* RE: [OE-core] [PATCH] glibc: stable 2.43 branch updates
2026-04-08 9:16 Hemanth.KumarMD
@ 2026-04-08 9:43 ` Marko, Peter
2026-04-08 11:21 ` Hemanth Kumar M D
0 siblings, 1 reply; 10+ messages in thread
From: Marko, Peter @ 2026-04-08 9:43 UTC (permalink / raw)
To: Hemanth.KumarMD@windriver.com,
openembedded-core@lists.openembedded.org
Cc: Sundeep.Kokkonda@windriver.com
Please set status for fixed CVEs via CVE_STATUS_STABLE_BACKPORTS, otherwise they will be still present in CVE reports.
Peter
-----Original Message-----
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Hemanth Kumar M D via lists.openembedded.org
Sent: Wednesday, April 8, 2026 11:16 AM
To: openembedded-core@lists.openembedded.org
Cc: Sundeep.Kokkonda@windriver.com; Hemanth.KumarMD@windriver.com
Subject: [OE-core] [PATCH] glibc: stable 2.43 branch updates
From: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
$ git log --oneline 856c426a753450b8c6861a5b994a564f4fc16d4b..ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c
ce1013a197 tests: fix tst-rseq with Linux 7.0
60cabd0464 riscv: Resolve calls to memcpy using memcpy-generic in early startup
02ffd413cf elf: Use dl-symbol-redir-ifunc.h instead _dl_strlen
2695314378 elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
dd9945c0ba resolv: Check hostname for validity (CVE-2026-4438)
5c6fca0c62 resolv: Count records correctly (CVE-2026-4437)
2be6cf2e75 posix: Run tst-wordexp-reuse-mem test
305ce0b588 aarch64: Tests for locking GCS
2ee41ba6ec aarch64: Lock GCS status at startup
fa4a40c7d4 tests: aarch64: fix makefile dependencies for dlopen tests for BTI
9898ea58b5 malloc: Avoid accessing /sys/kernel/mm files
c3ceb93dc4 Add BZ 33904 entry to NEWS
911bd469f8 debug: Fix build with --enable-fortify-source=1 (BZ 33904)
48f5a05a7a nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
d6cb7ce0e9 Linux: In getlogin_r, use utmp fallback only for specific errors
140c760d71 nss: Introduce dedicated struct nss_database_for_fork type
Testing Results:
+--------------+--------+--------+------+
| Result | Before | After | Diff |
+--------------+--------+--------+------+
| PASS | 6770 | 6774 | +4 |
| XPASS | 4 | 4 | 0 |
| FAIL | 29 | 28 | -1 |
| XFAIL | 16 | 16 | 0 |
| UNSUPPORTED | 489 | 490 | +1 |
+--------------+--------+--------+------+
Changes in testcases:
+------------------------------------------------------+--------+-------------+
| Testcase | Before | After |
+------------------------------------------------------+--------+-------------+
| elf/tst-tls20 | FAIL | PASS |
| posix/tst-wordexp-reuse-mem | N/A | PASS |
| resolv/tst-resolv-invalid-ptr | N/A | PASS |
| resolv/tst-resolv-dns-section | N/A | PASS |
| nss/tst-nss-malloc-failure-getlogin_r | N/A | UNSUPPORTED |
+------------------------------------------------------+--------+-------------+
Justification:
commit - 2be6cf2e75 posix: Run tst-wordexp-reuse-mem test
Fixes Makefile dependency to ensure the testcase is executed.
Passing new testcase:
+PASS: posix/tst-wordexp-reuse-mem
commit - dd9945c0ba resolv: Check hostname for validity (CVE-2026-4438)
Adds validation for hostname parsing and introduces a regression test.
Passing new testcase:
+PASS: resolv/tst-resolv-invalid-ptr
commit - 5c6fca0c62 resolv: Count records correctly (CVE-2026-4437)
Fixes DNS answer section parsing and adds a regression test.
Passing new testcase:
+PASS: resolv/tst-resolv-dns-section
commit - 48f5a05a7a nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
Fixes null pointer dereference and improves NSS handling.
Added testcase:
UNSUPPORTED: nss/tst-nss-malloc-failure-getlogin_r
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 89be8fcb88..015e7943c5 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.43/master"
PV = "2.43+git"
-SRCREV_glibc ?= "856c426a753450b8c6861a5b994a564f4fc16d4b"
+SRCREV_glibc ?= "ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c"
SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
--
2.49.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [OE-core] [PATCH] glibc: stable 2.43 branch updates
2026-04-08 9:43 ` [OE-core] " Marko, Peter
@ 2026-04-08 11:21 ` Hemanth Kumar M D
2026-04-08 11:28 ` Marko, Peter
0 siblings, 1 reply; 10+ messages in thread
From: Hemanth Kumar M D @ 2026-04-08 11:21 UTC (permalink / raw)
To: Marko, Peter, openembedded-core@lists.openembedded.org
Cc: Sundeep.Kokkonda@windriver.com
[-- Attachment #1: Type: text/plain, Size: 5451 bytes --]
Hi Peter,
Thanks for the suggestion.
I had already checked the CVE reports, and these CVEs are not currently
being reported there.
Ref:https://lists.openembedded.org/g/openembedded-core/message/234641?p=%2C%2C%2C20%2C0%2C0%2C0%3A%3ACr…
<https://lists.openembedded.org/g/openembedded-core/message/234641?p=%2C%2C%2C20%2C0%2C0%2C0%3A%3ACreated%2C%2COE-core+CVE+metrics+for+master%2C20%2C2%2C0%2C118682687>
Would it still be preferred to add CVE_STATUS entries in such cases, or
only when they appear in the reports?
On 08-04-2026 03:13 pm, Marko, Peter wrote:
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> Please set status for fixed CVEs via CVE_STATUS_STABLE_BACKPORTS, otherwise they will be still present in CVE reports.
> Peter
>
> -----Original Message-----
> From:openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Hemanth Kumar M D via lists.openembedded.org
> Sent: Wednesday, April 8, 2026 11:16 AM
> To:openembedded-core@lists.openembedded.org
> Cc:Sundeep.Kokkonda@windriver.com;Hemanth.KumarMD@windriver.com
> Subject: [OE-core] [PATCH] glibc: stable 2.43 branch updates
>
> From: Hemanth Kumar M D<Hemanth.KumarMD@windriver.com>
>
> $ git log --oneline 856c426a753450b8c6861a5b994a564f4fc16d4b..ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c
>
> ce1013a197 tests: fix tst-rseq with Linux 7.0
> 60cabd0464 riscv: Resolve calls to memcpy using memcpy-generic in early startup
> 02ffd413cf elf: Use dl-symbol-redir-ifunc.h instead _dl_strlen
> 2695314378 elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
> dd9945c0ba resolv: Check hostname for validity (CVE-2026-4438)
> 5c6fca0c62 resolv: Count records correctly (CVE-2026-4437)
> 2be6cf2e75 posix: Run tst-wordexp-reuse-mem test
> 305ce0b588 aarch64: Tests for locking GCS
> 2ee41ba6ec aarch64: Lock GCS status at startup
> fa4a40c7d4 tests: aarch64: fix makefile dependencies for dlopen tests for BTI
> 9898ea58b5 malloc: Avoid accessing /sys/kernel/mm files
> c3ceb93dc4 Add BZ 33904 entry to NEWS
> 911bd469f8 debug: Fix build with --enable-fortify-source=1 (BZ 33904)
> 48f5a05a7a nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
> d6cb7ce0e9 Linux: In getlogin_r, use utmp fallback only for specific errors
> 140c760d71 nss: Introduce dedicated struct nss_database_for_fork type
>
> Testing Results:
> +--------------+--------+--------+------+
> | Result | Before | After | Diff |
> +--------------+--------+--------+------+
> | PASS | 6770 | 6774 | +4 |
> | XPASS | 4 | 4 | 0 |
> | FAIL | 29 | 28 | -1 |
> | XFAIL | 16 | 16 | 0 |
> | UNSUPPORTED | 489 | 490 | +1 |
> +--------------+--------+--------+------+
>
> Changes in testcases:
> +------------------------------------------------------+--------+-------------+
> | Testcase | Before | After |
> +------------------------------------------------------+--------+-------------+
> | elf/tst-tls20 | FAIL | PASS |
> | posix/tst-wordexp-reuse-mem | N/A | PASS |
> | resolv/tst-resolv-invalid-ptr | N/A | PASS |
> | resolv/tst-resolv-dns-section | N/A | PASS |
> | nss/tst-nss-malloc-failure-getlogin_r | N/A | UNSUPPORTED |
> +------------------------------------------------------+--------+-------------+
>
> Justification:
>
> commit - 2be6cf2e75 posix: Run tst-wordexp-reuse-mem test
> Fixes Makefile dependency to ensure the testcase is executed.
> Passing new testcase:
> +PASS: posix/tst-wordexp-reuse-mem
>
> commit - dd9945c0ba resolv: Check hostname for validity (CVE-2026-4438)
> Adds validation for hostname parsing and introduces a regression test.
> Passing new testcase:
> +PASS: resolv/tst-resolv-invalid-ptr
>
> commit - 5c6fca0c62 resolv: Count records correctly (CVE-2026-4437)
> Fixes DNS answer section parsing and adds a regression test.
> Passing new testcase:
> +PASS: resolv/tst-resolv-dns-section
>
> commit - 48f5a05a7a nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
> Fixes null pointer dereference and improves NSS handling.
> Added testcase:
> UNSUPPORTED: nss/tst-nss-malloc-failure-getlogin_r
>
> Signed-off-by: Hemanth Kumar M D<Hemanth.KumarMD@windriver.com>
> ---
> meta/recipes-core/glibc/glibc-version.inc | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
> index 89be8fcb88..015e7943c5 100644
> --- a/meta/recipes-core/glibc/glibc-version.inc
> +++ b/meta/recipes-core/glibc/glibc-version.inc
> @@ -1,6 +1,6 @@
> SRCBRANCH ?= "release/2.43/master"
> PV = "2.43+git"
> -SRCREV_glibc ?= "856c426a753450b8c6861a5b994a564f4fc16d4b"
> +SRCREV_glibc ?= "ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c"
> SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
>
> GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
> --
> 2.49.0
>
--
Regards,
Hemanth Kumar M D
[-- Attachment #2: Type: text/html, Size: 7155 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [OE-core] [PATCH] glibc: stable 2.43 branch updates
2026-04-08 11:21 ` Hemanth Kumar M D
@ 2026-04-08 11:28 ` Marko, Peter
0 siblings, 0 replies; 10+ messages in thread
From: Marko, Peter @ 2026-04-08 11:28 UTC (permalink / raw)
To: Hemanth.KumarMD@windriver.com,
openembedded-core@lists.openembedded.org
Cc: Sundeep.Kokkonda@windriver.com
[-- Attachment #1: Type: text/plain, Size: 6365 bytes --]
Hello,
CVEs are being tracked and updated daily.
Newest report already has them flagged as open.
See https://valkyrie.yocto.io/pub/non-release/patchmetrics/
Please update their status.
Peter
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Hemanth Kumar M D via lists.openembedded.org
Sent: Wednesday, April 8, 2026 1:22 PM
To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>; openembedded-core@lists.openembedded.org
Cc: Sundeep.Kokkonda@windriver.com
Subject: Re: [OE-core] [PATCH] glibc: stable 2.43 branch updates
Hi Peter,
Thanks for the suggestion.
I had already checked the CVE reports, and these CVEs are not currently being reported there.
Ref:https://lists.openembedded.org/g/openembedded-core/message/234641?p=%2C%2C%2C20%2C0%2C0%2C0%3A%3ACr…<https://lists.openembedded.org/g/openembedded-core/message/234641?p=%2C%2C%2C20%2C0%2C0%2C0%3A%3ACreated%2C%2COE-core+CVE+metrics+for+master%2C20%2C2%2C0%2C118682687>
Would it still be preferred to add CVE_STATUS entries in such cases, or only when they appear in the reports?
On 08-04-2026 03:13 pm, Marko, Peter wrote:
CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know the content is safe.
Please set status for fixed CVEs via CVE_STATUS_STABLE_BACKPORTS, otherwise they will be still present in CVE reports.
Peter
-----Original Message-----
From: openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org> <openembedded-core@lists.openembedded.org><mailto:openembedded-core@lists.openembedded.org> On Behalf Of Hemanth Kumar M D via lists.openembedded.org
Sent: Wednesday, April 8, 2026 11:16 AM
To: openembedded-core@lists.openembedded.org<mailto:openembedded-core@lists.openembedded.org>
Cc: Sundeep.Kokkonda@windriver.com<mailto:Sundeep.Kokkonda@windriver.com>; Hemanth.KumarMD@windriver.com<mailto:Hemanth.KumarMD@windriver.com>
Subject: [OE-core] [PATCH] glibc: stable 2.43 branch updates
From: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com><mailto:Hemanth.KumarMD@windriver.com>
$ git log --oneline 856c426a753450b8c6861a5b994a564f4fc16d4b..ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c
ce1013a197 tests: fix tst-rseq with Linux 7.0
60cabd0464 riscv: Resolve calls to memcpy using memcpy-generic in early startup
02ffd413cf elf: Use dl-symbol-redir-ifunc.h instead _dl_strlen
2695314378 elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
dd9945c0ba resolv: Check hostname for validity (CVE-2026-4438)
5c6fca0c62 resolv: Count records correctly (CVE-2026-4437)
2be6cf2e75 posix: Run tst-wordexp-reuse-mem test
305ce0b588 aarch64: Tests for locking GCS
2ee41ba6ec aarch64: Lock GCS status at startup
fa4a40c7d4 tests: aarch64: fix makefile dependencies for dlopen tests for BTI
9898ea58b5 malloc: Avoid accessing /sys/kernel/mm files
c3ceb93dc4 Add BZ 33904 entry to NEWS
911bd469f8 debug: Fix build with --enable-fortify-source=1 (BZ 33904)
48f5a05a7a nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
d6cb7ce0e9 Linux: In getlogin_r, use utmp fallback only for specific errors
140c760d71 nss: Introduce dedicated struct nss_database_for_fork type
Testing Results:
+--------------+--------+--------+------+
| Result | Before | After | Diff |
+--------------+--------+--------+------+
| PASS | 6770 | 6774 | +4 |
| XPASS | 4 | 4 | 0 |
| FAIL | 29 | 28 | -1 |
| XFAIL | 16 | 16 | 0 |
| UNSUPPORTED | 489 | 490 | +1 |
+--------------+--------+--------+------+
Changes in testcases:
+------------------------------------------------------+--------+-------------+
| Testcase | Before | After |
+------------------------------------------------------+--------+-------------+
| elf/tst-tls20 | FAIL | PASS |
| posix/tst-wordexp-reuse-mem | N/A | PASS |
| resolv/tst-resolv-invalid-ptr | N/A | PASS |
| resolv/tst-resolv-dns-section | N/A | PASS |
| nss/tst-nss-malloc-failure-getlogin_r | N/A | UNSUPPORTED |
+------------------------------------------------------+--------+-------------+
Justification:
commit - 2be6cf2e75 posix: Run tst-wordexp-reuse-mem test
Fixes Makefile dependency to ensure the testcase is executed.
Passing new testcase:
+PASS: posix/tst-wordexp-reuse-mem
commit - dd9945c0ba resolv: Check hostname for validity (CVE-2026-4438)
Adds validation for hostname parsing and introduces a regression test.
Passing new testcase:
+PASS: resolv/tst-resolv-invalid-ptr
commit - 5c6fca0c62 resolv: Count records correctly (CVE-2026-4437)
Fixes DNS answer section parsing and adds a regression test.
Passing new testcase:
+PASS: resolv/tst-resolv-dns-section
commit - 48f5a05a7a nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
Fixes null pointer dereference and improves NSS handling.
Added testcase:
UNSUPPORTED: nss/tst-nss-malloc-failure-getlogin_r
Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com><mailto:Hemanth.KumarMD@windriver.com>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 89be8fcb88..015e7943c5 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.43/master"
PV = "2.43+git"
-SRCREV_glibc ?= "856c426a753450b8c6861a5b994a564f4fc16d4b"
+SRCREV_glibc ?= "ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c"
SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
--
2.49.0
--
Regards,
Hemanth Kumar M D
[-- Attachment #2: Type: text/html, Size: 13878 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [OE-core] [PATCH] glibc: stable 2.43 branch updates
2026-05-07 22:48 [PATCH] " Peter Marko
@ 2026-05-11 16:39 ` Randy MacLeod
2026-05-11 19:07 ` Marko, Peter
2026-05-14 13:02 ` Sundeep KOKKONDA
0 siblings, 2 replies; 10+ messages in thread
From: Randy MacLeod @ 2026-05-11 16:39 UTC (permalink / raw)
To: peter.marko, openembedded-core, Kokkonda, Sundeep
[-- Attachment #1: Type: text/plain, Size: 3718 bytes --]
On 2026-05-07 18:48, Peter Marko via lists.openembedded.org wrote:
> From: Peter Marko<peter.marko@siemens.com>
>
> $ git log --oneline ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c..e9517114acc77c0b8af9da6700107df16882b701
> e9517114ac (origin/release/2.43/master) abilist.awk: Handle weak unversioned defined symbols
> 1634cc11a5 Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
> d1d8d27164 include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
> 8362e8ce10 Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
>
> Testing Results:
> +--------------+--------+--------+------+
> | Result | Before | After | Diff |
> +--------------+--------+--------+------+
> | PASS | 6629 | 6632 | +3 |
> | XPASS | 4 | 4 | 0 |
> | FAIL | 105 | 103 | -2 |
> | XFAIL | 16 | 16 | 0 |
> | UNSUPPORTED | 559 | 559 | 0 |
> +--------------+--------+--------+------+
>
> Changes in failed testcases:
> malloc/tst-malloc-fork-deadlock-malloc-check FAIL PASS
> malloc/tst-malloc-too-large-malloc-check PASS FAIL
From patch review meeting, we're going to merge this but I have the
following question:
It's a little odd that his failed.
Is the failure reproducible?
Sundeep, can someone on the team reproduce these results
and if the failure also happens for them explain and fix the issue?
Thanks for the update Peter.
../Randy
> nptl/tst-getpid3 FAIL PASS
> stdlib/tst-qsort3 FAIL PASS
>
> Signed-off-by: Peter Marko<peter.marko@siemens.com>
> ---
> meta/recipes-core/glibc/glibc-version.inc | 2 +-
> meta/recipes-core/glibc/glibc_2.43.bb | 4 +++-
> 2 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
> index 015e7943c5..af3db54cee 100644
> --- a/meta/recipes-core/glibc/glibc-version.inc
> +++ b/meta/recipes-core/glibc/glibc-version.inc
> @@ -1,6 +1,6 @@
> SRCBRANCH ?= "release/2.43/master"
> PV = "2.43+git"
> -SRCREV_glibc ?= "ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c"
> +SRCREV_glibc ?= "e9517114acc77c0b8af9da6700107df16882b701"
> SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
>
> GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https" diff --git a/meta/recipes-core/glibc/glibc_2.43.bb
> b/meta/recipes-core/glibc/glibc_2.43.bb index ffc17eb072..b84c55ca17
> 100644 --- a/meta/recipes-core/glibc/glibc_2.43.bb +++
> b/meta/recipes-core/glibc/glibc_2.43.bb @@ -17,7 +17,9 @@ Allows for
> ASLR bypass so can bypass some hardening, not an exploit in itself, m
> easier access for another. 'ASLR bypass itself is not a vulnerability.'"
>
> CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
> -CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438"
> +CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438 \
> + CVE-2026-4046 \
> +"
> CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
>
> DEPENDS += "gperf-native bison-native"
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#236626):https://lists.openembedded.org/g/openembedded-core/message/236626
> Mute This Topic:https://lists.openembedded.org/mt/119206065/3616765
> Group Owner:openembedded-core+owner@lists.openembedded.org
> Unsubscribe:https://lists.openembedded.org/g/openembedded-core/unsub [randy.macleod@windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
--
# Randy MacLeod
# Wind River Linux
[-- Attachment #2: Type: text/html, Size: 5551 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* RE: [OE-core] [PATCH] glibc: stable 2.43 branch updates
2026-05-11 16:39 ` [OE-core] " Randy MacLeod
@ 2026-05-11 19:07 ` Marko, Peter
2026-05-14 13:02 ` Sundeep KOKKONDA
1 sibling, 0 replies; 10+ messages in thread
From: Marko, Peter @ 2026-05-11 19:07 UTC (permalink / raw)
To: Randy MacLeod, openembedded-core@lists.openembedded.org,
Kokkonda, Sundeep
> -----Original Message-----
> From: Randy MacLeod <randy.macleod@windriver.com>
> Sent: Monday, May 11, 2026 6:40 PM
> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
> openembedded-core@lists.openembedded.org; Kokkonda, Sundeep
> <Sundeep.Kokkonda@windriver.com>
> Subject: Re: [OE-core] [PATCH] glibc: stable 2.43 branch updates
>
> On 2026-05-07 18:48, Peter Marko via lists.openembedded.org wrote:
>
>
> From: Peter Marko <peter.marko@siemens.com>
> <mailto:peter.marko@siemens.com>
>
> $ git log --oneline
> ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c..e9517114acc77c0b8af9da6700107df
> 16882b701
> e9517114ac (origin/release/2.43/master) abilist.awk: Handle weak
> unversioned defined symbols
> 1634cc11a5 Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if
> undefined (bug 33921)
> d1d8d27164 include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
> 8362e8ce10 Use pending character state in IBM1390, IBM1399 character
> sets (CVE-2026-4046)
>
> Testing Results:
> +--------------+--------+--------+------+
> | Result | Before | After | Diff |
> +--------------+--------+--------+------+
> | PASS | 6629 | 6632 | +3 |
> | XPASS | 4 | 4 | 0 |
> | FAIL | 105 | 103 | -2 |
> | XFAIL | 16 | 16 | 0 |
> | UNSUPPORTED | 559 | 559 | 0 |
> +--------------+--------+--------+------+
>
> Changes in failed testcases:
> malloc/tst-malloc-fork-deadlock-malloc-check FAIL PASS
> malloc/tst-malloc-too-large-malloc-check PASS FAIL
>
> From patch review meeting, we're going to merge this but I have the following
> question:
>
> It's a little odd that his failed.
>
> Is the failure reproducible?
>
> Sundeep, can someone on the team reproduce these results
> and if the failure also happens for them explain and fix the issue?
These tests are randomly failing.
If you check some previous glibc update commits from me, some contain the same testcase names.
Strange is that when I do a local build, then the failures are sticky, not changing anymore.
I tend to not upgrade glibc because of this weirdness but is it's too long since last update and CVEs are getting fixed, I just go for it and hope it goes through the system.
I guess I'll stop sending these updates as I always get back the same questions and wait until someone with better testing infrastructure does that.
Peter
>
> Thanks for the update Peter.
>
> ../Randy
>
>
> nptl/tst-getpid3 FAIL PASS
> stdlib/tst-qsort3 FAIL PASS
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> <mailto:peter.marko@siemens.com>
> ---
> meta/recipes-core/glibc/glibc-version.inc | 2 +-
> meta/recipes-core/glibc/glibc_2.43.bb | 4 +++-
> 2 files changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-
> core/glibc/glibc-version.inc
> index 015e7943c5..af3db54cee 100644
> --- a/meta/recipes-core/glibc/glibc-version.inc
> +++ b/meta/recipes-core/glibc/glibc-version.inc
> @@ -1,6 +1,6 @@
> SRCBRANCH ?= "release/2.43/master"
> PV = "2.43+git"
> -SRCREV_glibc ?= "ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c"
> +SRCREV_glibc ?= "e9517114acc77c0b8af9da6700107df16882b701"
> SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
>
> GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
> diff --git a/meta/recipes-core/glibc/glibc_2.43.bb b/meta/recipes-
> core/glibc/glibc_2.43.bb
> index ffc17eb072..b84c55ca17 100644
> --- a/meta/recipes-core/glibc/glibc_2.43.bb
> +++ b/meta/recipes-core/glibc/glibc_2.43.bb
> @@ -17,7 +17,9 @@ Allows for ASLR bypass so can bypass some
> hardening, not an exploit in itself, m
> easier access for another. 'ASLR bypass itself is not a vulnerability.'"
> <mailto:diff--gita/meta/recipes-core/glibc/glibc_2.43.bbb/meta/recipes-
> core/glibc/glibc_2.43.bbindexffc17eb072..b84c55ca17100644---a/meta/recipes-
> core/glibc/glibc_2.43.bb+++b/meta/recipes-core/glibc/glibc_2.43.bb@@-
> 17,7+17,9@@AllowsforASLRbypasssocanbypasssomehardening,notanexploitinitself
> ,measieraccessforanother.'ASLRbypassitselfisnotavulnerability.'>
>
> CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
> -CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-
> 0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438"
> +CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-
> 0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438 \
> + CVE-2026-4046 \
> +"
> CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix
> available in used git hash"
>
> DEPENDS += "gperf-native bison-native"
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#236626):
> https://lists.openembedded.org/g/openembedded-core/message/236626
> Mute This Topic: https://lists.openembedded.org/mt/119206065/3616765
> Group Owner: openembedded-core+owner@lists.openembedded.org
> <mailto:openembedded-core+owner@lists.openembedded.org>
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
> [randy.macleod@windriver.com <mailto:randy.macleod@windriver.com> ]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
>
>
>
> --
> # Randy MacLeod
> # Wind River Linux
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [OE-core] [PATCH] glibc: stable 2.43 branch updates
2026-05-11 16:39 ` [OE-core] " Randy MacLeod
2026-05-11 19:07 ` Marko, Peter
@ 2026-05-14 13:02 ` Sundeep KOKKONDA
1 sibling, 0 replies; 10+ messages in thread
From: Sundeep KOKKONDA @ 2026-05-14 13:02 UTC (permalink / raw)
To: Randy MacLeod, peter.marko, openembedded-core
On 11-May-26 22:09, Randy MacLeod wrote:
> On 2026-05-07 18:48, Peter Marko via lists.openembedded.org wrote:
>> From: Peter Marko<peter.marko@siemens.com>
>>
>> $ git log --oneline ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c..e9517114acc77c0b8af9da6700107df16882b701
>> e9517114ac (origin/release/2.43/master) abilist.awk: Handle weak unversioned defined symbols
>> 1634cc11a5 Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
>> d1d8d27164 include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
>> 8362e8ce10 Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
>>
>> Testing Results:
>> +--------------+--------+--------+------+
>> | Result | Before | After | Diff |
>> +--------------+--------+--------+------+
>> | PASS | 6629 | 6632 | +3 |
>> | XPASS | 4 | 4 | 0 |
>> | FAIL | 105 | 103 | -2 |
>> | XFAIL | 16 | 16 | 0 |
>> | UNSUPPORTED | 559 | 559 | 0 |
>> +--------------+--------+--------+------+
>>
>> Changes in failed testcases:
>> malloc/tst-malloc-fork-deadlock-malloc-check FAIL PASS
>> malloc/tst-malloc-too-large-malloc-check PASS FAIL
>
> From patch review meeting, we're going to merge this but I have the
> following question:
>
> It's a little odd that his failed.
>
> Is the failure reproducible?
>
> Sundeep, can someone on the team reproduce these results
> and if the failure also happens for them explain and fix the issue?
I checked the earlier updates and with our local tests also we do
sometimes see inconsistent behavior with malloc tests. We will
further analyze these tests and update here (if needed will be handled
with a bugzilla issue).
Thanks,
Sundeep K.
>
> Thanks for the update Peter.
>
> ../Randy
>> nptl/tst-getpid3 FAIL PASS
>> stdlib/tst-qsort3 FAIL PASS
>>
>> Signed-off-by: Peter Marko<peter.marko@siemens.com>
>> ---
>> meta/recipes-core/glibc/glibc-version.inc | 2 +-
>> meta/recipes-core/glibc/glibc_2.43.bb | 4 +++-
>> 2 files changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
>> index 015e7943c5..af3db54cee 100644
>> --- a/meta/recipes-core/glibc/glibc-version.inc
>> +++ b/meta/recipes-core/glibc/glibc-version.inc
>> @@ -1,6 +1,6 @@
>> SRCBRANCH ?= "release/2.43/master"
>> PV = "2.43+git"
>> -SRCREV_glibc ?= "ce1013a197eb4a3b8ff2b07e0672f4d0b976ce7c"
>> +SRCREV_glibc ?= "e9517114acc77c0b8af9da6700107df16882b701"
>> SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
>>
>> GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https" diff --git a/meta/recipes-core/glibc/glibc_2.43.bb
>> b/meta/recipes-core/glibc/glibc_2.43.bb index ffc17eb072..b84c55ca17
>> 100644 --- a/meta/recipes-core/glibc/glibc_2.43.bb +++
>> b/meta/recipes-core/glibc/glibc_2.43.bb @@ -17,7 +17,9 @@ Allows for
>> ASLR bypass so can bypass some hardening, not an exploit in itself, m
>> easier access for another. 'ASLR bypass itself is not a vulnerability.'"
>>
>> CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
>> -CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438"
>> +CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438 \
>> + CVE-2026-4046 \
>> +"
>> CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
>>
>> DEPENDS += "gperf-native bison-native"
>>
>> -=-=-=-=-=-=-=-=-=-=-=-
>> Links: You receive all messages sent to this group.
>> View/Reply Online (#236626):https://lists.openembedded.org/g/openembedded-core/message/236626
>> Mute This Topic:https://lists.openembedded.org/mt/119206065/3616765
>> Group Owner:openembedded-core+owner@lists.openembedded.org
>> Unsubscribe:https://lists.openembedded.org/g/openembedded-core/unsub [randy.macleod@windriver.com]
>> -=-=-=-=-=-=-=-=-=-=-=-
>>
>
> --
> # Randy MacLeod
> # Wind River Linux
^ permalink raw reply [flat|nested] 10+ messages in thread
* [OE-core][PATCH] glibc: stable 2.43 branch updates
@ 2026-07-27 11:29 Adarsh Jagadish Kamini
2026-07-28 4:43 ` Mathieu Dubois-Briand
0 siblings, 1 reply; 10+ messages in thread
From: Adarsh Jagadish Kamini @ 2026-07-27 11:29 UTC (permalink / raw)
To: openembedded-core
Update SRCREV to pull the latest fixes from the upstream
release/2.43/master branch, including fixes for the following CVEs:
CVE-2026-5435 resolv: More types as unknown in ns_sprintrrf
CVE-2026-5450 stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
CVE-2026-5928 libio: Fix ungetwc operating on byte stream [BZ #33998]
CVE-2026-6238 resolv: Fix buffer overreads in ns_sprintrrf
CVE-2026-6791 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091)
Commits between the old SRCREV (e9517114ac) and the new SRCREV (1c9988e525):
1c9988e525 rtld: cache cpuid results on the stack for intel
dae425b554 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
8759917de5 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
3a418da6a3 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
e64ae5a591 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
c9225a3e73 resolv: Check for inet_ntop failure in ns_sprintrrf
c46f7b2fd6 resolv: Improve formatting of unknown records in ns_sprintrrf
1d7d1a16b0 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
349297a4eb resolv: Declare __p_class_syms, __p_type_syms for internal use
fdf10644d6 hppa: Fix missing call to __feraiseexcept (BZ 34306)
a6fa9a9594 arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
fe0ccc9564 iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
22f3d24a6b Hurd: restore some SIOC ioctls
a13ebdbc7e Hurd: comment ioctls which cannot currently compile
446f708e4c Hurd: comment PF_ROUTE/AF_ROUTE defines
ced45fd472 Hurd: comment PF_LINK/AF_LINK defines
89cbf46693 elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
18b97b03b7 Rename __unused fields to __glibc_reserved.
a47b5b2b3e math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
4070d808be stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
2890b35cd3 libio: Fix ungetwc operating on byte stream [BZ #33998]
Testing Results:
Before After Diff
PASS 6609 6611 +2
XPASS 4 4 0
FAIL 131 132 +1
XFAIL 16 16 0
UNSUPPORTED 554 555 +1
Changes in testcases:
testcase-name before after
resolv/tst-ns_sprintrr(new) - PASS
nptl/tst-robustpi7 PASS FAIL
[Note: The uplift adds new testcases including resolv/tst-ns_sprintrr
from commit 8759917de5, which passes, accounting for the PASS and
UNSUPPORTED increases.
nptl/tst-robustpi7 shows as PASS->FAIL, but it is a flaky test under
QEMU user-mode emulation (PI robust-mutex handling). No nptl code was
changed in the SRCREV range.]
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.43.bb | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index af3db54cee..cf5a444095 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.43/master"
PV = "2.43+git"
-SRCREV_glibc ?= "e9517114acc77c0b8af9da6700107df16882b701"
+SRCREV_glibc ?= "1c9988e52540c844928c6d93ff45305adc2c24a0"
SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
diff --git a/meta/recipes-core/glibc/glibc_2.43.bb b/meta/recipes-core/glibc/glibc_2.43.bb
index b84c55ca17..9f3a3814d0 100644
--- a/meta/recipes-core/glibc/glibc_2.43.bb
+++ b/meta/recipes-core/glibc/glibc_2.43.bb
@@ -19,6 +19,7 @@ easier access for another. 'ASLR bypass itself is not a vulnerability.'"
CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438 \
CVE-2026-4046 \
+ CVE-2026-5435 CVE-2026-5450 CVE-2026-5928 CVE-2026-6238 CVE-2026-6791 \
"
CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
--
2.34.1
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [OE-core][PATCH] glibc: stable 2.43 branch updates
2026-07-27 11:29 [OE-core][PATCH] glibc: stable 2.43 branch updates Adarsh Jagadish Kamini
@ 2026-07-28 4:43 ` Mathieu Dubois-Briand
2026-07-28 8:24 ` Adarsh Jagadish Kamini
0 siblings, 1 reply; 10+ messages in thread
From: Mathieu Dubois-Briand @ 2026-07-28 4:43 UTC (permalink / raw)
To: Adarsh Jagadish Kamini, openembedded-core
On Mon Jul 27, 2026 at 1:29 PM CEST, Adarsh Jagadish Kamini wrote:
> Update SRCREV to pull the latest fixes from the upstream
> release/2.43/master branch, including fixes for the following CVEs:
>
> CVE-2026-5435 resolv: More types as unknown in ns_sprintrrf
> CVE-2026-5450 stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
> CVE-2026-5928 libio: Fix ungetwc operating on byte stream [BZ #33998]
> CVE-2026-6238 resolv: Fix buffer overreads in ns_sprintrrf
> CVE-2026-6791 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091)
>
> Commits between the old SRCREV (e9517114ac) and the new SRCREV (1c9988e525):
>
> 1c9988e525 rtld: cache cpuid results on the stack for intel
> dae425b554 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
> 8759917de5 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
> 3a418da6a3 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
> e64ae5a591 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
> c9225a3e73 resolv: Check for inet_ntop failure in ns_sprintrrf
> c46f7b2fd6 resolv: Improve formatting of unknown records in ns_sprintrrf
> 1d7d1a16b0 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
> 349297a4eb resolv: Declare __p_class_syms, __p_type_syms for internal use
> fdf10644d6 hppa: Fix missing call to __feraiseexcept (BZ 34306)
> a6fa9a9594 arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
> fe0ccc9564 iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
> 22f3d24a6b Hurd: restore some SIOC ioctls
> a13ebdbc7e Hurd: comment ioctls which cannot currently compile
> 446f708e4c Hurd: comment PF_ROUTE/AF_ROUTE defines
> ced45fd472 Hurd: comment PF_LINK/AF_LINK defines
> 89cbf46693 elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
> 18b97b03b7 Rename __unused fields to __glibc_reserved.
> a47b5b2b3e math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
> 4070d808be stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
> 2890b35cd3 libio: Fix ungetwc operating on byte stream [BZ #33998]
>
> Testing Results:
> Before After Diff
> PASS 6609 6611 +2
> XPASS 4 4 0
> FAIL 131 132 +1
> XFAIL 16 16 0
> UNSUPPORTED 554 555 +1
>
> Changes in testcases:
>
> testcase-name before after
> resolv/tst-ns_sprintrr(new) - PASS
> nptl/tst-robustpi7 PASS FAIL
>
> [Note: The uplift adds new testcases including resolv/tst-ns_sprintrr
> from commit 8759917de5, which passes, accounting for the PASS and
> UNSUPPORTED increases.
>
> nptl/tst-robustpi7 shows as PASS->FAIL, but it is a flaky test under
> QEMU user-mode emulation (PI robust-mutex handling). No nptl code was
> changed in the SRCREV range.]
>
> Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
> ---
Hi Adarsh,
Thanks for your patch, but this is not building at all. You will need to
refresh or drop some patches:
ERROR: nativesdk-glibc-2.43+git-r1 do_patch: Applying patch '/srv/pokybuild/yocto-worker/genericx86-64/build/layers/openembedded-core/meta/recipes-core/glibc/glibc/0023-CVE-2026-5450.patch' on target directory '/srv/pokybuild/yocto-worker/genericx86-64/build/build/tmp/work/x86_64-nativesdk-pokysdk-linux/nativesdk-glibc/2.43+git/sources/glibc-2.43+git'
https://autobuilder.yoctoproject.org/valkyrie/#/builders/4/builds/4241
Can you have a look at the issue?
Thanks,
Mathieu
--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [OE-core][PATCH] glibc: stable 2.43 branch updates
2026-07-28 4:43 ` Mathieu Dubois-Briand
@ 2026-07-28 8:24 ` Adarsh Jagadish Kamini
2026-07-28 10:02 ` Adarsh Jagadish Kamini
0 siblings, 1 reply; 10+ messages in thread
From: Adarsh Jagadish Kamini @ 2026-07-28 8:24 UTC (permalink / raw)
To: Mathieu Dubois-Briand, openembedded-core@lists.openembedded.org
________________________________________
From: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Sent: Tuesday, July 28, 2026 06:43
To: Adarsh Jagadish Kamini; openembedded-core@lists.openembedded.org
Subject: Re: [OE-core][PATCH] glibc: stable 2.43 branch updates
On Mon Jul 27, 2026 at 1:29 PM CEST, Adarsh Jagadish Kamini wrote:
> Update SRCREV to pull the latest fixes from the upstream
> release/2.43/master branch, including fixes for the following CVEs:
>
> CVE-2026-5435 resolv: More types as unknown in ns_sprintrrf
> CVE-2026-5450 stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
> CVE-2026-5928 libio: Fix ungetwc operating on byte stream [BZ #33998]
> CVE-2026-6238 resolv: Fix buffer overreads in ns_sprintrrf
> CVE-2026-6791 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091)
>
> Commits between the old SRCREV (e9517114ac) and the new SRCREV (1c9988e525):
>
> 1c9988e525 rtld: cache cpuid results on the stack for intel
> dae425b554 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
> 8759917de5 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
> 3a418da6a3 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
> e64ae5a591 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
> c9225a3e73 resolv: Check for inet_ntop failure in ns_sprintrrf
> c46f7b2fd6 resolv: Improve formatting of unknown records in ns_sprintrrf
> 1d7d1a16b0 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
> 349297a4eb resolv: Declare __p_class_syms, __p_type_syms for internal use
> fdf10644d6 hppa: Fix missing call to __feraiseexcept (BZ 34306)
> a6fa9a9594 arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
> fe0ccc9564 iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
> 22f3d24a6b Hurd: restore some SIOC ioctls
> a13ebdbc7e Hurd: comment ioctls which cannot currently compile
> 446f708e4c Hurd: comment PF_ROUTE/AF_ROUTE defines
> ced45fd472 Hurd: comment PF_LINK/AF_LINK defines
> 89cbf46693 elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
> 18b97b03b7 Rename __unused fields to __glibc_reserved.
> a47b5b2b3e math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
> 4070d808be stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
> 2890b35cd3 libio: Fix ungetwc operating on byte stream [BZ #33998]
>
> Testing Results:
> Before After Diff
> PASS 6609 6611 +2
> XPASS 4 4 0
> FAIL 131 132 +1
> XFAIL 16 16 0
> UNSUPPORTED 554 555 +1
>
> Changes in testcases:
>
> testcase-name before after
> resolv/tst-ns_sprintrr(new) - PASS
> nptl/tst-robustpi7 PASS FAIL
>
> [Note: The uplift adds new testcases including resolv/tst-ns_sprintrr
> from commit 8759917de5, which passes, accounting for the PASS and
> UNSUPPORTED increases.
>
> nptl/tst-robustpi7 shows as PASS->FAIL, but it is a flaky test under
> QEMU user-mode emulation (PI robust-mutex handling). No nptl code was
> changed in the SRCREV range.]
>
> Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
> ---
Hi Adarsh,
Thanks for your patch, but this is not building at all. You will need to
refresh or drop some patches:
ERROR: nativesdk-glibc-2.43+git-r1 do_patch: Applying patch '/srv/pokybuild/yocto-worker/genericx86-64/build/layers/openembedded-core/meta/recipes-core/glibc/glibc/0023-CVE-2026-5450.patch' on target directory '/srv/pokybuild/yocto-worker/genericx86-64/build/build/tmp/work/x86_64-nativesdk-pokysdk-linux/nativesdk-glibc/2.43+git/sources/glibc-2.43+git'
https://autobuilder.yoctoproject.org/valkyrie/#/builders/4/builds/4241
Can you have a look at the issue?
Thanks,
Mathieu
--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
Hi Mathieu,
I will check again.
Thanks!
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [OE-core][PATCH] glibc: stable 2.43 branch updates
2026-07-28 8:24 ` Adarsh Jagadish Kamini
@ 2026-07-28 10:02 ` Adarsh Jagadish Kamini
0 siblings, 0 replies; 10+ messages in thread
From: Adarsh Jagadish Kamini @ 2026-07-28 10:02 UTC (permalink / raw)
To: Mathieu Dubois-Briand, openembedded-core@lists.openembedded.org
________________________________________
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Sent: Tuesday, July 28, 2026 10:24
To: Mathieu Dubois-Briand; openembedded-core@lists.openembedded.org
Subject: Re: [OE-core][PATCH] glibc: stable 2.43 branch updates
________________________________________
From: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Sent: Tuesday, July 28, 2026 06:43
To: Adarsh Jagadish Kamini; openembedded-core@lists.openembedded.org
Subject: Re: [OE-core][PATCH] glibc: stable 2.43 branch updates
On Mon Jul 27, 2026 at 1:29 PM CEST, Adarsh Jagadish Kamini wrote:
> Update SRCREV to pull the latest fixes from the upstream
> release/2.43/master branch, including fixes for the following CVEs:
>
> CVE-2026-5435 resolv: More types as unknown in ns_sprintrrf
> CVE-2026-5450 stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
> CVE-2026-5928 libio: Fix ungetwc operating on byte stream [BZ #33998]
> CVE-2026-6238 resolv: Fix buffer overreads in ns_sprintrrf
> CVE-2026-6791 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091)
>
> Commits between the old SRCREV (e9517114ac) and the new SRCREV (1c9988e525):
>
> 1c9988e525 rtld: cache cpuid results on the stack for intel
> dae425b554 posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
> 8759917de5 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
> 3a418da6a3 resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
> e64ae5a591 resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
> c9225a3e73 resolv: Check for inet_ntop failure in ns_sprintrrf
> c46f7b2fd6 resolv: Improve formatting of unknown records in ns_sprintrrf
> 1d7d1a16b0 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
> 349297a4eb resolv: Declare __p_class_syms, __p_type_syms for internal use
> fdf10644d6 hppa: Fix missing call to __feraiseexcept (BZ 34306)
> a6fa9a9594 arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
> fe0ccc9564 iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
> 22f3d24a6b Hurd: restore some SIOC ioctls
> a13ebdbc7e Hurd: comment ioctls which cannot currently compile
> 446f708e4c Hurd: comment PF_ROUTE/AF_ROUTE defines
> ced45fd472 Hurd: comment PF_LINK/AF_LINK defines
> 89cbf46693 elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
> 18b97b03b7 Rename __unused fields to __glibc_reserved.
> a47b5b2b3e math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
> 4070d808be stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
> 2890b35cd3 libio: Fix ungetwc operating on byte stream [BZ #33998]
>
> Testing Results:
> Before After Diff
> PASS 6609 6611 +2
> XPASS 4 4 0
> FAIL 131 132 +1
> XFAIL 16 16 0
> UNSUPPORTED 554 555 +1
>
> Changes in testcases:
>
> testcase-name before after
> resolv/tst-ns_sprintrr(new) - PASS
> nptl/tst-robustpi7 PASS FAIL
>
> [Note: The uplift adds new testcases including resolv/tst-ns_sprintrr
> from commit 8759917de5, which passes, accounting for the PASS and
> UNSUPPORTED increases.
>
> nptl/tst-robustpi7 shows as PASS->FAIL, but it is a flaky test under
> QEMU user-mode emulation (PI robust-mutex handling). No nptl code was
> changed in the SRCREV range.]
>
> Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
> ---
Hi Adarsh,
Thanks for your patch, but this is not building at all. You will need to
refresh or drop some patches:
ERROR: nativesdk-glibc-2.43+git-r1 do_patch: Applying patch '/srv/pokybuild/yocto-worker/genericx86-64/build/layers/openembedded-core/meta/recipes-core/glibc/glibc/0023-CVE-2026-5450.patch' on target directory '/srv/pokybuild/yocto-worker/genericx86-64/build/build/tmp/work/x86_64-nativesdk-pokysdk-linux/nativesdk-glibc/2.43+git/sources/glibc-2.43+git'
https://autobuilder.yoctoproject.org/valkyrie/#/builders/4/builds/4241
Can you have a look at the issue?
Thanks,
Mathieu
--
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
Hi Mathieu,
I will check again.
Thanks!
Hi,
I see that there is a patch file for CVE-2026-5450, which creates the conflict. I also noticed that there is a patch submitted to uplift glibc to latest stable 2.44 that was submitted today. So, my patch is now irrelevant. I will drop this patch.
Thanks!
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-07-28 10:38 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-27 11:29 [OE-core][PATCH] glibc: stable 2.43 branch updates Adarsh Jagadish Kamini
2026-07-28 4:43 ` Mathieu Dubois-Briand
2026-07-28 8:24 ` Adarsh Jagadish Kamini
2026-07-28 10:02 ` Adarsh Jagadish Kamini
-- strict thread matches above, loose matches on Subject: below --
2026-05-07 22:48 [PATCH] " Peter Marko
2026-05-11 16:39 ` [OE-core] " Randy MacLeod
2026-05-11 19:07 ` Marko, Peter
2026-05-14 13:02 ` Sundeep KOKKONDA
2026-04-08 9:16 Hemanth.KumarMD
2026-04-08 9:43 ` [OE-core] " Marko, Peter
2026-04-08 11:21 ` Hemanth Kumar M D
2026-04-08 11:28 ` Marko, Peter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.