMPTY_PATH is added rather late (kernel 5.8), so fall back to going through /proc/ ++ * if unavailable. */ ++ + if (access(FORMAT_PROC_FD_PATH(fd), mode) < 0) { + if (errno != ENOENT) + return -errno; +-- +2.43.0 + diff --git a/meta/recipes-core/systemd/systemd_255.22.bb b/meta/recipes-core/systemd/systemd_255.22.bb index 84d41a86c9b..1bdeb551fd8 100644 --- a/meta/recipes-core/systemd/systemd_255.22.bb +++ b/meta/recipes-core/systemd/systemd_255.22.bb @@ -39,6 +39,7 @@ SRC_URI += " \ file://CVE-2026-29111-04.patch \ file://CVE-2026-4105.patch \ file://0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch \ + file://0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch \ " # patches needed by musl From patchwork Sat Oct 31 00:15:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102572 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3762.1793405775448406832 for ; Fri, 30 Oct 2026 17:16:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=KNfwnl/p; spf=pass (domain: smile.fr, ip: 209.85.128.45, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-4a218c463d1so7693505e9.0 for ; Fri, 30 Oct 2026 17:16:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405774; x=1794010574; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=zRHOYxOg8o2IDt5Nz0V6ZLVwAPiea76O64kbuoX2u+I=; b=KNfwnl/pskJpiZi+s7Nx4Uwx/OjHVXRxDCktTNdDDMuagQEaB/3sTIYetXx+be5SWH i0wX08l8h9bussoPH81Gsm1/9Vw9Eeq+/6M5hI9ZrgS4qyjeR5jz9SjkOhwDM3Y6nQbW 0emdZha72QjE9IQMAb2LVjF8xy6qklW6YppVyy3roH/9VHZ62ne7ggUzx4NR/G/vNBLN 5g+UAZn1XybrVcomGbngkrkQlHWo+ZbY0PYZwgqQ+nU3EOqSiDEPplwZQigadTJKo6W+ CAwtQE+y+WvwMNmLK0w4gJnxje1srvVbzHNmZFd0Yw9wS1RH4jfEpRjMwKYCDerwZTH3 DSXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405774; x=1794010574; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=zRHOYxOg8o2IDt5Nz0V6ZLVwAPiea76O64kbuoX2u+I=; b=wF/s0b2vq96unVHeLpFON63dm2ea+cjmQShvDgCbCv8v/ojdPvcpigyZAivbEx2TgQ CMaJwwLnJjHSTCWNvf2cl3odEuF+tBpDOWBsYammONEDJJyAl1hCfI4fywUQgdFLcqIT uNJMBugd1IWIkHIJbUQl/mZQe66K4MsJith/62vk7xv41uyFl2o7PRFu3HLD+KLRxJTJ 6Moqq6ffNLKTwA/BI40YvdpVeB1Vz+tsnR9+LPviu23+libuuT04J3qAsIbE/QX1Ij6J E4LmjtgNjzOIqePagv/B+MChH5j+704t6vACOGIY3jiOHr1u3J7uaM3uu4UI46m8s2M0 YkYQ== X-Gm-Message-State: AFq9FYKH/azhIRy3wf98uMCca+lcNac+5LvSNBCrFZnQQnPFalwjbrat QPOxpw9VAGPWEsqWd+L6Lx5fZQsF//M/6lhAXhgX8Qcf64JbkKHoudM2wSdk+1QJM5xjq99Hdby RBREYMLA= X-Gm-Gg: AYBFou3voAL9GMHoElFoz4Oq80O+VHeDwv2W9mJda2IK3WyEzpBW250Yv7zWoPgQoPs VMfs5kwiAJ4InZsqVNsRg7mdvZ6msf3oIVgMlFjEsj9azzkqqP9mNDhS7BKpVxD1atIpOcGvWXR iEoMhJXPkptUphNiqpNTBMNYu2+8nuCXTt//X9ZhDulvjuElAUe1PwVHNg99stRPwR/Lj6mtm33 ko5aXKRDJXa6o6JlZIqCrWTZBO3kG0EuEWHBG2AiljFg94f46JujBVb3jyjXKogniezB/1YGrQJ dQbuM+fBiVZ+05ihavwVytqlx1cAL7Gnp+8da//WFXCKZzHkA1y2scuTdGZSc+TU/i100MfAz2w 2F+YAjpR9q5zFLyG3bg6A0hBSoVSzZNrp0lqso/hsqpzdQDUKNyxsH/C8g2OaJ3k+7J+WHoqZOs MPGv/xJOTprtDuHElX+BqZEBi4z6P6cqvnBxn99U59TLKTVAefPm80qGH0aB25Xq4dIYceXZhfp 8v0ZFZHuOD2Gd7Tp750x/S8/vNK4FGJyFfhcaODbfLIFWQKVQrwrHaasSc843Uc7uWAsP421WR6 T8Kxyxbzk9Utxl22Gc6G5oxTXK2672eDesWZh70Q09MjJRo91njq8MEaIM5imef/CrIyu6TylOp 7wLIvQKJ+QgVX/dUN51ysfytJpdGA+p+st91fibgOocekbND0f/A= X-Received: by 2002:a05:600c:a4e:b0:4a7:76fa:87e9 with SMTP id 5b1f17b1804b1-4ac187a766bmr87864305e9.21.1793405773598; Fri, 30 Oct 2026 17:16:13 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:13 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 50/55] apr-util: Fix CVE-2025-49506 Date: Sat, 31 Oct 2026 01:15:11 +0100 Message-ID: <9da45770bb3a2b541b61f44e370ba20f415fb6c8.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249124 From: Hetvi Thakar Backport the upstream timing-safe comparison fix [1]. APR-util 1.6.4 identifies this issue as fixed [2]. [1] https://github.com/apache/apr-util/commit/f77a20761cb15686f8d4de5b5eafc534ae24b19e [2] https://nvd.nist.gov/vuln/detail/CVE-2025-49506 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../apr/apr-util/CVE-2025-49506.patch | 310 ++++++++++++++++++ meta/recipes-support/apr/apr-util_1.6.3.bb | 1 + 2 files changed, 311 insertions(+) create mode 100644 meta/recipes-support/apr/apr-util/CVE-2025-49506.patch diff --git a/meta/recipes-support/apr/apr-util/CVE-2025-49506.patch b/meta/recipes-support/apr/apr-util/CVE-2025-49506.patch new file mode 100644 index 00000000000..0ab5cf06485 --- /dev/null +++ b/meta/recipes-support/apr/apr-util/CVE-2025-49506.patch @@ -0,0 +1,310 @@ +From f77a20761cb15686f8d4de5b5eafc534ae24b19e Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 3 Aug 2026 12:10:13 +0000 +Subject: [PATCH] Merge r1936804 from aprutil 1.7.x: + +use timing safe comparison + +Submitted By: ylavic +Reviewed By: ylavic, rpluem, covener + + + + +git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936805 13f79535-47bb-0310-9956-ffa450edef68 + +CVE: CVE-2025-49506 +Upstream-Status: Backport [https://github.com/apache/apr-util/commit/f77a20761cb15686f8d4de5b5eafc534ae24b19e] + +(cherry picked from commit f77a20761cb15686f8d4de5b5eafc534ae24b19e) +Signed-off-by: Hetvi Thakar +--- + crypto/apr_crypto.c | 60 +++++++++++++++++--- + crypto/apr_passwd.c | 135 ++++++++++++++++++++++++++++++++++++++++---- + 2 files changed, 176 insertions(+), 19 deletions(-) + +diff --git a/crypto/apr_crypto.c b/crypto/apr_crypto.c +index 9ba190ef..ca3f0887 100644 +--- a/crypto/apr_crypto.c ++++ b/crypto/apr_crypto.c +@@ -21,6 +21,7 @@ + #include "apu.h" + #include "apr_pools.h" + #include "apr_dso.h" ++#include "apr_version.h" + #include "apr_strings.h" + #include "apr_hash.h" + #include "apr_thread_mutex.h" +@@ -173,19 +174,64 @@ APU_DECLARE(apr_status_t) apr_crypto_memzero(void *buffer, apr_size_t size) + return APR_SUCCESS; + } + ++/* Borrow this from APR-1.8 if not available */ ++#if !APR_VERSION_AT_LEAST(1,8,0) ++ ++/* A volatile variable which is always zero but allows to block the compiler ++ * from optimizing or eliding code using it. Volatile forces the compiler to ++ * emit a memory load for which no value can be assumed, so for instance an ++ * add/sub/xor/or with "optblocker" is a noop that will hide the result to ++ * the optimizer. ++ */ ++static volatile const apr_uint32_t optblocker; ++ ++/* Return whether x is not zero, with no branching controlled by x. ++ * ++ * Taken from the cryptoint library (public domain) by D. J. Bernstein, ++ * which provides timing attacks safe integer operations/primitives. ++ * Code: ++ * https://lib.mceliece.org/libmceliece-20250507/cryptoint/crypto_uint32.h ++ * Paper: ++ * https://cr.yp.to/papers/cryptoint-20250424.pdf ++ */ ++#if __has_attribute(always_inline) ++__attribute__((always_inline)) ++#endif ++static APR_INLINE int test_nonzero_timingsafe(apr_uint32_t x) ++{ ++ x |= -x; /* sets the most significant bit unless x == 0 */ ++ ++ /* shift bit 31 (MSB) to bit 0 */ ++ x >>= 32-6; /* keep 6 bits */ ++ x += optblocker; /* lose the optimizer */ ++ x >>= 5; /* keep the (original) MSB only */ ++ ++ /* x is now 0 or 1 */ ++ return x & INT_MAX; ++} ++ ++#endif /* !APR_VERSION_AT_LEAST(1,8,0) */ ++ + APU_DECLARE(int) apr_crypto_equals(const void *buf1, const void *buf2, + apr_size_t size) + { +- const unsigned char *p1 = buf1; +- const unsigned char *p2 = buf2; +- unsigned char diff = 0; +- apr_size_t i; ++#if APR_VERSION_AT_LEAST(1,8,0) ++ return apr_memeq_timingsafe(buf1, buf2, size); ++#else ++ apr_uint32_t diff = 0; ++ volatile apr_size_t count = size; /* prevent loop unrolling */ ++ apr_size_t i = 0; + +- for (i = 0; i < size; ++i) { +- diff |= p1[i] ^ p2[i]; ++ for (; i < count; ++i) { ++ const unsigned char c1 = ((volatile const unsigned char *)buf1)[i]; ++ const unsigned char c2 = ((volatile const unsigned char *)buf2)[i]; ++ ++ diff |= c1 ^ c2; /* sets diff to non-zero whenever c1 != c2 */ + } + +- return 1 & ((diff - 1) >> 8); ++ /* (diff == 0) <=> (diff != 0) ^ 1 */ ++ return test_nonzero_timingsafe(diff) ^ 1; ++#endif + } + + APU_DECLARE(apr_status_t) apr_crypto_get_driver( +diff --git a/crypto/apr_passwd.c b/crypto/apr_passwd.c +index c961de2b..74b5fc17 100644 +--- a/crypto/apr_passwd.c ++++ b/crypto/apr_passwd.c +@@ -14,6 +14,7 @@ + * limitations under the License. + */ + ++#include "apr_version.h" + #include "apr_strings.h" + #include "apr_md5.h" + #include "apr_lib.h" +@@ -39,6 +40,111 @@ + + static const char * const apr1_id = "$apr1$"; + ++#if APR_VERSION_AT_LEAST(1,8,0) ++ ++#define streq_timingsafe apr_streq_timingsafe ++#define strneq_timingsafe apr_strneq_timingsafe ++ ++#else /* borrow code from APR-1.8 if not available */ ++ ++/* A volatile variable which is always zero but allows to block the compiler ++ * from optimizing or eliding code using it. Volatile forces the compiler to ++ * emit a memory load for which no value can be assumed, so for instance an ++ * add/sub/xor/or with "optblocker" is a noop that will hide the result to ++ * the optimizer. ++ */ ++static volatile const apr_uint32_t optblocker; ++ ++/* Return whether x is not zero, with no branching controlled by x. ++ * ++ * Taken from the cryptoint library (public domain) by D. J. Bernstein, ++ * which provides timing attacks safe integer operations/primitives. ++ * Code: ++ * https://lib.mceliece.org/libmceliece-20250507/cryptoint/crypto_uint32.h ++ * Paper: ++ * https://cr.yp.to/papers/cryptoint-20250424.pdf ++ */ ++#if __has_attribute(always_inline) ++__attribute__((always_inline)) ++#endif ++static APR_INLINE int test_nonzero_timingsafe(apr_uint32_t x) ++{ ++ x |= -x; /* sets the most significant bit unless x == 0 */ ++ ++ /* shift bit 31 (MSB) to bit 0 */ ++ x >>= 32-6; /* keep 6 bits */ ++ x += optblocker; /* lose the optimizer */ ++ x >>= 5; /* keep the (original) MSB only */ ++ ++ /* x is now 0 or 1 */ ++ return x & INT_MAX; ++} ++ ++static int streq_timingsafe(const char *sec1, const char *str2) ++{ ++ apr_uint32_t diff = 0; ++ apr_size_t i1 = 0, i2 = 0; ++ ++ for (;; ++i2) { ++ const unsigned char c1 = ((volatile const unsigned char *)sec1)[i1]; ++ const unsigned char c2 = ((volatile const unsigned char *)str2)[i2]; ++ ++ diff |= c1 ^ c2; /* sets diff to non-zero whenever c1 != c2 */ ++ ++ /* Not a shortest/longest match because an attacker would usually know ++ * one of the strings and could then determine the length of the other. ++ * So assume only sec1 and its length are secret and stop the loop at ++ * the end of str2. If sec1 is shorter than str2 the loop will continue ++ * by comparing the rest of str2 with the trailing NUL byte of sec1. ++ * In any case since the diff above is computed up to and including a ++ * NUL byte, only the same content and length will raise match. ++ */ ++ if (!c2) { ++ break; ++ } ++ ++ /* Don't go above sec1's NUL byte */ ++ i1 += test_nonzero_timingsafe(c1); ++ } ++ ++ /* (diff == 0) <=> (diff != 0) ^ 1 */ ++ return test_nonzero_timingsafe(diff) ^ 1; ++} ++ ++static int strneq_timingsafe(const char *sec1, const char *str2, apr_size_t n) ++{ ++ apr_uint32_t diff = 0; ++ volatile apr_size_t count = n; /* prevent loop unrolling */ ++ apr_size_t i1 = 0, i2 = 0; ++ ++ for (; i2 < count; ++i2) { ++ const unsigned char c1 = ((volatile const unsigned char *)sec1)[i1]; ++ const unsigned char c2 = ((volatile const unsigned char *)str2)[i2]; ++ ++ diff |= c1 ^ c2; /* sets diff to non-zero whenever c1 != c2 */ ++ ++ /* Not a shortest/longest match because an attacker would usually know ++ * one of the strings and could then determine the length of the other. ++ * So assume only sec1 and its length are secret and stop the loop at ++ * the end of str2. If sec1 is shorter than str2 the loop will continue ++ * by comparing the rest of str2 with the trailing NUL byte of sec1. ++ * In any case since the diff above is computed up to and including a ++ * NUL byte, only the same content and length will raise match. ++ */ ++ if (!c2) { ++ break; ++ } ++ ++ /* Don't go above sec1's NUL byte */ ++ i1 += test_nonzero_timingsafe(c1); ++ } ++ ++ /* (diff == 0) <=> (diff != 0) ^ 1 */ ++ return test_nonzero_timingsafe(diff) ^ 1; ++} ++ ++#endif /* APR_VERSION_AT_LEAST(1,8,0) */ ++ + #if !defined(WIN32) && !defined(BEOS) && !defined(NETWARE) + #if defined(APU_CRYPT_THREADSAFE) || !APR_HAS_THREADS || \ + defined(CRYPT_R_CRYPTD) || defined(CRYPT_R_STRUCT_CRYPT_DATA) +@@ -86,28 +192,33 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd, + #if !CRYPT_MISSING + char *crypt_pw; + #endif +- if (hash[0] == '$' +- && hash[1] == '2' +- && (hash[2] == 'a' || hash[2] == 'y') +- && hash[3] == '$') { ++ ++ if ((strneq_timingsafe(hash, "$2a$", 4) | /* test both */ ++ strneq_timingsafe(hash, "$2y$", 4))) { ++ /* ++ * The hash was created using [apr_]bcrypt encoding. ++ */ + if (_crypt_blowfish_rn(passwd, hash, sample, sizeof(sample)) == NULL) + return APR_FROM_OS_ERROR(errno); + } +- else if (!strncmp(hash, apr1_id, strlen(apr1_id))) { ++ else if (strneq_timingsafe(hash, apr1_id, strlen(apr1_id))) { + /* + * The hash was created using our custom algorithm. + */ + apr_md5_encode(passwd, hash, sample, sizeof(sample)); + } +- else if (!strncmp(hash, APR_SHA1PW_ID, APR_SHA1PW_IDLEN)) { +- apr_sha1_base64(passwd, (int)strlen(passwd), sample); ++ else if (strneq_timingsafe(hash, APR_SHA1PW_ID, APR_SHA1PW_IDLEN)) { ++ /* ++ * The hash is a (naked) SHA1. ++ */ ++ apr_sha1_base64(passwd, (int)strlen(passwd), sample); + } + else { + /* + * It's not our algorithm, so feed it to crypt() if possible. + */ + #if CRYPT_MISSING +- return (strcmp(passwd, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH; ++ return streq_timingsafe(hash, passwd) ? APR_SUCCESS : APR_EMISMATCH; + #elif defined(CRYPT_R_CRYPTD) + apr_status_t rv; + CRYPTD *buffer = malloc(sizeof(*buffer)); +@@ -118,7 +229,7 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd, + if (!crypt_pw) + rv = APR_EMISMATCH; + else +- rv = (strcmp(crypt_pw, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH; ++ rv = streq_timingsafe(hash, crypt_pw) ? APR_SUCCESS : APR_EMISMATCH; + free(buffer); + return rv; + #elif defined(CRYPT_R_STRUCT_CRYPT_DATA) +@@ -149,7 +260,7 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd, + if (!crypt_pw) + rv = APR_EMISMATCH; + else +- rv = (strcmp(crypt_pw, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH; ++ rv = streq_timingsafe(hash, crypt_pw) ? APR_SUCCESS : APR_EMISMATCH; + free(buffer); + return rv; + #else +@@ -173,14 +284,14 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd, + rv = APR_EMISMATCH; + } + else { +- rv = (strcmp(crypt_pw, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH; ++ rv = streq_timingsafe(hash, crypt_pw) ? APR_SUCCESS : APR_EMISMATCH; + } + crypt_mutex_unlock(); + return rv; + } + #endif + } +- return (strcmp(sample, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH; ++ return streq_timingsafe(hash, sample) ? APR_SUCCESS : APR_EMISMATCH; + } + + static const char * const bcrypt_id = "$2y$"; diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb index 3a5f52d2501..7b5a04c4350 100644 --- a/meta/recipes-support/apr/apr-util_1.6.3.bb +++ b/meta/recipes-support/apr/apr-util_1.6.3.bb @@ -13,6 +13,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \ file://configfix.patch \ file://configure_fixes.patch \ file://0001-test_transformation-Check-if-transform-is-supported-.patch \ + file://CVE-2025-49506.patch \ file://run-ptest \ " From patchwork Sat Oct 31 00:15:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102566 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3763.1793405775906644148 for ; Fri, 30 Oct 2026 17:16:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=RCOr0mEw; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a2d6cf958bso6350635e9.1 for ; Fri, 30 Oct 2026 17:16:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405774; x=1794010574; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=oSuRNpCkLciRTiAnT1te9553WS6fCMULCLntkdxyba0=; b=RCOr0mEwGIaQ4inpv8fjBxi+vHOPAQFqbw0awJCcIRzzal6haqPIk2O6Si5MqtNhzS GjezR4kQE9LkyRiKyOCfwG+fe9UDIwqr/evbNuQk98JGQEh+Fq6+aNVsJVL90SjgXjUl bX93TOYWNvfc0VT7M3J3cvR0Ev/8FmgvKGWycuMLDtvWzMANJZT2S3NL2QFT633XRb3f iLCm9wgCn929E15LCR0pGYVJ/n588WPa3rY3tqBevvI0SJhE+BZ/IOMro86B5O5hmZwn tojdjWU4NxdrM26VkSUMLRl6ufDm7IUD4PQrqByxbSrWc5M9S1qQW+9HLen0CT/oWBjj wyjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405774; x=1794010574; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=oSuRNpCkLciRTiAnT1te9553WS6fCMULCLntkdxyba0=; b=oTrMkZckHevXEk8yVLUFQVO4tvQ1EhTbyNqB/svSlWgFkJWdaM34a67mqOS1yz+rE+ b/vw+qVYWYV8KcXslRgjA1jIskAvNa4QWyVkfXypiyQ/kswZ8oJypeMvyQbvYRtumscM SHf8MNvlnyQfDpTTrf0xDA2BYF3YrTibxYu/kXrmTa0MCUPRJgGrU5Qk371vvFqQT1Yw Bq84RUZ62tmnymFYdJaYHvS9c3vcSggrKT+QZH6DU86C+X2ZhkWAADmFIoSseteFCDet si8aZHSOQmson+wONq+TB2w5VrjS0rlRC/oToAIE7oM7XhF+qYIOooSEntQqlRhgcGxd EJKQ== X-Gm-Message-State: AFq9FYInJ2eabv79jEg4oFuvAUHo2vD5h95waBdPUb851K//03fYSZwt tA+ltS6+r53di2CKYTPLeSY+15dgJJGSnn4FmdHrp7DsjCzqQFmROXOVdEA6BYwe/TQccHomsV0 bok/mdQs= X-Gm-Gg: AYBFou2BQrVWtE0xaBx8sQORLcDvrsl3Po5eOOyqxMYBtR7Dv7CxlNw9JXDrmmV87ku gGYpY7xmPNgZBYGAmLaYGgc3M73EnE7+jOMGk5EhHQbETVc5kih5fIJrq0Ja/kZ1igjX63P+w6o +LV4qlpi4OCW7C1DjUab5pR1hDvd4fc09S52H5jhyry9XHcwGYu69LaSUj7uiPCAKyZGreRxS9o 4WJVC4YMFLezpegeZMONCNBzlLMu7Iq3yQUTwijgP94Vw4JjIycjMdEp9nCHdVU+y6Fs3ktMbiR m/Bostrc5KYNiVfn7qnOhDyHcTPIevxSPp8BQxDlkcvZ9xs09bVX6aajsucaYFrchoiEDGFonja BRYccf+CoLeg/WDASbPSSIKLuzHs5egxW9NEbG7ia3nCofwuRXeLXijzrF3e03vpeLuBRr91IIK c2tYpS8RBMcIhZN+51Op5a3g1r92gihQZtmiLQidyCPcD6RALe3Hg9bwPMuaed+fpVoPzvORjmv +s9bXadgQYMbraiz+9SMCxfOszWTYaVon7UoVP61VTAn//+/VQoUP0rEFgs6QiLeAxpmfpO0/ra XBCWe8kIg2qoOpghsEaqzytXwZr3FmCSQIHRLINXFHBWPigEI9E2RWAjRDc5fchvEeCQApAeAEi gAoKWEJdJUB4iUG+qx/NL+elecAJx X-Received: by 2002:a05:600c:a012:b0:49f:fd2d:23c7 with SMTP id 5b1f17b1804b1-4ac17b2ce18mr81998845e9.27.1793405774161; Fri, 30 Oct 2026 17:16:14 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:13 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 51/55] apr-util: Fix CVE-2026-32327 Date: Sat, 31 Oct 2026 01:15:12 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249126 From: Hetvi Thakar Backport the upstream test compatibility prerequisite [1], which is required by the regression tests included with the XML nesting-depth fix [2]. The fix addresses CVE-2026-32327 as described by the advisory [3]. [1] https://github.com/apache/apr-util/commit/dba5d434dba0547478f411d6fa068766455446ce [2] https://github.com/apache/apr-util/commit/414e12e427c89f135d8ee66ab1203feffd3e2bd8 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-32327 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../apr-util/CVE-2026-32327-dependent.patch | 34 + .../apr/apr-util/CVE-2026-32327.patch | 2162 +++++++++++++++++ meta/recipes-support/apr/apr-util_1.6.3.bb | 2 + 3 files changed, 2198 insertions(+) create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-32327.patch diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch b/meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch new file mode 100644 index 00000000000..c3c570f4070 --- /dev/null +++ b/meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch @@ -0,0 +1,34 @@ +From dba5d434dba0547478f411d6fa068766455446ce Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Tue, 19 Dec 2023 11:20:33 +0000 +Subject: [PATCH] Merge r1914772 from 1.7.x: + +* test/testutil.h: Define APR_ASSERT_SUCCESS for compatibility + with apr trunk. + + + +git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1914774 13f79535-47bb-0310-9956-ffa450edef68 + +CVE: CVE-2026-32327 +Upstream-Status: Backport [https://github.com/apache/apr-util/commit/dba5d434dba0547478f411d6fa068766455446ce] + +(cherry picked from commit dba5d434dba0547478f411d6fa068766455446ce) +Signed-off-by: Hetvi Thakar +--- + test/testutil.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/test/testutil.h b/test/testutil.h +index eaa7e759..4c5e30b8 100644 +--- a/test/testutil.h ++++ b/test/testutil.h +@@ -40,6 +40,8 @@ extern apr_pool_t *p; + /* Assert that RV is an APR_SUCCESS value; else fail giving strerror + * for RV and CONTEXT message. */ + void apr_assert_success(abts_case* tc, const char *context, apr_status_t rv); ++#define APR_ASSERT_SUCCESS(tc, ctxt, rv) \ ++ apr_assert_success(tc, ctxt, rv) + + void apr_assert_failure(abts_case* tc, const char *context, + apr_status_t rv, int lineno); diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-32327.patch b/meta/recipes-support/apr/apr-util/CVE-2026-32327.patch new file mode 100644 index 00000000000..a0c4004709c --- /dev/null +++ b/meta/recipes-support/apr/apr-util/CVE-2026-32327.patch @@ -0,0 +1,2162 @@ +From 414e12e427c89f135d8ee66ab1203feffd3e2bd8 Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Mon, 3 Aug 2026 12:34:32 +0000 +Subject: [PATCH] Merge r1936807 from 1.7.x: + +limit XML processing depth + +Submitted By: jorton +Reviewed By: jorton, jfclere, ivan + + +git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936815 13f79535-47bb-0310-9956-ffa450edef68 + +CVE: CVE-2026-32327 +Upstream-Status: Backport [https://github.com/apache/apr-util/commit/414e12e427c89f135d8ee66ab1203feffd3e2bd8] + +(cherry picked from commit 414e12e427c89f135d8ee66ab1203feffd3e2bd8) +Signed-off-by: Hetvi Thakar +--- + CMakeLists.txt | 3 + + test/data/nesting.xml | 2001 +++++++++++++++++++++++++++++++++++++++++ + test/testxml.c | 32 + + xml/apr_xml.c | 21 +- + 4 files changed, 2056 insertions(+), 1 deletion(-) + create mode 100644 test/data/nesting.xml + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index fcbfc582..65b9194d 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -288,6 +288,9 @@ IF(APR_BUILD_TESTAPR) + EXECUTE_PROCESS(COMMAND ${CMAKE_COMMAND} -E copy_if_different + ${PROJECT_SOURCE_DIR}/test/data/billion-laughs.xml + ${PROJECT_BINARY_DIR}/data/billion-laughs.xml) ++ EXECUTE_PROCESS(COMMAND ${CMAKE_COMMAND} -E copy_if_different ++ ${PROJECT_SOURCE_DIR}/test/data/nesting.xml ++ ${PROJECT_BINARY_DIR}/data/nesting.xml) + + IF(TEST_STATIC_LIBS) + SET(whichapr aprutil-1) +diff --git a/test/data/nesting.xml b/test/data/nesting.xml +new file mode 100644 +index 00000000..a4efda86 +--- /dev/null ++++ b/test/data/nesting.xml +@@ -0,0 +1,2001 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/test/testxml.c b/test/testxml.c +index eed10672..5284f888 100644 +--- a/test/testxml.c ++++ b/test/testxml.c +@@ -20,6 +20,10 @@ + #include "abts.h" + #include "testutil.h" + ++#ifndef APR_XML_MAX_DEPTH ++#define APR_XML_MAX_DEPTH 256 ++#endif ++ + static apr_status_t create_dummy_file_error(abts_case *tc, apr_pool_t *p, + apr_file_t **fd) + { +@@ -166,6 +170,33 @@ static void test_billion_laughs(abts_case *tc, void *data) + apr_file_close(fd); + } + ++static void test_nesting_limit(abts_case *tc, void *data) ++{ ++ apr_file_t *fd; ++ apr_xml_parser *parser = NULL; ++ apr_xml_doc *doc; ++ apr_status_t rv; ++ char errbuf[256], *err; ++ ++ rv = apr_file_open(&fd, "data/nesting.xml", ++ APR_FOPEN_READ, 0, p); ++ APR_ASSERT_SUCCESS(tc, "open nesting.xml", rv); ++ ++ rv = apr_xml_parse_file(p, &parser, &doc, fd, 2000); ++ ABTS_TRUE(tc, rv != APR_SUCCESS); ++ ++ if (parser) { ++ err = apr_xml_parser_geterror(parser, errbuf, sizeof errbuf); ++ ABTS_STR_EQUAL(tc, ++ "The maximum element nesting limit " ++ "(" APR_STRINGIFY(APR_XML_MAX_DEPTH) ")" ++ " was exceeded.", ++ err); ++ } ++ ++ apr_file_close(fd); ++} ++ + static void test_CVE_2009_3720_alpha(abts_case *tc, void *data) + { + apr_xml_parser *xp; +@@ -198,6 +229,7 @@ abts_suite *testxml(abts_suite *suite) + + abts_run_test(suite, test_xml_parser, NULL); + abts_run_test(suite, test_billion_laughs, NULL); ++ abts_run_test(suite, test_nesting_limit, NULL); + abts_run_test(suite, test_CVE_2009_3720_alpha, NULL); + abts_run_test(suite, test_CVE_2009_3720_beta, NULL); + +diff --git a/xml/apr_xml.c b/xml/apr_xml.c +index 2685a9a5..a2535f98 100644 +--- a/xml/apr_xml.c ++++ b/xml/apr_xml.c +@@ -61,12 +61,19 @@ struct apr_xml_parser { + int error; /* an error has occurred */ + #define APR_XML_ERROR_EXPAT 1 + #define APR_XML_ERROR_PARSE_DONE 2 +-/* also: public APR_XML_NS_ERROR_* values (if any) */ ++#define APR_XML_ERROR_DEPTH_LIMIT 3 + ++/* also: public APR_XML_NS_ERROR_* values (if any) */ ++ /** depth of element tree. */ ++ unsigned int depth; + XML_Parser xp; /* the actual (Expat) XML parser */ + enum XML_Error xp_err; /* stored Expat error code */ + }; + ++#ifndef APR_XML_MAX_DEPTH ++#define APR_XML_MAX_DEPTH 256 ++#endif ++ + /* struct for scoping namespace declarations */ + typedef struct apr_xml_ns_scope { + const char *prefix; /* prefix used for this ns */ +@@ -154,6 +161,11 @@ static void start_handler(void *userdata, const char *name, const char **attrs) + if (parser->error) + return; + ++ if (++parser->depth > APR_XML_MAX_DEPTH) { ++ parser->error = APR_XML_ERROR_DEPTH_LIMIT; ++ return; ++ } ++ + elem = apr_pcalloc(parser->p, sizeof(*elem)); + + /* prep the element */ +@@ -327,6 +339,8 @@ static void end_handler(void *userdata, const char *name) + if (parser->error) + return; + ++ parser->depth--; ++ + /* pop up one level */ + parser->cur_elem = parser->cur_elem->parent; + } +@@ -499,6 +513,11 @@ APU_DECLARE(char *) apr_xml_parser_geterror(apr_xml_parser *parser, + XML_ErrorString(parser->xp_err), parser->xp_err); + return errbuf; + ++ case APR_XML_ERROR_DEPTH_LIMIT: ++ msg = "The maximum element nesting limit (" ++ APR_STRINGIFY(APR_XML_MAX_DEPTH) ") was exceeded."; ++ break; ++ + case APR_XML_ERROR_PARSE_DONE: + msg = "The parser is not active."; + break; diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb index 7b5a04c4350..00a9589ae83 100644 --- a/meta/recipes-support/apr/apr-util_1.6.3.bb +++ b/meta/recipes-support/apr/apr-util_1.6.3.bb @@ -14,6 +14,8 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \ file://configure_fixes.patch \ file://0001-test_transformation-Check-if-transform-is-supported-.patch \ file://CVE-2025-49506.patch \ + file://CVE-2026-32327-dependent.patch \ + file://CVE-2026-32327.patch \ file://run-ptest \ " From patchwork Sat Oct 31 00:15:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102568 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3753.1793405776211266806 for ; Fri, 30 Oct 2026 17:16:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=Xt+qcVd9; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-4a9a8d6cea8so16513025e9.1 for ; Fri, 30 Oct 2026 17:16:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405774; x=1794010574; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Obo4iaglS2spej9exaSf0x5XqvhW9wlUGJqtR8qQ0/0=; b=Xt+qcVd9rEtBxk1F9TL/ZtuXu/D54E4QTUM5sZ+yY4YVC5XaqtGf3Hz56MMToxl/Od NCYthbOvqhNmu6IaNAtdBM4LgFcs4nIXMo8bIdDpiG8arsWlg+Yu6z0R0Aweu74sWHY3 DRS+PDAGiBKG3v3f1l2MxmyT+9ZWeE98M5WGNmTno3pBiPEOEydaqKrfOPSU9YRj8/cf ODCi5KJjIZGcuZTrVMUAax3jqYBkZUgXA371qNGHjYA4E/WGY2XfdQ4qfMYrhOfSObNB U12ToijjCC5QmPVxSzjo8Oc7xcCfSrEo0WeP+07SpsM26sJ29BBS6xKH4m31rCIMBb6n otpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405774; x=1794010574; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Obo4iaglS2spej9exaSf0x5XqvhW9wlUGJqtR8qQ0/0=; b=Mtc2Zmn6CAAcxXp9jsc8PpVv4ruG1W2Cq7KiTN+hXt4fjw2nBJsHtRlmYTsJRELGSL 0M/ibfPX69YO1DHX3NR18uRg21eVuy7j0Cy+UxPJzU9z5Tby6lHNiyWvLSsbgzvDYSNw 4TDbS76VmFX8aFYlQ4IIvkLSPS1KsysGMC8Gm2XgSbty8orrQGPzPLajn4B7KbioZUZ5 7RC1wD/nKUrcovVnHK7MRSP2Nx2TQsx/KenPx/75rvYYjABpnlmD0wDdTi5C2jD/S4ky OsHN674WZxjVl+MCssbuZOafwOzfOS47tcG5T7bmql74ISCrVOrfUNKsTjEKRrIo1gHJ NpMQ== X-Gm-Message-State: AFq9FYIDWVuNcC+/4LqAIJKTMSPPSWKYqRGcyDf0oqcoC7MX0OIcGqSs NTYplNpyDoBY1p/7LsXKKsdhY0qcS+RvhcqPHSJ4RTTehy/BCKK+mWM/G2+IWH9ILTris/p6jeR 0dy+mIRA= X-Gm-Gg: AYBFou1Y6LxAlm16oW/nY3bPNSlTIXa4tEfOsUeaxLRhmt2zuHls2Mlz6QaIPY8p/D7 y49Rpzkjzm/xgZrj8e7eLxXlXMkkEY7AcS6HEPRhk67/zruXlONp72LQpAPd0GeKFDAPjzN2hNZ Covgsa1Jgo+eKMyMI8WyCPWAHHN6/500nyfQto+H8Sjf/fQbrehsuIm3hnipVvDiT1BlnINRDC8 lVcsFjZOS99lhemTGy3WXNclPBxAPL7CvtGeDznxcOcvvVCw31mcOVDaDGbYoEAL5PZAsMWEaxO /4rptj+rqdcJkTRMnOh3VjvOKaZWnG2dJ6w3Qj962Xd8GjE70cCTCoH7AqeJDUMcnfxLpQ5Wt9F peAlKyTVAH3neFvWZXps/qYRLGe97FAjnxeORWvy7RZDSmAmuNvTDNxYKJrdDB5T2qkosKIBefQ nps/q0A98FG1AgSyFCQ2yxtIPqYowpEWYiFuJtPpYWIDBWiz9zJd4CNwHyApeU+BFYjNgszlfbn 4/WZnO7P0IZ9cg218rr8BY5eUdyvGVWbgNidbEUr7gRh7csvbaK6QASr/1avT35IbzRZF8ShFk1 EeHe8K+qPDv6axeEyrF7H6nqQQFBucA3uoxSx+XwQeiIvfS4oCtBsKS0Xm+jCoqvWkl3tazpqFk vsMRGdXgZFycrTTqMHnkPiq/05EzJ X-Received: by 2002:a05:600c:6285:b0:4a1:c6f5:2450 with SMTP id 5b1f17b1804b1-4ac180f07d1mr105793905e9.17.1793405774605; Fri, 30 Oct 2026 17:16:14 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:14 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 52/55] apr-util: Mark CVE-2026-34191 not applicable Date: Sat, 31 Oct 2026 01:15:13 +0100 Message-ID: <7d8d78bdf698be81a89edcea5e45a693086d31f9.1793405493.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249127 From: Hetvi Thakar CVE-2026-34191 affects only the apr_dbd_oracle provider [1]. The apr-util recipe does not enable --with-oracle, so configure keeps apu_have_oracle=0 [2]. Hence mark the CVE not applicable to this build. [1] https://nvd.nist.gov/vuln/detail/CVE-2026-34191 [2] https://github.com/apache/apr-util/blob/1.6.3/build/dbd.m4 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- meta/recipes-support/apr/apr-util_1.6.3.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb index 00a9589ae83..1b7beda9042 100644 --- a/meta/recipes-support/apr/apr-util_1.6.3.bb +++ b/meta/recipes-support/apr/apr-util_1.6.3.bb @@ -101,3 +101,5 @@ do_install_ptest() { # Add CVE_PRODUCT to match the NVD CPE product name CVE_PRODUCT = "apache:apr-util apache:portable_runtime_utility" + +CVE_STATUS[CVE-2026-34191] = "not-applicable-config: apr_dbd_oracle is not built because --with-oracle is not enabled" From patchwork Sat Oct 31 00:15:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102567 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3755.1793405776713158436 for ; Fri, 30 Oct 2026 17:16:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=m+ta3i7c; spf=pass (domain: smile.fr, ip: 209.85.128.44, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4a2000d5fb1so7644035e9.1 for ; Fri, 30 Oct 2026 17:16:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405775; x=1794010575; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=BtwMnu80lep27E9xOU+j3v6T0hB2/wNzvzf8cmixAQw=; b=m+ta3i7c5Wm38/UlMCHniJOim0dyIBY+ErF46MavVCDQCtNjywcA0Y+HpXghNoOcZ5 67qyFZ/ucPeT/F2g0i1rggai1oaoL4dI4OkW144Y03KwnsdXX4oJ2r4s23voiFuBr7R1 gzOtc2tSsSMECrT8YlNxci/xGgBkYfK3nhQ68lHDbuukCDkfBdKEqtEwVeBa21FX93Wk W9kI8TfvvtT/Fk3rTTSIKqBHNgYJfnz3PoPTIwIEFV3iUO0jaL4ouDuHM+4T4pu5C/Fc 1q6pL0aK2seQr9DcdDgarlAWteq1WVIvuQT95G00c9YctkFTEzrx8JYxI0zUvUqWkjgJ vUNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405775; x=1794010575; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=BtwMnu80lep27E9xOU+j3v6T0hB2/wNzvzf8cmixAQw=; b=mFg2KjCl9Gad23cQ34ZsUuVKeUDPOBLPMkReP/7NEr1171zzqhyYNiUclPYVhju/Ff QDOWYr3iB9wpTmPLFIfNZ3M2yfYtdqb7Td27kFqkM0oTRN08+hrk7Df9/JlI5P3QWnpI G2bUFvKb8q153qNnjsJnPu0ALPlyNMlyHutGwYg0dvqSDaUwCP/JQytLNDv1silbGsOu zRisdHUV3OIdcMGR5ZEnrfxWVWATBgGW4DDJQN/1ZDqyCgV5zeBeEz/9ONQ6g+at9i+k lF5oq0bgsXPMEiFyyVnSqyWETJGXL3msFLipbC/hwcfPEtRfWbMD+7IEdwzNltuwXBd0 3SYw== X-Gm-Message-State: AFq9FYKf+mpEDjSruoP2rtDagHYWP/HnlDsn90XB1QNhriyZNNKtyhxv jl37Yd+zAQE6NI6WGV+IXgGFkAn9RTritKUlvbMfD7vvVEXdYRLFU68XduyES/c1UPa62YEfmnq DEeLhiGA= X-Gm-Gg: AYBFou3toQSzhNUle9ftFM2Ym9F2XuhhkXoG0j4lJrSEVxWSC+qx3npvuGHqZRcRME9 Vr+VcAhEtFLQT8go4d7+10T8gO5M8eNOI7kM3UO4cRrLk01F3spsyWSB3gadPa4BBsvbT2Uz+qL VhWF/e/sPf8999ZMpY9qioSo+LoMTrGQ5iFzdRufAnEXg+bcR/SVZoH0S0FZC6kzx093hi0EUjs ZEwLh3gNeAXez/TuTT3K0ZdBEpcKAp5LyVCBJsrgfsZSCxfzOtnN16kChbVftgHRXrDolq70LXT 9Ek2z1relo7gR9ni8VDkgvI2V1FBj+hke0WVJ5laU/cSVz8FozJCs4UJ/PaF9yF8vezkOvbB/nX p1DLr6cOIy8dG4EZTquEElFTvHpDDy4Dd+QbSVLW7yq5S2hmxbLRFfJ+zz8BvbA4lQy7XGR3zpw mTi34U1QRfkZ+nYueAm/4LJUlDFT2fqEImt8h4O59tYhyzSiM6RPaZ7CrszGsVtSJkqyHqJSXAD 3S+ZJI8JMffti7zWhBvgjWZlxGOdcp9xlvD5OuheMtQpzyEtTNlG8JINOpHJFiYWQhnSBBRgwZT on9NZ/V+pVsNDBpQv6+4Sh6+B3PwtXQy05hImq2PUUxrkamp8NlUsXUJWV7f8217eF0bbFAdZtY X/fWRvIyGVrzPbMfumdRL5tPD55LE X-Received: by 2002:a05:600c:8b06:b0:4a2:d:5ccc with SMTP id 5b1f17b1804b1-4ac17b2bc63mr93716175e9.10.1793405775063; Fri, 30 Oct 2026 17:16:15 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:14 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 53/55] apr-util: Fix CVE-2026-34501 Date: Sat, 31 Oct 2026 01:15:14 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249128 From: Hetvi Thakar Backport the upstream Redis response-length and error-checking fix [1] to address CVE-2026-34501 [2]. [1] https://github.com/apache/apr-util/commit/e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-34501 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../apr/apr-util/CVE-2026-34501.patch | 128 ++++++++++++++++++ meta/recipes-support/apr/apr-util_1.6.3.bb | 1 + 2 files changed, 129 insertions(+) create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34501.patch diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch new file mode 100644 index 00000000000..0056e621718 --- /dev/null +++ b/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch @@ -0,0 +1,128 @@ +From e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 3 Aug 2026 12:28:37 +0000 +Subject: [PATCH] Merge r1936809 from aprutil 1.7.x: + +Merge r1936808 from apr trunk: + +apr_redis error checking + +Submitted By: jfclere +Reviewed By: jfclere, jorton, covener + + + + + +git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936810 13f79535-47bb-0310-9956-ffa450edef68 + +CVE: CVE-2026-34501 +Upstream-Status: Backport [https://github.com/apache/apr-util/commit/e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2] + +(cherry picked from commit e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2) +Signed-off-by: Hetvi Thakar +--- + redis/apr_redis.c | 54 +++++++++++++++++++++++++++++++++++++---------- + 1 file changed, 43 insertions(+), 11 deletions(-) + +diff --git a/redis/apr_redis.c b/redis/apr_redis.c +index 8d01fdd6..e7fe2071 100644 +--- a/redis/apr_redis.c ++++ b/redis/apr_redis.c +@@ -853,26 +853,42 @@ APU_DECLARE(apr_status_t) apr_redis_setex(apr_redis_t *rc, + return rv; + } + ++/* Redis upstream default is 512Mb. This code will try to read the entire ++ * response into a brigade, and then copy that into a pool, so impose ++ * some reasonable limit since RAM consumption will be double this. ++ * https://redis.io/docs/latest/develop/reference/protocol-spec/#bulk-strings ++ */ ++#ifndef APR_REDIS_MAX_BULK_LEN ++#define APR_REDIS_MAX_BULK_LEN (64 * 1024 * 1024) ++#endif ++ + static apr_status_t grab_bulk_resp(apr_redis_server_t *rs, apr_redis_t *rc, + apr_redis_conn_t *conn, apr_pool_t *p, + char **baton, apr_size_t *new_length) + { +- char *length; ++ /* conn->buffer contains "$\r\n" */ ++ char *length = conn->buffer + 1; + char *last; + apr_status_t rv; + apr_size_t len = 0; ++ long val; ++ + *new_length = 0; ++ *baton = NULL; + +- length = apr_strtok(conn->buffer + 1, " ", &last); +- if (length) { +- len = strtol(length, (char **) NULL, 10); ++ errno = 0; ++ last = NULL; ++ val = strtol(length, &last, 10); ++ if (errno || last == NULL || last == length || *last != '\r' ++ || val < 0 || val > APR_REDIS_MAX_BULK_LEN) { ++ rs_bad_conn(rs, conn); ++ if (rc) ++ apr_redis_disable_server(rc, rs); ++ return val > APR_REDIS_MAX_BULK_LEN ? APR_ENOSPC : APR_EGENERAL; + } ++ len = (apr_size_t)val; + +- if (len == 0) { +- *new_length = 0; +- *baton = NULL; +- } +- else { ++ if (len) { + apr_bucket_brigade *bbb; + apr_bucket *e; + +@@ -907,6 +923,11 @@ static apr_status_t grab_bulk_resp(apr_redis_server_t *rs, apr_redis_t *rc, + + conn->bb = bbb; + ++ if (len < 2) { ++ *baton = NULL; ++ *new_length = 0; ++ return APR_EGENERAL; ++ } + *new_length = len - 2; + (*baton)[*new_length] = '\0'; + } +@@ -992,6 +1013,10 @@ APU_DECLARE(apr_status_t) apr_redis_getp(apr_redis_t *rc, + } + else if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) { + rv = grab_bulk_resp(rs, rc, conn, p, baton, new_length); ++ if (rv != APR_SUCCESS) { ++ /* grab_bulk_resp already called rs_bad_conn; do not also release */ ++ return rv; ++ } + } + else { + rv = APR_EGENERAL; +@@ -1172,12 +1197,19 @@ apr_redis_info(apr_redis_server_t *rs, apr_pool_t *p, char **baton) + return rv; + } + +- if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) { ++ if (strncmp(RS_NOT_FOUND_GET, conn->buffer, RS_NOT_FOUND_GET_LEN) == 0) { ++ rv = APR_NOTFOUND; ++ } ++ else if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) { + apr_size_t nl; + rv = grab_bulk_resp(rs, NULL, conn, p, baton, &nl); ++ if (rv != APR_SUCCESS) { ++ /* grab_bulk_resp already called rs_bad_conn; do not also release */ ++ return rv; ++ } + } else { + rs_bad_conn(rs, conn); +- rv = APR_EGENERAL; ++ return APR_EGENERAL; + } + + rs_release_conn(rs, conn); diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb index 1b7beda9042..8d751e7b7a1 100644 --- a/meta/recipes-support/apr/apr-util_1.6.3.bb +++ b/meta/recipes-support/apr/apr-util_1.6.3.bb @@ -16,6 +16,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \ file://CVE-2025-49506.patch \ file://CVE-2026-32327-dependent.patch \ file://CVE-2026-32327.patch \ + file://CVE-2026-34501.patch \ file://run-ptest \ " From patchwork Sat Oct 31 00:15:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102569 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3756.1793405777492851342 for ; Fri, 30 Oct 2026 17:16:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=TXJxI+st; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4a140e7405dso13072355e9.3 for ; Fri, 30 Oct 2026 17:16:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405776; x=1794010576; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=J6cU1KWgohvQIsXRaxumf1PfocdRspIWit2FnUnQWak=; b=TXJxI+st9nMIndPErwrGi/qwRG+zNRGrmWHjuY5NNn3iTjGaZ7aH8LVPGlzIsKI47E sNT7k1vkGmPn/kG4UID0Cc8PIIBlXtc/JJomv4ALrhxRuxwvJnoqAB/G7poWv5xndp8A cpdgBiHagqlfnCYtm1qWKSzrO+/Z8zyl32ychOcOMEDUouFAFZJFYaoUBU6sUJZ+cZo8 6VP87GKuvSvCpke/jtM1H1DUOYm3fmqXSPHnpCtEW6e0i0qOhCLssnNlAOMi9OUSLwMR aCLvjH2UaH5U4OmDnrrumd1IALxV8hCJBckiEWW/UvWi++2H2ORc7jTbTzRjSyeJW6Q6 o8EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405776; x=1794010576; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=J6cU1KWgohvQIsXRaxumf1PfocdRspIWit2FnUnQWak=; b=CpC1vqVhW15DX5JIh/j4PAxppZYdv2L2goSGBED6/t8Hx8ftRqhduW9fsxjcSKf4WQ STGDEogCcVfJa17F8Q1S5XfBK0KLqMy5SCnE5k6yp4jyHuMVpWLsTs91iygEp2zIfy8f NZxFsIiOtPRlZUxTr/IHIYi5hro2mouyD/amA44bpoQc87+/HSdCWWBUBYJnbKNjxUkv /SZsfCO9pP9aPuIqQogqQFrPjWLl+lzr1zGF4w6wdQS9kHI+n1pMbQ1kfYhA551L9Edm CzpgGutZ5ShQhjoCpa7cHB8HnapjAD7hBtO6n7gHihfrSWn9Vv6DnOxvGb/YIaMoBe0S Mcyg== X-Gm-Message-State: AFq9FYIdf/uBRxCmqHNoODp18NtjN1NwSLvtbd61Zpjhg/85Z4C/3PNX Wu3N9qK0Cmt+yQVcSt8vtlw7ZCXG3m7Ug93p06r8P9cbvjwPjI8aR1YjTLeaBoWuSdXLOJ9w+Xc 50pLbdPs= X-Gm-Gg: AYBFou0hAvfn3wf3TvOEEXelF6ZzpD3jKi2LdgtMksAYEij+CMeTJ1ZtoYckbcXrEaX sadFOTHiBJ+lzDpCx4H4WtFNYe2KWACVxZU5+crsIre/zG8qZSKxTE6u8xJLClGkFHuGw4SCyDt /JRRBXX1b/avy4KihX2yFUvID/qIYKYMkwiLvbFHeM2uQPhxTPwaA6gnD8oUENrkPIHleZkxIHz FyqFo1WQUljfew439IRO1Kw/hv+9RLT5BsCY0LnRrl+Aqv03X1+kHw0lHPwrWaxmMGHZt4rXpqh T22Aka/5J86g1ZfTPwNOiygLKYR+Cmg6jDGZMd5exulenBVuj48y5rdVKIA5FiNN4fBsI0o4HHq EcGwMnowlf7XZrzytIvQ7y28rrauXLGuB4r5QyK1bHXQdJAMsh6S8aHzM5MS+5xjxrOuGmSbu2w 46/bYZdYtI76jouBs2bCsn2dnzEPN/GVi3Y9Jjkfs1auNxNkBZHhknY/fq7kVsGUy/vwVysZW8d sDKjahXtjfWA8+2dIem5TrL08vEigzjdee2qD9vaM1kmo+9SU7ndfSQIMGC58CB5MgCKqAuutl0 YzfDlNoboon3JkVEKdjusmGaxh5Yh+e0r2s1X04B3FXUHcFxmT/of49/iRHjJMlP9z0aS9+pk6/ JABWlffVFVuqgEUQIFRYA4u8cq4ma X-Received: by 2002:a05:600c:870f:b0:4a2:1196:db0e with SMTP id 5b1f17b1804b1-4ac1899348bmr77127115e9.30.1793405775714; Fri, 30 Oct 2026 17:16:15 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:15 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 54/55] apr-util: Fix CVE-2026-34502 Date: Sat, 31 Oct 2026 01:15:15 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249129 From: Hetvi Thakar Backport the upstream memcache validation fix [1] and its follow-up parsing correction [2] to address CVE-2026-34502 [3]. [1] https://github.com/apache/apr-util/commit/f1c98dd0847c43375daf3789c936685adbc6d872 [2] https://github.com/apache/apr-util/commit/997c02ce5b9db44083c580e3e47095f5ac4524ae [3] https://nvd.nist.gov/vuln/detail/CVE-2026-34502 Signed-off-by: Hetvi Thakar Signed-off-by: Yoann Congal --- .../apr/apr-util/CVE-2026-34502_p1.patch | 106 ++++++++++++++++++ .../apr/apr-util/CVE-2026-34502_p2.patch | 38 +++++++ meta/recipes-support/apr/apr-util_1.6.3.bb | 2 + 3 files changed, 146 insertions(+) create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch new file mode 100644 index 00000000000..d4c6cb39b40 --- /dev/null +++ b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch @@ -0,0 +1,106 @@ +From f1c98dd0847c43375daf3789c936685adbc6d872 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 3 Aug 2026 12:33:18 +0000 +Subject: [PATCH] Merge r1936812 from aprutil 1.7.x: + +Merge r1936811 from apr trunk: + +apr_memcache: error checking + +Reviewed By: covener, jorton, jfclere + + + + + +git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936813 13f79535-47bb-0310-9956-ffa450edef68 + +CVE: CVE-2026-34502 +Upstream-Status: Backport [https://github.com/apache/apr-util/commit/f1c98dd0847c43375daf3789c936685adbc6d872] + +(cherry picked from commit f1c98dd0847c43375daf3789c936685adbc6d872) +Signed-off-by: Hetvi Thakar +--- + memcache/apr_memcache.c | 31 ++++++++++++++++++++++++++++--- + 1 file changed, 28 insertions(+), 3 deletions(-) + +diff --git a/memcache/apr_memcache.c b/memcache/apr_memcache.c +index 2c7bd1de..137be778 100644 +--- a/memcache/apr_memcache.c ++++ b/memcache/apr_memcache.c +@@ -595,6 +595,11 @@ static apr_status_t get_server_line(apr_memcache_conn_t *conn) + conn->blen = bsize; + conn->buffer[bsize] = '\0'; + ++ /* Validate CRLF line termination to prevent integer underflow attacks */ ++ if (bsize < 2 || conn->buffer[bsize-2] != '\r' || conn->buffer[bsize-1] != '\n') { ++ return APR_EGENERAL; ++ } ++ + return apr_brigade_cleanup(conn->tb); + } + +@@ -1087,9 +1092,14 @@ apr_memcache_version(apr_memcache_server_t *ms, + } + + if (strncmp(MS_VERSION, conn->buffer, MS_VERSION_LEN) == 0) { +- *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, +- conn->blen - MS_VERSION_LEN - 2); +- rv = APR_SUCCESS; ++ if (conn->blen < MS_VERSION_LEN + 2) { ++ rv = APR_EGENERAL; ++ } ++ else { ++ *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, ++ conn->blen - MS_VERSION_LEN - 2); ++ rv = APR_SUCCESS; ++ } + } + else { + rv = APR_EGENERAL; +@@ -1555,23 +1565,35 @@ apr_memcache_multgetp(apr_memcache_t *mc, + static const char *stat_read_string(apr_pool_t *p, char *buf, apr_size_t len) + { + /* remove trailing \r\n and null char */ ++ if (len < 2) { ++ return apr_pstrdup(p, ""); ++ } + return apr_pstrmemdup(p, buf, len-2); + } + + static apr_uint32_t stat_read_uint32(apr_pool_t *p, char *buf, apr_size_t len) + { ++ if (len < 2) { ++ return 0; ++ } + buf[len-2] = '\0'; + return atoi(buf); + } + + static apr_uint64_t stat_read_uint64(apr_pool_t *p, char *buf, apr_size_t len) + { ++ if (len < 2) { ++ return 0; ++ } + buf[len-2] = '\0'; + return apr_atoi64(buf); + } + + static apr_time_t stat_read_time(apr_pool_t *p, char *buf, apr_size_t len) + { ++ if (len < 2) { ++ return 0; ++ } + buf[len-2] = '\0'; + return apr_time_from_sec(atoi(buf)); + } +@@ -1583,6 +1605,9 @@ static apr_time_t stat_read_rtime(apr_pool_t *p, char *buf, apr_size_t len) + char *usecs; + const char *sep = ":."; + ++ if (len < 2) { ++ return apr_time_make(0, 0); ++ } + buf[len-2] = '\0'; + + secs = apr_strtok(buf, sep, &tok); diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch new file mode 100644 index 00000000000..844ad8109d4 --- /dev/null +++ b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch @@ -0,0 +1,38 @@ +From 997c02ce5b9db44083c580e3e47095f5ac4524ae Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Fri, 7 Aug 2026 14:23:29 +0000 +Subject: [PATCH] fix memcache version parsing + +partial port of 1936966 from trunk + + +git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936975 13f79535-47bb-0310-9956-ffa450edef68 + +CVE: CVE-2026-34502 +Upstream-Status: Backport [https://github.com/apache/apr-util/commit/997c02ce5b9db44083c580e3e47095f5ac4524ae] + +(cherry picked from commit 997c02ce5b9db44083c580e3e47095f5ac4524ae) +Signed-off-by: Hetvi Thakar +--- + memcache/apr_memcache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/memcache/apr_memcache.c b/memcache/apr_memcache.c +index 137be778..74146712 100644 +--- a/memcache/apr_memcache.c ++++ b/memcache/apr_memcache.c +@@ -1092,12 +1092,12 @@ apr_memcache_version(apr_memcache_server_t *ms, + } + + if (strncmp(MS_VERSION, conn->buffer, MS_VERSION_LEN) == 0) { +- if (conn->blen < MS_VERSION_LEN + 2) { ++ if (conn->blen < MS_VERSION_LEN + 4) { + rv = APR_EGENERAL; + } + else { + *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1, +- conn->blen - MS_VERSION_LEN - 2); ++ conn->blen - MS_VERSION_LEN - 3); + rv = APR_SUCCESS; + } + } diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb index 8d751e7b7a1..f694ae01eb9 100644 --- a/meta/recipes-support/apr/apr-util_1.6.3.bb +++ b/meta/recipes-support/apr/apr-util_1.6.3.bb @@ -17,6 +17,8 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \ file://CVE-2026-32327-dependent.patch \ file://CVE-2026-32327.patch \ file://CVE-2026-34501.patch \ + file://CVE-2026-34502_p1.patch \ + file://CVE-2026-34502_p2.patch \ file://run-ptest \ " From patchwork Sat Oct 31 00:15:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 102571 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3758.1793405778337078282 for ; Fri, 30 Oct 2026 17:16:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google2 header.b=nMWnGAwt; spf=pass (domain: smile.fr, ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-4a218c463d1so7693635e9.0 for ; Fri, 30 Oct 2026 17:16:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google2; t=1793405776; x=1794010576; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=1PL9L2UYoGclyu0WjR6qYDpZAq0FQd0qynZdH/frOag=; b=nMWnGAwtOyfXHrz3b9OocKVGF2J/ec0PhrbRO9TMOYfry6gA9xLSKFrovwakU0fCSZ MrAx6+eKpBKrS37bm0Q6nR64adqK+V1HKQBZTWQJ0NP9TIVpEWA5t8QiW5cjfBSH3+45 yjsAFqS6A+RdlE070Rz+YMNffkmVlb4CuqGfadkd/2yISD2KQ4UZPE8v4T47FB3CQu8X Ywvw7hZBq8kroahgtizUnzxhhUxKfHI2dDSrBKOuvk02ASrbSB1epsszAs7Me/7l5efA z0SOVu5Tn0aNBCMHhtUd8YpAgCtnaS5c9Lwcv7bB58h2GY/3HKnuzqqm2lJpGibQCl5v AliQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793405776; x=1794010576; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=1PL9L2UYoGclyu0WjR6qYDpZAq0FQd0qynZdH/frOag=; b=Y+bElH48yTIXOKr9FSSZK9YGz5pkaHLznCt7kLoAZqRXPHhbpyw6ZjsFsbESuDWTUf ztTdCvqAbipN+MwCcYYSebDRPvFIJ0xLXCHWbUFvL/eXgZ74vFYRDQnI/sDedl4UA2ju 3EtpBqTD9al0zsCllBYaWcxbpditfSXgN1hQpJx3kFn/3hNY6t+b3U3ebKze6mcAlNHI 6YuUx8g2Y9wVQCruO75Uhc8oC8VLs4RgC0I86F+rZHKAbLMcCQTQcUXIxHIxhVa1E0iU qI2DGb8Nk7XMmtHjSAc1HMQKcu3ExnlWMCQUKKDGoOGw5brJToD+X0ReuUXLOp9bvaut /qnw== X-Gm-Message-State: AFq9FYIgono1HErEtE2RCOBX0Spcfns0kqLfcVWG6pDyZxpCDgz5R8nF 3XG06zP9Do/6M1kyNPvK72fnXgPG3ueWXWhpXqoHT6gVzY5BxdHQ7oWdIs/1MKQJvCYMlHQHqlO pJuL75pU= X-Gm-Gg: AYBFou1nGe4YYJNAVWi9T7b830naV3WhOZGA3Zq6GdfIHSk7b9pIrp3YsBYhxLnENWi 8fzArANpPSQenoeyoK02rbTYGsqZ5fvmiP6mOEUM+dy2D9fYCZLh+mPtBemHYfOlpubP9Uopz7A L7+yje2Qh+Xymzx0/IQ0QdV1ELkysfW37APTpK7BjhQHB9ZaeLqe1FsmD+PXRoSvYLmcjghs7zY gFZkG9yxkPVJy2Uqt0y45kG+UwS/LjQBHjR65LntmUu06Li2YvunnJO0HzXLY1BRINQSyJSzODH zJ9styMHN4wSVIHK/bRg07uaZP5nfxwLGnT1EYI82fPVc05qXy0PJgjS2EaegTG8cF4AKl7WEqS s591D4x0Ik0vQubkvk69FTeBwNdBhJudLu2mzAGrjujJFY6EUu5T0YOHOkcX+EUoh1wR1t7U/1S 7dokk9NYgFIe6K3ATvGaKaoOjy0/MRD/fy6+rfAx8tB8QVCjkmavaRte+9NHuf3mDx66hkmiUmW AnZll4y7eOm2IXMTGu+u238AISvNcfP97v7p2Z2QMrc613FX+b56hClLrMnn7bYT4iSJ/SzwVBb ZjtO+QuoZlg35XSnvkNv/Htwb7Eo2E9Bpb8z/PzLlre1nbT/cEjGX3+Fe3rzlUh6t/T1ha3RQz0 jBAReHFsmZiFaaeyRc3NmXVLKS5m0 X-Received: by 2002:a05:600c:8b55:b0:4a1:ddca:8b66 with SMTP id 5b1f17b1804b1-4ac19234a06mr85338175e9.31.1793405776591; Fri, 30 Oct 2026 17:16:16 -0700 (PDT) Return-Path: Received: from FRSMI25-LASER.home (2a01cb001331aa00a2e4fb7b0d887544.ipv6.abo.wanadoo.fr. [2a01:cb00:1331:aa00:a2e4:fb7b:d88:7544]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4ab61d8b9f4sm130350635e9.12.2026.10.30.17.16.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 30 Oct 2026 17:16:15 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 55/55] util-linux: patch CVE-2026-53615 Date: Sat, 31 Oct 2026 01:15:16 +0100 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 31 Oct 2026 00:16:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249130 From: Peter Marko Pick patch per [1] from 2.41 branch. Resolve minor conflict with [2] (unrelated const variable). [1] https://security-tracker.debian.org/tracker/CVE-2026-53615 [2] https://github.com/util-linux/util-linux/commit/7eba8f98bdc3ed9c0ef1c8527aa61e1a3656449c Signed-off-by: Peter Marko Signed-off-by: Yoann Congal --- meta/recipes-core/util-linux/util-linux.inc | 1 + .../util-linux/CVE-2026-53615.patch | 109 ++++++++++++++++++ 2 files changed, 110 insertions(+) create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index fdc8c62f6e5..66616f06527 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -63,6 +63,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://CVE-2026-78410-02.patch \ file://CVE-2026-78410-03.patch \ file://CVE-2026-76642.patch \ + file://CVE-2026-53615.patch \ " SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f" diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch new file mode 100644 index 00000000000..f06f175e9c9 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch @@ -0,0 +1,109 @@ +From 05c2dbadf34cc74192287f377904afaaf4061623 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Wed, 25 Mar 2026 11:54:28 +0100 +Subject: [PATCH] libblkid: dos: validate EBR data and links within extended + partition + +The parse_dos_extended() function processes EBR (Extended Boot Record) +chains, but does not properly validate that partitions and links stay +within the master extended partition area [ex_start, ex_start+ex_size). + +For EBR data partitions at index 0 and 1, there are no bounds checks +at all, unlike entries at index 2 and 3. This allows a crafted disk +image to register partitions at arbitrary sectors via uint32_t overflow +in the abs_start calculation (cur_start + start wraps to a small value). + +Fix by: + - using 64-bit arithmetic for the abs_start calculation to avoid + uint32_t wraparound + - applying the extended partition area bounds check to all EBR data + entries, not just index >= 2 + - validating EBR link targets stay within the extended area and + advance forward (preventing backward links that could loop) + +Reported-by: Michele Piccinni +Signed-off-by: Karel Zak +(cherry picked from commit e9d544d013267ea86b70ee8ff78abd280e6641af) + +CVE: CVE-2026-53615 +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623] +Signed-off-by: Peter Marko +--- + libblkid/src/partitions/dos.c | 38 +++++++++++++++++++++++++++-------- + 1 file changed, 30 insertions(+), 8 deletions(-) + +diff --git a/libblkid/src/partitions/dos.c b/libblkid/src/partitions/dos.c +index d5a8aa3ae..5c78aac21 100644 +--- a/libblkid/src/partitions/dos.c ++++ b/libblkid/src/partitions/dos.c +@@ -46,6 +46,7 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab, + { + blkid_partlist ls = blkid_probe_get_partlist(pr); + uint32_t cur_start = ex_start, cur_size = ex_size; ++ uint64_t ex_end = (uint64_t) ex_start + ex_size; + unsigned char *data; + int ct_nodata = 0; /* count ext.partitions without data partitions */ + int i; +@@ -88,24 +89,31 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab, + /* Parse data partition */ + for (p = p0, i = 0; i < 4; i++, p++) { + uint32_t abs_start; ++ uint64_t abs; + blkid_partition par; + + /* the start is relative to the parental ext.partition */ + start = dos_partition_get_start(p) * ssf; + size = dos_partition_get_size(p) * ssf; +- abs_start = cur_start + start; /* absolute start */ + + if (!size || is_extended(p)) + continue; ++ ++ abs = (uint64_t) cur_start + start; ++ ++ /* data partition must be within the extended area */ ++ if (abs < ex_start || abs + size > ex_end) { ++ DBG(LOWPROBE, ul_debug("#%d: EBR data partition outside " ++ "extended -- ignore", i + 1)); ++ continue; ++ } ++ abs_start = (uint32_t) abs; ++ + if (i >= 2) { +- /* extra checks to detect real data on ++ /* extra check to detect real data on + * 3rd and 4th entries */ + if (start + size > cur_size) + continue; +- if (abs_start < ex_start) +- continue; +- if (abs_start + size > ex_start + ex_size) +- continue; + } + + /* Avoid recursive non-empty links, see ct_nodata counter */ +@@ -142,8 +150,22 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab, + if (i == 4) + goto leave; + +- cur_start = ex_start + start; +- cur_size = size; ++ { ++ uint64_t next = (uint64_t) ex_start + start; ++ ++ if (next + size > ex_end) { ++ DBG(LOWPROBE, ul_debug("EBR link outside " ++ "extended area -- leave")); ++ goto leave; ++ } ++ if (next <= cur_start) { ++ DBG(LOWPROBE, ul_debug("EBR link does not " ++ "advance -- leave")); ++ goto leave; ++ } ++ cur_start = (uint32_t) next; ++ cur_size = size; ++ } + } + leave: + return BLKID_PROBE_OK;