* [OE-core][scarthgap 01/37] python3-pyopenssl: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 02/37] python3-idna: " Fabien Thomas
` (37 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: "mark.yang" <mark.yang@lge.com>
The pypi class default python:pyopenssl matches nothing in the CVE
databases, which have used four vendor spellings for pyOpenSSL over
the years:
* CVE-2013-4314 (jean-paul_calderone:pyopenssl)
* CVE-2018-1000807 (pyopenssl:pyopenssl)
* CVE-2018-1000808 (pyopenssl_project:pyopenssl)
* CVE-2026-27448, CVE-2026-27459 (pyca:pyopenssl in the CNA records,
pyopenssl:pyopenssl in the NVD CPEs)
Set all four vendor:product pairs.
For scarthgap, python3-pyopenssl is 24.0.0. CVE-2026-27448 and
CVE-2026-27459 are fixed in 26.0.0, so this metadata change will
expose those CVEs as applicable/unpatched. The fixes for these CVEs
need to be handled separately.
Note: Original commit was for python3-pyopenssl_26.0.0.bb. This is
adjusted for scarthgap where recipe version is
python3-pyopenssl_24.0.0.bb.
(From OE-Core rev: f6cc7e0c0a4a906244fc8cd4b45706d42a931fce)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ba3d752e577004f871fe7f4235e2625410140a08)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb b/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb
index 94a70aa17d1..ab00730b570 100644
--- a/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb
+++ b/meta/recipes-devtools/python/python3-pyopenssl_24.0.0.bb
@@ -8,6 +8,7 @@ DEPENDS += "openssl python3-cryptography"
SRC_URI[sha256sum] = "6aa33039a93fffa4563e655b61d11364d01264be8ccb49906101e02a334530bf"
PYPI_PACKAGE = "pyOpenSSL"
+CVE_PRODUCT = "jean-paul_calderone:pyopenssl pyca:pyopenssl pyopenssl:pyopenssl pyopenssl_project:pyopenssl"
inherit pypi setuptools3
SRC_URI += " \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 02/37] python3-idna: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 01/37] python3-pyopenssl: set CVE_PRODUCT Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 03/37] python3-certifi: " Fabien Thomas
` (36 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: "mark.yang" <mark.yang@lge.com>
The pypi class default python:idna matches nothing in the CVE
databases, which track the Python idna CVEs as:
* CVE-2024-3651 (kjd:internationalized_domain_names_in_applications) [1]
* CVE-2026-45409 (kjd:idna in the CNA record, same NVD CPE as above)
Set both vendor:product pairs.
For scarthgap, python3-idna is 3.7. CVE-2026-45409 affects idna
versions before 3.15, so this metadata change will expose that CVE as
applicable/unpatched. The fix for CVE-2026-45409 needs to be handled
separately.
The bare product name is not an option here: it would also match
"servo:idna", the Rust idna crate (e.g. CVE-2024-12224).
Note: Original commit was for python3-idna_3.11.bb. This is adjusted
for scarthgap where recipe version is python3-idna_3.7.bb.
[1] https://nvd.nist.gov/vuln/detail/CVE-2024-3651
(From OE-Core rev: 70a1b17edf909715065c1d727f989fc07f8db8bf)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48428c0fe22d8ecbfa53efffb28173d4d37539e6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-devtools/python/python3-idna_3.7.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-idna_3.7.bb b/meta/recipes-devtools/python/python3-idna_3.7.bb
index 729aff1c462..e4213be5dfc 100644
--- a/meta/recipes-devtools/python/python3-idna_3.7.bb
+++ b/meta/recipes-devtools/python/python3-idna_3.7.bb
@@ -5,6 +5,8 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=204c0612e40a4dd46012a78d02c80fb1"
SRC_URI[sha256sum] = "028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc"
+CVE_PRODUCT = "kjd:idna kjd:internationalized_domain_names_in_applications"
+
inherit pypi python_flit_core
RDEPENDS:${PN}:class-target = "\
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 03/37] python3-certifi: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 01/37] python3-pyopenssl: set CVE_PRODUCT Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 02/37] python3-idna: " Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 04/37] python3-xmltodict: " Fabien Thomas
` (35 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: "mark.yang" <mark.yang@lge.com>
NVD tracks certifi as certifi:certifi, so the default python:certifi
vendor prefix never matches and its CVEs are not evaluated at all.
Use the exact vendor:product pair.
For scarthgap, python3-certifi is 2024.2.2. CVE-2024-39689 affects
certifi versions before 2024.7.4, but this recipe already carries
CVE-2024-39689.patch. With this mapping, cve-check can evaluate that
existing backport against the correct NVD product instead of missing
the CVE mapping.
Note: Original commit was for python3-certifi_2026.2.25.bb. This is
adjusted for scarthgap where recipe version is
python3-certifi_2024.2.2.bb.
(From OE-Core rev: e6773f4c819544eae93f3efa7d2101b448db4ebb)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 26c49743ec431a3cc39803664eec8851be75756e)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-devtools/python/python3-certifi_2024.2.2.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb b/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb
index 116add2079d..b3d6cf080cc 100644
--- a/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb
+++ b/meta/recipes-devtools/python/python3-certifi_2024.2.2.bb
@@ -12,6 +12,8 @@ SRC_URI += "file://CVE-2024-39689.patch \
SRC_URI[sha256sum] = "0569859f95fc761b18b45ef421b1290a0f65f147e92a1e5eb3e635f9a5e4e66f"
+CVE_PRODUCT = "certifi:certifi"
+
inherit pypi setuptools3
BBCLASSEXTEND = "native nativesdk"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 04/37] python3-xmltodict: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (2 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 03/37] python3-certifi: " Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 05/37] python3-pyyaml: " Fabien Thomas
` (34 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: "mark.yang" <mark.yang@lge.com>
The CVE databases track xmltodict as xmltodict:xmltodict, so the
default python:xmltodict vendor prefix never matches and its CVEs
are not evaluated at all. Use the exact vendor:product pair.
Note: Original commit was for python3-xmltodict_1.0.4.bb. This is
adjusted for scarthgap where recipe version is python3-xmltodict_0.13.0.bb.
(From OE-Core rev: 918d1fd448ff96431197031e5adb1be658156bc2)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2229426b729adf85780c23d38c85fc3cf090f6ba)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb b/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb
index 9a308a29d2c..33bf49b1fcc 100644
--- a/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb
+++ b/meta/recipes-devtools/python/python3-xmltodict_0.13.0.bb
@@ -7,6 +7,8 @@ SRC_URI[sha256sum] = "341595a488e3e01a85a9d8911d8912fd922ede5fecc4dce437eb4b6c8d
PYPI_PACKAGE = "xmltodict"
+CVE_PRODUCT = "xmltodict:xmltodict"
+
BBCLASSEXTEND = "native nativesdk"
inherit pypi setuptools3 ptest
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 05/37] python3-pyyaml: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (3 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 04/37] python3-xmltodict: " Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 06/37] gnutls: fix CVE-2026-3833 Fabien Thomas
` (33 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: "mark.yang" <mark.yang@lge.com>
The pypi class default python:pyyaml vendor prefix matches nothing,
so PyYAML CVEs are not evaluated at all. The databases use two
vendor spellings: pyyaml in the NVD CPEs, and "Red Hat" (with a
space, not expressible as a vendor:product pair) in CVE-2020-1747's
CNA record. Use the bare product name to cover both.
All four existing CVEs (CVE-2017-18342, CVE-2019-20477,
CVE-2020-1747, CVE-2020-14343) are fixed by 5.4, so they resolve as
not affected at 6.0.1.
Note: Original commit was for python3-pyyaml_6.0.3.bb. This is adjusted
for scarthgap where recipe version is python3-pyyaml_6.0.1.bb.
(From OE-Core rev: 666e25c1fe1347da307726afd87554ffc080ed12)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 89a0ba3c2da2a7755bafb28afbf75dc7112e2549)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb b/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb
index 33883125570..07bf851fce3 100644
--- a/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb
+++ b/meta/recipes-devtools/python/python3-pyyaml_6.0.1.bb
@@ -7,6 +7,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=6d8242660a8371add5fe547adf083079"
PYPI_PACKAGE = "PyYAML"
+CVE_PRODUCT = "pyyaml"
+
inherit pypi python_setuptools_build_meta
SRC_URI += "file://0001-Fix-builds-with-Cython-3.patch"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 06/37] gnutls: fix CVE-2026-3833
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (4 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 05/37] python3-pyyaml: " Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 07/37] expat: fix CVE-2026-56403 Fabien Thomas
` (32 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Backport patch to fix CVE-2026-3833.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-3833
Upstream fix:
https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5
Tested with ptest:
Before: PASSED: 369, FAILED: 0, SKIPPED: 17
After: PASSED: 369, FAILED: 0, SKIPPED: 17
(From OE-Core rev: c4d9e204adc134b1d7d2b3b8ea9bbfd6fd33e5f5)
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../gnutls/gnutls/CVE-2026-3833.patch | 90 +++++++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.4.bb | 1 +
2 files changed, 91 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch
new file mode 100644
index 00000000000..a92703bb26d
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch
@@ -0,0 +1,90 @@
+From 47f495820c5c049933563e869e931a2180e0a428 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Mon, 16 Mar 2026 15:29:40 +0100
+Subject: [PATCH] x509/name-constraints: compare domain names case-insensitive
+
+RFC 5280 7.2:
+> When comparing DNS names for equality, conforming implementations
+> MUST perform a case-insensitive exact match on the entire DNS name.
+> When evaluating name constraints, conforming implementations MUST
+> perform a case-insensitive exact match on a label-by-label basis.
+
+Domain name comparison during name constraints processing
+was case-sensitive. For excluded name constraints, this could lead to
+incorrectly accepting domain names that should've been rejected.
+The code for comparing domain names and domain name parts of emails
+has been modified to perform case-insensitive comparison instead.
+
+Reported-by: Oleh Konko <security@1seal.org>
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1223
+Fixes: #1803
+Fixes: #1852
+Fixes: CVE-2026-3833
+Fixes: GNUTLS-SA-2026-04-29-5
+CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+
+CVE: CVE-2026-3833
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/x509/name_constraints.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c
+index 04722bdf4..dee045d25 100644
+--- a/lib/x509/name_constraints.c
++++ b/lib/x509/name_constraints.c
+@@ -35,6 +35,7 @@
+ #include "x509_int.h"
+ #include "x509_ext_int.h"
+ #include <libtasn1.h>
++#include "c-strcase.h"
+
+ #include "ip.h"
+ #include "ip-in-cidr.h"
+@@ -80,7 +81,7 @@ enum name_constraint_relation {
+ NC_SORTS_AFTER = 2 /* unrelated constraints */
+ };
+
+-/* A helper to compare just a pair of strings with this rich comparison */
++/* Helpers to compare just a pair of strings with this rich comparison */
+ static enum name_constraint_relation
+ compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len)
+ {
+@@ -96,6 +97,22 @@ compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len)
+ return NC_EQUAL;
+ }
+
++static enum name_constraint_relation
++compare_strings_case_insensitive(const void *n1, size_t n1_len, const void *n2,
++ size_t n2_len)
++{
++ int r = c_strncasecmp(n1, n2, MIN(n1_len, n2_len));
++ if (r < 0)
++ return NC_SORTS_BEFORE;
++ if (r > 0)
++ return NC_SORTS_AFTER;
++ if (n1_len < n2_len)
++ return NC_SORTS_BEFORE;
++ if (n1_len > n2_len)
++ return NC_SORTS_AFTER;
++ return NC_EQUAL;
++}
++
+ /* Rich-compare DNS names. Example order/relationships:
+ * z.x.a INCLUDED_BY x.a BEFORE y.a INCLUDED_BY a BEFORE x.b BEFORE y.b */
+ static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1,
+@@ -121,8 +138,8 @@ static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1,
+ while (j && n2->data[j - 1] != '.')
+ j--;
+
+- rel = compare_strings(&n1->data[i], i_end - i, &n2->data[j],
+- j_end - j);
++ rel = compare_strings_case_insensitive(&n1->data[i], i_end - i,
++ &n2->data[j], j_end - j);
+ if (rel == NC_SORTS_BEFORE) /* x.a BEFORE y.a */
+ return NC_SORTS_BEFORE;
+ if (rel == NC_SORTS_AFTER) /* y.a AFTER x.a */
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.4.bb b/meta/recipes-support/gnutls/gnutls_3.8.4.bb
index d27d2cfa748..676c5c6f940 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.4.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.4.bb
@@ -45,6 +45,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://CVE-2025-14831-9.patch \
file://CVE-2026-42009_p1.patch \
file://CVE-2026-42009_p2.patch \
+ file://CVE-2026-3833.patch \
"
SRC_URI[sha256sum] = "2bea4e154794f3f00180fa2a5c51fe8b005ac7a31cd58bd44cdfa7f36ebc3a9b"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 07/37] expat: fix CVE-2026-56403
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (5 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 06/37] gnutls: fix CVE-2026-3833 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 08/37] expat: fix CVE-2026-56408 Fabien Thomas
` (31 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
These patches apply the upstream fixes shown in [1] and [2], as
referenced by [3].
[1] https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648
[2] https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-56403
(From OE-Core rev: a9e124fc7c48291392676a3cf26cde4acd660fa5)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56403_p1.patch | 81 +++++++++++++++++++
.../expat/expat/CVE-2026-56403_p2.patch | 52 ++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 2 +
3 files changed, 135 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
new file mode 100644
index 00000000000..8c9860c6e67
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
@@ -0,0 +1,81 @@
+From b689559597116ee75a633453e2f7177c8541b04e Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Wed, 20 May 2026 12:12:10 +0200
+Subject: [PATCH 01/17] lib: Protect function `storeAtts` from signed integer
+ overflow
+
+CVE: CVE-2026-56403
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648]
+
+Backport Changes:
+- Adapt storeAtts to the Scarthgap 2.6.4 loop and URI allocation
+ logic while preserving the upstream overflow checks.
+
+(cherry picked from commit 12dc6d8d3d65f79471a94d8565f6bf1cf245f648)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 9bc67f38..df92a3ca 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -4226,26 +4226,32 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ return XML_ERROR_NONE;
+ prefixLen = 0;
+ if (parser->m_ns_triplets && binding->prefix->name) {
+- for (; binding->prefix->name[prefixLen++];)
+- ; /* prefixLen includes null terminator */
++ size_t candidateLen = 0;
++ for (; binding->prefix->name[candidateLen++];)
++ ; /* candidateLen includes null terminator */
++ /* Detect and prevent integer overflow */
++ if (candidateLen > INT_MAX)
++ return XML_ERROR_NO_MEMORY;
++ prefixLen = (int)candidateLen;
+ }
+ tagNamePtr->localPart = localPart;
+ tagNamePtr->uriLen = binding->uriLen;
+ tagNamePtr->prefix = binding->prefix->name;
+ tagNamePtr->prefixLen = prefixLen;
+- for (i = 0; localPart[i++];)
+- ; /* i includes null terminator */
++
++ size_t localPartLen = 0;
++ for (; localPart[localPartLen++];)
++ ; /* localPartLen includes null terminator */
+
+ /* Detect and prevent integer overflow */
+- if (binding->uriLen > INT_MAX - prefixLen
+- || i > INT_MAX - (binding->uriLen + prefixLen)) {
++ if (localPartLen > INT_MAX || binding->uriLen > INT_MAX - prefixLen
++ || localPartLen > (size_t)INT_MAX - (binding->uriLen + prefixLen)) {
+ return XML_ERROR_NO_MEMORY;
+ }
+
+- n = i + binding->uriLen + prefixLen;
++ n = (int)localPartLen + binding->uriLen + prefixLen;
+ if (n > binding->uriAlloc) {
+ TAG *p;
+-
+ /* Detect and prevent integer overflow */
+ if (n > INT_MAX - EXPAND_SPARE) {
+ return XML_ERROR_NO_MEMORY;
+@@ -4273,10 +4279,14 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ }
+ /* if m_namespaceSeparator != '\0' then uri includes it already */
+ uri = binding->uri + binding->uriLen;
+- memcpy(uri, localPart, i * sizeof(XML_Char));
++ /* Detect and prevent integer overflow */
++ if (localPartLen > SIZE_MAX / sizeof(XML_Char)) {
++ return XML_ERROR_NO_MEMORY;
++ }
++ memcpy(uri, localPart, localPartLen * sizeof(XML_Char));
+ /* we always have a namespace separator between localPart and prefix */
+ if (prefixLen) {
+- uri += i - 1;
++ uri += localPartLen - 1;
+ *uri = parser->m_namespaceSeparator; /* replace null terminator */
+ memcpy(uri + 1, binding->prefix->name, prefixLen * sizeof(XML_Char));
+ }
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
new file mode 100644
index 00000000000..88cb66c5469
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
@@ -0,0 +1,52 @@
+From 2855ce68a1ce9732267c06734427930364ab66c1 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Fri, 22 May 2026 00:43:52 +0200
+Subject: [PATCH 02/17] xmlwf: Protect function `xcsdup` from signed integer
+ overflow
+
+CVE: CVE-2026-56403
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15]
+
+Backport Changes:
+- Add stdint.h and convert count and numBytes to size_t because
+ Scarthgap 2.6.4 lacks these upstream prerequisites.
+
+(cherry picked from commit 147c8f36d6277d5c6011c098370a8362aed47b15)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index fd4fc3f8..7bbdb303 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -45,6 +45,7 @@
+
+ #include <assert.h>
+ #include <stdio.h>
++#include <stdint.h>
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <string.h>
+@@ -304,13 +305,18 @@ processingInstruction(void *userData, const XML_Char *target,
+ static XML_Char *
+ xcsdup(const XML_Char *s) {
+ XML_Char *result;
+- int count = 0;
+- int numBytes;
++ size_t count = 0;
++ size_t numBytes;
+
+ /* Get the length of the string, including terminator */
+ while (s[count++] != 0) {
+ /* Do nothing */
+ }
++
++ // Detect and prevent integer overflow
++ if (count > SIZE_MAX / sizeof(XML_Char))
++ return NULL;
++
+ numBytes = count * sizeof(XML_Char);
+ result = malloc(numBytes);
+ if (result == NULL)
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 3581d94fac4..de03bab4ab7 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -61,6 +61,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-45186-05.patch \
file://CVE-2026-45186-06.patch \
file://CVE-2026-45186-07.patch \
+ file://CVE-2026-56403_p1.patch;striplevel=2 \
+ file://CVE-2026-56403_p2.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 08/37] expat: fix CVE-2026-56408
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (6 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 07/37] expat: fix CVE-2026-56403 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 09/37] expat: fix CVE-2026-56404 Fabien Thomas
` (30 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
The fix is adapted to the existing Scarthgap Expat 2.6.4 source.
[1] https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56408
(From OE-Core rev: 7a0997b570488debe1ae1f2ab5a312150a96b940)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56408.patch | 29 +++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 1 +
2 files changed, 30 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56408.patch b/meta/recipes-core/expat/expat/CVE-2026-56408.patch
new file mode 100644
index 00000000000..8e066565ba2
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56408.patch
@@ -0,0 +1,29 @@
+From c1ad5610cf060c6374d8f8d3b39163edd7053321 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Thu, 23 Apr 2026 10:31:45 +0200
+Subject: [PATCH 03/17] lib: Waterproof `copyString` from integer overflow
+
+CVE: CVE-2026-56408
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817]
+
+(cherry picked from commit 16e2efd867ea8567ffa012210b52ef5918e20817)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index df92a3ca..12bbe23e 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -8489,6 +8489,10 @@ copyString(const XML_Char *s, XML_Parser parser) {
+ /* Include the terminator */
+ charsRequired++;
+
++ /* Detect and prevent integer overflow */
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char))
++ return NULL;
++
+ /* Now allocate space for the copy */
+ result = MALLOC(parser, charsRequired * sizeof(XML_Char));
+ if (result == NULL)
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index de03bab4ab7..7fe81749095 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -63,6 +63,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-45186-07.patch \
file://CVE-2026-56403_p1.patch;striplevel=2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
+ file://CVE-2026-56408.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 09/37] expat: fix CVE-2026-56404
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (7 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 08/37] expat: fix CVE-2026-56408 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 10/37] expat: fix CVE-2026-56405 Fabien Thomas
` (29 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56404
(From OE-Core rev: 5ac52606f2aae12323b29026e3d8af24a9c278bf)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56404.patch | 45 +++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 1 +
2 files changed, 46 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56404.patch b/meta/recipes-core/expat/expat/CVE-2026-56404.patch
new file mode 100644
index 00000000000..bd5f99742b7
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56404.patch
@@ -0,0 +1,45 @@
+From d8e09a54fa9214e64d8e73057ca6918d08857022 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Thu, 28 May 2026 12:44:11 +0530
+Subject: [PATCH 04/17] lib: protect function addBinding from signed integer
+ overflow
+
+CVE: CVE-2026-56404
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164]
+
+(cherry picked from commit babfc48090977cbf7be24b2c48f6053dca75c164)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 12bbe23e..9d21e136 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -4456,6 +4456,10 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ }
+
+ for (len = 0; uri[len]; len++) {
++ /* Detect and prevent signed integer overflow */
++ if (len == INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ if (isXML && (len > xmlLen || uri[len] != xmlNamespace[len]))
+ isXML = XML_FALSE;
+
+@@ -4496,8 +4500,13 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ if (isXMLNS)
+ return XML_ERROR_RESERVED_NAMESPACE_URI;
+
+- if (parser->m_namespaceSeparator)
++ if (parser->m_namespaceSeparator) {
++ /* Detect and prevent signed integer overflow */
++ if (len == INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ len++;
++ }
+ if (parser->m_freeBindingList) {
+ b = parser->m_freeBindingList;
+ if (len > b->uriAlloc) {
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 7fe81749095..5e3aef3b7ea 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -64,6 +64,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56403_p1.patch;striplevel=2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
file://CVE-2026-56408.patch;striplevel=2 \
+ file://CVE-2026-56404.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 10/37] expat: fix CVE-2026-56405
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (8 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 09/37] expat: fix CVE-2026-56404 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 11/37] expat: fix CVE-2026-56410 Fabien Thomas
` (28 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56405
(From OE-Core rev: 7d9b2576a9dcb01184c0aa3bd54a6bdd20496bbe)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56405.patch | 30 +++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 1 +
2 files changed, 31 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56405.patch b/meta/recipes-core/expat/expat/CVE-2026-56405.patch
new file mode 100644
index 00000000000..67595173414
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56405.patch
@@ -0,0 +1,30 @@
+From 49ba5bdafa7aaee9b77a32ffaa798e625bd46e73 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Fri, 29 May 2026 11:45:17 +0530
+Subject: [PATCH 05/17] lib: Protect function getAttributeId from signed
+ integer overflow
+
+CVE: CVE-2026-56405
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0]
+
+(cherry picked from commit 2c6c42d33689f6b266a5267b639e03cde17e53c0)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 9d21e136..80ad0811 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -7312,6 +7312,10 @@ getAttributeId(XML_Parser parser, const ENCODING *enc, const char *start,
+ } else {
+ int i;
+ for (i = 0; name[i]; i++) {
++ /* Detect and prevent signed integer overflow */
++ if (i == INT_MAX) {
++ return NULL;
++ }
+ /* attributes without prefix are *not* in the default namespace */
+ if (name[i] == XML_T(ASCII_COLON)) {
+ int j;
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 5e3aef3b7ea..6d71393b2a5 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -65,6 +65,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
file://CVE-2026-56408.patch;striplevel=2 \
file://CVE-2026-56404.patch;striplevel=2 \
+ file://CVE-2026-56405.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 11/37] expat: fix CVE-2026-56410
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (9 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 10/37] expat: fix CVE-2026-56405 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 12/37] expat: fix CVE-2026-56406 Fabien Thomas
` (27 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
These patches apply the upstream fixes shown in [1] and [2], as
referenced by [3].
[1] https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347
[2] https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-56410
(From OE-Core rev: 51d1871b3551deddd9f5fac85fdcd4b2793b94f0)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56410_p1.patch | 46 +++++++++++++++++++
.../expat/expat/CVE-2026-56410_p2.patch | 39 ++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 2 +
3 files changed, 87 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
new file mode 100644
index 00000000000..6f906e682d3
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
@@ -0,0 +1,46 @@
+From b454931c42290c9f0faf2a01f9634d82db636bac Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Fri, 29 May 2026 17:51:25 +0530
+Subject: [PATCH 06/17] xmlwf: protect resolveSystemId from integer overflow
+
+CVE: CVE-2026-56410
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347]
+
+Backport Changes:
+- Adapt the allocation hunk to Scarthgap 2.6.4's explicit cast and
+ include stdint.h so SIZE_MAX is available.
+
+(cherry picked from commit deeb97f7c88d17a16b0ea2521a13733abc283347)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlfile.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlfile.c b/expat/xmlwf/xmlfile.c
+index 9c4f7f8d..ad691b12 100644
+--- a/expat/xmlwf/xmlfile.c
++++ b/expat/xmlwf/xmlfile.c
+@@ -41,6 +41,7 @@
+ #include "expat_config.h"
+
+ #include <stdio.h>
++#include <stdint.h>
+ #include <stdlib.h>
+ #include <stddef.h>
+ #include <string.h>
+@@ -130,8 +131,13 @@ resolveSystemId(const XML_Char *base, const XML_Char *systemId,
+ #endif
+ )
+ return systemId;
+- *toFree = (XML_Char *)malloc((tcslen(base) + tcslen(systemId) + 2)
+- * sizeof(XML_Char));
++ const size_t charsRequired = tcslen(base) + tcslen(systemId) + 2;
++
++ /* Detect and prevent integer overflow */
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char))
++ return systemId;
++
++ *toFree = malloc(charsRequired * sizeof(XML_Char));
+ if (! *toFree)
+ return systemId;
+ tcscpy(*toFree, base);
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
new file mode 100644
index 00000000000..148592ba9bc
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
@@ -0,0 +1,39 @@
+From 7e6230212ddc4ea74115218fdbe5717e8e1c0f2b Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Sat, 30 May 2026 11:28:51 +0530
+Subject: [PATCH 07/17] xmlwf: guard each operator in resolveSystemId length
+ sum
+
+CVE: CVE-2026-56410
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea]
+
+(cherry picked from commit cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlfile.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlfile.c b/expat/xmlwf/xmlfile.c
+index ad691b12..4d2e3220 100644
+--- a/expat/xmlwf/xmlfile.c
++++ b/expat/xmlwf/xmlfile.c
+@@ -131,9 +131,17 @@ resolveSystemId(const XML_Char *base, const XML_Char *systemId,
+ #endif
+ )
+ return systemId;
+- const size_t charsRequired = tcslen(base) + tcslen(systemId) + 2;
++ const size_t baseLen = tcslen(base);
++ const size_t systemIdLen = tcslen(systemId);
+
+- /* Detect and prevent integer overflow */
++ /* Detect and prevent integer overflow in the addition (without risking
++ underflow) */
++ if (baseLen > SIZE_MAX - systemIdLen || baseLen > SIZE_MAX - systemIdLen - 2)
++ return systemId;
++
++ const size_t charsRequired = baseLen + systemIdLen + 2;
++
++ /* Detect and prevent integer overflow in the multiplication */
+ if (charsRequired > SIZE_MAX / sizeof(XML_Char))
+ return systemId;
+
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 6d71393b2a5..39e40befc44 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -66,6 +66,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56408.patch;striplevel=2 \
file://CVE-2026-56404.patch;striplevel=2 \
file://CVE-2026-56405.patch;striplevel=2 \
+ file://CVE-2026-56410_p1.patch;striplevel=2 \
+ file://CVE-2026-56410_p2.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 12/37] expat: fix CVE-2026-56406
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (10 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 11/37] expat: fix CVE-2026-56410 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 13/37] expat: fix CVE-2026-56409 Fabien Thomas
` (26 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [3].
The prerequisite in [2] provides XML_INDEX_MAX for the Scarthgap Expat
2.6.4 backport.
[1] https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d
[2] https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-56406
(From OE-Core rev: 6cbc3b17313df01c48e738a87f8d12bc8834fd59)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/CVE-2026-56406-dependent.patch | 59 +++++++++++++++++++
.../expat/expat/CVE-2026-56406.patch | 34 +++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 2 +
3 files changed, 95 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch b/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
new file mode 100644
index 00000000000..d749ef06089
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
@@ -0,0 +1,59 @@
+From 9aafa47798332618f08af046c3471de1f3a9e031 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Wed, 27 May 2026 17:01:44 -0700
+Subject: [PATCH 08/17] lib: Make `XML_Index` overflow check more intuitive
+
+In fixing a bug, 7e5b71b748491b6e459e5c9a1d090820f94544d8 introduced a magic number `2` in this code that made it difficult to understand the rationale for this overflow check without reading the commit log. This change introduces some more readable constants to use in these situations.
+
+CVE: CVE-2026-56406
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd]
+
+Backport Changes:
+- Adapt include context for Scarthgap 2.6.4 and expose SIZE_MAX in
+ the existing stdint.h comment.
+
+(cherry picked from commit 252ff1a307b1490ce0f430632791e7e52d7e43fd)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 80ad0811..5bf706b0 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -97,10 +97,10 @@
+ #include <stddef.h>
+ #include <string.h> /* memset(), memcpy() */
+ #include <assert.h>
+-#include <limits.h> /* UINT_MAX */
++#include <limits.h> /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */
+ #include <stdio.h> /* fprintf */
+ #include <stdlib.h> /* getenv, rand_s */
+-#include <stdint.h> /* uintptr_t */
++#include <stdint.h> /* SIZE_MAX, uintptr_t */
+ #include <math.h> /* isnan */
+
+ #ifdef _WIN32
+@@ -211,6 +211,12 @@ typedef char ICHAR;
+
+ #endif
+
++#ifdef XML_LARGE_SIZE
++# define XML_INDEX_MAX LLONG_MAX
++#else
++# define XML_INDEX_MAX LONG_MAX
++#endif
++
+ /* Round up n to be a multiple of sz, where sz is a power of 2. */
+ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1))
+
+@@ -2360,7 +2366,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) {
+ int nLeftOver;
+ enum XML_Status result;
+ /* Detect overflow (a+b > MAX <==> b > MAX-a) */
+- if ((XML_Size)len > ((XML_Size)-1) / 2 - parser->m_parseEndByteIndex) {
++ if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) {
+ parser->m_errorCode = XML_ERROR_NO_MEMORY;
+ parser->m_eventPtr = parser->m_eventEndPtr = NULL;
+ parser->m_processor = errorProcessor;
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56406.patch b/meta/recipes-core/expat/expat/CVE-2026-56406.patch
new file mode 100644
index 00000000000..56de9e41249
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56406.patch
@@ -0,0 +1,34 @@
+From 5db699faa6af1c66e96abec5dbd1908efd64ef70 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 31 May 2026 15:18:58 +0200
+Subject: [PATCH 09/17] lib: Copy overflow check from `XML_Parse` to
+ `XML_ParseBuffer`
+
+CVE: CVE-2026-56406
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d]
+
+(cherry picked from commit 99d8454fdf900a6d00c2a52748e6c0eeb507574d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 5bf706b0..9f07b860 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -2483,6 +2483,14 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+ parser->m_parsingStatus.parsing = XML_PARSING;
+ }
+
++ // Detect and avoid integer overflow
++ if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) {
++ parser->m_errorCode = XML_ERROR_NO_MEMORY;
++ parser->m_eventPtr = parser->m_eventEndPtr = NULL;
++ parser->m_processor = errorProcessor;
++ return XML_STATUS_ERROR;
++ }
++
+ start = parser->m_bufferPtr;
+ parser->m_positionPtr = start;
+ parser->m_bufferEnd += len;
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 39e40befc44..aa2a4f89669 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -68,6 +68,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56405.patch;striplevel=2 \
file://CVE-2026-56410_p1.patch;striplevel=2 \
file://CVE-2026-56410_p2.patch;striplevel=2 \
+ file://CVE-2026-56406-dependent.patch;striplevel=2 \
+ file://CVE-2026-56406.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 13/37] expat: fix CVE-2026-56409
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (11 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 12/37] expat: fix CVE-2026-56406 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 14/37] expat: fix CVE-2026-56411 Fabien Thomas
` (25 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56409
(From OE-Core rev: 6e0669fdbf661569083b7fe479bf829e6e476f72)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56409.patch | 51 +++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 1 +
2 files changed, 52 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56409.patch b/meta/recipes-core/expat/expat/CVE-2026-56409.patch
new file mode 100644
index 00000000000..b0aac260739
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56409.patch
@@ -0,0 +1,51 @@
+From 174ce18f2a283be634d830a5259bd07142635fe8 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Mon, 1 Jun 2026 11:53:19 +0530
+Subject: [PATCH 10/17] xmlwf: protect output path join from integer overflow
+
+CVE: CVE-2026-56409
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e]
+
+Backport Changes:
+- Adapt the allocation hunk to the explicit XML_Char cast used by
+ Scarthgap 2.6.4; overflow checks are unchanged.
+
+(cherry picked from commit 61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index 7bbdb303..bd5f68a4 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -1240,8 +1240,26 @@ tmain(int argc, XML_Char **argv) {
+ }
+ #endif
+ }
+- outName = (XML_Char *)malloc((tcslen(outputDir) + tcslen(file) + 2)
+- * sizeof(XML_Char));
++ const size_t outputDirLen = tcslen(outputDir);
++ const size_t fileLen = tcslen(file);
++
++ /* Detect and prevent integer overflow in the addition (without
++ risking underflow) and the multiplication, mirroring the guards
++ in xcsdup() and resolveSystemId() */
++ if (outputDirLen > SIZE_MAX - fileLen
++ || outputDirLen > SIZE_MAX - fileLen - 2) {
++ tperror(T("Could not allocate memory"));
++ exit(XMLWF_EXIT_INTERNAL_ERROR);
++ }
++
++ const size_t charsRequired = outputDirLen + fileLen + 2;
++
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char)) {
++ tperror(T("Could not allocate memory"));
++ exit(XMLWF_EXIT_INTERNAL_ERROR);
++ }
++
++ outName = malloc(charsRequired * sizeof(XML_Char));
+ if (! outName) {
+ tperror(T("Could not allocate memory"));
+ exit(XMLWF_EXIT_INTERNAL_ERROR);
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index aa2a4f89669..0f996f882ba 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -70,6 +70,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56410_p2.patch;striplevel=2 \
file://CVE-2026-56406-dependent.patch;striplevel=2 \
file://CVE-2026-56406.patch;striplevel=2 \
+ file://CVE-2026-56409.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 14/37] expat: fix CVE-2026-56411
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (12 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 13/37] expat: fix CVE-2026-56409 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 15/37] expat: fix CVE-2026-56407 Fabien Thomas
` (24 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56411
(From OE-Core rev: 61f895ea50fc7d6e3c1f3bac9e77f3a7ac96de6a)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56411.patch | 50 +++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 1 +
2 files changed, 51 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56411.patch b/meta/recipes-core/expat/expat/CVE-2026-56411.patch
new file mode 100644
index 00000000000..c6dd601f202
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56411.patch
@@ -0,0 +1,50 @@
+From 5e696e78f8c4a709c4f774973b142e57090c4364 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Tue, 2 Jun 2026 13:13:34 +0530
+Subject: [PATCH 11/17] xmlwf: protect notation list allocation from integer
+ overflow
+
+CVE: CVE-2026-56411
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5]
+
+Backport Changes:
+- Use Scarthgap 2.6.4 freeNotations cleanup and return directly
+ because the newer shared cleanUp label is absent.
+
+(cherry picked from commit 528a4e5017e1bd3b48b689fd0c131df940ae3ea5)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index bd5f68a4..6a3d31b7 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -387,9 +387,9 @@ static void XMLCALL
+ endDoctypeDecl(void *userData) {
+ XmlwfUserData *data = (XmlwfUserData *)userData;
+ NotationList **notations;
+- int notationCount = 0;
++ size_t notationCount = 0;
+ NotationList *p;
+- int i;
++ size_t i;
+
+ /* How many notations do we have? */
+ for (p = data->notationListHead; p != NULL; p = p->next)
+@@ -401,6 +401,14 @@ endDoctypeDecl(void *userData) {
+ return;
+ }
+
++ /* Detect and prevent integer overflow in the multiplication, mirroring
++ the guards in xcsdup() and resolveSystemId() */
++ if (notationCount > SIZE_MAX / sizeof(NotationList *)) {
++ fprintf(stderr, "Unable to sort notations");
++ freeNotations(data);
++ return;
++ }
++
+ notations = malloc(notationCount * sizeof(NotationList *));
+ if (notations == NULL) {
+ fprintf(stderr, "Unable to sort notations");
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 0f996f882ba..fb36108eafa 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -71,6 +71,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56406-dependent.patch;striplevel=2 \
file://CVE-2026-56406.patch;striplevel=2 \
file://CVE-2026-56409.patch;striplevel=2 \
+ file://CVE-2026-56411.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 15/37] expat: fix CVE-2026-56407
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (13 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 14/37] expat: fix CVE-2026-56411 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 16/37] expat: fix CVE-2026-56132 Fabien Thomas
` (23 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56407
(From OE-Core rev: 9e565187ad989856ed274feecb343744a4d0d290)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56407.patch | 41 +++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 1 +
2 files changed, 42 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56407.patch b/meta/recipes-core/expat/expat/CVE-2026-56407.patch
new file mode 100644
index 00000000000..498f93d5b93
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56407.patch
@@ -0,0 +1,41 @@
+From d1cd2bd7da8ed830e9432660616e9b4831df959a Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Tue, 2 Jun 2026 11:59:01 +0530
+Subject: [PATCH 12/17] cap entity textLen against signed integer overflow
+
+CVE: CVE-2026-56407
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13]
+
+(cherry picked from commit 30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 9f07b860..8439dc0e 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5655,6 +5655,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ parser, enc, s + enc->minBytesPerChar, next - enc->minBytesPerChar,
+ XML_ACCOUNT_NONE);
+ if (parser->m_declEntity) {
++ /* Detect and prevent signed integer overflow */
++ if ((size_t)poolLength(&dtd->entityValuePool) > (size_t)INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ parser->m_declEntity->textPtr = poolStart(&dtd->entityValuePool);
+ parser->m_declEntity->textLen
+ = (int)(poolLength(&dtd->entityValuePool));
+@@ -7076,6 +7080,11 @@ storeSelfEntityValue(XML_Parser parser, ENTITY *entity) {
+ return XML_ERROR_NO_MEMORY;
+ }
+
++ /* Detect and prevent signed integer overflow */
++ if ((size_t)poolLength(pool) > (size_t)INT_MAX) {
++ poolDiscard(pool);
++ return XML_ERROR_NO_MEMORY;
++ }
+ entity->textPtr = poolStart(pool);
+ entity->textLen = (int)(poolLength(pool));
+ poolFinish(pool);
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index fb36108eafa..2851c752977 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -72,6 +72,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56406.patch;striplevel=2 \
file://CVE-2026-56409.patch;striplevel=2 \
file://CVE-2026-56411.patch;striplevel=2 \
+ file://CVE-2026-56407.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 16/37] expat: fix CVE-2026-56132
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (14 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 15/37] expat: fix CVE-2026-56407 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 17/37] python3: fix CVE-2026-7210 Fabien Thomas
` (22 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
These patches apply the upstream fix shown in [2], its prerequisite
[1], the regression test in [3], and the follow-up cleanups in [4] and
[5], as referenced by [6].
[1] https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3
[2] https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e
[3] https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf
[4] https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4
[5] https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5
[6] https://nvd.nist.gov/vuln/detail/CVE-2026-56132
(From OE-Core rev: 0cba8f866ffe5b96dd7f2a8fe7b4c52264d382c5)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../expat/expat/CVE-2026-56132_p1.patch | 80 +++++++++++++++++++
.../expat/expat/CVE-2026-56132_p2.patch | 60 ++++++++++++++
.../expat/expat/CVE-2026-56132_p3.patch | 74 +++++++++++++++++
.../expat/expat/CVE-2026-56132_p4.patch | 60 ++++++++++++++
.../expat/expat/CVE-2026-56132_p5.patch | 56 +++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 5 ++
6 files changed, 335 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
new file mode 100644
index 00000000000..fc5b5778787
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
@@ -0,0 +1,80 @@
+From 9d1c131840a501e6664c5770046153235467f574 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH 13/17] lib: Remove reuse of `m_groupSize` to count
+ `m_scaffIndex` allocation
+
+The sizes of the two arrays `m_groupConnector` and `scaffIndex` need to
+vary independently. This change is a step towards allowing this.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3]
+
+Backport Changes:
+- Adapt scaffIndex sizing to Scarthgap 2.6.4, where m_groupSize is
+ not temporarily doubled before reallocation.
+ Keep the branch's equivalent size_t overflow check.
+
+(cherry picked from commit 3a4eaf47af8fd7abda38ea2c08308c91152061f3)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 8439dc0e..e9ad78df 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -423,6 +423,7 @@ typedef struct {
+ unsigned scaffCount;
+ int scaffLevel;
+ int *scaffIndex;
++ size_t scaffIndexSize;
+ } DTD;
+
+ enum EntityType {
+@@ -5975,6 +5976,7 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (new_scaff_index == NULL)
+ return XML_ERROR_NO_MEMORY;
+ dtd->scaffIndex = new_scaff_index;
++ dtd->scaffIndexSize = parser->m_groupSize;
+ }
+ } else {
+ parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32);
+@@ -7575,6 +7577,7 @@ dtdCreate(XML_Parser parser) {
+
+ p->in_eldecl = XML_FALSE;
+ p->scaffIndex = NULL;
++ p->scaffIndexSize = 0;
+ p->scaffold = NULL;
+ p->scaffLevel = 0;
+ p->scaffSize = 0;
+@@ -7615,6 +7618,7 @@ dtdReset(DTD *p, XML_Parser parser) {
+
+ FREE(parser, p->scaffIndex);
+ p->scaffIndex = NULL;
++ p->scaffIndexSize = 0;
+ FREE(parser, p->scaffold);
+ p->scaffold = NULL;
+
+@@ -7790,6 +7794,7 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
+ newDtd->scaffSize = oldDtd->scaffSize;
+ newDtd->scaffLevel = oldDtd->scaffLevel;
+ newDtd->scaffIndex = oldDtd->scaffIndex;
++ newDtd->scaffIndexSize = oldDtd->scaffIndexSize;
+
+ return 1;
+ } /* End dtdCopy */
+@@ -8310,6 +8315,7 @@ nextScaffoldPart(XML_Parser parser) {
+ dtd->scaffIndex = MALLOC(parser, parser->m_groupSize * sizeof(int));
+ if (! dtd->scaffIndex)
+ return -1;
++ dtd->scaffIndexSize = parser->m_groupSize;
+ dtd->scaffIndex[0] = 0;
+ }
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
new file mode 100644
index 00000000000..c8a4971e839
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
@@ -0,0 +1,60 @@
+From a4c1b874dffcc80ee63ca3b4d6a1537c56da8dc1 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH 14/17] lib: doProlog: Fix out-of-bound scaffolding index store
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The scaffold backing array is reallocated using the caller parser’s
+per-parser `m_groupSize`, but the DTD struct (which carries
+`scaffIndex`) is shared between a parent parser and any external
+parameter-entity sub-parser created via
+`XML_ExternalEntityParserCreate(parent, NULL, …)`. A sub-parser whose
+group nesting is shallower than the parent’s can `REALLOC` the shared
+`scaffIndex` down to its own size; when the parent resumes and parses a
+deeper element content model, its bounds check passes (its private
+`m_groupSize` is still large enough), the doubling-grow path is skipped,
+and the next write lands past the shrunken buffer.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+Reported-by: Trail of Bits, in collaboration with Anthropic
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e]
+
+(cherry picked from commit 58400483d7c97be316d7a77739c0a6af5d55932e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index e9ad78df..c46c17bc 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5992,6 +5992,21 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (myindex < 0)
+ return XML_ERROR_NO_MEMORY;
+ assert(dtd->scaffIndex != NULL);
++ if ((size_t)dtd->scaffLevel >= dtd->scaffIndexSize) {
++ /* Detect and prevent integer overflow */
++ if (dtd->scaffIndexSize > SIZE_MAX / 2 / sizeof(int)) {
++ return XML_ERROR_NO_MEMORY;
++ }
++ assert(dtd->scaffIndexSize > 0);
++ const size_t new_size = dtd->scaffIndexSize * 2;
++ int *const new_scaff_index
++ = REALLOC(parser, dtd->scaffIndex, new_size * sizeof(int));
++ if (new_scaff_index == NULL) {
++ return XML_ERROR_NO_MEMORY;
++ }
++ dtd->scaffIndex = new_scaff_index;
++ dtd->scaffIndexSize = new_size;
++ }
+ dtd->scaffIndex[dtd->scaffLevel] = myindex;
+ dtd->scaffLevel++;
+ dtd->scaffold[myindex].type = XML_CTYPE_SEQ;
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
new file mode 100644
index 00000000000..1376e1d4c0c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
@@ -0,0 +1,74 @@
+From 5d4d0dab46e077b327f70a7c02a307287e8d1fe5 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH 15/17] tests: Add a test case for scaffolding array limits in
+ shared DTDs
+
+This test case provokes the bug fixed in the previous commit.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+Reported-by: Trail of Bits, in collaboration with Anthropic
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf]
+
+(cherry picked from commit 353919b3b9f2174073a557ac7d517a5f3cd0cbbf)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/tests/basic_tests.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/expat/tests/basic_tests.c b/expat/tests/basic_tests.c
+index 023d9ce4..d52dcf1c 100644
+--- a/expat/tests/basic_tests.c
++++ b/expat/tests/basic_tests.c
+@@ -4044,6 +4044,37 @@ START_TEST(test_skipped_external_entity) {
+ }
+ END_TEST
+
++START_TEST(test_scaff_index_shared_across_external_entity_parser) {
++ const char text[]
++ = "<!DOCTYPE doc [\n"
++ "<!ELEMENT a "
++ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((b))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))>\n"
++ "<!ENTITY % e SYSTEM 'ext'>\n"
++ "%e;\n"
++ "<!ELEMENT c "
++ "(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((d)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))>\n"
++ "]>\n"
++ "<doc/>";
++ ExtOption options[]
++ = {{XCS("ext"),
++ "<!ELEMENT x "
++ "((((((((((((((((((((((((((((((((y))))))))))))))))))))))))))))))))>"},
++ {NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS);
++ XML_SetUserData(parser, options);
++ XML_SetExternalEntityRefHandler(parser, external_entity_optioner);
++ XML_SetElementDeclHandler(parser, dummy_element_decl_handler);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ == XML_STATUS_ERROR)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ /* Test a different form of unknown external entity */
+ START_TEST(test_skipped_null_loaded_ext_entity) {
+ const char *text = "<!DOCTYPE doc SYSTEM 'http://example.org/one.ent'>\n"
+@@ -6399,6 +6430,8 @@ make_basic_test_case(Suite *s) {
+ tcase_add_test(tc_basic, test_trailing_cr_in_att_value);
+ tcase_add_test(tc_basic, test_standalone_internal_entity);
+ tcase_add_test(tc_basic, test_skipped_external_entity);
++ tcase_add_test__ifdef_xml_dtd(
++ tc_basic, test_scaff_index_shared_across_external_entity_parser);
+ tcase_add_test(tc_basic, test_skipped_null_loaded_ext_entity);
+ tcase_add_test(tc_basic, test_skipped_unloaded_ext_entity);
+ tcase_add_test__ifdef_xml_dtd(tc_basic, test_param_entity_with_trailing_cr);
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
new file mode 100644
index 00000000000..74d0e33a9d9
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
@@ -0,0 +1,60 @@
+From a7d7ed5d6dbcc7231529357d64eb19ede3114868 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH 16/17] lib: Remove unnecessary `scaffIndex` expansion
+
+Following the previous changes, all locations that append entries to
+`scaffIndex` handle expanding the array if it is not already large
+enough. So this extra expansion code is no longer necessary. In some
+cases such as processing siblings with alternating scaffolding counts,
+this logic would actually _shrink_ the array only to then later
+re-expand it.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4]
+
+Backport Changes:
+- Remove the Scarthgap 2.6.4 scaffIndex resize block because later
+ append paths already expand the array when required.
+
+(cherry picked from commit bca93b4ba9e15fd84425568d772b69baebf790e4)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 19 -------------------
+ 1 file changed, 19 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index c46c17bc..3afe2884 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5959,25 +5959,6 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ parser->m_groupConnector = new_connector;
+ }
+-
+- if (dtd->scaffIndex) {
+- /* Detect and prevent integer overflow.
+- * The preprocessor guard addresses the "always false" warning
+- * from -Wtype-limits on platforms where
+- * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
+-#if UINT_MAX >= SIZE_MAX
+- if (parser->m_groupSize > (size_t)(-1) / sizeof(int)) {
+- return XML_ERROR_NO_MEMORY;
+- }
+-#endif
+-
+- int *const new_scaff_index = REALLOC(
+- parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int));
+- if (new_scaff_index == NULL)
+- return XML_ERROR_NO_MEMORY;
+- dtd->scaffIndex = new_scaff_index;
+- dtd->scaffIndexSize = parser->m_groupSize;
+- }
+ } else {
+ parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32);
+ if (! parser->m_groupConnector) {
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
new file mode 100644
index 00000000000..59229f331ca
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
@@ -0,0 +1,56 @@
+From 778ba31c47f9930fe339194f4d97081e43893362 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH 17/17] lib: Remove indented scoping of `new_connector` local
+
+Following the previous change, the lifetime of `new_connector` as
+constrained by this introduced scope was identical to the parent scope.
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5]
+
+Backport Changes:
+- Retain the Scarthgap 2.6.4 unsigned integer overflow guard while
+ removing only the redundant new_connector scope.
+
+(cherry picked from commit 08baa7ef9d168b99094249998fd78f8d190526e5)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 3afe2884..df8331d5 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5945,20 +5945,18 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ case XML_ROLE_GROUP_OPEN:
+ if (parser->m_prologState.level >= parser->m_groupSize) {
+ if (parser->m_groupSize) {
+- {
+- /* Detect and prevent integer overflow */
+- if (parser->m_groupSize > (unsigned int)(-1) / 2u) {
+- return XML_ERROR_NO_MEMORY;
+- }
++ /* Detect and prevent integer overflow */
++ if (parser->m_groupSize > (unsigned int)(-1) / 2u) {
++ return XML_ERROR_NO_MEMORY;
++ }
+
+- char *const new_connector = REALLOC(
+- parser, parser->m_groupConnector, parser->m_groupSize *= 2);
+- if (new_connector == NULL) {
+- parser->m_groupSize /= 2;
+- return XML_ERROR_NO_MEMORY;
+- }
+- parser->m_groupConnector = new_connector;
++ char *const new_connector = REALLOC(parser, parser->m_groupConnector,
++ parser->m_groupSize *= 2);
++ if (new_connector == NULL) {
++ parser->m_groupSize /= 2;
++ return XML_ERROR_NO_MEMORY;
+ }
++ parser->m_groupConnector = new_connector;
+ } else {
+ parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32);
+ if (! parser->m_groupConnector) {
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 2851c752977..3387a7d7c1f 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -73,6 +73,11 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56409.patch;striplevel=2 \
file://CVE-2026-56411.patch;striplevel=2 \
file://CVE-2026-56407.patch;striplevel=2 \
+ file://CVE-2026-56132_p1.patch;striplevel=2 \
+ file://CVE-2026-56132_p2.patch;striplevel=2 \
+ file://CVE-2026-56132_p3.patch;striplevel=2 \
+ file://CVE-2026-56132_p4.patch;striplevel=2 \
+ file://CVE-2026-56132_p5.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 17/37] python3: fix CVE-2026-7210
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (15 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 16/37] expat: fix CVE-2026-56132 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 18/37] python3-pip: set CVE_PRODUCT Fabien Thomas
` (21 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Amaury Couderc <amaury.couderc@est.tech>
CVE-2026-7210 is a hash-flooding denial-of-service vulnerability in
Python's XML parsing modules (xml.parsers.expat, xml.etree.ElementTree).
An attacker can craft XML input that forces O(n²) hash collisions in
libexpat's internal name dictionary, causing excessive CPU consumption.
The previous mitigation seeded libexpat's hash function with only 4
bytes of entropy, which is insufficient against a determined attacker.
This patch upgrades to XML_SetHashSalt16Bytes (libexpat >= 2.8.0),
providing a full 16-byte secret. Older expat versions fall back
gracefully to the legacy XML_SetHashSalt via a runtime NULL check.
Backport patch to fix CVE-2026-7210.
https://nvd.nist.gov/vuln/detail/CVE-2026-7210
Upstream fix:
https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4
-- Changes from Upstream --
Replace compile-time version checks with runtime detection of the
XML_SetHashSalt16Bytes function using #pragma weak. This allows using
backported security fixes from expat even when version macros haven't
been bumped (in thus case expat 2.6.4 with CVE-2026-41080).
- Add weak symbol declaration for XML_SetHashSalt16Bytes
- Convert newxmlparseobject() version check to runtime NULL check
- Convert pyexpat_exec() CAPI export check to runtime NULL check
Tested with ptest:
Before: PASSED: 40019, FAILED: 0, SKIPPED: 1882
After: PASSED: 40020, FAILED: 0, SKIPPED: 1882
CVE: CVE-2026-7210
(From OE-Core rev: d753c46085c9d31f3b68d59f863855c909a6f400)
Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../python/python3/CVE-2026-7210.patch | 148 ++++++++++++++++++
.../python/python3_3.12.13.bb | 1 +
2 files changed, 149 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-7210.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-7210.patch b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch
new file mode 100644
index 00000000000..029eb713e42
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-7210.patch
@@ -0,0 +1,148 @@
+From 2ed6138dea0bc94c726f879501e4525712e885d1 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <stan@python.org>
+Date: Sun, 10 May 2026 18:36:26 +0100
+Subject: [PATCH] gh-149018: Use `XML_SetHashSalt16Bytes` in
+ `pyexpat`/`_elementtree` when possible (#149023)
+
+
+CVE: CVE-2026-7210
+Upstream-Status: Backport [https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4]
+
+[yocto: Use weak symbol detection for XML_SetHashSalt16Bytes instead of
+XML_COMBINED_VERSION >= 20800, since our backported expat 2.6.4 provides
+the function but does not bump the version macros.]
+
+Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
+---
+ Include/pyexpat.h | 3 +++
+ Include/pyhash.h | 8 +++++---
+ .../2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst | 3 +++
+ Modules/_elementtree.c | 8 ++++++--
+ Modules/pyexpat.c | 22 ++++++++++++++++------
+ 5 files changed, 33 insertions(+), 11 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
+
+diff --git a/Include/pyexpat.h b/Include/pyexpat.h
+index 04548b7684a..d28d6828975 100644
+--- a/Include/pyexpat.h
++++ b/Include/pyexpat.h
+@@ -57,6 +57,9 @@ struct PyExpat_CAPI
+ XML_Parser parser, unsigned long long activationThresholdBytes);
+ XML_Bool (*SetAllocTrackerMaximumAmplification)(
+ XML_Parser parser, float maxAmplificationFactor);
++ /* might be NULL for expat < 2.8.0 */
++ XML_Bool (*SetHashSalt16Bytes)(
++ XML_Parser parser, const uint8_t entropy[16]);
+ /* always add new stuff to the end! */
+ };
+
+diff --git a/Include/pyhash.h b/Include/pyhash.h
+index 182d223fab1..ec359bd2f35 100644
+--- a/Include/pyhash.h
++++ b/Include/pyhash.h
+@@ -39,14 +39,14 @@ PyAPI_FUNC(Py_hash_t) _Py_HashBytes(const void*, Py_ssize_t);
+ * pppppppp ssssssss ........ fnv -- two Py_hash_t
+ * k0k0k0k0 k1k1k1k1 ........ siphash -- two uint64_t
+ * ........ ........ ssssssss djbx33a -- 16 bytes padding + one Py_hash_t
+- * ........ ........ eeeeeeee pyexpat XML hash salt
++ * eeeeeeee eeeeeeee eeeeeeee pyexpat XML hash salt
+ *
+ * memory layout on 32 bit systems
+ * cccccccc cccccccc cccccccc uc
+ * ppppssss ........ ........ fnv -- two Py_hash_t
+ * k0k0k0k0 k1k1k1k1 ........ siphash -- two uint64_t (*)
+ * ........ ........ ssss.... djbx33a -- 16 bytes padding + one Py_hash_t
+- * ........ ........ eeee.... pyexpat XML hash salt
++ * eeeeeeee eeeeeeee eeee.... pyexpat XML hash salt
+ *
+ * (*) The siphash member may not be available on 32 bit platforms without
+ * an unsigned int64 data type.
+@@ -71,7 +71,9 @@ typedef union {
+ Py_hash_t suffix;
+ } djbx33a;
+ struct {
+- unsigned char padding[16];
++ /* 16 bytes for XML_SetHashSalt16Bytes */
++ uint8_t hashsalt16[16];
++ /* 4/8 bytes for legacy XML_SetHashSalt */
+ Py_hash_t hashsalt;
+ } expat;
+ } _Py_HashSecret_t;
+diff --git a/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst b/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
+new file mode 100644
+index 00000000000..d1b5b368684
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-04-26-19-30-45.gh-issue-149018.a9SqWb.rst
+@@ -0,0 +1,3 @@
++Improved protection against XML hash-flooding attacks in
++:mod:`xml.parsers.expat` and :mod:`xml.etree.ElementTree` when Python is
++compiled with libExpat 2.8.0 or later.
+diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
+index 56d1508af13..941376613b0 100644
+--- a/Modules/_elementtree.c
++++ b/Modules/_elementtree.c
+@@ -3657,8 +3657,12 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *target,
+ PyErr_NoMemory();
+ return -1;
+ }
+- /* expat < 2.1.0 has no XML_SetHashSalt() */
+- if (EXPAT(st, SetHashSalt) != NULL) {
++ // Prefer 16-byte entropy, only expat >= 2.8.0. See gh-149018
++ if (EXPAT(st, SetHashSalt16Bytes) != NULL) {
++ EXPAT(st, SetHashSalt16Bytes)(self->parser,
++ _Py_HashSecret.expat.hashsalt16);
++ }
++ else if (EXPAT(st, SetHashSalt) != NULL) {
+ EXPAT(st, SetHashSalt)(self->parser,
+ (unsigned long)_Py_HashSecret.expat.hashsalt);
+ }
+diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
+index 79492ca5c4f..47e3a1b2c00 100644
+--- a/Modules/pyexpat.c
++++ b/Modules/pyexpat.c
+@@ -14,6 +14,11 @@
+
+ #include "pyexpat.h"
+
++/* Use weak symbol to detect XML_SetHashSalt16Bytes at link time.
++ This allows using the backported function from expat even when the
++ version macros have not been bumped (e.g. expat 2.6.4 + CVE-2026-41080). */
++#pragma weak XML_SetHashSalt16Bytes
++
+ /* Do not emit Clinic output to a file as that wreaks havoc with conditionally
+ included methods. */
+ /*[clinic input]
+@@ -1388,10 +1393,16 @@ newxmlparseobject(pyexpat_state *state, const char *encoding,
+ Py_DECREF(self);
+ return NULL;
+ }
+-#if XML_COMBINED_VERSION >= 20100
+- /* This feature was added upstream in libexpat 2.1.0. */
+- XML_SetHashSalt(self->itself,
+- (unsigned long)_Py_HashSecret.expat.hashsalt);
++ /* Prefer 16-byte entropy (expat >= 2.8.0 or backported). */
++ if (XML_SetHashSalt16Bytes != NULL) {
++ XML_SetHashSalt16Bytes(self->itself, _Py_HashSecret.expat.hashsalt16);
++ }
++#if XML_COMBINED_VERSION >= 20100
++ else {
++ /* This feature was added upstream in libexpat 2.1.0. */
++ XML_SetHashSalt(self->itself,
++ (unsigned long)_Py_HashSecret.expat.hashsalt);
++ }
+ #endif
+ XML_SetUserData(self->itself, (void *)self);
+ XML_SetUnknownEncodingHandler(self->itself,
+@@ -2257,6 +2267,12 @@ pyexpat_exec(PyObject *mod)
+ #else
+ capi->SetHashSalt = NULL;
+ #endif
++ /* Detect at runtime via weak symbol */
++ if (XML_SetHashSalt16Bytes != NULL) {
++ capi->SetHashSalt16Bytes = XML_SetHashSalt16Bytes;
++ } else {
++ capi->SetHashSalt16Bytes = NULL;
++ }
+ #if XML_COMBINED_VERSION >= 20600
+ capi->SetReparseDeferralEnabled = XML_SetReparseDeferralEnabled;
+ #else
diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb
index de174f7bfdc..b6ceb0c6343 100644
--- a/meta/recipes-devtools/python/python3_3.12.13.bb
+++ b/meta/recipes-devtools/python/python3_3.12.13.bb
@@ -47,6 +47,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://CVE-2026-11940.patch \
file://CVE-2026-11972.patch \
file://CVE-2026-9669.patch \
+ file://CVE-2026-7210.patch \
"
SRC_URI:append:class-native = " \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 18/37] python3-pip: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (16 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 17/37] python3: fix CVE-2026-7210 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 19/37] libssh2: Fix CVE-2025-15661 Fabien Thomas
` (20 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Himanshu Jadon <hjadon@cisco.com>
CVE_PRODUCT is not set for python3-pip, so cve-check can miss or
misreport pip CVEs. CVE-2026-8643 is reported in NVD with pypa:pip.
Add CVE_PRODUCT to match the NVD product name and report this CVE
correctly.
(From OE-Core rev: 3a24c9f77622148c3894c9228e061cabf79f169f)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a486abd4889ad03e1a8ddd5311595f3ece7d61b6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-devtools/python/python3-pip_24.0.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb
index cf123a5d230..51fff41e257 100644
--- a/meta/recipes-devtools/python/python3-pip_24.0.bb
+++ b/meta/recipes-devtools/python/python3-pip_24.0.bb
@@ -41,6 +41,8 @@ do_install:append() {
rm -f ${D}/${bindir}/pip
}
+CVE_PRODUCT = "pypa:pip"
+
do_install:append(){
# pip vendors distlib which ships Windows launcher templates (*.exe).
# Keep them only when building for a Windows (mingw) host.
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 19/37] libssh2: Fix CVE-2025-15661
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (17 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 18/37] python3-pip: set CVE_PRODUCT Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 20/37] curl: fix CVE-2026-5545 Fabien Thomas
` (19 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: David Nyström <david.nystrom@est.tech>
Fix CVE-2025-15661[1] similiar to debian[2], two first commits identical,
third commit fixes a return code regression introduced by CVE fix commit.
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-15661
[2] https://sources.debian.org/patches/libssh2/1.11.1-4/
(From OE-Core rev: bfe549a53dc12382745fc49d37f3d2709fc20bec)
Signed-off-by: David Nyström <david.nystrom@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../libssh2/libssh2/CVE-2025-15661-1.patch | 45 ++++++
.../libssh2/libssh2/CVE-2025-15661-2.patch | 131 ++++++++++++++++++
.../libssh2/libssh2/CVE-2025-15661-3.patch | 57 ++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 3 +
4 files changed, 236 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch
new file mode 100644
index 00000000000..93a9e6eb596
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch
@@ -0,0 +1,45 @@
+From 95028b06d1875e07c99918145234a473e5e8521f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Nystr=C3=B6m?= <david.nystrom@est.tech>
+Date: Thu, 9 Jul 2026 12:36:24 +0000
+Subject: [PATCH 1/3] sftp: add LIBSSH2_UNCONST() macro needed by
+ CVE-2025-15661 fix
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Needed by the fix for CVE-2025-15661.
+
+Extracted from upstream commit 606c102e52f8447de2b745dd6c5ddf418defc519
+(build: enable -Wcast-qual, fix fallouts) by Viktor Szakats.
+Only the LIBSSH2_UNCONST() macro definition in libssh2_priv.h is
+included; the remainder of that commit is not applicable to this
+stable branch.
+
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/606c102e52f8447de2b745dd6c5ddf418defc519]
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ src/libssh2_priv.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h
+index 9b8866dc..bb1f8ad3 100644
+--- a/src/libssh2_priv.h
++++ b/src/libssh2_priv.h
+@@ -117,6 +117,14 @@
+ #define UINT32_MAX 0xffffffffU
+ #endif
+
++#ifdef _WIN64
++#define LIBSSH2_UNCONST(p) ((void *)(libssh2_uint64_t)(const void *)(p))
++#elif defined(_MSC_VER)
++#define LIBSSH2_UNCONST(p) ((void *)(unsigned int)(const void *)(p))
++#else
++#define LIBSSH2_UNCONST(p) ((void *)(uintptr_t)(const void *)(p))
++#endif
++
+ #if (defined(__GNUC__) || defined(__clang__)) && \
+ defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \
+ !defined(LIBSSH2_NO_FMT_CHECKS)
+--
+2.43.0
+
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch
new file mode 100644
index 00000000000..40096d3318d
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch
@@ -0,0 +1,131 @@
+From 72e8f8dd812503e07fecd775e7f88183e005d9ae Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Fri, 10 Oct 2025 08:26:20 -0700
+Subject: [PATCH 2/3] Update sftp_symlink to avoid out of bounds read on
+ malformed packet #1705 (#1717)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Use buffer struct to guard against out of bounds reads and invalid packets.
+
+Discovery Credit:
+Joshua Rogers
+
+CVE: CVE-2025-15661
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d]
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ src/sftp.c | 66 ++++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 47 insertions(+), 19 deletions(-)
+
+diff --git a/src/sftp.c b/src/sftp.c
+index 6ede3111..43b6ff90 100644
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -3795,15 +3795,19 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ {
+ LIBSSH2_CHANNEL *channel = sftp->channel;
+ LIBSSH2_SESSION *session = channel->session;
+- size_t data_len = 0, link_len;
++ size_t data_len = 0, lk_len;
+ /* 13 = packet_len(4) + packet_type(1) + request_id(4) + path_len(4) */
+ ssize_t packet_len =
+ path_len + 13 +
+ ((link_type == LIBSSH2_SFTP_SYMLINK) ? (4 + target_len) : 0);
+ unsigned char *s, *data = NULL;
++ struct string_buf buf;
+ static const unsigned char link_responses[2] =
+ { SSH_FXP_NAME, SSH_FXP_STATUS };
+ int retcode;
++ unsigned char packet_type;
++ uint32_t tmp_u32;
++ unsigned char *lk_target;
+
+ if(sftp->symlink_state == libssh2_NB_state_idle) {
+ sftp->last_errno = LIBSSH2_FX_OK;
+@@ -3891,8 +3895,25 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+
+ sftp->symlink_state = libssh2_NB_state_idle;
+
+- if(data[0] == SSH_FXP_STATUS) {
+- retcode = _libssh2_ntohu32(data + 5);
++ buf.data = (unsigned char *)LIBSSH2_UNCONST(data);
++ buf.dataptr = buf.data;
++ buf.len = data_len;
++
++ if(_libssh2_get_byte(&buf, &packet_type)) {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (type)");
++ }
++
++ if(packet_type == SSH_FXP_STATUS) {
++ if(_libssh2_get_u32(&buf, &tmp_u32)) {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (code)");
++ }
++
++ retcode = (int)tmp_u32;
++
+ LIBSSH2_FREE(session, data);
+ if(retcode == LIBSSH2_FX_OK)
+ return LIBSSH2_ERROR_NONE;
+@@ -3903,30 +3924,37 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ }
+ }
+
+- if(_libssh2_ntohu32(data + 5) < 1) {
++ /* advance past id */
++ if(_libssh2_get_u32(&buf, &tmp_u32)) {
+ LIBSSH2_FREE(session, data);
+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
+- "Invalid READLINK/REALPATH response, "
+- "no name entries");
++ "SFTP Protocol Error (id)");
+ }
+
+- if(data_len < 13) {
+- if(data_len > 0) {
+- LIBSSH2_FREE(session, data);
+- }
++ /* look for at least one link */
++ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) {
++ LIBSSH2_FREE(session, data);
+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
+- "SFTP stat packet too short");
++ "Invalid READLINK/REALPATH response, "
++ "no name entries");
+ }
+
+- /* this reads a u32 and stores it into a signed 32bit value */
+- link_len = _libssh2_ntohu32(data + 9);
+- if(link_len < target_len) {
+- memcpy(target, data + 13, link_len);
+- target[link_len] = 0;
+- retcode = (int)link_len;
++ if(_libssh2_get_string(&buf, &lk_target, &lk_len) == LIBSSH2_ERROR_NONE) {
++ if(lk_len < target_len) {
++ memcpy(target, lk_target, lk_len);
++ target[lk_len] = '\0';
++ retcode = (int)lk_len;
++ }
++ else {
++ retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;
++ }
+ }
+- else
+- retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;
++ else {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (filename)");
++ }
++
+ LIBSSH2_FREE(session, data);
+
+ return retcode;
+--
+2.43.0
+
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch
new file mode 100644
index 00000000000..f34a8778080
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch
@@ -0,0 +1,57 @@
+From 09a4a795b051c8c39957a85b36abba5d8dbd7230 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Mon, 20 Oct 2025 14:04:52 -0700
+Subject: [PATCH 3/3] Fix sftp_symlink when getting SSH_FXP_STATUS response
+ (#1731)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Move advancing past packet ID before reading the FXP_STATUS response.
+
+Note:
+Fixes return code regression introduced by:
+"Update sftp_symlink to avoid out of bounds read on malformed packet #1705 (#1717)"
+
+CVE: CVE-2025-15661
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/4ed26f5740bdd409269ed9fb48a28bf8f565b681]
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ src/sftp.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/src/sftp.c b/src/sftp.c
+index 43b6ff90..0a6d15de 100644
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -3905,6 +3905,13 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ "SFTP Protocol Error (type)");
+ }
+
++ /* advance past id */
++ if(_libssh2_get_u32(&buf, &tmp_u32)) {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (id)");
++ }
++
+ if(packet_type == SSH_FXP_STATUS) {
+ if(_libssh2_get_u32(&buf, &tmp_u32)) {
+ LIBSSH2_FREE(session, data);
+@@ -3924,13 +3931,6 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ }
+ }
+
+- /* advance past id */
+- if(_libssh2_get_u32(&buf, &tmp_u32)) {
+- LIBSSH2_FREE(session, data);
+- return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
+- "SFTP Protocol Error (id)");
+- }
+-
+ /* look for at least one link */
+ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) {
+ LIBSSH2_FREE(session, data);
+--
+2.43.0
+
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index 960ff71df2f..1b281e62966 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -13,6 +13,9 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2026-7598.patch \
file://CVE-2026-55200.patch \
file://CVE-2026-55199.patch \
+ file://CVE-2025-15661-1.patch \
+ file://CVE-2025-15661-2.patch \
+ file://CVE-2025-15661-3.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 20/37] curl: fix CVE-2026-5545
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (18 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 19/37] libssh2: Fix CVE-2025-15661 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 21/37] curl: fix CVE-2026-6253 Fabien Thomas
` (18 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream backport for CVE-2026-5545.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].
[1] https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd
[2] https://curl.se/docs/CVE-2026-5545.html
(From OE-Core rev: dfb61bf303fc32257e32719df36344286b1a80e6)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../curl/curl/CVE-2026-5545.patch | 42 +++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 43 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5545.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-5545.patch b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
new file mode 100644
index 00000000000..d012f39b079
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
@@ -0,0 +1,42 @@
+From ab96b09b1163659b83b0716abe42662d1e1630ea Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Fri, 5 Jun 2026 01:17:44 -0700
+Subject: [PATCH] url: improve connection reuse on negotiate
+
+Check state of negotiate to allow proper connection reuse.
+
+Closes #21203
+
+CVE: CVE-2026-5545
+Upstream-Status: Backport [https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd]
+
+Backport Changes:
+- curl-8.7.1 still performs the NTLM/Negotiate reuse logic inline in
+ ConnectionExists(), so the upstream guard was adapted there.
+
+(cherry picked from commit 33e43985b8f3b9e66691d06e70be0395849856cd)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 30f215fd48..1d6e3309f5 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -1219,8 +1219,14 @@ ConnectionExists(struct Curl_easy *data,
+ Curl_timestrcmp(needle->passwd, check->passwd)) {
+
+ /* we prefer a credential match, but this is at least a connection
+- that can be reused and "upgraded" to NTLM */
++ that can be reused and "upgraded" to NTLM if it does
++ not have any auth ongoing. */
++#ifdef USE_SPNEGO
++ if((check->http_ntlm_state == NTLMSTATE_NONE) &&
++ (check->http_negotiate_state == GSS_AUTHNONE))
++#else
+ if(check->http_ntlm_state == NTLMSTATE_NONE)
++#endif
+ chosen = check;
+ continue;
+ }
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 3e48c58fa78..7ea5723de07 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -38,6 +38,7 @@ SRC_URI = " \
file://CVE-2026-3784.patch \
file://CVE-2026-5773.patch \
file://CVE-2026-6276.patch \
+ file://CVE-2026-5545.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 21/37] curl: fix CVE-2026-6253
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (19 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 20/37] curl: fix CVE-2026-5545 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429 Fabien Thomas
` (17 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream backport for CVE-2026-6253.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].
[1] https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f
[2] https://curl.se/docs/CVE-2026-6253.html
(From OE-Core rev: 21a929291fddb4f7c874609f6d5293477fb74ad9)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../curl/curl/CVE-2026-6253.patch | 392 ++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 393 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6253.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6253.patch b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
new file mode 100644
index 00000000000..956beac27bb
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
@@ -0,0 +1,392 @@
+From eb175878ffa07392d6654127f3d4637d4d335c78 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 5 Jun 2026 01:18:43 -0700
+Subject: [PATCH] http: clear the proxy credentials as well on port or scheme
+ change
+
+Add tests 2009-2011 to verify switching between proxies with credentials
+when the switch is driven by a redirect
+
+Reported-by: Dwij Mehta
+
+Closes #21304
+
+CVE: CVE-2026-6253
+Upstream-Status: Backport [https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f]
+
+Backport Changes:
+- The upstream lib/http.c hunk adds the credential resets to
+ Curl_http_follow(). curl-8.7.1 predates that protocol-specific redirect
+ handler and carries the equivalent logic in lib/transfer.c via
+ Curl_follow(), so the full upstream lib/http.c hunk was adapted there.
+- The upstream Curl_reset_proxypwd() helper includes a CURL_DISABLE_PROXY
+ fallback. In curl-8.7.1, the proxy credential fields and string slots are
+ unconditional and the pre-existing code accesses them without that guard,
+ so this backport retains the target-version behavior instead.
+- curl-8.7.1 uses tests/data/Makefile.inc instead of the upstream
+ tests/data/Makefile.am list.
+
+(cherry picked from commit 188c2f166a20fa97c2325b2da7d0e5cecc13725f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/transfer.c | 56 ++++++++++++++++++++++++--------
+ lib/transfer.h | 2 ++
+ tests/data/Makefile.inc | 1 +
+ tests/data/test2009 | 70 ++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2010 | 71 +++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2011 | 70 ++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 257 insertions(+), 13 deletions(-)
+ create mode 100644 tests/data/test2009
+ create mode 100644 tests/data/test2010
+ create mode 100644 tests/data/test2011
+
+diff --git a/lib/transfer.c b/lib/transfer.c
+index ccd042b80d..a73462928d 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -553,6 +553,35 @@ void Curl_init_CONNECT(struct Curl_easy *data)
+ data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
+ }
+
++/*
++ * Restore the user credentials to those set in options.
++ */
++CURLcode Curl_reset_userpwd(struct Curl_easy *data)
++{
++ CURLcode result;
++ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD])
++ data->state.creds_from = CREDS_OPTION;
++ result = Curl_setstropt(&data->state.aptr.user,
++ data->set.str[STRING_USERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.passwd,
++ data->set.str[STRING_PASSWORD]);
++ return result;
++}
++
++/*
++ * Restore the proxy credentials to those set in options.
++ */
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data)
++{
++ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser,
++ data->set.str[STRING_PROXYUSERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.proxypasswd,
++ data->set.str[STRING_PROXYPASSWORD]);
++ return result;
++}
++
+ /*
+ * Curl_pretransfer() is called immediately before a transfer starts, and only
+ * once for one transfer no matter if it has redirects or do multi-pass
+@@ -700,21 +729,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
+ return CURLE_OUT_OF_MEMORY;
+ }
+
+- if(data->set.str[STRING_USERNAME] ||
+- data->set.str[STRING_PASSWORD])
+- data->state.creds_from = CREDS_OPTION;
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.user,
+- data->set.str[STRING_USERNAME]);
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.passwd,
+- data->set.str[STRING_PASSWORD]);
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxyuser,
+- data->set.str[STRING_PROXYUSERNAME]);
++ result = Curl_reset_userpwd(data);
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxypasswd,
+- data->set.str[STRING_PROXYPASSWORD]);
++ result = Curl_reset_proxypwd(data);
+
+ data->req.headerbytecount = 0;
+ Curl_headers_cleanup(data);
+@@ -759,6 +777,7 @@ CURLcode Curl_follow(struct Curl_easy *data,
+ bool disallowport = FALSE;
+ bool reachedmax = FALSE;
+ CURLUcode uc;
++ CURLcode result;
+
+ DEBUGASSERT(type != FOLLOW_NONE);
+
+@@ -889,12 +908,23 @@ CURLcode Curl_follow(struct Curl_easy *data,
+ free(scheme);
+ }
+ if(clear) {
++ result = Curl_reset_userpwd(data);
++ if(result) {
++ free(newurl);
++ return result;
++ }
+ Curl_safefree(data->state.aptr.user);
+ Curl_safefree(data->state.aptr.passwd);
+ }
+ }
+ }
+
++ result = Curl_reset_proxypwd(data);
++ if(result) {
++ free(newurl);
++ return result;
++ }
++
+ if(type == FOLLOW_FAKE) {
+ /* we're only figuring out the new url if we would've followed locations
+ but now we're done so we can get out! */
+diff --git a/lib/transfer.h b/lib/transfer.h
+index e65b2b1472..f1a791f1cf 100644
+--- a/lib/transfer.h
++++ b/lib/transfer.h
+@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data,
+
+ void Curl_init_CONNECT(struct Curl_easy *data);
+
++CURLcode Curl_reset_userpwd(struct Curl_easy *data);
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data);
+ CURLcode Curl_pretransfer(struct Curl_easy *data);
+ CURLcode Curl_posttransfer(struct Curl_easy *data);
+
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 9fb92742ee..aafd309a9d 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -231,6 +231,7 @@ test1955 test1956 test1957 test1958 test1959 test1960 test1964 \
+ test1970 test1971 test1972 test1973 test1974 test1975 \
+ \
+ test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
++test2009 test2010 test2011 \
+ \
+ test2023 \
+ test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
+diff --git a/tests/data/test2009 b/tests/data/test2009
+new file mode 100644
+index 0000000000..d2fd79e0d6
+--- /dev/null
++++ b/tests/data/test2009
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via env variables, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2010 b/tests/data/test2010
+new file mode 100644
+index 0000000000..443ae9d2f9
+--- /dev/null
++++ b/tests/data/test2010
+@@ -0,0 +1,71 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via options for two proxies, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2011 b/tests/data/test2011
+new file mode 100644
+index 0000000000..dd4e534248
+--- /dev/null
++++ b/tests/data/test2011
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy creds via env, cross-scheme redirect, --location-trusted
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --location-trusted --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 7ea5723de07..2b988654c41 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -39,6 +39,7 @@ SRC_URI = " \
file://CVE-2026-5773.patch \
file://CVE-2026-6276.patch \
file://CVE-2026-5545.patch \
+ file://CVE-2026-6253.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (20 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 21/37] curl: fix CVE-2026-6253 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168 Fabien Thomas
` (16 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream backport for CVE-2026-6429.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].
[1] https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
[2] https://curl.se/docs/CVE-2026-6429.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-6429
(From OE-Core rev: 0cbfae83eebf9076f7b22d07b48cb5cef1536989)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../curl/curl/CVE-2026-6429.patch | 367 ++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 368 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429.patch b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
new file mode 100644
index 00000000000..f4df441aa2b
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
@@ -0,0 +1,367 @@
+From 8191fd6d5677c30579c09a8d0988b47bbf33f65f Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 5 Jun 2026 01:20:50 -0700
+Subject: [PATCH] http: clear credentials better on redirect
+
+Verify with test 2506: netrc with redirect using proxy
+
+Updated test 998 which was wrong.
+
+Reported-by: Muhamad Arga Reksapati
+
+Closes #21345
+
+CVE: CVE-2026-6429
+Upstream-Status: Backport [https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306]
+
+Backport Changes:
+- The upstream lib/http.c hunk adds the same-origin credential clearing to
+ Curl_http_follow(). curl-8.7.1 predates that protocol-specific redirect
+ handler and carries the equivalent redirect logic in lib/transfer.c via
+ Curl_follow(), so the full upstream lib/http.c hunk was adapted there.
+- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc
+ instead of the upstream tests/data/Makefile.am and
+ tests/libtest/Makefile.am lists.
+- curl-8.7.1 does not contain test2504/lib2504, so the new
+ test2506/lib2506 entries were registered after the nearest existing
+ test2503/lib2502 entries in the target-version test lists.
+- curl-8.7.1 uses the older libtest harness, so first.h,
+ test_lib2506(), and CURLcode result handling were adapted to test.h,
+ test(), and int res.
+- Scarthgap curl-8.7.1 keeps the same incorrect redirected-request
+ Authorization expectation in tests/data/test998, so this backport removes
+ that expectation with an equivalent target-version hunk.
+
+(cherry picked from commit b4024bf808bd558026fdc6096e8457f199ace306)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/transfer.c | 103 +++++++++++++++++++++----------------
+ tests/data/Makefile.inc | 2 +-
+ tests/data/test2506 | 64 +++++++++++++++++++++++
+ tests/data/test998 | 1 -
+ tests/libtest/Makefile.inc | 5 +-
+ tests/libtest/lib2506.c | 71 +++++++++++++++++++++++++
+ 6 files changed, 198 insertions(+), 48 deletions(-)
+ create mode 100644 tests/data/test2506
+ create mode 100644 tests/libtest/lib2506.c
+
+diff --git a/lib/transfer.c b/lib/transfer.c
+index a73462928d..0f5bd8ce59 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -865,49 +865,62 @@ CURLcode Curl_follow(struct Curl_easy *data,
+ if(uc)
+ return Curl_uc_to_curlcode(uc);
+
+- /* Clear auth if this redirects to a different port number or protocol,
+- unless permitted */
+- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
+- char *portnum;
+- int port;
+- bool clear = FALSE;
+-
+- if(data->set.use_port && data->state.allow_port)
+- /* a custom port is used */
+- port = (int)data->set.use_port;
+- else {
+- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
+- CURLU_DEFAULT_PORT);
+- if(uc) {
+- free(newurl);
+- return Curl_uc_to_curlcode(uc);
+- }
+- port = atoi(portnum);
+- free(portnum);
+- }
+- if(port != data->info.conn_remote_port) {
+- infof(data, "Clear auth, redirects to port from %u to %u",
+- data->info.conn_remote_port, port);
+- clear = TRUE;
++ {
++ bool same_origin;
++ CURLU *u;
++ char *oldscheme = NULL;
++ char *oldhost = NULL;
++ char *oldport = NULL;
++ char *newscheme = NULL;
++ char *newhost = NULL;
++ char *newport = NULL;
++
++ u = curl_url();
++ if(!u) {
++ free(newurl);
++ return CURLE_OUT_OF_MEMORY;
+ }
+- else {
+- char *scheme;
+- const struct Curl_handler *p;
+- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
+- if(uc) {
+- free(newurl);
+- return Curl_uc_to_curlcode(uc);
+- }
+
+- p = Curl_get_scheme_handler(scheme);
+- if(p && (p->protocol != data->info.conn_protocol)) {
+- infof(data, "Clear auth, redirects scheme from %s to %s",
+- data->info.conn_scheme, scheme);
+- clear = TRUE;
+- }
+- free(scheme);
++ uc = curl_url_set(u, CURLUPART_URL, data->state.url, 0);
++ if(!uc)
++ uc = curl_url_get(u, CURLUPART_SCHEME, &oldscheme, 0);
++ if(!uc)
++ uc = curl_url_get(u, CURLUPART_HOST, &oldhost, 0);
++ if(!uc)
++ uc = curl_url_get(u, CURLUPART_PORT, &oldport, CURLU_DEFAULT_PORT);
++ if(!uc)
++ uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &newscheme, 0);
++ if(!uc)
++ uc = curl_url_get(data->state.uh, CURLUPART_HOST, &newhost, 0);
++ if(!uc)
++ uc = curl_url_get(data->state.uh, CURLUPART_PORT, &newport,
++ CURLU_DEFAULT_PORT);
++ if(uc) {
++ curl_url_cleanup(u);
++ free(oldscheme);
++ free(oldhost);
++ free(oldport);
++ free(newscheme);
++ free(newhost);
++ free(newport);
++ free(newurl);
++ return Curl_uc_to_curlcode(uc);
+ }
+- if(clear) {
++
++ same_origin = strcasecompare(oldscheme, newscheme) &&
++ strcasecompare(oldhost, newhost) &&
++ !strcmp(oldport, newport);
++
++ curl_url_cleanup(u);
++ free(oldscheme);
++ free(oldhost);
++ free(oldport);
++ free(newscheme);
++ free(newhost);
++ free(newport);
++
++ if((!same_origin && !data->set.allow_auth_to_other_hosts) ||
++ !data->set.str[STRING_USERNAME]) {
+ result = Curl_reset_userpwd(data);
+ if(result) {
+ free(newurl);
+@@ -917,12 +930,12 @@ CURLcode Curl_follow(struct Curl_easy *data,
+ Curl_safefree(data->state.aptr.passwd);
+ }
+ }
+- }
+
+- result = Curl_reset_proxypwd(data);
+- if(result) {
+- free(newurl);
+- return result;
++ result = Curl_reset_proxypwd(data);
++ if(result) {
++ free(newurl);
++ return result;
++ }
+ }
+
+ if(type == FOLLOW_FAKE) {
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index aafd309a9d..f673f86384 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -251,7 +251,7 @@ test2300 test2301 test2302 test2303 test2304 test2305 test2306 test2307 \
+ \
+ test2400 test2401 test2402 test2403 test2404 \
+ \
+-test2500 test2501 test2502 test2503 \
++test2500 test2501 test2502 test2503 test2506 \
+ \
+ test2600 test2601 test2602 test2603 \
+ \
+diff --git a/tests/data/test2506 b/tests/data/test2506
+new file mode 100644
+index 0000000000..9c65002496
+--- /dev/null
++++ b/tests/data/test2506
+@@ -0,0 +1,64 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++<reply>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 3
++Location: http://numbertwo.example/%TESTNUMBER0002
++
++ok
++</data>
++<data2 crlf="headers" nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 4
++
++yes
++</data2>
++</reply>
++
++<client>
++<server>
++http
++</server>
++<features>
++proxy
++</features>
++<tool>
++lib%TESTNUMBER
++</tool>
++<name>
++netrc with redirect using proxy
++</name>
++<file name="%LOGDIR/netrc2506">
++machine site.example login batman password robin
++</file>
++<command>
++http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506
++</command>
++</client>
++
++<verify>
++<protocol crlf="headers">
++GET http://site.example/ HTTP/1.1
++Host: site.example
++Authorization: Basic %b64[batman:robin]b64%
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://numbertwo.example/25060002 HTTP/1.1
++Host: numbertwo.example
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test998 b/tests/data/test998
+index 0969d4704b..17c0a0e150 100644
+--- a/tests/data/test998
++++ b/tests/data/test998
+@@ -82,7 +82,6 @@ Proxy-Connection: Keep-Alive
+
+ GET http://somewhere.else.example/a/path/9980002 HTTP/1.1
+ Host: somewhere.else.example
+- Authorization: Basic YWxiZXJ0bzplaW5zdGVpbg==
+ User-Agent: curl/%VERSION
+ Accept: */*
+ Proxy-Connection: Keep-Alive
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 9f7cec6027..9d3356aaf5 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -75,7 +75,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \
+ lib1970 lib1971 lib1972 lib1973 lib1974 lib1975 \
+ lib2301 lib2302 lib2304 lib2305 lib2306 \
+ lib2402 lib2404 \
+- lib2502 \
++ lib2502 lib2506 \
+ lib3010 lib3025 lib3026 lib3027 \
+ lib3100 lib3101 lib3102 lib3103
+
+@@ -684,6 +684,9 @@ lib2404_LDADD = $(TESTUTIL_LIBS)
+ lib2502_SOURCES = lib2502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib2502_LDADD = $(TESTUTIL_LIBS)
+
++lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
++lib2506_LDADD = $(TESTUTIL_LIBS)
++
+ lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib3010_LDADD = $(TESTUTIL_LIBS)
+
+diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c
+new file mode 100644
+index 0000000000..e6dde18507
+--- /dev/null
++++ b/tests/libtest/lib2506.c
+@@ -0,0 +1,71 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "test.h"
++
++#include "testtrace.h"
++
++static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud)
++{
++ (void)ptr;
++ (void)ud;
++ return size * nmemb;
++}
++
++int test(char *URL)
++{
++ CURL *curl;
++ int res = CURLE_OUT_OF_MEMORY;
++
++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
++ curl_mfprintf(stderr, "curl_global_init() failed\n");
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506);
++ test_setopt(curl, CURLOPT_PROXY, URL);
++ test_setopt(curl, CURLOPT_URL, libtest_arg2);
++ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
++ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3);
++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
++ test_setopt(curl, CURLOPT_VERBOSE, 1L);
++
++ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the
++ credentials come from netrc */
++ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
++
++ res = curl_easy_perform(curl);
++
++test_cleanup:
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++
++ return res;
++}
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 2b988654c41..8e39d821626 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -40,6 +40,7 @@ SRC_URI = " \
file://CVE-2026-6276.patch \
file://CVE-2026-5545.patch \
file://CVE-2026-6253.patch \
+ file://CVE-2026-6429.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (21 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 24/37] u-boot: Set CVE_PRODUCT Fabien Thomas
` (15 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream backport for CVE-2026-7168.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].
[1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507
[2] https://curl.se/docs/CVE-2026-7168.html
(From OE-Core rev: 2fa295fe7473c6df94175de36528736bf32f1e9a)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../curl/curl/CVE-2026-7168.patch | 425 ++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 426 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
new file mode 100644
index 00000000000..0669be6546d
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
@@ -0,0 +1,425 @@
+From 0f0bb5efbd1e4f2199eeb98e6c62a7a67242cad2 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 5 Jun 2026 01:22:37 -0700
+Subject: [PATCH] setopt: clear proxy auth properties when switching
+
+Verify with test 1588
+
+Closes #21453
+
+CVE: CVE-2026-7168
+Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507]
+
+Backport Changes:
+- The upstream lib/setopt.c hunk reuses Curl_auth_digest_cleanup() from the
+ newer tree. curl-8.7.1 does not expose that helper to setopt.c in the same
+ way, so this backport adds the vauth/vauth.h include before applying the
+ upstream setproxy() cleanup logic.
+- The upstream tree already provides a CURL_DISABLE_DIGEST_AUTH fallback for
+ Curl_auth_digest_cleanup(). curl-8.7.1 does not, so this backport adds the
+ equivalent no-op macro in lib/vauth/vauth.h.
+- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc
+ instead of the upstream tests/data/Makefile.am and
+ tests/libtest/Makefile.am lists.
+- curl-8.7.1 uses the older libtest harness, so first.h,
+ test_lib1588(), libtest_arg4, and CURLcode result handling were adapted to
+ test.h, test(), test_argv[4], and int res.
+- curl-8.7.1 does not define the newer digest test feature in runtests.pl.
+ This backport defines the target harness feature as digest-auth, matching
+ tests/server/disabled.c, and makes test 1588 require digest-auth.
+- The curl-8.7.1 server harness does not handle crlf="headers" correctly on
+ response data sections for this test, so those attributes were removed from
+ the two server response blocks and datacheck. The protocol block keeps
+ crlf="headers" because runtests.pl normalizes protocol verification when any
+ crlf attribute is present.
+
+(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/setopt.c | 18 ++++-
+ lib/vauth/vauth.h | 2 +
+ tests/data/Makefile.inc | 1 +
+ tests/data/test1588 | 106 ++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc | 5 +-
+ tests/libtest/lib1588.c | 152 +++++++++++++++++++++++++++++++++++++
+ tests/runtests.pl | 2 +
+ 7 files changed, 283 insertions(+), 3 deletions(-)
+ create mode 100644 tests/data/test1588
+ create mode 100644 tests/libtest/lib1588.c
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 8a5a5d7..7eaf309 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -51,6 +51,7 @@
+ #include "altsvc.h"
+ #include "hsts.h"
+ #include "tftp.h"
++#include "vauth/vauth.h"
+ #include "strdup.h"
+ /* The last 3 #include files should be in this order */
+ #include "curl_printf.h"
+@@ -76,6 +77,20 @@ CURLcode Curl_setstropt(char **charp, const char *s)
+ return CURLE_OK;
+ }
+
++#ifndef CURL_DISABLE_PROXY
++static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
++{
++ if((data->set.str[STRING_PROXY] && proxy) &&
++ /* there was one set, is this a new one? */
++ !strcmp(data->set.str[STRING_PROXY], proxy))
++ return CURLE_OK; /* same one as before */
++
++ Curl_auth_digest_cleanup(&data->state.proxydigest);
++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
++}
++#endif
++
+ CURLcode Curl_setblobopt(struct curl_blob **blobp,
+ const struct curl_blob *blob)
+ {
+@@ -1139,8 +1154,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+ * Setting it to NULL, means no proxy but allows the environment variables
+ * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
+ */
+- result = Curl_setstropt(&data->set.str[STRING_PROXY],
+- va_arg(param, char *));
++ result = setproxy(data, va_arg(param, char *));
+ break;
+
+ case CURLOPT_PRE_PROXY:
+diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
+index 9da0540..bf5c7a3 100644
+--- a/lib/vauth/vauth.h
++++ b/lib/vauth/vauth.h
+@@ -119,6 +119,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
+
+ /* This is used to clean up the digest specific data */
+ void Curl_auth_digest_cleanup(struct digestdata *digest);
++#else
++#define Curl_auth_digest_cleanup(x)
+ #endif /* !CURL_DISABLE_DIGEST_AUTH */
+
+ #ifdef USE_GSASL
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index f673f86..461eb37 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -200,6 +200,7 @@ test1540 test1541 test1542 test1543 test1544 test1545 \
+ test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \
+ test1558 test1559 test1560 test1561 test1562 test1563 test1564 test1565 \
+ test1566 test1567 test1568 test1569 test1570 \
++test1588 \
+ \
+ test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
+ test1598 \
+diff --git a/tests/data/test1588 b/tests/data/test1588
+new file mode 100644
+index 0000000..8a3bf81
+--- /dev/null
++++ b/tests/data/test1588
+@@ -0,0 +1,106 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data>
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000>
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<datacheck>
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</datacheck>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++digest-auth
++</features>
++<name>
++HTTP proxy auth Digest, then change proxy and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 9d3356a..4c42d34 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -62,7 +62,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \
+ lib1540 lib1541 lib1542 lib1543 lib1545 \
+ lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \
+ lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \
+- lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
++ lib1588 lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
+ \
+ lib1662 \
+ \
+@@ -687,6 +687,9 @@ lib2502_LDADD = $(TESTUTIL_LIBS)
+ lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib2506_LDADD = $(TESTUTIL_LIBS)
+
++lib1588_SOURCES = lib1588.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
++lib1588_LDADD = $(TESTUTIL_LIBS)
++
+ lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib3010_LDADD = $(TESTUTIL_LIBS)
+
+diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c
+new file mode 100644
+index 0000000..00c6b35
+--- /dev/null
++++ b/tests/libtest/lib1588.c
+@@ -0,0 +1,152 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = URL
++ * argv2 = proxy host
++ * argv3 = proxy port
++ * argv4 = proxyuser:password
++ */
++
++#include "test.h"
++#include "testutil.h"
++
++static CURLcode init1588(CURL *curl, const char *url,
++ const char *userpwd, const char *proxy)
++{
++ int res = CURLE_OK;
++
++ res_easy_setopt(curl, CURLOPT_URL, url);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY, proxy);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++ if(res)
++ goto init_failed;
++#if 0
++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
++ if(res)
++ goto init_failed;
++#endif
++
++ res_easy_setopt(curl, CURLOPT_HEADER, 1L);
++ if(res)
++ goto init_failed;
++
++ return CURLE_OK; /* success */
++
++init_failed:
++ return (CURLcode)res; /* failure */
++}
++
++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
++ const char *proxy)
++{
++ CURLcode res = CURLE_OK;
++
++ res = init1588(curl, url, userpwd, proxy);
++ if(res)
++ return res;
++
++ return curl_easy_perform(curl);
++}
++
++int test(char *URL)
++{
++ int res = CURLE_OK;
++ CURL *curl = NULL;
++ const char *proxyuserpws;
++ struct curl_slist *host = NULL;
++ struct curl_slist *host2 = NULL;
++ char proxy1_resolve[128];
++ char proxy2_resolve[128];
++ char proxy1_connect[128];
++ char proxy2_connect[128];
++
++ if(test_argc < 5)
++ return TEST_ERR_MAJOR_BAD;
++ proxyuserpws = test_argv[4];
++
++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
++
++ /* we connect to the fake host name but the right port number */
++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
++ "firstproxy:%s", libtest_arg3);
++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
++ "secondproxy:%s", libtest_arg3);
++
++ res_global_init(CURL_GLOBAL_ALL);
++ if(res)
++ return res;
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ host = curl_slist_append(NULL, proxy1_resolve);
++ if(!host)
++ goto test_cleanup;
++ host2 = curl_slist_append(host, proxy2_resolve);
++ if(!host2)
++ goto test_cleanup;
++ host = host2;
++
++ start_test_timing();
++
++ easy_setopt(curl, CURLOPT_RESOLVE, host);
++
++ res = run1588(curl, URL, proxyuserpws, proxy1_connect);
++ if(res)
++ goto test_cleanup;
++
++ curl_mfprintf(stderr, "lib1588: now we do the request again\n");
++
++ res = run1588(curl, URL, proxyuserpws, proxy2_connect);
++
++test_cleanup:
++
++ /* proper cleanup sequence - type PB */
++
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++ curl_slist_free_all(host);
++ return res;
++}
+diff --git a/tests/runtests.pl b/tests/runtests.pl
+index ddfab20..b40df55 100755
+--- a/tests/runtests.pl
++++ b/tests/runtests.pl
+@@ -637,6 +637,8 @@ sub checksystemfeatures {
+ $feature{"Kerberos"} = $feat =~ /Kerberos/i;
+ # SPNEGO enabled
+ $feature{"SPNEGO"} = $feat =~ /SPNEGO/i;
++ # Digest auth enabled unless disabled by build
++ $feature{"digest-auth"} = 1;
+ # CharConv enabled
+ $feature{"CharConv"} = $feat =~ /CharConv/i;
+ # TLS-SRP enabled
+--
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 8e39d821626..7d55f72b03f 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -41,6 +41,7 @@ SRC_URI = " \
file://CVE-2026-5545.patch \
file://CVE-2026-6253.patch \
file://CVE-2026-6429.patch \
+ file://CVE-2026-7168.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 24/37] u-boot: Set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (22 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168 Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 25/37] xserver-org: update CVE_PRODUCT Fabien Thomas
` (14 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Maik Otto <m.otto@phytec.de>
The CPE vendor is "denx" and the CPE product is "u-boot".
Set CVE_PRODUCT for properly matching in the NVD database.
(From OE-Core rev: f4c9c7930bda530f60248a5db8e45c89f2c66f50)
Signed-off-by: Maik Otto <m.otto@phytec.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d2e5d427de13b33694a1d802f5ac833b2c04ced6)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-bsp/u-boot/u-boot.inc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
index 7935f2b4aa4..00dda93b4ac 100644
--- a/meta/recipes-bsp/u-boot/u-boot.inc
+++ b/meta/recipes-bsp/u-boot/u-boot.inc
@@ -19,6 +19,8 @@ PACKAGECONFIG ??= "openssl"
# a host build dependency.
PACKAGECONFIG[openssl] = ",,openssl-native"
+CVE_PRODUCT = "denx:u-boot"
+
# Allow setting an additional version string that will be picked up by the
# u-boot build system and appended to the u-boot version. If the .scmversion
# file already exists it will not be overwritten.
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 25/37] xserver-org: update CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (23 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 24/37] u-boot: Set CVE_PRODUCT Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 26/37] shadow: set CVE_PRODUCT Fabien Thomas
` (13 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
In cvelistV5, CVE-2024-21886 uses CPE xorg:xserver ([1]).
Detected because this CVE is shown for xwayland recipe.
[1] https://github.com/CVEProject/cvelistV5/blob/cve_2026-04-12_1800Z/cves/2024/21xxx/CVE-2024-21886.json#L646
(From OE-Core rev: c3cbb4003424f8b1e1faa06857096f4b1e609fea)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5311f2a08842612b74472c843be2ae0d47cff6f5)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
index 815be6a4986..9bf5137de1e 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
@@ -19,7 +19,7 @@ SRC_URI = "${XORG_MIRROR}/individual/xserver/${XORG_PN}-${PV}.tar.xz"
UPSTREAM_CHECK_REGEX = "xorg-server-(?P<pver>\d+(\.(?!99)\d+)+)\.tar"
-CVE_PRODUCT = "xorg-server x_server"
+CVE_PRODUCT = "xorg-server x_server xorg:xserver"
CVE_STATUS[CVE-2011-4613] = "not-applicable-platform: This is specific to Debian's xserver-wrapper.c"
CVE_STATUS[CVE-2020-25697] = "upstream-wontfix: \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 26/37] shadow: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (24 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 25/37] xserver-org: update CVE_PRODUCT Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 27/37] flex: update CVE_PRODUCT Fabien Thomas
` (12 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This will remove CVE-2016-15024 from open cve reports.
This CVE for is for "doomsider:shadow" [1].
It will also remove
* CVE-2018-16588 (suse:shadow, [2])
* CVE-2019-16110 (blade-group:shadow [3])
which can be verified that they don't affect Yocto shadow.
[1] https://security-tracker.debian.org/tracker/CVE-2016-15024
[2] https://security-tracker.debian.org/tracker/CVE-2018-16588
[3] https://security-tracker.debian.org/tracker/CVE-2019-16110
(From OE-Core rev: 2a4ade3b03b92e4dd1d57ac4074a9147b2fbb220)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2946e238d2a3947c1a51c4ac1c86c8284f68e4cf)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-extended/shadow/shadow.inc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc
index 40e6ab0b30e..a308ea00d24 100644
--- a/meta/recipes-extended/shadow/shadow.inc
+++ b/meta/recipes-extended/shadow/shadow.inc
@@ -36,6 +36,8 @@ PAM_SRC_URI = "file://pam.d/chfn \
file://pam.d/passwd \
file://pam.d/su"
+CVE_PRODUCT = "debian:shadow shadow_project:shadow"
+
inherit autotools gettext github-releases pkgconfig
export CONFIG_SHELL="/bin/sh"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 27/37] flex: update CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (25 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 26/37] shadow: set CVE_PRODUCT Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:56 ` [OE-core][scarthgap 28/37] sudo: set CVE_PRODUCT Fabien Thomas
` (11 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Marta Rybczynska <rybczynska@gmail.com>
NVD uses westes:flex for recent CVEs in flex, based on the GitHub repo
(From OE-Core rev: 711e2864b17db92ee1f6b9cfaaa16c7a20ec8331)
Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8bb6aa4b4acb16c59b66aa55b33053e3e8749e72)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-devtools/flex/flex_2.6.4.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/flex/flex_2.6.4.bb b/meta/recipes-devtools/flex/flex_2.6.4.bb
index 52543b6e021..e424aa58e8f 100644
--- a/meta/recipes-devtools/flex/flex_2.6.4.bb
+++ b/meta/recipes-devtools/flex/flex_2.6.4.bb
@@ -83,4 +83,4 @@ do_install_ptest() {
do_install_ptest[vardepsexclude] += "UNINATIVE_LOADER"
# Not Apache Flex, or Adobe Flex, or IBM Flex.
-CVE_PRODUCT = "flex_project:flex"
+CVE_PRODUCT = "flex_project:flex westes:flex"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 28/37] sudo: set CVE_PRODUCT
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (26 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 27/37] flex: update CVE_PRODUCT Fabien Thomas
@ 2026-08-19 15:56 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 29/37] perf: drop newt from tui build requirements Fabien Thomas
` (10 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:56 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This change removes currently open CVE-2025-64170 and CVE-2025-64517
from reports which are for "trifectatech:sudo-rs".
It also removes following "patched" ones:
* CVE-2023-42456 (memorysafety:sudo)
* CVE-2025-46717 (trifectatech:sudo)
* CVE-2025-46718 (trifectatech:sudo)
All these are also for "sudo-rs".
(From OE-Core rev: 00c2ea8cd0c1e1a1f841b8af0bacc6b9c179973a)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0459398d31f74e9653cb55a57d8d0f6bfbdfa2ad)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-extended/sudo/sudo_1.9.17p2.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
index 90672ed7afd..69bd654d08f 100644
--- a/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
+++ b/meta/recipes-extended/sudo/sudo_1.9.17p2.bb
@@ -10,6 +10,8 @@ PAM_SRC_URI = "file://sudo.pam"
SRC_URI[sha256sum] = "4a38a1ab3adb1199257edc2a7c4a2bd714665eb605b04368843b06dada2cfcfb"
+CVE_PRODUCT = "gratisoft:sudo sudo:sudo sudo_project:sudo todd_miller:sudo"
+
DEPENDS += " virtual/crypt ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}"
RDEPENDS:${PN} += " ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-limits pam-plugin-keyinit', '', d)}"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 29/37] perf: drop newt from tui build requirements
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (27 preceding siblings ...)
2026-08-19 15:56 ` [OE-core][scarthgap 28/37] sudo: set CVE_PRODUCT Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 30/37] busybox: patch CVE-2026-38754 Fabien Thomas
` (9 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
As the comment says this was used by very old kernels
(pre 3.10), and slang has been the only option for a
long time. Also, correct the option to disable slang TUI.
(From OE-Core rev: 9a9d894ddcb619a86d63b25cf7d3f4cb2cf3a5a8)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a36a84490b943e6f0638c0430ad1eac7740e9be3)
Signed-off-by: Shinu Chandran <shinucha@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
meta/recipes-kernel/perf/perf.bb | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/meta/recipes-kernel/perf/perf.bb b/meta/recipes-kernel/perf/perf.bb
index 2d432f3f40f..a4bc3c1319f 100644
--- a/meta/recipes-kernel/perf/perf.bb
+++ b/meta/recipes-kernel/perf/perf.bb
@@ -14,10 +14,7 @@ PACKAGECONFIG ??= "python tui libunwind libtraceevent"
PACKAGECONFIG[dwarf] = ",NO_DWARF=1"
PACKAGECONFIG[perl] = ",NO_LIBPERL=1,perl"
PACKAGECONFIG[python] = ",NO_LIBPYTHON=1,python3 python3-setuptools-native"
-# gui support was added with kernel 3.6.35
-# since 3.10 libnewt was replaced by slang
-# to cover a wide range of kernel we add both dependencies
-PACKAGECONFIG[tui] = ",NO_NEWT=1,libnewt slang"
+PACKAGECONFIG[tui] = ",NO_SLANG=1,slang"
PACKAGECONFIG[libunwind] = ",NO_LIBUNWIND=1 NO_LIBDW_DWARF_UNWIND=1,libunwind"
PACKAGECONFIG[libnuma] = ",NO_LIBNUMA=1"
PACKAGECONFIG[bfd] = ",NO_LIBBFD=1"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 30/37] busybox: patch CVE-2026-38754
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (28 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 29/37] perf: drop newt from tui build requirements Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 31/37] curl: fix CVE-2026-4873 Fabien Thomas
` (8 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch which fixes this CVE as discussed in [1].
[1] https://lists.busybox.net/pipermail/busybox/2026-July/092392.html
(From OE-Core rev: 052fef5679987d726e40c8a87f0bf019f3833149)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../busybox/busybox/CVE-2026-38754.patch | 155 ++++++++++++++++++
meta/recipes-core/busybox/busybox_1.36.1.bb | 1 +
2 files changed, 156 insertions(+)
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38754.patch
diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38754.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38754.patch
new file mode 100644
index 00000000000..d263d72d9f3
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2026-38754.patch
@@ -0,0 +1,155 @@
+From a448b6d5b21e5b21249391389b6f0551d9bea136 Mon Sep 17 00:00:00 2001
+From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Date: Thu, 18 Jun 2026 17:04:20 +0900
+Subject: [PATCH] ash: fix out-of-bounds read in ifsbreakup()
+
+ifsfree() does not only release allocated ifsregion nodes; it also clears
+the global IFS region state used by ifsbreakup(). If argstr() raises an
+error while expanding an argument, ash longjmps out of expandarg() before
+that cleanup runs, leaving stale IFS split offsets behind.
+
+A later expansion can reuse the stack for a shorter string. ifsbreakup()
+then sees the stale IFS state, trusts the old offsets, and can walk past
+the current stack block before dereferencing p.
+
+Follow dash's root-cause fix: when an expansion-related handler catches
+EXERROR and continues, restore the handler and call ifsfree(). Apply
+the cleanup to redirectsafe(), expandstr(), and evaltree().
+
+Upstream commit:
+
+ Date: Mon Dec 5 23:02:01 2022 +0800
+ expand: Add ifsfree to expand to fix a logic error that causes a buffer over-read
+
+ On Mon, Jun 20, 2022 at 02:27:10PM -0400, Alex Gorinson wrote:
+ > Due to a logic error in the ifsbreakup function in expand.c if a
+ > heredoc and normal command is run one after the other by means of a
+ > semi-colon, when the second command drops into ifsbreakup the command
+ > will be evaluated with the ifslastp/ifsfirst struct that was set when
+ > the here doc was evaluated. This results in a buffer over-read that
+ > can leak the program's heap, stack, and arena addresses which can be
+ > used to beat ASLR.
+ >
+ > Steps to Reproduce:
+ > First bug:
+ > cmd args: ~/exampleDir/example> dash
+ > $ M='AAAAAAAAAAAAAAAAA' <note: 17 A's>
+ > $ q00(){
+ > $ <<000;echo
+ > $ ${D?$M$M$M$M$M$M} <note: 6 $M's>
+ > $ 000
+ > $ }
+ > $ q00 <note: After the q00 is typed in, the leak
+ > should be echo'd out; this works with ash, busybox ash, and dash and
+ > with all option args.>
+ >
+ > Patch:
+ > Adding the following to expand.c will fix both bugs in one go.
+ > (Thank you to Harald van Dijk and Michael Greenberg for doing the
+ > heavy lifting for this patch!)
+ > ==========================
+ > --- a/src/expand.c
+ > +++ b/src/expand.c
+ > @@ -859,6 +859,7 @@
+ > if (discard)
+ > return -1;
+ >
+ > +ifsfree();
+ > sh_error("Bad substitution");
+ > }
+ >
+ > @@ -1739,6 +1740,7 @@
+ > } else
+ > msg = umsg;
+ > }
+ > +ifsfree();
+ > sh_error("%.*s: %s%s", end - var - 1, var, msg, tail);
+ > }
+ > ==========================
+
+ Thanks for the report!
+
+ I think it's better to add the ifsfree() call to the exception
+ handling path as other sh_error calls may trigger this too.
+
+function old new delta
+restore_handler_expandarg - 33 +33
+evaltree 725 711 -14
+static.redirectsafe 141 124 -17
+expandstr 262 242 -20
+------------------------------------------------------------------------------
+(add/remove: 1/0 grow/shrink: 0/3 up/down: 36/-45) Total: -18 bytes
+
+Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+CVE: CVE-2026-38754
+Upstream-Status: Backport [https://github.com/vda-linux/busybox_mirror/commit/a448b6d5b21e5b21249391389b6f0551d9bea136]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ shell/ash.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/shell/ash.c b/shell/ash.c
+index fb887f31b..b8ff67b16 100644
+--- a/shell/ash.c
++++ b/shell/ash.c
+@@ -5480,6 +5480,7 @@ stoppedjobs(void)
+ */
+ /* openhere needs this forward reference */
+ static void expandhere(union node *arg);
++static void ifsfree(void);
+ static int
+ openhere(union node *redir)
+ {
+@@ -5909,6 +5910,17 @@ redirect(union node *redir, int flags)
+ // preverrout_fd = copied_fd2;
+ }
+
++static void
++restore_handler_expandarg(struct jmploc *savehandler, int err)
++{
++ exception_handler = savehandler;
++ if (err) {
++ if (exception_type != EXERROR)
++ longjmp(exception_handler->loc, 1);
++ ifsfree();
++ }
++}
++
+ static int
+ redirectsafe(union node *redir, int flags)
+ {
+@@ -5924,9 +5936,7 @@ redirectsafe(union node *redir, int flags)
+ exception_handler = &jmploc;
+ redirect(redir, flags);
+ }
+- exception_handler = savehandler;
+- if (err && exception_type != EXERROR)
+- longjmp(exception_handler->loc, 1);
++ restore_handler_expandarg(savehandler, err);
+ RESTORE_INT(saveint);
+ return err;
+ }
+@@ -9435,9 +9445,7 @@ evaltree(union node *n, int flags)
+ trap_depth--;
+ in_trap_ERR = 0;
+
+- exception_handler = savehandler;
+- if (err && exception_type != EXERROR)
+- longjmp(exception_handler->loc, 1);
++ restore_handler_expandarg(savehandler, err);
+
+ exitstatus = savestatus;
+ }
+@@ -13444,9 +13452,7 @@ expandstr(const char *ps, int syntax_type)
+ result = stackblock();
+
+ out:
+- exception_handler = savehandler;
+- if (err && exception_type != EXERROR)
+- longjmp(exception_handler->loc, 1);
++ restore_handler_expandarg(savehandler, err);
+
+ doprompt = saveprompt;
+ /* Try: PS1='`xxx(`' */
diff --git a/meta/recipes-core/busybox/busybox_1.36.1.bb b/meta/recipes-core/busybox/busybox_1.36.1.bb
index 7929d396c85..60796de9ce2 100644
--- a/meta/recipes-core/busybox/busybox_1.36.1.bb
+++ b/meta/recipes-core/busybox/busybox_1.36.1.bb
@@ -66,6 +66,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
file://CVE-2026-26157-CVE-2026-26158-02.patch \
file://CVE-2026-29004-01.patch \
file://CVE-2026-29004-02.patch \
+ file://CVE-2026-38754.patch \
"
SRC_URI:append:libc-musl = " file://musl.cfg "
# TODO http://lists.busybox.net/pipermail/busybox/2023-January/090078.html
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 31/37] curl: fix CVE-2026-4873
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (29 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 30/37] busybox: patch CVE-2026-38754 Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 32/37] libssh2: fix CVE-2026-66032 Fabien Thomas
` (7 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream backport for CVE-2026-4873.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].
[1] https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865
[2] https://curl.se/docs/CVE-2026-4873.html
(From OE-Core rev: 2dadf65eab0db85eed6bc250753baa0d5ab78660)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../curl/curl/CVE-2026-4873.patch | 58 +++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 59 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-4873.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-4873.patch b/meta/recipes-support/curl/curl/CVE-2026-4873.patch
new file mode 100644
index 00000000000..bc6268da7d0
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-4873.patch
@@ -0,0 +1,58 @@
+From a7e6dd14ee3900226066819a0334defb58c52486 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 28 Jul 2026 04:35:55 -0700
+Subject: [PATCH] url: do not reuse a non-tls starttls connection if new
+ requires TLS
+
+Reported-by: Arkadi Vainbrand
+
+Closes #21082
+
+CVE: CVE-2026-4873
+Upstream-Status: Backport [https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865]
+
+Backport Changes:
+- Upstream adds req_tls to struct url_conn_match, sets match.req_tls in
+ url_attach_existing(), and enforces it in url_match_ssl_use() when a
+ clear-text requested scheme is matched with a candidate connection
+ that is not actually using TLS.
+- Scarthgap curl 8.7.1 does not have struct url_conn_match or the
+ url_attach_existing()/url_match_ssl_use() split. The equivalent reuse
+ matching still happens directly in ConnectionExists(), so this backport
+ keeps the same state in a local req_tls variable derived from
+ data->set.use_ssl.
+- The rejection check is placed after the general SSL compatibility
+ check and uses Curl_conn_is_ssl(check, FIRSTSOCKET). This preserves
+ valid implicit-TLS IMAPS/POP3S/SMTPS reuse while still rejecting a
+ clear-text STARTTLS-capable cached connection for a request that
+ requires TLS.
+
+(cherry picked from commit 507e7be573b0a76fca597b75ff7cb27a66e7d865)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/url.c b/lib/url.c
+index 30f215f..c4c5982 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -935,6 +935,7 @@ ConnectionExists(struct Curl_easy *data,
+ /* plain HTTP with upgrade */
+ bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
+ (needle->handler->protocol & CURLPROTO_HTTP);
++ bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
+
+ *usethis = NULL;
+ *force_reuse = FALSE;
+@@ -1052,6 +1053,10 @@ ConnectionExists(struct Curl_easy *data,
+ /* except protocols that have been upgraded via TLS */
+ continue;
+
++ if(!(needle->handler->flags & PROTOPT_SSL) &&
++ req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
++ continue;
++
+ if(needle->bits.conn_to_host != check->bits.conn_to_host)
+ /* don't mix connections that use the "connect to host" feature and
+ * connections that don't use this feature */
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 7d55f72b03f..c0e5e8f2725 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -42,6 +42,7 @@ SRC_URI = " \
file://CVE-2026-6253.patch \
file://CVE-2026-6429.patch \
file://CVE-2026-7168.patch \
+ file://CVE-2026-4873.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 32/37] libssh2: fix CVE-2026-66032
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (30 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 31/37] curl: fix CVE-2026-4873 Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 33/37] libssh2: fix CVE-2026-66033 Fabien Thomas
` (6 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66032
https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: 19f03bde8988ecff900d2c6f12fb93db84a6d48c)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../libssh2/libssh2/CVE-2026-66032.patch | 36 +++++++++++++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch
new file mode 100644
index 00000000000..15a52664853
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66032.patch
@@ -0,0 +1,36 @@
+From 352341aaebcf91ab16e7fcff158fef4a3b8c32f6 Mon Sep 17 00:00:00 2001
+From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+Date: Tue, 4 Aug 2026 12:32:31 +0000
+Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)
+
+Set data to NULL after freeing it to avoid dangling pointer. fixes
+GHSA-px3w-7g75-hg7w.
+
+Credit: VladimirEliTokarev
+
+CVE: CVE-2026-66032
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0]
+
+Backport adaptations:
+- The upstream fix uses SSH2_FREE() which was renamed from
+ LIBSSH2_FREE() in newer libssh2. Context adjusted to match
+ the 1.11.1 codebase (different line numbers and surrounding
+ function/macro names).
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/sftp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/sftp.c b/src/sftp.c
+index 6ede3111..793f267c 100644
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -1279,6 +1279,7 @@ sftp_open(LIBSSH2_SFTP *sftp, const char *filename,
+ "got HANDLE FXOK"));
+
+ LIBSSH2_FREE(session, data);
++ data = NULL;
+
+ /* silly situation, but check for a HANDLE */
+ rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index 1b281e62966..260f06204df 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -16,6 +16,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2025-15661-1.patch \
file://CVE-2025-15661-2.patch \
file://CVE-2025-15661-3.patch \
+ file://CVE-2026-66032.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 33/37] libssh2: fix CVE-2026-66033
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (31 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 32/37] libssh2: fix CVE-2026-66032 Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 34/37] libssh2: fix CVE-2026-66034 Fabien Thomas
` (5 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66033
https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: 172d606e76f116377df822d94ffb0f9064e57b17)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../libssh2/libssh2/CVE-2026-66033.patch | 45 +++++++++++++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 1 +
2 files changed, 46 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
new file mode 100644
index 00000000000..bb046a6eae2
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch
@@ -0,0 +1,45 @@
+From d1b6996c3b31ce6b60d5a820ecc33880e61ef0ae Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Thu, 23 Jul 2026 10:32:04 +0200
+Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in
+ `ssh2_cipher_crypt()`
+
+By applying two bounds checks to non-debug builds.
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-c4f7-cvfc-33j7
+Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797
+
+Closes #2401
+
+CVE: CVE-2026-66033
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/openssl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/src/openssl.c b/src/openssl.c
+index eba05031..28ae1cc0 100644
+--- a/src/openssl.c
++++ b/src/openssl.c
+@@ -1042,13 +1042,15 @@ _libssh2_cipher_crypt(_libssh2_cipher_ctx * ctx,
+ const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;
+ /* size of AT, if present */
+ const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;
+- /* length to encrypt */
+- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
++ unsigned int cryptlen; /* length to encrypt */
+
+ (void)algo;
+
+- assert(blocksize <= sizeof(buf));
+- assert(cryptlen >= 0);
++ if(blocksize > sizeof(buf) ||
++ blocksize < (size_t)(aadlen + authenticationtag))
++ return 1;
++
++ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
+
+ #if LIBSSH2_AES_GCM
+ /* First block */
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index 260f06204df..5633d3bae4b 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -17,6 +17,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2025-15661-2.patch \
file://CVE-2025-15661-3.patch \
file://CVE-2026-66032.patch \
+ file://CVE-2026-66033.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 34/37] libssh2: fix CVE-2026-66034
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (32 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 33/37] libssh2: fix CVE-2026-66033 Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 35/37] libssh2: fix CVE-2026-66035 Fabien Thomas
` (4 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66034
https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: a19d6c5bbc4e2b4ab4803397e78c70370243a553)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../libssh2/libssh2/CVE-2026-66034.patch | 40 +++++++++++++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 1 +
2 files changed, 41 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
new file mode 100644
index 00000000000..906356baf28
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch
@@ -0,0 +1,40 @@
+From 16720054e0b3f02e36f31dd04add534d73d4a18d Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Sat, 4 Jul 2026 11:19:49 +0200
+Subject: [PATCH] publickey: fix potential OOB read in
+ `libssh2_publickey_list_fetch()`
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-w6g9-cpfp-22gc
+
+Closes #2202
+
+Backport adaptations:
+- The upstream fix uses ssh2_err() which is not available in libssh2
+ 1.11.1. Replace with the equivalent _libssh2_error() call.
+
+CVE: CVE-2026-66034
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/publickey.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/publickey.c b/src/publickey.c
+index 9c9fa618..f3776d2d 100644
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -988,6 +988,13 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
+ }
+
+ if(comment_len) {
++ if(pkey->listFetch_s + comment_len >
++ pkey->listFetch_data + pkey->listFetch_data_len) {
++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++ "ListFetch data too short");
++ goto err_exit;
++ }
++
+ list[keys].num_attrs = 1;
+ list[keys].attrs =
+ LIBSSH2_ALLOC(session,
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index 5633d3bae4b..e2872c335b0 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -18,6 +18,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2025-15661-3.patch \
file://CVE-2026-66032.patch \
file://CVE-2026-66033.patch \
+ file://CVE-2026-66034.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 35/37] libssh2: fix CVE-2026-66035
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (33 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 34/37] libssh2: fix CVE-2026-66034 Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 36/37] libsndfile1: patch CVE-2026-37555 Fabien Thomas
` (3 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66035
https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
libssh2 ptest results (qemux86-64):
before: PASSED: 1 FAILED: 0 SKIPPED: 0
after: PASSED: 1 FAILED: 0 SKIPPED: 0
(From OE-Core rev: 6bfaa957e88c866c9e8257adb165150a2fd6c8d3)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../libssh2/libssh2/CVE-2026-66035.patch | 56 +++++++++++++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 1 +
2 files changed, 57 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch
new file mode 100644
index 00000000000..7c15f92fb6d
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch
@@ -0,0 +1,56 @@
+From 6671019836476649792eea12868a370133be1abe Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Fri, 3 Jul 2026 18:22:55 +0200
+Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-6c79-444r-wx26
+
+Closes #2198
+
+Backport adaptations:
+- The upstream fix uses SSH2_SAFEFREE() to safely release allocated
+ memory and reset the pointer. Since SSH2_SAFEFREE() is not available
+ in libssh2 1.11.1, replace its usage with the equivalent NULL check,
+ LIBSSH2_FREE(), and pointer reset sequence.
+- The upstream fix renames decrypt() to transport_decrypt(). Since this
+ rename is not present in libssh2 1.11.1, retain the original
+ decrypt() function name.
+
+CVE: CVE-2026-66035
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/transport.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/transport.c b/src/transport.c
+index d147505b..9f386e75 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -242,6 +242,17 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+ unsigned char *decrypt_buffer;
+ int blocksize = session->remote.crypt->blocksize;
+
++ if(p->total_num < mac_len + 4 + (size_t)blocksize) {
++ if(p->payload) {
++ LIBSSH2_FREE(session, p->payload);
++ p->payload = NULL;
++ }
++ return LIBSSH2_ERROR_DECRYPT;
++ }
++ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
++
++ first_block[0] = 0;
++
+ rc = decrypt(session, p->payload + 4,
+ first_block, blocksize, FIRST_BLOCK);
+ if(rc) {
+@@ -249,7 +260,6 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
+ }
+
+ /* we need buffer for decrypt */
+- decrypt_size = p->total_num - mac_len - 4;
+ decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
+ if(!decrypt_buffer) {
+ return LIBSSH2_ERROR_ALLOC;
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index e2872c335b0..d14a27f3dc3 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -19,6 +19,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2026-66032.patch \
file://CVE-2026-66033.patch \
file://CVE-2026-66034.patch \
+ file://CVE-2026-66035.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 36/37] libsndfile1: patch CVE-2026-37555
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (34 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 35/37] libssh2: fix CVE-2026-66035 Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
2026-08-19 15:57 ` [OE-core][scarthgap 37/37] linux-yocto/6.6: update to v6.6.147 Fabien Thomas
` (2 subsequent siblings)
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-37555
(From OE-Core rev: bdf36cd3a438b0d52de4c8971c19268ff1fc427f)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../libsndfile1/CVE-2026-37555.patch | 44 +++++++++++++++++++
.../libsndfile/libsndfile1_1.2.2.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch
new file mode 100644
index 00000000000..bac8476ee8c
--- /dev/null
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2026-37555.patch
@@ -0,0 +1,44 @@
+From c32c090ff9bb45e1dae637957c9c9b47b3967623 Mon Sep 17 00:00:00 2001
+From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com>
+Date: Sat, 27 Jun 2026 14:34:16 +0200
+Subject: [PATCH] sds: avoid divide-by-zero in sds_byterate for zero-frame
+ files
+
+sds_read_header() sets psf->sf.frames directly from the file's 3-byte
+data-length field without a lower bound, so a crafted .sds file can
+leave psf->sf.frames == 0. SDS never sets psf->bytewidth, so
+sf_current_byterate() falls through to psf->byterate (sds_byterate),
+which computes
+
+ (psf->datalength * psf->sf.samplerate) / psf->sf.frames
+
+dividing by zero -> SIGFPE crash (denial of service) when an
+application calls the public sf_current_byterate() on such a file.
+
+Guard the division with psf->sf.frames > 0, returning -1 (the same
+'unknown' value already used for the write path) otherwise.
+
+Reproduced with a 21-byte crafted .sds (data-length field = 0) under
+AddressSanitizer: 'FPE ... in sds_byterate src/sds.c:761' before the
+fix; returns -1 cleanly after.
+
+CVE: CVE-2026-37555
+Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/commit/c32c090ff9bb45e1dae637957c9c9b47b3967623]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/sds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/sds.c b/src/sds.c
+index 2a0f164c..1070e653 100644
+--- a/src/sds.c
++++ b/src/sds.c
+@@ -757,7 +757,7 @@ sds_seek (SF_PRIVATE *psf, int mode, sf_count_t seek_from_start)
+ static int
+ sds_byterate (SF_PRIVATE * psf)
+ {
+- if (psf->file.mode == SFM_READ)
++ if (psf->file.mode == SFM_READ && psf->sf.frames > 0)
+ return (psf->datalength * psf->sf.samplerate) / psf->sf.frames ;
+
+ return -1 ;
diff --git a/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb b/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb
index 4cf42375739..5d2a2c256b0 100644
--- a/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb
+++ b/meta/recipes-multimedia/libsndfile/libsndfile1_1.2.2.bb
@@ -13,6 +13,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/libsndfile-${PV}.tar.xz \
file://CVE-2024-50612.patch \
file://CVE-2025-56226-01.patch \
file://CVE-2025-56226-02.patch \
+ file://CVE-2026-37555.patch \
"
GITHUB_BASE_URI = "https://github.com/libsndfile/libsndfile/releases/"
^ permalink raw reply related [flat|nested] 42+ messages in thread* [OE-core][scarthgap 37/37] linux-yocto/6.6: update to v6.6.147
2026-08-19 15:56 [OE-core][scarthgap 00/37] Patch review Fabien Thomas
` (35 preceding siblings ...)
2026-08-19 15:57 ` [OE-core][scarthgap 36/37] libsndfile1: patch CVE-2026-37555 Fabien Thomas
@ 2026-08-19 15:57 ` Fabien Thomas
[not found] ` <18CD40121B3B9CC0.2965692@lists.openembedded.org>
[not found] ` <18CD4012388268D1.189677@lists.openembedded.org>
38 siblings, 0 replies; 42+ messages in thread
From: Fabien Thomas @ 2026-08-19 15:57 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
a1153c0deb44f Linux 6.6.147
12a891c773aeb posix-cpu-timers: Prevent UAF caused by non-leader exec() race
ae068b6761967 Linux 6.6.146
d8a1f7420d2d5 mm: refactor mm_access() to not return NULL
c5596480c50e0 Linux 6.6.145
bd37e81cb475c selftests/bpf: Add simple strscpy() implementation
8fa926d33f082 tools/testing: add linux/args.h header and fix radix, VMA tests
2f48e29ce9dca driver core: Guard deferred probe timeout extension with delayed_work_pending()
d329ff4039abd driver core: Fix missing jiffies conversion in deferred_probe_extend_timeout()
8cd66ea50f3b1 jiffies: Cast to unsigned long in secs_to_jiffies() conversion
a48236b8889e8 jiffies: Define secs_to_jiffies()
df9757a9f5213 writeback: drop now-unnecessary rcu_barrier() in cgroup_writeback_umount()
19ec404b079be writeback: Fix use after free in inode_switch_wbs_work_fn()
96ae4c663f127 xfs: fix stupid compiler warning
2ec1d9d1cd538 Bluetooth: btmtk: remove #ifdef around declarations
88a04d42aa6c0 Bluetooth: btmtk: Fix btmtk.c undefined reference build error harder
9f53402757671 selftests/hid: ensure CKI can compile our new tests on old kernels
4893deede7bbc Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
6d012b730fd22 Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle
3d65aa0fd012e Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state
fcd446bbe7446 ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
faa3ff1dd933c seqlock: fix scoped_seqlock_read kernel-doc
90d35d2b8e47a KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
83b22d7f7c384 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
e51042ddc0b20 Bluetooth: hci_sync: annotate data-races around hdev->req_status
436b54dfa0fb7 Bluetooth: separate CIS_LINK and BIS_LINK link types
3053a0be28cfa Bluetooth: hci_core: Enable buffer flow control for SCO/eSCO
097b159d43407 btrfs: fix incorrect buffered IO fallback for append direct writes
7236d59f58f39 btrfs: fix false IO failure after falling back to buffered write
d0bf0a7d75bb0 exfat: preserve benign secondary entries during rename and move
1058a40273237 exfat: move exfat_chain_set() out of __exfat_resolve_path()
2e22bced8e7e7 exfat: add exfat_get_dentry_set_by_ei() helper
e603c5487f365 exfat: rename argument name for exfat_move_file and exfat_rename_file
04fe6ca144141 exfat: remove unnecessary read entry in __exfat_rename()
fa0d1c1ff406b exfat: move free cluster out of exfat_init_ext_entry()
744b23aa430d5 mm: do file ownership checks with the proper mount idmap
e2baf8ea13fb4 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
7c90aa5cae6f5 regulator: scmi: Simplify with scoped for each OF child loop
1526f3c9884c4 audit: fix potential integer overflow in audit_log_n_hex()
fc7e17d2f742c audit: add audit_log_nf_skb helper function
3ba204896c144 crypto: qat - fix restarting state leak on allocation failure
08f1388e09886 btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
e2e4042d86664 usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
80cd28b56ab62 nvmet-auth: validate reply message payload bounds against transfer length
824425c42253a nvmet: return DHCHAP status codes from nvmet_setup_auth()
981ccee1414ba nvmet: remove superfluous initialization
d5631081be07f usb: gadget: f_fs: initialize reset_work at allocation time
7b20686bf065b crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
9379d998f86d5 crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
f37d00b9d28d5 usb: typec: tcpm: Fix VDM type for Enter Mode commands
f2a6abc670104 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
6be54e2c8ea48 usb: iowarrior: remove inherent race with minor number
ec662a8b2cde0 bpf: Allow LPM map access from sleepable BPF programs
85f16dd3f4872 bpf: Consistently use bpf_rcu_lock_held() everywhere
b6a481642ea19 hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
d6be467a9eb23 hfs/hfsplus: prevent getting negative values of offset/length
587afb06a5d1d serial: 8250_mid: Disable DMA for selected platforms
184579feec824 serial: 8250_mid: Remove 8250_pci usage
05e3decc55d1d HID: appleir: fix UAF on pending key_up_timer in remove()
120306ea29e99 treewide: Switch/rename to timer_delete[_sync]()
7456ae990a973 proc: protect ptrace_may_access() with exec_update_lock (part 1)
42417d36cf084 seqlock: Change do_task_stat() to use scoped_seqlock_read()
7d9295e319ec7 seqlock: Introduce scoped_seqlock_read()
6256899c3a346 mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
a6d5ce2e1a2d7 HID: multitouch: fix out-of-bounds bit access on mt_io_flags
7c29bc073a1f7 HID: add haptics page defines
a018a7c37d5ae perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
5c3265f3252b2 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
ac7b2c21f2269 writeback: Avoid contention on wb->list_lock when switching inodes
138c692d2b2d6 proc: protect ptrace_may_access() with exec_update_lock (FD links)
5e7fc3518a48d proc: rename proc_setattr to proc_nochmod_setattr
ea5c9bf99f626 ksmbd: track the connection owning a byte-range lock
875f1fde874f3 ksmbd: centralize ksmbd_conn final release to plug transport leak
1e112c47ec5dd ksmbd: use opener credentials for FSCTL mutations
aa3c0cab4b28c smb: client: resolve SWN tcon from live registrations
5bb65ae76d055 smb: client: Improve unlocking of a mutex in cifs_get_swn_reg()
8c37e4338c801 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
080a5a42810a4 Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
8daaf7f73fe99 Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
9e6c5169db423 netfilter: ebtables: zero chainstack array
101358689d262 netfilter: ebtables: Use vmalloc_array() to improve code
d22fb719654bf media: nxp: imx8-isi: Fix use-after-free on remove
8b8358c7ce216 media: nxp: imx8-isi: use devm_pm_runtime_enable() to simplify code
e522a5ec70b88 media: nxp: imx8-isi: Convert to platform remove callback returning void
7a550256d68bb gpio: sch: use raw_spinlock_t in the irq startup path
c23a7bbb0277f coresight: etb10: restore atomic_t for shared reading state
e441cbfbd0eaa mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
1455793885772 mm: shrinker: remove redundant shrinker_rwsem in debugfs operations
91047a4396a8b Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
f344a369d0380 crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
b27ecba3196f6 staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
425e1db64b5a6 staging: rtl8723bs: fix spaces around binary operators
e2d5e8e8f758f staging: rtl8723bs: core: move constants to right side in comparison
7d41a98a0d22e PCI: Skip Resizable BAR restore on read error
51b254181df29 PCI: Move Resizable BAR code to rebar.c
fd0e8911770f5 PCI: Add kerneldoc for pci_resize_resource()
0b52ed5ec3deb PCI: Fix restoring BARs on BAR resize rollback path
56f89adc050b6 PCI: Free saved list without holding pci_bus_sem
c3e11419a630c PCI: Prevent resource tree corruption when BAR resize fails
fe8c701a53c28 PCI: mediatek: Fix IRQ domain leak when port fails to enable
87129460aacb8 PCI: mediatek: Use generic MACRO for TPVPERL delay
5bbdcf407209d PCI: mediatek: Convert bool to single quirks entry and bitmap
81842201d74a9 PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
4860120380916 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
f1db80a67da92 vfio/mlx5: Fix racy bitfields and tighten struct layout
a25bfa2a6665a PCI: altera: Fix resource leaks on probe failure
2ee9c46fd2dcd ALSA: aoa: check snd_ctl_new1() return value
f2315b1675bd3 iio: common: st_sensors: honour channel endianness in read_axis_data
668e305b743fa bitops: make BYTES_TO_BITS() treewide-available
5022f4ed5aae9 iio: pressure: mpl115: fix runtime PM leak on read error
f88ae94a69ce7 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
4700ad28cfdd3 iio: imu: inv_icm42600: stabilized timestamp in interrupt
e56fac319bb99 iio: invensense: fix timestamp glitches when switching frequency
3822181f61903 iio: invensense: remove redundant initialization of variable period
a5df36432d8cc iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
bd3c53b25b241 iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
8e63297ca0af2 ACPI: NFIT: core: Fix possible deadlock and missing notifications
5dfed5a90e2ca ACPI: NFIT: core: Use devm_acpi_install_notify_handler()
c5570ebe8ec65 ACPI: bus: Introduce devm_acpi_install_notify_handler()
f1e12d81f9cd2 ACPI: driver: Check ACPI_COMPANION() against NULL during probe
c127dbd832bd4 ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
ac44b4a3d6137 perf/x86/amd/brs: Fix kernel address leakage
bd4a622786f92 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
f51f5acaeee65 mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
f3da9bc7c8c2d mtd: rawnand: fsl_ifc: return errors for failed page reads
7ee7a77ec2f44 mmc: vub300: defer reset until cmd_mutex is unlocked
7c0a3a73dccc9 mtd: mchp23k256: use SPI match data for chip caps
35568121adfc5 mtd: onenand: samsung: report DMA completion timeouts
deb5f0ae384f1 wifi: mwifiex: fix permanently busy scans after multiple roam iterations
5d9f700511a52 wifi: mac80211: free ack status frame on TX header build failure
d97a8f3668949 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
6dc0c8cd9c8a8 reset: sunxi: fix memory region leak on ioremap failure
ac6ac3d35bfc0 ipvs: reload ip header after head reallocation
a3f0d5b605cd5 ipvs: fix more places with wrong ipv6 transport offsets
d5db3439ee8d1 memstick: ms_block: reject a card that reports too many blocks
9735bc3aacc28 macsec: fix promiscuity refcount leak in macsec_dev_open()
75866e80e31e9 llc: fix SAP refcount leak when creating incoming sockets
68c5a2a19987c Bluetooth: btrtl: validate firmware patch bounds
d573250d22840 net: openvswitch: reject oversized nested action attrs
e1f485f5ea8cd regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
a02b52fe54f7b wifi: mac80211: fix memory leak in ieee80211_register_hw()
eb7474d0253bb wifi: rt2x00: avoid full teardown before work setup in probe
8bf359e2547e8 powerpc/pseries: fix memory leak on krealloc failure in papr_init
87af3ebc112fb pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
5c5d58fff3401 pmdomain: imx: Fix i.MX8MP power notifier
02f67c4f88be8 cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
3c693635bb7b3 tracing/osnoise: Call synchronize_rcu() when unregistering
b5f92cc4e24a2 riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
f16866c626568 drbd: reject data replies with an out-of-range payload size
f21fa533a3ed1 macsec: don't read an unset MAC header in macsec_encrypt()
9e36602cbec55 ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
9cb5ac594ca76 ipvs: use parsed transport offset in SCTP state lookup
c7881b6088276 llc: fix SAP refcount leak in llc_ui_autobind()
b91e5248dd7af mac802154: remove interfaces with RCU list deletion
036bc56610607 s390/monwriter: Reject buffer reuse with different data length
5da5cf48a432e riscv: probes: save original sp in rethook trampoline
76392d35c8df4 hwmon: (asus_atk0110) Check package count before accessing element
2b822df8e498a net: wwan: iosm: bound device offsets in the MUX downlink decoder
566d5bf1e27c8 ata: pata_pxa: Fix DMA channel leak on probe error
07c05601a9a8e orangefs: keep the readdir entry size 64-bit in fill_from_part()
1b7687fc56c9b tracing/probes: Fix double addition of offset for @+FOFFSET
6ee5a7665a908 net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
86a61e46a1919 net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
6523daa6852b1 net: lan743x: Initialize eth_syslock spinlock before use
ffb13fe1947bc fsl/fman: Free init resources on KeyGen failure in fman_init()
e7fd81e9fb1fe hwmon: (occ) unregister sysfs devices outside occ lock
b74f293e5f380 net: liquidio: fix BAR resource leak on PF number failure
22f864f7471a5 hwmon: (w83793) remove vrm sysfs file on probe failure
43d49fa630edf hwmon: (w83627hf) remove VID sysfs files on error and remove
22fa00dac08c7 rtc: mpfs: fix counter upload completion condition
5576ee19a6a4a bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
54d73f18f8919 espintcp: use sk_msg_free_partial to fix partial send
e8a916579e427 LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
f2423da55976e batman-adv: clean untagged VLAN on netdev registration failure
e6640923afee6 batman-adv: ensure minimal ethernet header on TX
f19259395b44a batman-adv: retrieve ethhdr after potential skb realloc on RX
29dbd6e27d0f8 net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants
1fe2643d0b24c ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
b9071dc7889be ieee802154: ca8210: fix cas_ctl leak on spi_async failure
66f3053070c0b ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
5abe94a205539 ieee802154: admin-gate legacy LLSEC dump operations
1d4d8ee002083 net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
983cc4aa7e6f6 net: ipip: require CAP_NET_ADMIN in the device netns for changelink
33fd93961557e net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
c64b9ae7eb97e net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
f2ff634d95f8a net: ena: clean up XDP TX queues when regular TX setup fails
2400c4b05d588 net/sched: act_ct: preserve tc_skb_cb across defragmentation
fd0b939ebd1ee net: ixp4xx_hss: fix duplicate HDLC netdev allocation
fd01247bde1ad net: wwan: t7xx: destroy DMA pool on CLDMA late init failure
388ccffbd2e7e net: sit: require CAP_NET_ADMIN in the device netns for changelink
f916210f9d64e gpios: palmas: add .get_direction() op
0ea41686d72f6 gpio-f7188x: Add support for NCT6126D version B
998f66e9ce320 cpu: hotplug: Bound hotplug states sysfs output
7a68257b90d8a cpu: hotplug: Preserve per instance callback errors
cff8281bacd28 posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
218cc15a4c907 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
08bf4b6ee2898 Input: ims-pcu - fix type confusion in CDC union descriptor parsing
129187ec3f868 Input: ims-pcu - fix race condition in reset_device sysfs callback
e3f93d63dcd48 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
3fd7c0ace2453 Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
477149c848d40 Input: ims-pcu - fix DMA mapping violation in line setup
f7f5afeed31ba Input: ims-pcu - add response length checks
aa1885f87e60c Input: ims-pcu - validate control endpoint type
ae05b7a600c07 Input: ims-pcu - release data interface on disconnect
6a6c373e6a82e Input: ims-pcu - fix use-after-free and double-free in disconnect
8c689a8f22922 scsi: elx: efct: Fix I/O leak on unsupported additional CDB
62cf39a9770a6 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
a040004846f1f scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
6ca5de8782e67 scsi: target: Bound PR-OUT TransportID parsing to the received buffer
fa588f2840110 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
18d4f86816592 scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
5594ee5a2653b scsi: sg: Report request-table problems when any status is set
c3f4e40766154 scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
a61de4d7e22a9 scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
29b8d12278d20 dm-verity: increase sprintf buffer size
1f04b390add2e dm-verity: fix a possible NULL pointer dereference
cf9feed8c131e dm-integrity: don't increment hash_offset twice
259ce9e3fc3a3 dm_early_create: fix freeing used table on dm_resume failure
9964ae466c589 dm-stats: fix merge accounting
04ca47b6768d8 dm-stats: fix dm_jiffies_to_msec64
d05e0edfecf52 dm-log: fix a bitset_size overflow on 32bit machines
29536a9ff146d dm-ioctl: fix a possible overflow in list_version_get_info
ae7fac9cb5bb0 dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
7e1822f83c5a1 dm era: fix out-of-bounds memory access for non-zero start sector
3dc9ae1029320 dm thin metadata: fix metadata snapshot consistency on commit failure
a887bf1f0de8e dm thin metadata: fix superblock refcount leak on snapshot shadow failure
cf419c869e0d0 net: sparx5: unregister blocking notifier on init failure
8b719cef5ac30 bpf: Add missing access_ok call to copy_user_syms
c3fd6f28c7ce1 bpf,fork: wipe ->bpf_storage before bailouts that access it
f53bdab85e64e can: bcm: add missing rcu list annotations and operations
0f6f9f95294b4 can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
4177762f70646 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
6280eda96e070 can: isotp: use unconditional synchronize_rcu() in isotp_release()
a02e1d8f19132 can: esd_usb: kill anchored URBs before freeing netdevs
7c96581169c9d nvmet-rdma: handle inline data with a nonzero offset
a257b41ddfe9e sctp: validate STALE_COOKIE cause length before reading staleness
49f6705d80b5e spi: uniphier: Fix completion initialization order before devm_request_irq()
64b4197d013bf time: Fix off-by-one in compat settimeofday() usec validation
9c513dabd4540 tpm: Make the TPM character devices non-seekable
0084fd985fe28 tpm: fix event_size output in tpm1_binary_bios_measurements_show
e9c90756f10da xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
9257c256efa27 xfrm: use compat translator only for u64 alignment mismatch
311011f8cc206 xen/gntdev: fix error handling in ioctl
c3f2f080b21f8 ice: fix ice_init_link() error return preventing probe
5290a52533e09 i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
6239860c5581f i2c: mediatek: fix WRRD for SoCs without auto_restart option
1f45a48035bdb hwmon: (ltc2992) add missing 'select REGMAP_I2C' to Kconfig
b1d16cecefbcd ksmbd: fix integer overflow in set_file_allocation_info()
ecf3107bfa717 smb: client: use kvzalloc() for megabyte buffer in simple fallocate
9a14297744686 platform/x86/amd/pmc: Add delay_suspend module parameter
b977cfb193aad platform/x86/amd/pmc: Delay suspend for some Lenovo Laptops
1ec0f176f793e platform/x86/amd/pmc: Check for intermediate wakeup in function
3ee0f478bb29b dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK
8f0f5de109111 dmaengine: tegra: Fix burst size calculation
6b068a97958aa tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
424130169dc03 irqchip/crossbar: Use correct index in crossbar_domain_free()
44c6abf5d823d mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
dc341272cf8e1 mtd: spi-nor: swp: Improve locking user experience
0d3766fecd9b2 fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
2b3b4e5ff5a58 net: thunderbolt: Fix frags[] overflow by bounding frame_count
7a563dbb3d8d5 bus: mhi: ep: Protect mhi_ep_handle_syserr() in the error path
b2f6220e929b2 fpga: dfl: add bounds check in dfh_get_param_size()
38c1ef7ce50eb ocfs2: reject non-inline dinodes with i_size and zero i_clusters
b363e2c77de8e ocfs2: reject dinodes whose i_rdev disagrees with the file type
a5b555bcabbb0 ocfs2: reject dinodes with non-canonical i_mode type
7da7e4ac21895 ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
f14aaaa130356 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
e281d892ce587 ocfs2: avoid moving extents to occupied clusters
3da4eb15c7b42 mtd: rawnand: fix condition in 'nand_select_target()'
f62a1f245a716 net/9p: fix infinite loop in p9_client_rpc on fatal signal
afddc64840351 mtd: rawnand: pl353: fix probe resource allocation
6ab9356517c7b ocfs2: use kzalloc for quota recovery bitmap allocation
17400e4d9dd57 scsi: sas: Skip opt_sectors when DMA reports no real optimization hint
e1919423f1b92 scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
a5a682b016ef5 9p: skip nlink update in cacheless mode to fix WARN_ON
200b8bc5b6065 mtd: slram: remove failed entries from the device list
511a60e71aec3 mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
31bfda8ca7745 proc: only bump parent nlink when registering directories
50a753171d255 mm/damon/sysfs-schemes: put stats for scheme_add_dirs() internal error
a8c0592a80e95 mm/damon/sysfs-schemes: fix dir put orders in access_pattern_add_dirs()
51afb7da697b6 riscv: cacheinfo: Fix node reference leak in populate_cache_leaves
3446ffb5d03c3 mips: sched: Fix CPUMASK_OFFSTACK memory corruption
e44ad91e9f75f power: supply: charger-manager: fix refcount leak in is_full_charged()
bd77afca2ae9b ntfs3: fix out-of-bounds read in decompress_lznt
b232eb5c9fe11 ntfs3: validate split-point offset in indx_insert_into_buffer
53c5f3b2da377 ntfs3: bound to_move in indx_insert_into_root before hdr_insert_head
7ac4c86915c24 ntfs3: cap RESTART_TABLE free-chain walker at rt->used
429d653ca641d fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
96fb64f9da86f fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
57c071e2c4f30 fs/ntfs3: validate lcns_follow in log_replay conversion
546518468e6c9 fs/ntfs3: bound attr_off in UpdateResidentValue against data_off
9b7c28d8c61bd fs/ntfs3: bound copy_lcns dp->page_lcns[] index in analysis pass
4c8aac931c1cd fs/ntfs3: bound DeleteIndexEntryAllocation memmove length
af08e689ec260 fs/ntfs3: fix syncing wrong inode on DIRSYNC cross-directory rename
c31067bf5c8dc mm/damon/core: make charge_addr_from aware of end-address exclusivity
700c225d829a1 power: supply: cpcap-battery: Fix missing nvmem_device_put() causing reference leak
27857db30c985 MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
fadd0af657f35 MIPS: ip22-gio: fix device reference leak in probe
22c4c06006721 MIPS: ip22-gio: fix kfree() of static object
9d19995c61977 MIPS: ip22-gio: fix gio device memory leak
65104d6eb43f0 remoteproc: qcom: Fix leak when custom dump_segments addition fails
4a1148f2739d5 SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
7ce4c23e783e7 lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
ddfbd816273b4 lockd: Plug nlm_file leak when nlm_do_fopen() fails
0d8ceb3988414 sunrpc: wait for in-flight TLS handshake callback when cancel loses race
f3b55945dd99f sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
0b0d9404951aa nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
5804e6a6912b5 nvdimm/btt: Free arenas on btt_init() error paths
fb9b49618ed72 jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
d141d9b769bcd Bluetooth: SCO: hold sk properly in sco_conn_ready
44a203afaedb4 Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
6df7b63afb666 HID: playstation: validate num_touch_reports in DualShock 4 reports
614b6c5ad99c6 mfd: tps6586x: Fix OF node refcount
9015475f766b3 cifs: invalidate cfid on unlink/rename/rmdir
604bd5042fbcd batman-adv: tt: prevent TVLV OOB check overflow
d2148aeee9319 batman-adv: frag: fix primary_if leak on failed linearization
740542f11bf8c batman-adv: frag: free unfragmentable packet
5ae95378caa59 batman-adv: fix VLAN priority offset
067e413eec2e6 batman-adv: tt: avoid request storms during pending request
ddfea9b5089c7 batman-adv: dat: fix tie-break for candidate selection
3c62694c31f04 batman-adv: dat: ensure accessible eth_hdr proto field
ab2bac47a0263 batman-adv: bla: reacquire gw address after skb realloc
3404be97b940a batman-adv: dat: acquire ARP hw source only after skb realloc
ed90eb5c68420 batman-adv: access unicast_ttvn skb->data only after skb realloc
afac8096bde49 batman-adv: gw: acquire ethernet header only after skb realloc
27206bb57c47b s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
5be478c1e0898 perf/x86/amd/lbr: Fix kernel address leakage
7ab30a12b88bf x86/boot: Reject too long acpi_rsdp= values
9a77a7639dfdc x86/boot: Validate console=uart8250 baud rate to fix early boot hang
db938eb9a3c13 tools/power/x86/intel-speed-select: Harden daemon pidfile open
a3e340d506c10 mfd: sm501: Fix reference leak on failed device registration
8bf529571cca6 leds: uleds: Fix potential buffer overread
30500acfc43ef selinux: fix incorrect execmem checks on overlayfs
e507633bf76bc selinux: check connect-related permissions on TCP Fast Open
bb29a484dee0b soc: fsl: qe: panic on ioremap() failure in qe_reset()
f747a76004dac soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
edc7267b59a46 gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
c141f69d0a0fb netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
a842dab87cab2 netfilter: xt_nat: reject unsupported target families
bca4bfb9cc5c5 netfilter: ecache: fix inverted time_after() check
7bdc3c0985ecf netfilter: nf_conncount: fix zone comparison in tuple dedup
cd0d7bbc027b4 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
57e4e29644ec0 netfilter: nf_nat_sip: reload possible stale data pointer
3f03a2d225c66 netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
fac2fdac3baad netfilter: xt_cluster: reject template conntracks in hash match
893319e9950d0 netfilter: nfnl_cthelper: apply per-class values when updating policies
2b70f61f569bb netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
ec369eac0795c ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback
48b6c39883637 ASoC: mediatek: mt8183: Release reserved memory on cleanup
989cbe8cc86f4 ASoC: mediatek: mt8192: Release reserved memory on cleanup
ee781058cd4d7 ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
1adde1941bba7 ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
8d16e5bc78478 fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
6ca48f23ce61a fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
124df55c7201d fbdev: vesafb: fix memory leak in vesafb_probe()
d21e6747f3f68 fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
dfbb1a695d889 fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
c53fdf7ee65af fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
0d0fa8425b296 fbdev: s3fb: fix potential memory leak in s3_pci_probe()
e1ecbaeec5fbf fbdev: i740fb: fix potential memory leak in i740fb_probe()
f4dacbfd885f3 fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
200375909216b fbdev: sm712: Fix operator precedence in big_swap macro
2952767e399e2 fbdev: hecubafb: fix potential memory leak in hecubafb_probe()
4ce94f9e3bfb3 fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()
01708cf3dca2f fbdev: metronomefb: fix potential memory leak in metronomefb_probe()
8e9f7a95279bf KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
3ef3190e30601 KVM: s390: pci: Fix handling of AIF enable without AISB
654be81c4c637 KVM: arm64: vgic: Check the interrupt is still ours before migrating it
6e69317cd44a2 KVM: s390: pci: Fix GISC refcount leak on AIF enable failure
1237c24ea3ceb arm64: dts: qcom: sdm630: describe adsp_mem region properly
cedcabcd3c826 arm64: fpsimd: Fix type mismatch in sve_{save,load}_state()
9433578bff9c1 net: ife: require ETH_HLEN to be pullable in ife_decode()
513f820b3f0cf net: atm: reject out-of-range traffic classes in QoS validation
d0597074e9973 net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
7c6d2d2baeb1e ASoC: SOF: topology: validate vendor array size before parsing
0dce240145f47 ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get
89a2309a9eec8 ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc
266f936db83ae ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put
d7e7c813834c6 vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter
220d41bdce41f mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
8b3350eacd9df mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
160045fc943f6 smb: client: fix overflow in passthrough ioctl bounds check
212c59e5e4168 octeontx2-af: fix VF bringup affecting PF promiscuous state
6c97f394bb15f net/mlx5: Fix L3 tunnel entropy refcount leak
75a59698886cc selftests/net: fix EVP_MD_CTX leak in tcp_mmap
29a7953e9adea regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
889374b8e4a60 dm era: fix NULL pointer dereference in metadata_open()
79cd550f8c884 SUNRPC: pin upper rpc_clnt across the TLS connect_worker
ce4d29a99878c SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
d64b6be5740ce cifs: validate DFS referral string offsets
25e7c0fc304bd s390/zcrypt: Remove the empty file
9bc9b95aee2b2 ipvs: ensure inner headers in ICMP errors are in headroom
accee8e53a760 ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
d45f73c274435 ipvs: use parsed transport offset in TCP state lookup
946e09454b1a0 ipvs: pass parsed transport offset to state handlers
9815e834f5ff8 ipv6: mcast: Fix potential UAF in MLD delayed work
8374a462c74ec ipv6: mcast: Replace locking comments with lockdep annotations.
40a1e998cb266 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
75a7e03ad7336 octeontx2-pf: check DMAC extraction support before filtering
336c1e414fc0e net/sched: cake: reject overhead values that underflow length
ff431529d3773 net: usb: lan78xx: disable VLAN filter in promiscuous mode
0e75abbc36ed1 net: usb: lan78xx: move functions to avoid forward definitions
0867b0f2513eb net/tls: Consume empty data records in tls_sw_read_sock()
dbcb8635b1eb7 ring-buffer: Fix event length with forced 8-byte alignment
f80b4afe893df Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
85f5e3a9885a3 Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
5aabbd01ac315 Bluetooth: MGMT: Fix adv monitor add failure cleanup
ba1f1ef6522e6 Bluetooth: 6lowpan: hold L2CAP conn across debugfs control
dd54267a70e32 amt: fix size calculation in amt_get_size()
647b19e5cc145 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
0d8532a5e972a net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload
3868c3244369a net: qualcomm: rmnet: validate MAP frame length before ingress parsing
0bf78df2d3ecb qede: fix off-by-one in BD ring consumption on build_skb failure
786456d0a244b net: microchip: vcap: fix races on the shared Super VCAP block
24c77044cdfcf net/mlx5e: Fix HV VHCA stats agent registration race
5b927dcec5f10 net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation
8ace320ac4416 netfilter: xt_connmark: reject invalid shift parameters
2fd89a50a9783 netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
5da915fc159c6 netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
0a8b7a6d76377 netfilter: xt_u32: reject invalid shift counts
2a99224c12082 gue: validate REMCSUM private option length
685e92934f11d net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
6a3e06f1d1185 selftests/hid: Cover hid_bpf_get_data() size overflow
56558ef8eb2f8 selftests/hid: convert the hid_bpf selftests with struct_ops
4dee51c96e870 selftests/hid: force using our compiled libbpf headers
b52c523eb8fc9 selftests/hid: do not manually call headers_install
75e9e9f1bc6ca selftests/hid: ensure we can compile the tests on kernels pre-6.3
6a10e76a56f81 arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
33833e83cf552 arm64/mm: convert ptep_clear() to ptep_get_and_clear()
3be7e80fc59b2 arm64/mm: convert set_pte_at() to set_ptes(..., 1)
3ea68f5ec9bfe arm64/mm: convert READ_ONCE(*ptep) to ptep_get(ptep)
c973d53bcd420 HID: core: Fix OOB read in hid_get_report for numbered reports
a02d5d7ad7ae5 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
9eae03f0df96b ata: sata_gemini: unwind clocks on IDE pinctrl errors
a11ebaab50d27 minix: avoid overflow in bitmap block count calculation
598f8ba4e8818 afs: Fix unchecked-length string display in debug statement
1607075220cf5 afs: Fix the volume AFS_VOLUME_RM_TREE is set on
bef5514f6b6cb afs: Fix vllist leak
5a39b145a8fb4 afs: Fix callback service message parsers to pass through -EAGAIN
ac428553b5a3d afs: use kvfree() to free memory allocated by kvcalloc()
9ad9016e3333c afs: Fix error code in afs_extract_vl_addrs()
bac8fb0d60254 fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
d3b5adfa2f008 net/sched: hhf: clear heavy-hitter state on reset
fb64c5a232808 pinctrl: meson: restore non-sleeping GPIO access
1bc19683c8bbb gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
fb978d7205270 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
515195c5e508c smb: move some duplicate definitions to common/cifsglob.h
16fb65ec15fe7 ksmbd: reject undersized DACLs before parsing ACEs
17efa598efd94 net/sched: act_bpf: use rcu_dereference_bh() to read the filter
d04abfe08e4f8 cxgb4: Fix decode strings dump for T6 adapters
97cc510eafb6e virtio_net: disable cb when NAPI is busy-polled
e6b674dc341c6 irqchip/ts4800: Fix missing chained handler cleanup on remove
57a48d17a789c irqchip/gic-v3-its: Fix OF node reference leak
284928533c7ed tracing: eprobe: read the complete FILTER_PTR_STRING pointer
63d5fd8f5e2db tracing/events: Fix to check the simple_tsk_fn creation
4c40eec06eeac bridge: stp: Fix a potential use-after-free when deleting a bridge
735567bde7401 net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
e8c714acf5573 net: gianfar: dispose irq mappings on probe failure and device removal
d2c37f26d1a37 net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
573418f7ea8f8 usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
2106bf4056858 hwmon: (pmbus) Fix passing events to regulator core
39a581bd64a0e hwmon: adm1275: Prevent reading uninitialized stack
8c693f988ce1b MIPS: DEC: Ensure RTC platform device deregistration upon failure
dcb0940c3df1e sctp: fix SCTP_RESET_STREAMS stream list length limit
f55276160ffad net: enetc: check the number of BDs needed for xdp_frame
e30af53dca803 qede: fix out-of-bounds check for cqe->len_list[]
804bb969f194c seg6: validate SRH length before reading fixed fields
a05c848a94bbc gpio: htc-egpio: use managed gpiochip registration
f0320c623f4d4 gpio: mvebu: fail probe if gpiochip registration fails
0567b5bcbd793 spi: sh-msiof: abort transfers when reset times out
edce0203a4fc0 tracing: probes: fix typo in a log message
cde84429e0fae dt-bindings: net: renesas,ether: Drop example "ethernet-phy-ieee802.3-c22" fallback
d805c95580b23 ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count
1596d8ecb6680 net: ethernet: sunplus: spl2sw: fix phy_node refcount leak in remove
a63eaf7605d15 net: sungem: fix probe error cleanup
be626ac1faadd net: mvneta: re-enable percpu interrupt on resume
aa6e2b431070b rtc: cmos: unregister HPET IRQ handler on probe failure
ebe5ad5937dbc rtc: ds1307: Fix off-by-one issue with wday for rx8130
0d6d5194d9bba smb/client: preserve errors from smb2_set_sparse()
ea8e946b09baf ipv6: fix error handling in disable_policy sysctl
2474255868717 ipv6: fix error handling in forwarding sysctl
7469cebbd8107 ipv6: fix error handling in ignore_routes_with_linkdown sysctl
bcf9266fc3cd1 ipv6: fix error handling in disable_ipv6 sysctl
447d493034a9c net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
83090f5e7b547 veth: fix NAPI leak in XDP enable error path
fc62bfd30d30a net: dsa: sja1105: round up PTP perout pin duration
3876318ea54e8 net, bpf: check master for NULL in xdp_master_redirect()
bd9e5220ffb15 alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
4de5ff924c0a8 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
4e5ed2a7dda54 NTB: epf: Fix doorbell bitmask and IRQ vector handling
3fb009699812a NTB: epf: Report 0-based doorbell vector via ntb_db_event()
ba1a84de32848 NTB: epf: Make db_valid_mask cover only real doorbell bits
efc17b9240d82 netfilter: nft_compat: ebtables emulation must reject non-bridge targets
1655ca28c5b6d netfilter: nft_synproxy: stop bypassing the priv->info snapshot
abef7f817217f netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
87f7a720de254 netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
6b44c6660aa1c bpf: Disable xfrm_decode_session hook attachment
b3b4719429d5c bpf, lsm: Add disabled BPF LSM hook list
49eaf14032013 ipv4: fib: Don't ignore error route in local/main tables.
302d57ed78728 ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
7470511d085af ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE
52c73b6992b46 rtc: msc313: fix NULL deref in shared IRQ handler at probe
3186a301d65d5 i40e: Fix i40e_debug() to use struct i40e_hw argument
d662269211c49 ice: fix AQ error code comparison in ice_set_pauseparam()
335c2dd21ad9d ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs()
2465d1bdf84e0 PCI: endpoint: pci-epf-ntb: Add check to detect 'db_count' value of 0
014dd1c8617ba PCI: endpoint: pci-epf-vntb: Add check to detect 'db_count' value of 0
bfa05d89dc3ca drm/edid: fix OOB read in drm_parse_tiled_block()
525e408c27ae7 bpf: Fix effective prog array index with BPF_F_PREORDER
9fe373020cc9d bpf: zero-initialize the fib lookup flow struct
475405593de2b bpf: Fix stack slot index in nospec checks
48c16ed988790 rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
429025d25ac24 rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
e88b1ff95f2ed octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
ab9c0b007c7fd octeontx2-pf: Clear stats of all resources when freeing resources
9ab0fb5758cbb octeontx2-af: mcs: Fix unsupported secy stats read
754dfaddde3a1 net: ethernet: mtk_ppe: Fix rhashtable leak in mtk_ppe_init error paths
5e215bf1c47fd tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
a07f77e995a63 net: marvell: prestera: initialize err in prestera_port_sfp_bind
c6edb7532c8e7 selftests/mm: fix exclusive_cow test fork() handling
75ec9461a4623 selftests/mm: allow PUD-level entries in compound testcase of hmm tests
04dfc21465992 selftests/mm: clarify alternate unmapping in compaction_test
b508e7542d683 irqchip/crossbar: Fix parent domain resource leak
f73b7de5338fc netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
76d1bc5498c72 netfilter: nf_reject: skip iphdr options when looking for icmp header
d01b4b471f0fc netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
6329d3a9afe71 netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
28642b1420f27 netfilter: ipset: annotate "pos" for concurrent readers/writers
bead63993e05e netfilter: ipset: Fix data race between add and dump in all hash types
c66ed3e6371f5 md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
71b5add66c51d ieee802154: fix kernel-infoleak in dgram_recvmsg()
ded58bfebcb32 ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
e74488982ecfd ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()
e3987bc539630 ACPI: resource: Amend kernel-doc style
e432404e63edd thermal: intel: Fix dangling resources on thermal_throttle_online() failure
79417b08f747d arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
bcdd5a7363bdd ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
9a65860959db5 flow_dissector: check device type before reading ETH_ADDRS
f104794507099 devlink: Fix parent ref leak in devl_rate_node_create()
0ce4f958ddeb8 dpaa2-switch: fix VLAN upper check not rejecting bridge join
38e94d63e29f4 virtio-net: fix len check in receive_big()
154e29d0c6a23 spi: rpc-if: Use correct device for hardware reinitialization on resume
e58aef585d173 PCI: iproc: Restore .map_irq() for the platform bus driver
722576aba0a6d sctp: hold socket lock when dumping endpoints in sctp_diag
befe1ebe7fc2c net: psample: fix info leak in PSAMPLE_ATTR_DATA
19d2d36e193c3 octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
cfbffc8091f51 drm/amdgpu: initialize irq.lock spinlock earlier
506e635aed05d drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm
283e77af49fda drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
a6d0abb35052c ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode
efa9e3b9f3dea xfrm: validate selector family and prefixlen during match
a1c6d68ddee37 xfrm: annotate data-races around xfrm_policy_count[] and xfrm_policy_default[]
be8cdef5c93d5 xfrm: Support crypto offload for inbound IPv6 ESP packets not in GRO path
22d554d9ba241 xfrm: Use the XFRM_GRO to indicate a GRO call on input
cb4f93bdade99 spi: dw: fix wrong BAUDR setting after resume
6564da2814a79 gpio: mlxbf3: fail probe if gpiochip registration fails
e1a215900d2ed sparc: led: avoid trimming a newline from empty writes
5feaaa1d34b29 apparmor: fix label can not be immediately before a declaration
b8e89081a97b6 i3c: master: Prevent reuse of dynamic address on device add failure
07fea242a8942 apparmor: put secmark label after secid lookup
58817bf37ccc4 apparmor: aa_getprocattr free procattr leak on format failure
5cba148eae6e8 apparmor: fix potential UAF in aa_replace_profiles
5acb878db4132 apparmor: grab ns lock and refresh when looking up changehat child profiles
6a26de6c05542 apparmor: fix rawdata_f_data implicit flex array
cc2192899d502 apparmor: aa_label_alloc use aa_label_free on alloc failure
b7c45c05a396a apparmor: check label build before no_new_privs test
79d80d70b03d1 security/apparmor/apparmorfs.c: conditionally compile get_loaddata_common_ref()
6848ca381edff Revert "PCI/MSI: Unmap MSI-X region on error"
2e605bef29e09 PCI: mediatek: Use actual physical address instead of virt_to_phys()
26b30daf73ae8 PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
b3c60e4f962dd tools lib api: Fix mount_overload() snprintf truncation and toupper range
bd0a73192c3a9 tools lib api: Fix filename__write_int() writing uninitialized stack data
20a17dd8a0c7e tools lib api: Fix missing null termination in filename__read_int/ull()
05457b1241d74 xprtrdma: Return sendctx slot after Send preparation failure
4322fd9645ee7 xprtrdma: Repost Receive buffers for malformed replies
4163424214017 xprtrdma: Sanitize the reply credit grant after parsing
88b5346284a18 xprtrdma: Fix bcall rep leak and unbounded peek
e967e82e372f4 xprtrdma: Resize reply buffers before reposting receives
2b84ff4da343b xprtrdma: Document and assert reply-handler invariants
dd798b76a3481 xprtrdma: Check frwr_wp_create() during connect
65a04db641fdb PCI: rcar-host: Remove unused LIST_HEAD(res)
2097a2537d9d1 fs/ntfs3: resize log->one_page_buf when adopting on-disk page size
018359b048c4c PCI: meson: Propagate devm_add_action_or_reset() failure
b0c5bc5068f8c PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
4bc7e5c789b62 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
502b282f2f452 NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
c31ce9fd8b349 nfs: keep PG_UPTODATE clear after read errors in page groups
02e00663846b2 NFSv4/pnfs: defer return_range callbacks until after inode unlock
9f3d9b68c1c6c xprtrdma: Decouple req recycling from RPC completion
d006a5fb63b92 xprtrdma: Use sendctx DMA state for Send signaling
d1b159356a358 xprtrdma: Post receive buffers after RPC completion
9d17e2618037d xprtrdma: Close lost-wakeup race in xprt_rdma_alloc_slot
b7070614baeba xprtrdma: Avoid 250 ms delay on backlog wakeup
e253e1a0b360e xprtrdma: Remove temp allocation of rpcrdma_rep objects
b6c4002122573 pNFS/filelayout: fix cheking if a layout is striped
a64d70d5e33f8 clk: qcom: a53: Corrected frequency multiplier for 1152MHz
5876f38b67a30 dmaengine: Fix possible use after free
98cc38b541014 dmaengine: qcom: gpi: set DMA_PRIVATE capability
ba8b410c7c4f6 perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
b67a3bcc1cb49 dmaengine: imx-sdma: Refine spba bus searching in probe
bca364c4c7579 drm/amd/display: Add missing kdoc for ALLM parameters
914a77aa7a24e fs/ntfs3: fix mount failure on 64K page-size kernels
8afc24a884aff fs/ntfs3: add bounds check to run_get_highest_vcn()
6c63a4ed26927 HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
eda31b3b90f15 clk: at91: keep securam node alive while mapping it
8ac30431ca7e4 iio: tcs3472: power down chip on probe failure
eed69f8a10b82 iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
94d158985b6ea iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling
8cf3460745333 iio: magnetometer: ak8975: fix potential kernel stack memory leak
922e9be5c41a2 iio: light: si1133: prevent race condition on timeout
4799162324a84 iio: light: si1133: reset counter to prevent race condition
764723bd67a6c char: tlclk: fix use-after-free in tlclk_cleanup()
2bb0cfa1392c3 usb: host: max3421: Reject hub port requests for non-existent ports
d512bdefd241b usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
4928096212b78 staging: most: video: avoid double free on video register failure
e519c1d8c5efb mailbox: mtk-adsp: fix UAF during device teardown
9c55eb9a0f6f4 phy: phy-can-transceiver: Check driver match and driver data against NULL
4d6628c106697 bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()
78a0d1fa5d7a3 PCI: loongson: Do not ignore downstream devices on external bridges
f67b187af7493 platform/x86: xo15-ebook: Fix wakeup source and GPE handling
37b43903ef0f0 x86/platform/olpc: xo15: Drop wakeup source on driver removal
4997873e3abba PCI: Check ROM header and data structure addr before accessing
01b03bc88bd8d PCI: Introduce named defines for PCI ROM
a397bf58445ff PCI/ASPM: Don't reconfigure ASPM entering low-power state
d887844028cd6 coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore
66433aca6e806 coresight: cti: Fix DT filter signals silently ignored
08626fcfe1230 staging: nvec: fix use-after-free in nvec_rx_completed()
8aadc136d8e8d net/9p: fix race condition on rdma->state in trans_rdma.c
49b34bd3ad696 ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
2ce02059ceb63 mfd: cs42l43: Sanity check firmware size
7c3264d273d52 ksmbd: fix use-after-free in same_client_has_lease()
179966099aa10 ionic: Fix check in ionic_get_link_ext_stats
572fff10819df tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
50ff092633b06 tipc: fix UAF in tipc_l2_send_msg()
00cd01ea0cf53 KEYS: Use acquire when reading state in keyring search
55d0edf94c19c powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
7c75878359bd2 powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
5397142d60aa2 powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
ac7385af1dca8 MIPS: mm: Fix out-of-bounds write in maar_res_walk()
c05a0ec1cdced bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
888706a76286c bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
5c5fccbcf3e1c bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
98219ce3e1c96 selftests/bpf: Initialize operation name before use
6fb80feea3099 smb/client: always return a value for FS_IOC_GETFLAGS
4465ebe67d893 cifs: remove all cifs files before kill super
3ff31b83aacf2 ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait()
68d0415c16e5e netfilter: nf_conncount: callers must hold rcu read lock
b8c90823cdfb5 kcm: use WRITE_ONCE() when changing lower socket callbacks
498a667dc9542 net: bcmgenet: Use weighted round-robin TX DMA arbitration
7edd4db82f942 net: wwan: t7xx: check skb_clone in control TX
8d654fa6ebf45 net/mlx5: Check max_macs devlink param value against max capability
b6dced2150081 bpf: Run generic devmap egress prog on private skb
637639118ef33 net: mana: guard TX wq object destroy with INVALID_MANA_HANDLE check
8e52a247d9aa9 net: mana: initialize gdma queue id to INVALID_QUEUE_ID
e8c6dbadf139c net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
acc08a0c7f37e net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
25fb53e43ec00 handshake: Require admin permission for DONE command
23a29ee1d9de3 power: supply: core: fix supplied_from allocations
820a87639e9aa ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO
dfab0d4698a64 spi: xilinx: use FIFO occupancy register to determine buffer size
cbc2fcf580882 crypto: rng - Free default RNG on module exit
8afd1007ef798 crypto: cavium/cpt - fix DMA cleanup using wrong loop index
ed374dbc70c10 crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
66bdbb8e6c5c8 cxl/test: Add check after kzalloc() memory in alloc_mock_res()
f1715d92ee309 tipc: reject inverted service ranges from peer bindings
47ed873e4ceda tipc: prevent snt_unacked underflow on CONN_ACK
9b937de4b3ded tipc: require net admin for TIPCv2 netlink mutators
b2a017bfcf565 net/sched: sch_hfsc: Don't make class passive twice
85f54cf589163 sctp: validate embedded address parameter length
53788b134519e bridge: cfm: reject invalid CCM interval at configuration time
a7ef30753353b net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
3d05400186027 net/sched: cls_flow: Dont expose folded kernel pointers
4bcb23635d505 ASoC: tegra: tegra210_ahub: Validate written enum value
0b10c6203e62d ASoC: fsl: fsl_audmix: Validate written enum values
8cbf24714d6b3 ASoC: codecs: hdac_hdmi: Validate written enum value
aabfc845838ef RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
6fc874fdfb366 RDMA/mlx5: Fix undefined shift of user RQ WQE size
87262e60adfe1 RDMA/mlx5: Remove raw RSS QP restrack tracking
60fa67263a772 fs: efs: remove unneeded debug prints
41d3e5526fcd6 Bluetooth: vhci: validate devcoredump state before side effects
290b36f9d1eb9 Bluetooth: hci: validate codec capability element length
809230cc25dde Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
b43dee28b7c81 s390/process: Fix kernel thread function pointer type
eb73056ce2a6f bpf: Tighten cgroup storage cookie checks for prog arrays
b0dbe5f70ee8d of: cpu: add check in __of_find_n_match_cpu_property()
7f10e0f35ac1d cxl/test: Zero out LSA backing memory to avoid leaking to user
0101d4000a124 cxl/test: Fix integer overflow in mock LSA bounds checks
2a0ee19de6e89 selftests/bpf: Fix bpf_iter/task_vma test
260830a9a706f ext4: fix kernel BUG in ext4_write_inline_data_end
015e32e264a9b bonding: 3ad: fix mux port state on oper down
3c75cd8e68f1f ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails
b72d5d2d8fe76 ASoC: cs35l56: Fix missing calls to wm_adsp2_remove()
67fb36b508ce7 tools/virtio: check mmap return value in vringh_test
6445b945024f4 vhost/net: complete zerocopy ubufs only once
f8e1f130689a2 vduse: Requeue failed read to send_list head
2b3f79b90b231 vhost/vdpa: validate virtqueue index in mmap and fault paths
93ed4692f2299 vduse: hold vduse_lock across IDR lookup in open path
dbc63fe645f09 ASoC: codecs: aw88261: fix incorrect masks for boost regs
a28ad91dc5d80 spi: meson-spifc: fix runtime PM leak on remove
407472df02dba IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
fcce8a44dfa39 btrfs: zoned: don't account data relocation space-info in statfs free space
5a15f8d87a007 hwmon: (it87) Clamp negative values to zero in set_fan()
b2ff450f7f5cf fbdev: sm501fb: Fix buffer errors in OF binding code
015dc4a1e0c2c btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
06010aab6ec04 wifi: mt76: mt7921: fix potential tx_retries underflow
d42f6f25211a4 wifi: mt76: mt7915: fix potential tx_retries underflow
e93b18ddc18a2 wifi: mt76: fix argument to ieee80211_is_first_frag()
66f21eecda2a2 sched/fair: Fix cpu_util runnable_avg arithmetic
6abaa8ec1b986 hwspinlock: qcom: avoid uninitialized struct members
af71c2b88ccae vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
310958030dc02 pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
9f56b6dbefa85 pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
8c888a062c6de scsi: target: Remove tcm_loop target reset handling
0165403da5086 scsi: target: Fix hexadecimal CHAP_I handling
89184909634e5 watchdog: unregister PM notifier on watchdog unregister
9e57e2863872e configfs: fix lockless traversals of ->s_children
38149b57427c7 firmware_loader: Fix recursive lock in device_cache_fw_images()
43c9646d98a04 spi: ep93xx: fix double-free of zeropage on DMA setup failure
94f7e50eb6b2c IB/mlx5: Properly support implicit ODP rereg_mr
52d0e6527716f IB/mlx5: Don't take the rereg_mr fallback without a new translation
2bc08fe88e578 cpufreq: Documentation: fix conservative governor freq_step description
e67b984f8c142 ACPI: IPMI: Fix message kref handling on dead device
e0c3edd864145 ALSA: seq: Clear variable event pointer on read
dba54c80f86eb riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
32b482fbda6b5 ALSA: seq: Fix partial userptr event expansion
c07aa0534d503 wifi: wcn36xx: fix OOB read from short trigger BA firmware response
64228dfc4247a wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
cfc67aee0c83e wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
5e630134d11d4 bpf: Update transport_header when encapsulating UDP tunnel in lwt
1bfabe51760db bpf: Check tail zero of bpf_prog_info
f8ab1c1bf42ee arm64: dts: tqma8mpql-mba8mpxl: configure sai clock in audio codec as well
3982121730f91 RDMA/irdma: Initialize iwmr->access during MR registration
ad360a31092a8 RDMA/irdma: Fix OOB read during CQ MR registration
9b82054dfe69a IB/cm: Fix av cm device leak on an error path in cm_init_av_by_path()
c121473586603 netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
6bba4846f196d netfilter: conntrack: revert ct extension genid infrastructure
8d86b4041d219 netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
cc5d7dadb6d87 netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
f38fb17c8758e ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
aa7883b6a3c76 ocfs2/dlm: require a ref for locking_state debugfs open
346314bb0cc2f ocfs2: reject FITRIM ranges shorter than a cluster
ecb3f9386f435 ocfs2: fix buffer head management in ocfs2_read_blocks()
6b38a5b8ee951 ocfs2: rebase copied fsdlm LVB pointers in locking_state
a97a5f842c68f perf/x86/amd/core: Always use the NMI latency mitigation
c35dce681145f bpftool: Use libbpf error code for flow dissector query
71323880be792 drm/amdgpu: set sub_block_index for mca ras sub-blocks
eee07d769da5a configfs_lookup(): don't leave ->s_dentry dangling on failure
b0799d03b709f lib/test_meminit: use && for bools
e8bbcc00760df sched: restore timer_slack_ns when resetting RT policy on fork
8990dbb7065b0 ext2: fix ignored return value of generic_write_sync()
4af4f0b04964a mm/fake-numa: fix under-allocation detection in uniform split
c70d0f9114c3c bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs
10e05b5ff05ce scsi: ufs: Fix wrong value printed in unexpected UPIU response case
4f944acca6379 scsi: pm8001: Fix error code in non_fatal_log_show()
da4853eb4616f scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
73e35c1bdfa16 nvdimm/btt: Handle preemption in BTT lane acquisition
c225bb49c697f ARM: imx31: Fix IIM mapping leak in revision check
ddab66c9a90d6 ata: libata: Fix ata_exec_internal()
21b8e6afbd1bb HID: wiimote: Fix table layout and whitespace errors
7eb7c42ec4930 ARM: imx3: Fix CCM node reference leak
93bc5642fbda3 ASoC: rsnd: Fix RSND_SOC_MASK width to single nibble
70b1c71b1fdfb ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
ce3030e92f143 md/raid10: reset read_slot when reusing r10bio for discard
964a44a990d61 rpmsg: use generic driver_override infrastructure
04c18c43d250e media: qcom: venus: relax encoder frame/blur step size on v6
061a2f302fc50 media: qcom: venus: relax encoder frame/blur dimension steps on v4
c4f0846d1d246 media: qcom: venus: drop extra padding in NV12 raw size calculation
fc72fd61cc8b2 RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
cd19a6345e372 RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
0c16d7c01284a EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
01623d834b5e8 drm/msm/dp: Fix the ISR_* enum values
fee0e0eefcd41 drm/msm/dp: fix HPD state status bit shift value
86145b5c5a7c2 crypto: hisilicon/qm - disable error report before flr
cc7d67197c51a ocfs2: kill osb->system_file_mutex lock
b460f8d01a120 ocfs2: don't BUG_ON an invalid journal dinode
acd54f42abbbd rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
d47b0b8a69a13 dax/kmem: account for partial discontiguous resource upon removal
ca06e163e5181 libbpf: Fix UAF in strset__add_str()
fb203d0e21dc0 libbpf: Harden parse_vma_segs() path parsing
9980c66ad2d4f drm/nouveau/bios: specify correct display fuse register for Ampere and Ada
13d9e73955c91 drm/tegra: Fix iommu_map_sgtable() return value check
3ac173e46ef6f gpu: host1x: Fix iommu_map_sgtable() return value check
3d211fb43a04e drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
71c017b3f83ff gpu: host1x: Allow entries in BO caches to be freed
4b731af227c69 drm/tegra: gr2d/gr3d: Contain PM in the gr*d_probe/gr*d_remove
6e22d5ad61cfa drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered
4a76953c3ed04 net/sched: cls_bpf: prevent unbounded recursion in offload rollback
1e3db30a88815 ipv6: guard against possible NULL deref in __in6_dev_stats_get()
ec2644cc69e14 workqueue: drop spurious '*' from print_worker_info() fn declaration
9ffdd11bd6c96 nvme-multipath: fix flex array size in struct nvme_ns_head
2f7c245d4601d pinctrl: cs42l43: Fix polarity on debounce
936641af564c3 ALSA: seq: midi: Serialize output teardown with event_input
82d6a87de7843 mtd: spi-nor: Drop duplicate Kconfig dependency
5b36ed8cc78f5 mips: n64: add __iomem for writel call
9291ea4dc7b05 mips: ralink: mt7621: add missing __iomem
17f5de95069b8 MIPS: DEC: Remove do_IRQ() call indirection
f3d1b0c22466f MIPS: Fix big-endian stack argument fetching in o32 wrapper
59096e2aa0f66 PM: sleep: Use complete() in device_pm_sleep_init()
a22346dc47b02 RDMA/counter: Fix incorrect port index in rdma_counter_init() error cleanup
a075a7acd155f RDMA/hns: Fix warning in poll cq direct mode
1035807ed1aba IB/mlx4: Fix refcount leak in add_port() error path
665fb7d22a700 RDMA/rxe: Fix a use-after-free problem in rxe_mmap
9f8f0d2099e3d RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
b0c4c1d8d42f4 bus: sunxi-rsb: Always check register address validity
5ff037ec8b5e9 pwm: imx27: Fix variable truncation in .apply()
7a832f4070be1 cpufreq: conservative: Simplify frequency limit handling
de8f81c0e7d3e cpufreq: Documentation: fix sampling_down_factor range
9f1de8e384012 Revert "treewide: Fix probing of devices in DT overlays"
73323db56aae6 driver core: Use mod_delayed_work to prevent lost deferred probe work
08739321420f0 device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
0c584c27f6649 tracing: Bound synthetic-field strings with seq_buf
0a1d6bbba52ae arm64: dts: qcom: sm8450: Add power-domain and iface clk for ice node
30aa348494531 firmware: arm_scmi: Fix OOB in scmi_power_name_get()
8972d8f38373e media: rockchip: rga: fix too small buffer size
ed4e2f9f7e54b net/sched: sch_drr: annotate data-races around cl->deficit
8bfe280576b2a regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
e05e423fff76c bitops: use common function parameter names
969203772e515 sysfs: clamp show() return value in sysfs_kf_read()
457136c9719af firmware: arm_scmi: Read sensor config as 32-bit value
f8c7669f57056 media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
dcf7a986f377c RDMA/srpt: fix integer overflow in immediate data length check
1025dc2f7ba29 RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
0ccf70ea84330 RDMA/hns: Fix arithmetic overflow in calc_hem_config()
2c3b2667dad69 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier
8ed0ce9ea58d6 ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
1134ff0c8228f net/sched: sch_htb: annotate data-races (I)
dc56c30c50cee net/sched: sch_htb: do not change sch->flags in htb_dump()
e9c1d78836cef spi: hisi-kunpeng: Use dev_err_probe() for host registration failure
50c3c7df4f26d crypto: ccp - Treat zero-length cert chain as query for blob lengths
5543dd4d8eb58 net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
1029bb377700e clk: scpi: Unregister child clock providers on remove
345675e960ab4 thermal: hwmon: Fix critical temperature attribute removal
a36cbfb85f26e evm: terminate and bound the evm_xattrs read buffer
31f5ad37509d6 drm/hisilicon/hibmc: use clock to look up the PLL value
08bb9f3fdd4e6 drm/hisilicon/hibmc: move display contrl config to hibmc_probe()
cca79a18f6275 arm64: dts: qcom: sm8450: Fix ICE reg size
79784c80d570e clk: scmi: Fix clock rate rounding
c10d7a84e5a1a arm64: dts: mediatek: mt8192-asurada: Move PCIe DMA bounce buffer to host
747a1775c4ee1 iommu/amd: Fix a stale comment about which legacy mode is user visible
ac3d1a11397a4 nilfs2: fix backing_dev_info reference leak
ae9e534e502a0 dlm: fix add msg handle in send_queue ordered
627938383761f crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
32e50358edf05 crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
e833e865e4944 crypto: atmel-sha204a - fix blocking and non-blocking rng logic
f79c80f173fda vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
95b9fff4036e3 arm64: dts: imx8x-colibri: Correct SODIMM PAD settings
118930f6c9dcf arm64: dts: rockchip: fix rk809 interrupt pin on rk3566-roc-pc
c399e66507af1 pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
42fbc613682f5 media: v4l2-common: Add YUV24 format info
d011267be9a3f media: cedrus: Fix failure to clean up hardware on probe failure
0b22f0181250b watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
72b77aa04b50a watchdog: sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
886c7101db617 watchdog: sp5100_tco: Use EFCH MMIO for newer Hygon FCH
ee346dcb5ebcd ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
46ca1451f61b5 wifi: ath9k: fix OOB access from firmware tx status queue ID
3e135495c1657 kconfig: fix potential NULL pointer dereference in conf_askvalue
6a3c384393d3f wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
966fbed4b4463 wifi: rtw89: Correct data type for scan index to avoid infinite loop
5e79e0180515b driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
89a75e3349c4f drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
d2ebe124d3633 dt-bindings: pinctrl: nvidia,tegra234: Add missing required block
da4a14062bbcb arm64: tegra: Fix Tegra234 MGBE PTP clock
dbb66f78931b1 wifi: cfg80211: fix grammar in MLO group key error message
2ed6b94441cf6 arm64: dts: qcom: sdm845-mezzanine: Fix camss ports unit_address_vs_reg warning
6d7ef14197b71 arm64: dts: rockchip: Fix gmac0 reset pin for NanoPi R5S
b6f6a8b8c3f92 Documentation: proc: fix section numbering in table of contents
126549251ce38 libbpf: Report error when a negative kprobe offset is specified
1c9ba32308c02 drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
b7b44937c548c drm/radeon: fix integer overflow in radeon_align_pitch()
a5d13544cacb3 drm/amdgpu: fix integer overflow in amdgpu_gem_align_pitch()
a0a24f75f8420 drm/tidss: Drop extra drm_mode_config_reset() call
c0d5266a945a4 drm/rockchip: Test for imported buffers with drm_gem_is_imported()
e3e69cfb053e6 clocksource/drivers/sun5i: Handle error returns from devm_reset_control_get_optional_exclusive()
9b783b7e03dc7 fbcon: fix NULL pointer dereference for a console without vc_data
f34fa27d4ac18 afs: Fix further netns teardown to cancel the preallocation charger
867b3ea146a04 afs: fix NULL pointer dereference in afs_get_tree()
85d5fb80fe4f0 afs: Fix netns teardown to cancel the preallocation charger
86eff3140c9d4 rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
8bbede0afced3 rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
c004ef925faf0 serial: 8250_omap: clear rx_running on zero-length DMA completes
abc1926c88c18 serial: msm: Disable DMA for kernel console UART
6c9ac3417de7b dt-bindings: power: imx93: Add MIPI PHY power domain
3a9c0bee69e68 dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
47ca0107e6a65 media: uvcvideo: Fix sequence number when no EOF
e1052f8406019 media: uvcvideo: Fix buffer sequence in frame gaps
3351da80ca645 media: uvcvideo: Avoid partial metadata buffers
116f0e0890896 bpf: Prefer dirty packs for eBPF allocations
8d65c431e1037 bpf: Prefer packs that won't trigger an IBPB flush on allocation
1f232626a42b6 bpf: Skip redundant IBPB in pack allocator
3b3b23c80202c bpf: Restrict JIT predictor flush to cBPF
cb27f3bf915cc x86/bugs: Enable IBPB flush on BPF JIT allocation
6e52c240c43a6 bpf: Support for hardening against JIT spraying
9badc789a500a crypto: hisi-trng - Remove crypto_rng interface
9a0e68b66e7ce crypto: crypto4xx - Remove insecure and unused rng_alg
05b7812164cee crypto: crypto4xx - Remove ahash-related code
b2dbc71fe33b4 x86/mm: Fix check/use ordering in switch_mm_irqs_off()
306ded31bfa00 crypto: sun4i-ss - Remove insecure and unused rng_alg
e091ff83d962f nvmet-tcp: Fix potential UAF when ddgst mismatch
e602c93b25bda nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
477145860dba4 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
2c5e72b9fbf83 KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
7b91e51d0eb7c crypto: algif_skcipher - force synchronous processing on trees without ctx->state
5a3218fbdeacb sched/fair: Only update stats for allowed CPUs when looking for dst group
d6998ddd507c8 block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
c2e252e04fdcc smb/server: do not require delete access for non-replacing links
50f0012da1040 xfs: resample the data fork mapping after cycling ILOCK
d0ae7ec3aa61d xfs: fail recovery on a committed log item with no regions
36bfa52459e45 smb: client: reject overlapping data areas in SMB2 responses
0e4a5a000123d fuse: re-lock request before returning from fuse_ref_folio()
018e33d403946 fuse: fix device node leak in cuse_process_init_reply()
b2e26c955f8dd RDMA/siw: bound Read Response placement to the RREAD length
2912f3d40355d RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
04781ba93e362 Input: maplecontrol - set driver data before registering input device
985cb452c2d10 Input: maplemouse - set driver data before registering input device
330f7b37f838c Input: maple_keyb - set driver data before registering input device
d89daead87d9b Input: mms114 - fix multi-touch slot corruption
a72f944864b45 Input: maplemouse - fix NULL pointer dereference in open()
5d2ea15ba03bf Input: mms114 - reject an oversized device packet size
431ad239f2924 Input: touchwin - reset the packet index on every complete packet
112666835071d Input: mms114 - fix touch indexing for MMS134S and MMS136
c21295616a8a5 Input: iforce - bound the device-reported force-feedback effect index
719d1a2c83a46 Input: goodix - clamp the device-reported contact count
8c1db3418a419 Input: elan_i2c - prevent division by zero and arithmetic underflow
26c895928d711 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
ba57f43032853 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
5bd64ed8dd76f Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
8f9b0cb58a10f i2c: stm32f7: truncate clock period instead of rounding it
0c36f72fc4d94 i2c: mpc: Fix timeout calculations
9882a9bd74db0 i2c: core: fix adapter deregistration race
051be2ed4d073 udmabuf: fix DMA direction mismatch in release_udmabuf()
ffaaff82336db KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
8192763d0ad78 KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
503fdfdcac243 NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
ce4736c1e6c4c exfat: bound uniname advance in exfat_find_dir_entry()
afcc0515bbdd2 module: decompress: check return value of module_extend_max_pages()
22c1fd1355ad4 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
35ae19764eabf tracing: Prevent out-of-bounds read in glob matching
0cab02d06307c watchdog: apple: Add "apple,t8103-wdt" compatible
caf08fd5ed742 EDAC/i10nm: Don't fail probing if ADXL is missing
e65505d91fa03 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
bf69ee9355c26 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
51ffc1f5d8981 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
7953af378a19f crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
0fae6fb13c49e crypto: talitos/hash - remove useless wrapper
c9a65ad48bd24 crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
d1731c1798f8f crypto: talitos/hash - drop workqueue mechanism for SEC1
44174532b459a crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
49ca4ff6d6432 crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
9c68f257f9b29 crypto: talitos - move code in current_desc_hdr() into a standalone function
a9ba45af2788f crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
03ab5ac0dc382 crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
c25be6c4e4bef crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
3d1d94445ab01 crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
500319830d769 crypto: qat - validate RSA CRT component lengths
e3155eb0ea98f crypto: drbg - Fix the fips_enabled priority boost
d955e2127c34c crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
cc42fb40171c2 crypto: drbg - Fix returning success on failure in CTR_DRBG
82789a44415e3 crypto: pcrypt - restore callback for non-parallel fallback
677450e5ef850 crypto: ecc - Fix carry overflow in vli multiplication
c8cfe11e48b2a crypto: caam - use print_hex_dump_devel to guard key hex dumps again
ebd37eef6e4f4 crypto: caam - use print_hex_dump_devel to guard key hex dumps
425d2001df58c crypto: af_alg - Remove zero-copy support from skcipher and aead
b736b12108fd1 isofs: bound Rock Ridge symlink components to the SL record
fd94a779020f2 partitions: aix: bound the pp_count scan to the ppe array
9c894159c5b8a btrfs: do not trim a device which is not writeable
be5e5553b1e2a nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
ee4465a245c14 dm-ioctl: report an error if a device has no table
93dfe94d55676 hwrng: jh7110 - fix refcount leak in starfive_trng_read()
7285276aa50d2 udf: validate sparing table length as an entry count, not a byte count
bb0d384c1f42a udf: validate VAT header length against the VAT inode size
fb49099206c5c udf: validate free block extents against the partition length
7f91201b1e486 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
edcbc218c39f6 iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
97a5da403566c usb: typec: ucsi: cancel pending work on system suspend
c32df11147822 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
af040c5b300c0 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
0195c30c77e3a usb: typec: ucsi: Invert DisplayPort role assignment
012406f89abc5 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
a82450bcb7ae4 usb: typec: class: drop PD lookup reference
58b26ba693008 usb: typec: anx7411: use devm_pm_runtime_enable()
d0ebf9cc7c2dd usbip: vudc: fix NULL deref in vep_dequeue()
5bd3654a778bd usbip: tools: support SuperSpeedPlus devices
0b0651f8ed4f0 USB: usb-storage: ene_ub6250: restore media-ready check
5c098f20f15db USB: ulpi: fix memory leak on registration failure
699dfb6917503 USB: serial: digi_acceleport: fix write buffer corruption
bcfeae431db99 USB: serial: digi_acceleport: fix hard lockup on disconnect
8d50a910194f6 USB: serial: digi_acceleport: fix broken rx after throttle
64a115456397c USB: serial: option: add Telit Cinterion FE990D50 compositions
2f7a6b8ab3845 USB: serial: keyspan_pda: fix information leak
4183874b7925f usb: mtu3: unmap request DMA on queue failure
0b3073f40cc9f USB: misc: uss720: unregister parport on probe failure
6a935158d01f9 USB: storage: include US_FL_NO_SAME in quirks mask
bb545c4dd22a3 usb: sl811-hcd: disable controller wakeup on remove
0b57e5ddbd89d USB: legousbtower: fix use-after-free on disconnect race
9b40d283ac2ad USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
164398601a7f1 USB: iowarrior: fix use-after-free on disconnect
02ca08fff74cf USB: ldusb: fix use-after-free on disconnect race
60fc5ef4ecea3 USB: idmouse: fix use-after-free on disconnect race
75c0ad13e1369 usb: gadget: f_printer: take kref only for successful open
7a5214dae906d usb: gadget: udc: Fix use-after-free in gadget_match_driver
56add2b9b2e89 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
be5004395dfd0 usb: free iso schedules on failed submit
164a966035039 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
dd338e4ffa7fe USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
fde3c095e1d48 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
19d9ff2b423d1 usb: cdc_acm: Add quirk for Uniden BC125AT scanner
46ab32870d010 net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
702d75f1a6025 bpf: Restore sysctl new-value from 1 to 0
bccbab36ff228 bpf: Reject fragmented frames in devmap
2c590972a2735 xfs: fix unreachable BIGTIME check in dquot flush validation
960b29769c909 xfs: use null daddr for unset first bad log block
0fed0fc34ce73 media: mtk-jpeg: cancel workqueue on release for supported platforms only
286f77d002a33 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
16ca053c2be5f hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
798d762a5e55b HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
33cd1a000daf9 HID: lg-g15: cancel pending work on remove to fix a use-after-free
523db788c0f84 HID: letsketch: fix UAF on inrange_timer at driver unbind
1a1ebdcb56ae5 HID: wacom: stop hardware after post-start probe failures
5b535bde893f5 tools/mm/slabinfo: fix total_objects attribute name
d2468e241af4c tools/mm/slabinfo: Fix trace disable logic inversion
459b3a373d197 X.509: Fix validation of ASN.1 certificate header
9638d3d28f9fe clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
e5ffc638faf5d posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
982c9f92d57bd cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
73255d702c756 cpufreq: Fix hotplug-suspend race during reboot
860aaff72c844 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
069ae9502f27f cpufreq: intel_pstate: Sync policy->cur during CPU offline
46d403da376a8 firmware_loader: fix device reference leak in firmware_upload_register()
f0776d142e530 OPP: of: Fix potential memory leak in opp_parse_supplies()
08c600b7e1818 smb: client: mask server-provided mode to 07777 in modefromsid
0de5b8e76847f smb: client: harden POSIX SID length parsing
b723097775598 smb: client: use unaligned reads in parse_posix_ctxt()
9136a08dc2932 smb: client: Fix next buffer leak in receive_encrypted_standard()
037511726228a smb: client: fix double-free in SMB2_close() replay
02bc2896bdc3e smb: client: fix double-free in SMB2_open() replay
6e27f40b682a5 smb: client: fix double-free in SMB2_flush() replay
5821f9dbb8b5b smb: client: fix change notify replay double-free
0be4bc64882ed smb: client: fix double-free in SMB2_ioctl() replay
100fb7c455fa8 smb: client: fix query_info() replay double-free
3409aedf3c81a smb: client: fix query directory replay double-free
f08b3f451f12e ksmbd: use opener credentials for delete-on-close
2b9d2a370d639 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
288a4abc16fe5 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
b35afd5cf8fab ksmbd: run set info with opener credentials
e6aa731f1b4b3 ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
67bdad9cf01b2 ksmbd: require source read access for duplicate extents
7703fd9aba1f2 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
2a64dbf9c739d ksmbd: serialize QUERY_DIRECTORY requests per file
3072d82461f49 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
620d133d46929 ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
aa37f5fef78dd smb/client: Fix error code in smb2_aead_req_alloc()
38dbc8db8341c coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
ea59d9dbc5504 fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
3ca13af5a4004 fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
92300ac7ff17c fs/ntfs3: handle attr_set_size() errors when truncating files
caa36a91c9c51 fs/ntfs3: fsync files by syncing parent inodes
98d93c226bdfa Bluetooth: L2CAP: validate option length before reading conf opt value
c66a95e60b65d Bluetooth: fix UAF in bt_accept_dequeue()
21e60eb4d9585 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
ae215c5b6422d Bluetooth: bnep: pin L2CAP connection during netdev registration
466540e045d01 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
2664f537ca5bc netfilter: ebtables: terminate table name before find_table_lock()
d2367d99f2455 netfilter: ebtables: module names must be null-terminated
e44f78f5f0585 netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
09d2407985b8c mm: shrinker: fix NULL pointer dereference in debugfs
729ae27dc2503 mfd: cros_ec: Delay dev_set_drvdata() until probe success
e81f805824a81 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
76d030ac95e17 ipv4: igmp: remove multicast group from hash table on device destruction
ea61b04e1d724 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
19d63fd528719 gpio: eic-sprd: use raw_spinlock_t in the irq startup path
1dba8444ac010 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
946046841013e fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
d663fbf28b2ee debugobjects: Plug race against a concurrent OOM disable
caed4a96d5575 Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
7ff42312ccde5 audit: Fix data races of skb_queue_len() readers on audit_queue
273c06b81d2e9 net: af_key: initialize alg_key_len for IPComp states
b8e274e69ab09 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
f30e2b879bda1 crypto: amlogic - avoid double cleanup in meson_crypto_probe()
bb3b942da4123 staging: rtl8723bs: fix OOB write in HT_caps_handler()
6f26cc55affd9 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
4c21eec80cf50 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
9193c34f75fd9 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
0406d746574e8 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
1f6c9d255bdda staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
5d7812360abf3 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
85263739e810d staging: media: atomisp: reduce load_primary_binaries() stack usage
b7da3b9f7c3c5 media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
eef048dd77ebf staging: vme_user: fix location monitor leak in tsi148 bridge
0471a3c725326 staging: vme_user: fix location monitor leak in fake bridge
573e502d14714 smb: client: restrict implied bcc[0] exemption to responses without data area
adc8b9c30d716 staging: vme_user: bound slave read/write to the kern_buf size
9a51115fcdc78 tipc: fix out-of-bounds read in broadcast Gap ACK blocks
a8e3a94711134 6lowpan: fix NHC entry use-after-free on error path
5e5798880eb15 usb: dwc3: run gadget disconnect from sleepable suspend context
6c82f88bc7a84 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
fde19b0d4eeab hwrng: virtio: clamp device-reported used.len at copy_data()
74a4cac9603d3 virtio-mmio: fix device release warning on module unload
96fbafc20ebd9 netfilter: ipset: fix race between dump and ip_set_list resize
74fef68d52115 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
0f90c4fadef8c PCI: host-common: Request bus reassignment when not probe-only
b8189e8b0343d PCI: altera: Do not dispose parent IRQ mapping
ce2e36e8759df usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
10666ac9c5529 usb: xhci: Fix sleep in atomic context in xhci_free_streams()
45df558c543bb binder: fix UAF in binder_free_transaction()
faa070c7ad8ba binder: fix UAF in binder_thread_release()
7370cb0dccd6d Bluetooth: btusb: fix wakeup source leak on probe failure
6e1b10df890f4 Bluetooth: btusb: fix use-after-free on marvell probe failure
e6313b800da61 Bluetooth: btusb: fix use-after-free on registration failure
9cc0350f2677e Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
8e872c07e40d5 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
08b74e320c7a2 vfio/pci: Fix racy bitfields and tighten struct layout
9e0a3f642e607 vfio/pci: Release the VGA arbiter client on register_device() failure
654710ef3135c vfio/pci: Latch disable_idle_d3 per device
28f92b8d3fefc vfio/pci: Use a private flag to prevent power state change with VFs
90310e29ca74e ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
73178209f2fec ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
b31c5faf77cdf ALSA: usb-audio: Roll back quirk control caches on write errors
a851636ef95a3 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
29dc393ab69b8 ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
a47ecd904c51a ALSA: usb-audio: avoid kobject path lookup in DualSense match
ea672a9f6cc38 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
69bf1dfa32155 ALSA: ice1712: check snd_ctl_new1() return value
eccf8e91266e3 ALSA: gus: check snd_ctl_new1() return value
3ed2fa1ed8cc6 ALSA: firewire: isight: bound the sample count to the packet payload
7531a37720c25 ALSA: es1938: check snd_ctl_new1() return value
8825a06bfa793 ALSA: cmipci: check snd_ctl_new1() return value
05df59b9a61f7 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
91095474eea29 ALSA: ymfpci: check snd_ctl_new1() return value
c31679fedfedc ALSA: virtio: Add missing 384 kHz PCM rate mapping
46a2cbf57dc3e iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
ae73df471a835 iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
664376579d1fd iio: light: veml6030: fix channel type when pushing events
4337683a3639d iio: light: tsl2591: return actual error from probe IRQ failure
140117813afde iio: light: opt3001: fix missing state reset on timeout
f350883989ced iio: light: gp2ap002: fix runtime PM leak on read error
06158c241f9a3 iio: light: al3010: fix incorrect scale for the highest gain range
34d9d5c81e9df iio: imu: st_lsm6dsx: deselect shub page before reading whoami
00982b61d026b iio: imu: inv_icm42600: fix timestamp clock period by using lower value
5a62be142e28e iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
5240dd5cf02ba iio: gyro: bmg160: wait full startup time after mode change at probe
8d202515baea4 iio: gyro: bmg160: bail out when bandwidth/filter is not in table
0d4a646d7f87e iio: event: Fix event FIFO reset race
b131f0011dfef iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
030fb84816471 iio: adc: ti-ads124s08: Return reset GPIO lookup errors
f3f90bc7b38ba iio: adc: spear: Initialize completion before requesting IRQ
820c4f15353ef iio: adc: lpc32xx: Initialize completion before requesting IRQ
36154171385a8 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
bfffc98f3de92 iio: accel: bmc150: clamp the device-reported FIFO frame count
d6ef5af7d0fe1 usb: gadget: function: rndis: add length check for header
caea8b1206043 usb: gadget: function: rndis: add length check to response query
e1919d0267065 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
cd2463ec60f0d net: Drop the lock in skb_may_tx_timestamp()
b0b39425b5202 LoongArch: Add PIO for early access before ACPI PCI root register
865a048a3f5ac virtio_net: Support dynamic rss indirection table size
dbab796ff3803 arm64: sysreg: Correct sign definitions for EIESB and DoubleLock
804e2e41641bd arm64: Revamp HCR_EL2.E2H RES1 detection
6e5714bcc98f3 KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()
a2c343370351f KVM: arm64: Initialize HCR_EL2.E2H early
153ed820d525b arm64: Fix early handling of FEAT_E2H0 not being implemented
4f25422239d09 arm64: Treat HCR_EL2.E2H as RES1 when ID_AA64MMFR4_EL1.E2H0 is negative
d087272c49aa5 arm64: sysreg: Add layout for ID_AA64MMFR4_EL1
5b8729416ee88 crypto: talitos - rename first/last to first_desc/last_desc
22e2db16c8011 crypto: talitos - fix SEC1 32k ahash request limitation
1981cde2f0be4 crypto: talitos - stop using crypto_ahash::init
7c3ba8f490f5b Revert "crypto: talitos - fix SEC1 32k ahash request limitation"
f35e5399c97b1 Revert "crypto: talitos - rename first/last to first_desc/last_desc"
4cdb1b3ab96eb perf/core: Detach event groups during remove_on_exec
a44343fe230aa ACPI: NFIT: core: Fix possible NULL pointer dereference
2fb80e9620290 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
140133dac0ae9 perf trace beauty fcntl: Fix build with older kernel headers
927ef409f7139 Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
a444c3de7187b xfs: move ->iop_recover to xfs_defer_op_type
5e327f772ca89 xfs: use xfs_defer_finish_one to finish recovered work items
ce9d7f9188f18 xfs: dump the recovered xattri log item if corruption happens
9395d11f63415 xfs: recreate work items when recovering intent items
9af37d8be0fb6 mm/vmscan: flush deferred TLB before freeing large folios
420e5aad7ba89 team: fix header_ops type confusion with non-Ethernet ports
9532d0d0ad1d7 bonding: prevent potential infinite loop in bond_header_parse()
5d0fb9806ab6c bonding: fix type confusion in bond_setup_by_slave()
4128ccd7683f8 bonding: fix xfrm offload feature setup on active-backup mode
8d5c8ac644554 bonding: use common function to compute the features
a1d397dbc00a7 net: add a common function to compute features for upper devices
ed976725dba37 bonding: Correctly support GSO ESP offload
3b2bd2018938b bonding: add ESP offload features when slaves support
4a85b335f8704 bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
7cf5a74558e31 net, team, bonding: Add netdev_base_features helper
1f1fe94e0c727 net: team: rename team to team_core for linking
f59f8c2addba0 nfsd: change nfs4_client_to_reclaim() to allocate data
2a8ff394907fe nfsd: move name lookup out of nfsd4_list_rec_dir()
42726c616d958 apparmor: advertise the tcp fast open fix is applied
655349816642f nfsd: Don't reset the write verifier on a commit EAGAIN
eeabb9020721d NFSv4/flexfiles: reject zero filehandle version count
a7a526fbc847f fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
da9d8d9711f78 i2c: core: fix adapter registration race
4a0034756c2a6 i2c: core: fix adapter debugfs creation
ad4322d84ebf7 i2c: core: fix NULL-deref on adapter registration failure
2f8a894e148a0 i2c: core: fix hang on adapter registration failure
055aff407db51 i2c: core: fix irq domain leak on adapter registration failure
1a02a5028bd6d block: Avoid mounting the bdev pseudo-filesystem in userspace
92fc631b69deb KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
2770041f34b52 f2fs: fix listxattr handling of corrupted xattr entries
1436031b33fa2 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
345c1d1ff7511 f2fs: fix potential deadlock in f2fs_balance_fs()
76e1a05cf6d40 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
7d3ae21783e59 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
d2f236196d542 f2fs: validate orphan inode entry count
f0b4e1cc8ad76 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
e54c05ed3d9c2 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
c717f052d7023 drm/amd: Fix set but not used warnings
290014c798763 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
c75f153e5d547 slimbus: Convert to platform remove callback returning void
e43819a198b56 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
da82ec28a0cf1 slimbus: qcom-ngd-ctrl: Fix probe error path ordering
ade787f047906 Bluetooth: btmtk: Fix btmtk.c undefined reference build error
f6290849b88a0 perf: Fix dangling cgroup pointer in cpuctx backport
5f4dbdb0a8759 userfaultfd: gate must_wait writability check on pte_present()
9440a6980fc63 Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
51c4b6e9c0e56 Bluetooth: btmtk: Fix failed to send func ctrl for MediaTek devices.
f344a2d77d47e Bluetooth: btmtk: move btusb_mtk_[setup, shutdown] to btmtk.c
9eca71da3b843 Bluetooth: btusb: mediatek: return error for failed reg access
6501b60129664 Bluetooth: btusb: mediatek: remove the unnecessary goto tag
6b6d985e7a889 Bluetooth: btusb: mediatek: add MT7922 subsystem reset
1c770a550df2f Bluetooth: btusb: mediatek: reset the controller before downloading the fw
eae5bb7c0c160 Bluetooth: btmtk: apply the common btmtk_fw_get_filename
1fa22de588a65 LoongArch: Report dying CPU to RCU in stop_this_cpu()
dd699a60a29ee ext4: get rid of ppath in get_ext_path()
666e837b247fc nfsd: reset write verifier on deferred writeback errors
48a586e382e4d nfsd: release layout stid on setlease failure
c39973ebd7329 bpf, arm64: Reject out-of-range B.cond targets
bb51b626b5a8e ia64: Make acpi_cpufreq_cpu_exit return void
(From OE-Core rev: 92b8d1a7a5576a677c1e299963b44174ed2dceb6)
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
---
.../linux/linux-yocto-rt_6.6.bb | 6 ++--
.../linux/linux-yocto-tiny_6.6.bb | 6 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index cb8d8c418f1..d252eb8c4a2 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,13 +14,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "d7fbdb4e5e7a35bdb8bb87d159204d74ef130a32"
-SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af"
+SRCREV_machine ?= "27ed791688e060988fb39429477ee529093c9a01"
+SRCREV_meta ?= "127bac58b21e8c3769d0cf2432f706f5605c4afb"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.6.144"
+LINUX_VERSION ?= "6.6.147"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index 73d971f7eee..f50f5cd51e1 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
# CVE exclusions
include recipes-kernel/linux/cve-exclusion_6.6.inc
-LINUX_VERSION ?= "6.6.144"
+LINUX_VERSION ?= "6.6.147"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "25b07b85b558f3587c11c9363cccd9cb93fcef45"
-SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af"
+SRCREV_machine ?= "18f147623b634b40b3bc5823ae03f049bb14fc84"
+SRCREV_meta ?= "127bac58b21e8c3769d0cf2432f706f5605c4afb"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index 64609554ee2..77274850c2b 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "3adc19c1e1e3ee865f9b0d7bc0fedd0e4aeee995"
-SRCREV_machine:qemuarm64 ?= "39a4fe09d3d795042cc14eb3c78f6a03874c48df"
-SRCREV_machine:qemuloongarch64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
-SRCREV_machine:qemumips ?= "ba0b8f925ec8b5926c6c2ddbc2c2c77305324bab"
-SRCREV_machine:qemuppc ?= "66c01b44545110249c940f865c4ed10d4d315b29"
-SRCREV_machine:qemuriscv64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
-SRCREV_machine:qemuriscv32 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
-SRCREV_machine:qemux86 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
-SRCREV_machine:qemux86-64 ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
-SRCREV_machine:qemumips64 ?= "1793417d6568e244579278e6f1fc7107987946f5"
-SRCREV_machine ?= "2baf8e92ef6ad38945005adf39342b9efb4509ec"
-SRCREV_meta ?= "a77e1b965423603456f2d9dbf3de53bb8a3d75af"
+SRCREV_machine:qemuarm ?= "1790b505a65896a34abc5abe3109f9811f6f2960"
+SRCREV_machine:qemuarm64 ?= "4da6f6f6201c34d32cf5ae6524f8de44d003f0ed"
+SRCREV_machine:qemuloongarch64 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82"
+SRCREV_machine:qemumips ?= "254643819dbbde9f388d8d02b6d2550606b8e442"
+SRCREV_machine:qemuppc ?= "c0e9acf672bff2c9001b96423b8ae5723d7f7190"
+SRCREV_machine:qemuriscv64 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82"
+SRCREV_machine:qemuriscv32 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82"
+SRCREV_machine:qemux86 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82"
+SRCREV_machine:qemux86-64 ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82"
+SRCREV_machine:qemumips64 ?= "830cb34f387303f99b95f1f3e3938794195ff1a6"
+SRCREV_machine ?= "402296b5e824b46fd4301eddc7c389b9f7fe1d82"
+SRCREV_meta ?= "127bac58b21e8c3769d0cf2432f706f5605c4afb"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "da47cbc254661aa66d61ef061485a7080305c4be"
+SRCREV_machine:class-devupstream ?= "a1153c0deb44f75190f07677c0c6d61efd887246"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.6/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.6.144"
+LINUX_VERSION ?= "6.6.147"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 42+ messages in thread[parent not found: <18CD40121B3B9CC0.2965692@lists.openembedded.org>]
* Re: [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429
[not found] ` <18CD40121B3B9CC0.2965692@lists.openembedded.org>
@ 2026-08-20 10:23 ` Fabien Thomas
2026-08-24 9:49 ` Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 1 reply; 42+ messages in thread
From: Fabien Thomas @ 2026-08-20 10:23 UTC (permalink / raw)
To: fabien.thomas, openembedded-core
On Wed Aug 19, 2026 at 5:56 PM CEST, Fabien Thomas via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> This patch applies the upstream backport for CVE-2026-6429.
> The upstream fix commit is referenced in [1], and the public
> CVE advisory is referenced in [2].
>
> [1] https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
> [2] https://curl.se/docs/CVE-2026-6429.html
> [3] https://nvd.nist.gov/vuln/detail/CVE-2026-6429
>
> (From OE-Core rev: 0cbfae83eebf9076f7b22d07b48cb5cef1536989)
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
> ---
> .../curl/curl/CVE-2026-6429.patch | 367 ++++++++++++++++++
> meta/recipes-support/curl/curl_8.7.1.bb | 1 +
> 2 files changed, 368 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429.patch b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
> new file mode 100644
> index 00000000000..f4df441aa2b
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
> @@ -0,0 +1,367 @@
> +From 8191fd6d5677c30579c09a8d0988b47bbf33f65f Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Fri, 5 Jun 2026 01:20:50 -0700
> +Subject: [PATCH] http: clear credentials better on redirect
> +
> +Verify with test 2506: netrc with redirect using proxy
> +
> +Updated test 998 which was wrong.
> +
> +Reported-by: Muhamad Arga Reksapati
> +
> +Closes #21345
> +
> +CVE: CVE-2026-6429
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306]
> +
> +Backport Changes:
> +- The upstream lib/http.c hunk adds the same-origin credential clearing to
> + Curl_http_follow(). curl-8.7.1 predates that protocol-specific redirect
> + handler and carries the equivalent redirect logic in lib/transfer.c via
> + Curl_follow(), so the full upstream lib/http.c hunk was adapted there.
> +- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc
> + instead of the upstream tests/data/Makefile.am and
> + tests/libtest/Makefile.am lists.
> +- curl-8.7.1 does not contain test2504/lib2504, so the new
> + test2506/lib2506 entries were registered after the nearest existing
> + test2503/lib2502 entries in the target-version test lists.
> +- curl-8.7.1 uses the older libtest harness, so first.h,
> + test_lib2506(), and CURLcode result handling were adapted to test.h,
> + test(), and int res.
> +- Scarthgap curl-8.7.1 keeps the same incorrect redirected-request
> + Authorization expectation in tests/data/test998, so this backport removes
> + that expectation with an equivalent target-version hunk.
> +
> +(cherry picked from commit b4024bf808bd558026fdc6096e8457f199ace306)
> +Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> +---
> + lib/transfer.c | 103 +++++++++++++++++++++----------------
> + tests/data/Makefile.inc | 2 +-
> + tests/data/test2506 | 64 +++++++++++++++++++++++
> + tests/data/test998 | 1 -
> + tests/libtest/Makefile.inc | 5 +-
> + tests/libtest/lib2506.c | 71 +++++++++++++++++++++++++
> + 6 files changed, 198 insertions(+), 48 deletions(-)
> + create mode 100644 tests/data/test2506
> + create mode 100644 tests/libtest/lib2506.c
> +
> +diff --git a/lib/transfer.c b/lib/transfer.c
> +index a73462928d..0f5bd8ce59 100644
> +--- a/lib/transfer.c
> ++++ b/lib/transfer.c
> +@@ -865,49 +865,62 @@ CURLcode Curl_follow(struct Curl_easy *data,
> + if(uc)
> + return Curl_uc_to_curlcode(uc);
> +
> +- /* Clear auth if this redirects to a different port number or protocol,
> +- unless permitted */
> +- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
> +- char *portnum;
> +- int port;
> +- bool clear = FALSE;
> +-
> +- if(data->set.use_port && data->state.allow_port)
> +- /* a custom port is used */
> +- port = (int)data->set.use_port;
> +- else {
> +- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
> +- CURLU_DEFAULT_PORT);
> +- if(uc) {
> +- free(newurl);
> +- return Curl_uc_to_curlcode(uc);
> +- }
> +- port = atoi(portnum);
> +- free(portnum);
> +- }
> +- if(port != data->info.conn_remote_port) {
> +- infof(data, "Clear auth, redirects to port from %u to %u",
> +- data->info.conn_remote_port, port);
> +- clear = TRUE;
> ++ {
> ++ bool same_origin;
> ++ CURLU *u;
> ++ char *oldscheme = NULL;
> ++ char *oldhost = NULL;
> ++ char *oldport = NULL;
> ++ char *newscheme = NULL;
> ++ char *newhost = NULL;
> ++ char *newport = NULL;
> ++
> ++ u = curl_url();
> ++ if(!u) {
> ++ free(newurl);
> ++ return CURLE_OUT_OF_MEMORY;
> + }
> +- else {
> +- char *scheme;
> +- const struct Curl_handler *p;
> +- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
> +- if(uc) {
> +- free(newurl);
> +- return Curl_uc_to_curlcode(uc);
> +- }
> +
> +- p = Curl_get_scheme_handler(scheme);
> +- if(p && (p->protocol != data->info.conn_protocol)) {
> +- infof(data, "Clear auth, redirects scheme from %s to %s",
> +- data->info.conn_scheme, scheme);
> +- clear = TRUE;
> +- }
> +- free(scheme);
> ++ uc = curl_url_set(u, CURLUPART_URL, data->state.url, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(u, CURLUPART_SCHEME, &oldscheme, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(u, CURLUPART_HOST, &oldhost, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(u, CURLUPART_PORT, &oldport, CURLU_DEFAULT_PORT);
> ++ if(!uc)
> ++ uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &newscheme, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(data->state.uh, CURLUPART_HOST, &newhost, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(data->state.uh, CURLUPART_PORT, &newport,
> ++ CURLU_DEFAULT_PORT);
> ++ if(uc) {
> ++ curl_url_cleanup(u);
> ++ free(oldscheme);
> ++ free(oldhost);
> ++ free(oldport);
> ++ free(newscheme);
> ++ free(newhost);
> ++ free(newport);
> ++ free(newurl);
> ++ return Curl_uc_to_curlcode(uc);
> + }
> +- if(clear) {
> ++
> ++ same_origin = strcasecompare(oldscheme, newscheme) &&
> ++ strcasecompare(oldhost, newhost) &&
> ++ !strcmp(oldport, newport);
> ++
> ++ curl_url_cleanup(u);
> ++ free(oldscheme);
> ++ free(oldhost);
> ++ free(oldport);
> ++ free(newscheme);
> ++ free(newhost);
> ++ free(newport);
> ++
> ++ if((!same_origin && !data->set.allow_auth_to_other_hosts) ||
> ++ !data->set.str[STRING_USERNAME]) {
> + result = Curl_reset_userpwd(data);
> + if(result) {
> + free(newurl);
> +@@ -917,12 +930,12 @@ CURLcode Curl_follow(struct Curl_easy *data,
> + Curl_safefree(data->state.aptr.passwd);
> + }
> + }
> +- }
> +
> +- result = Curl_reset_proxypwd(data);
> +- if(result) {
> +- free(newurl);
> +- return result;
> ++ result = Curl_reset_proxypwd(data);
> ++ if(result) {
> ++ free(newurl);
> ++ return result;
> ++ }
> + }
> +
> + if(type == FOLLOW_FAKE) {
> +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
> +index aafd309a9d..f673f86384 100644
> +--- a/tests/data/Makefile.inc
> ++++ b/tests/data/Makefile.inc
> +@@ -251,7 +251,7 @@ test2300 test2301 test2302 test2303 test2304 test2305 test2306 test2307 \
> + \
> + test2400 test2401 test2402 test2403 test2404 \
> + \
> +-test2500 test2501 test2502 test2503 \
> ++test2500 test2501 test2502 test2503 test2506 \
> + \
> + test2600 test2601 test2602 test2603 \
> + \
> +diff --git a/tests/data/test2506 b/tests/data/test2506
> +new file mode 100644
> +index 0000000000..9c65002496
> +--- /dev/null
> ++++ b/tests/data/test2506
> +@@ -0,0 +1,64 @@
> ++<?xml version="1.0" encoding="US-ASCII"?>
> ++<testcase>
> ++<info>
> ++<keywords>
> ++HTTP
> ++cookies
> ++</keywords>
> ++</info>
> ++
> ++<reply>
> ++<data crlf="headers" nocheck="yes">
> ++HTTP/1.1 301 redirect
> ++Date: Tue, 09 Nov 2010 14:49:00 GMT
> ++Content-Length: 3
> ++Location: http://numbertwo.example/%TESTNUMBER0002
> ++
> ++ok
> ++</data>
> ++<data2 crlf="headers" nocheck="yes">
> ++HTTP/1.1 200 OK
> ++Date: Tue, 09 Nov 2010 14:49:00 GMT
> ++Content-Length: 4
> ++
> ++yes
> ++</data2>
> ++</reply>
> ++
> ++<client>
> ++<server>
> ++http
> ++</server>
> ++<features>
> ++proxy
> ++</features>
> ++<tool>
> ++lib%TESTNUMBER
> ++</tool>
> ++<name>
> ++netrc with redirect using proxy
> ++</name>
> ++<file name="%LOGDIR/netrc2506">
> ++machine site.example login batman password robin
> ++</file>
> ++<command>
> ++http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506
> ++</command>
> ++</client>
> ++
> ++<verify>
> ++<protocol crlf="headers">
> ++GET http://site.example/ HTTP/1.1
> ++Host: site.example
> ++Authorization: Basic %b64[batman:robin]b64%
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://numbertwo.example/25060002 HTTP/1.1
> ++Host: numbertwo.example
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++</protocol>
> ++</verify>
> ++</testcase>
> +diff --git a/tests/data/test998 b/tests/data/test998
> +index 0969d4704b..17c0a0e150 100644
> +--- a/tests/data/test998
> ++++ b/tests/data/test998
> +@@ -82,7 +82,6 @@ Proxy-Connection: Keep-Alive
> +
> + GET http://somewhere.else.example/a/path/9980002 HTTP/1.1
> + Host: somewhere.else.example
> +- Authorization: Basic YWxiZXJ0bzplaW5zdGVpbg==
> + User-Agent: curl/%VERSION
> + Accept: */*
> + Proxy-Connection: Keep-Alive
> +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
> +index 9f7cec6027..9d3356aaf5 100644
> +--- a/tests/libtest/Makefile.inc
> ++++ b/tests/libtest/Makefile.inc
> +@@ -75,7 +75,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \
> + lib1970 lib1971 lib1972 lib1973 lib1974 lib1975 \
> + lib2301 lib2302 lib2304 lib2305 lib2306 \
> + lib2402 lib2404 \
> +- lib2502 \
> ++ lib2502 lib2506 \
> + lib3010 lib3025 lib3026 lib3027 \
> + lib3100 lib3101 lib3102 lib3103
> +
> +@@ -684,6 +684,9 @@ lib2404_LDADD = $(TESTUTIL_LIBS)
> + lib2502_SOURCES = lib2502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib2502_LDADD = $(TESTUTIL_LIBS)
> +
> ++lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> ++lib2506_LDADD = $(TESTUTIL_LIBS)
> ++
> + lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib3010_LDADD = $(TESTUTIL_LIBS)
> +
> +diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c
> +new file mode 100644
> +index 0000000000..e6dde18507
> +--- /dev/null
> ++++ b/tests/libtest/lib2506.c
> +@@ -0,0 +1,71 @@
> ++/***************************************************************************
> ++ * _ _ ____ _
> ++ * Project ___| | | | _ \| |
> ++ * / __| | | | |_) | |
> ++ * | (__| |_| | _ <| |___
> ++ * \___|\___/|_| \_\_____|
> ++ *
> ++ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
> ++ *
> ++ * This software is licensed as described in the file COPYING, which
> ++ * you should have received as part of this distribution. The terms
> ++ * are also available at https://curl.se/docs/copyright.html.
> ++ *
> ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
> ++ * copies of the Software, and permit persons to whom the Software is
> ++ * furnished to do so, under the terms of the COPYING file.
> ++ *
> ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
> ++ * KIND, either express or implied.
> ++ *
> ++ * SPDX-License-Identifier: curl
> ++ *
> ++ ***************************************************************************/
> ++#include "test.h"
> ++
> ++#include "testtrace.h"
> ++
> ++static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud)
> ++{
> ++ (void)ptr;
> ++ (void)ud;
> ++ return size * nmemb;
> ++}
> ++
> ++int test(char *URL)
> ++{
> ++ CURL *curl;
> ++ int res = CURLE_OUT_OF_MEMORY;
> ++
> ++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
> ++ curl_mfprintf(stderr, "curl_global_init() failed\n");
> ++ return TEST_ERR_MAJOR_BAD;
> ++ }
> ++
> ++ curl = curl_easy_init();
> ++ if(!curl) {
> ++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
> ++ curl_global_cleanup();
> ++ return TEST_ERR_MAJOR_BAD;
> ++ }
> ++
> ++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506);
> ++ test_setopt(curl, CURLOPT_PROXY, URL);
> ++ test_setopt(curl, CURLOPT_URL, libtest_arg2);
> ++ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
> ++ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3);
> ++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
> ++ test_setopt(curl, CURLOPT_VERBOSE, 1L);
> ++
> ++ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the
> ++ credentials come from netrc */
> ++ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
> ++
> ++ res = curl_easy_perform(curl);
> ++
> ++test_cleanup:
> ++ curl_easy_cleanup(curl);
> ++ curl_global_cleanup();
> ++
> ++ return res;
> ++}
> diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
> index 2b988654c41..8e39d821626 100644
> --- a/meta/recipes-support/curl/curl_8.7.1.bb
> +++ b/meta/recipes-support/curl/curl_8.7.1.bb
> @@ -40,6 +40,7 @@ SRC_URI = " \
> file://CVE-2026-6276.patch \
> file://CVE-2026-5545.patch \
> file://CVE-2026-6253.patch \
> + file://CVE-2026-6429.patch \
> "
>
> SRC_URI:append:class-nativesdk = " \
I'll have to drop this patch because it is triggering a warning in the
autobuilder's ptest jobs qemuarm64-ptest[1] and qemux86-64-ptest[2].
It causes curl ptests 1159 & 1543 to fail :
`FAIL: 1159 - HTTP Location: and 'redirect_url' with non-supported scheme`
`FAIL: 1543 - CURLOPT_CURLU, URL with space and CURLINFO_EFFECTIVE_URL`
I'll drop the next patch of the series too (curl: fix CVE-2026-7168),
because it not applied anymore without this one.
[1] https://autobuilder.yoctoproject.org/valkyrie/#/builders/61/builds/4320
[2] https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4336
--
Fabien Thomas
Smile ECS
^ permalink raw reply [flat|nested] 42+ messages in thread* Re: [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429
2026-08-20 10:23 ` [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429 Fabien Thomas
@ 2026-08-24 9:49 ` Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 0 replies; 42+ messages in thread
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-08-24 9:49 UTC (permalink / raw)
To: fabien.thomas@smile.fr, openembedded-core@lists.openembedded.org
[-- Attachment #1: Type: text/plain, Size: 15846 bytes --]
Hi Fabien,
Thanks for your review. I have addressed this and sent the updated patch here:
openembedded-core@lists.openembedded.org | [scarthgap][PATCH v3 4/5] curl: fix CVE-2026-6429<https://lists.openembedded.org/g/openembedded-core/topic/120900343>
Regards,
Deepak
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Fabien Thomas via lists.openembedded.org <fabien.thomas=smile.fr@lists.openembedded.org>
Sent: Thursday, August 20, 2026 3:53 PM
To: fabien.thomas@smile.fr <fabien.thomas@smile.fr>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][scarthgap 22/37] curl: fix CVE-2026-6429
On Wed Aug 19, 2026 at 5:56 PM CEST, Fabien Thomas via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> This patch applies the upstream backport for CVE-2026-6429.
> The upstream fix commit is referenced in [1], and the public
> CVE advisory is referenced in [2].
>
> [1] https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
> [2] https://curl.se/docs/CVE-2026-6429.html
> [3] https://nvd.nist.gov/vuln/detail/CVE-2026-6429
>
> (From OE-Core rev: 0cbfae83eebf9076f7b22d07b48cb5cef1536989)
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
> ---
> .../curl/curl/CVE-2026-6429.patch | 367 ++++++++++++++++++
> meta/recipes-support/curl/curl_8.7.1.bb | 1 +
> 2 files changed, 368 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429.patch b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
> new file mode 100644
> index 00000000000..f4df441aa2b
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
> @@ -0,0 +1,367 @@
> +From 8191fd6d5677c30579c09a8d0988b47bbf33f65f Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Fri, 5 Jun 2026 01:20:50 -0700
> +Subject: [PATCH] http: clear credentials better on redirect
> +
> +Verify with test 2506: netrc with redirect using proxy
> +
> +Updated test 998 which was wrong.
> +
> +Reported-by: Muhamad Arga Reksapati
> +
> +Closes #21345
> +
> +CVE: CVE-2026-6429
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306]
> +
> +Backport Changes:
> +- The upstream lib/http.c hunk adds the same-origin credential clearing to
> + Curl_http_follow(). curl-8.7.1 predates that protocol-specific redirect
> + handler and carries the equivalent redirect logic in lib/transfer.c via
> + Curl_follow(), so the full upstream lib/http.c hunk was adapted there.
> +- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc
> + instead of the upstream tests/data/Makefile.am and
> + tests/libtest/Makefile.am lists.
> +- curl-8.7.1 does not contain test2504/lib2504, so the new
> + test2506/lib2506 entries were registered after the nearest existing
> + test2503/lib2502 entries in the target-version test lists.
> +- curl-8.7.1 uses the older libtest harness, so first.h,
> + test_lib2506(), and CURLcode result handling were adapted to test.h,
> + test(), and int res.
> +- Scarthgap curl-8.7.1 keeps the same incorrect redirected-request
> + Authorization expectation in tests/data/test998, so this backport removes
> + that expectation with an equivalent target-version hunk.
> +
> +(cherry picked from commit b4024bf808bd558026fdc6096e8457f199ace306)
> +Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> +---
> + lib/transfer.c | 103 +++++++++++++++++++++----------------
> + tests/data/Makefile.inc | 2 +-
> + tests/data/test2506 | 64 +++++++++++++++++++++++
> + tests/data/test998 | 1 -
> + tests/libtest/Makefile.inc | 5 +-
> + tests/libtest/lib2506.c | 71 +++++++++++++++++++++++++
> + 6 files changed, 198 insertions(+), 48 deletions(-)
> + create mode 100644 tests/data/test2506
> + create mode 100644 tests/libtest/lib2506.c
> +
> +diff --git a/lib/transfer.c b/lib/transfer.c
> +index a73462928d..0f5bd8ce59 100644
> +--- a/lib/transfer.c
> ++++ b/lib/transfer.c
> +@@ -865,49 +865,62 @@ CURLcode Curl_follow(struct Curl_easy *data,
> + if(uc)
> + return Curl_uc_to_curlcode(uc);
> +
> +- /* Clear auth if this redirects to a different port number or protocol,
> +- unless permitted */
> +- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
> +- char *portnum;
> +- int port;
> +- bool clear = FALSE;
> +-
> +- if(data->set.use_port && data->state.allow_port)
> +- /* a custom port is used */
> +- port = (int)data->set.use_port;
> +- else {
> +- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
> +- CURLU_DEFAULT_PORT);
> +- if(uc) {
> +- free(newurl);
> +- return Curl_uc_to_curlcode(uc);
> +- }
> +- port = atoi(portnum);
> +- free(portnum);
> +- }
> +- if(port != data->info.conn_remote_port) {
> +- infof(data, "Clear auth, redirects to port from %u to %u",
> +- data->info.conn_remote_port, port);
> +- clear = TRUE;
> ++ {
> ++ bool same_origin;
> ++ CURLU *u;
> ++ char *oldscheme = NULL;
> ++ char *oldhost = NULL;
> ++ char *oldport = NULL;
> ++ char *newscheme = NULL;
> ++ char *newhost = NULL;
> ++ char *newport = NULL;
> ++
> ++ u = curl_url();
> ++ if(!u) {
> ++ free(newurl);
> ++ return CURLE_OUT_OF_MEMORY;
> + }
> +- else {
> +- char *scheme;
> +- const struct Curl_handler *p;
> +- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
> +- if(uc) {
> +- free(newurl);
> +- return Curl_uc_to_curlcode(uc);
> +- }
> +
> +- p = Curl_get_scheme_handler(scheme);
> +- if(p && (p->protocol != data->info.conn_protocol)) {
> +- infof(data, "Clear auth, redirects scheme from %s to %s",
> +- data->info.conn_scheme, scheme);
> +- clear = TRUE;
> +- }
> +- free(scheme);
> ++ uc = curl_url_set(u, CURLUPART_URL, data->state.url, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(u, CURLUPART_SCHEME, &oldscheme, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(u, CURLUPART_HOST, &oldhost, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(u, CURLUPART_PORT, &oldport, CURLU_DEFAULT_PORT);
> ++ if(!uc)
> ++ uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &newscheme, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(data->state.uh, CURLUPART_HOST, &newhost, 0);
> ++ if(!uc)
> ++ uc = curl_url_get(data->state.uh, CURLUPART_PORT, &newport,
> ++ CURLU_DEFAULT_PORT);
> ++ if(uc) {
> ++ curl_url_cleanup(u);
> ++ free(oldscheme);
> ++ free(oldhost);
> ++ free(oldport);
> ++ free(newscheme);
> ++ free(newhost);
> ++ free(newport);
> ++ free(newurl);
> ++ return Curl_uc_to_curlcode(uc);
> + }
> +- if(clear) {
> ++
> ++ same_origin = strcasecompare(oldscheme, newscheme) &&
> ++ strcasecompare(oldhost, newhost) &&
> ++ !strcmp(oldport, newport);
> ++
> ++ curl_url_cleanup(u);
> ++ free(oldscheme);
> ++ free(oldhost);
> ++ free(oldport);
> ++ free(newscheme);
> ++ free(newhost);
> ++ free(newport);
> ++
> ++ if((!same_origin && !data->set.allow_auth_to_other_hosts) ||
> ++ !data->set.str[STRING_USERNAME]) {
> + result = Curl_reset_userpwd(data);
> + if(result) {
> + free(newurl);
> +@@ -917,12 +930,12 @@ CURLcode Curl_follow(struct Curl_easy *data,
> + Curl_safefree(data->state.aptr.passwd);
> + }
> + }
> +- }
> +
> +- result = Curl_reset_proxypwd(data);
> +- if(result) {
> +- free(newurl);
> +- return result;
> ++ result = Curl_reset_proxypwd(data);
> ++ if(result) {
> ++ free(newurl);
> ++ return result;
> ++ }
> + }
> +
> + if(type == FOLLOW_FAKE) {
> +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
> +index aafd309a9d..f673f86384 100644
> +--- a/tests/data/Makefile.inc
> ++++ b/tests/data/Makefile.inc
> +@@ -251,7 +251,7 @@ test2300 test2301 test2302 test2303 test2304 test2305 test2306 test2307 \
> + \
> + test2400 test2401 test2402 test2403 test2404 \
> + \
> +-test2500 test2501 test2502 test2503 \
> ++test2500 test2501 test2502 test2503 test2506 \
> + \
> + test2600 test2601 test2602 test2603 \
> + \
> +diff --git a/tests/data/test2506 b/tests/data/test2506
> +new file mode 100644
> +index 0000000000..9c65002496
> +--- /dev/null
> ++++ b/tests/data/test2506
> +@@ -0,0 +1,64 @@
> ++<?xml version="1.0" encoding="US-ASCII"?>
> ++<testcase>
> ++<info>
> ++<keywords>
> ++HTTP
> ++cookies
> ++</keywords>
> ++</info>
> ++
> ++<reply>
> ++<data crlf="headers" nocheck="yes">
> ++HTTP/1.1 301 redirect
> ++Date: Tue, 09 Nov 2010 14:49:00 GMT
> ++Content-Length: 3
> ++Location: http://numbertwo.example/%TESTNUMBER0002
> ++
> ++ok
> ++</data>
> ++<data2 crlf="headers" nocheck="yes">
> ++HTTP/1.1 200 OK
> ++Date: Tue, 09 Nov 2010 14:49:00 GMT
> ++Content-Length: 4
> ++
> ++yes
> ++</data2>
> ++</reply>
> ++
> ++<client>
> ++<server>
> ++http
> ++</server>
> ++<features>
> ++proxy
> ++</features>
> ++<tool>
> ++lib%TESTNUMBER
> ++</tool>
> ++<name>
> ++netrc with redirect using proxy
> ++</name>
> ++<file name="%LOGDIR/netrc2506">
> ++machine site.example login batman password robin
> ++</file>
> ++<command>
> ++http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506
> ++</command>
> ++</client>
> ++
> ++<verify>
> ++<protocol crlf="headers">
> ++GET http://site.example/ HTTP/1.1
> ++Host: site.example
> ++Authorization: Basic %b64[batman:robin]b64%
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://numbertwo.example/25060002 HTTP/1.1
> ++Host: numbertwo.example
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++</protocol>
> ++</verify>
> ++</testcase>
> +diff --git a/tests/data/test998 b/tests/data/test998
> +index 0969d4704b..17c0a0e150 100644
> +--- a/tests/data/test998
> ++++ b/tests/data/test998
> +@@ -82,7 +82,6 @@ Proxy-Connection: Keep-Alive
> +
> + GET http://somewhere.else.example/a/path/9980002 HTTP/1.1
> + Host: somewhere.else.example
> +- Authorization: Basic YWxiZXJ0bzplaW5zdGVpbg==
> + User-Agent: curl/%VERSION
> + Accept: */*
> + Proxy-Connection: Keep-Alive
> +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
> +index 9f7cec6027..9d3356aaf5 100644
> +--- a/tests/libtest/Makefile.inc
> ++++ b/tests/libtest/Makefile.inc
> +@@ -75,7 +75,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \
> + lib1970 lib1971 lib1972 lib1973 lib1974 lib1975 \
> + lib2301 lib2302 lib2304 lib2305 lib2306 \
> + lib2402 lib2404 \
> +- lib2502 \
> ++ lib2502 lib2506 \
> + lib3010 lib3025 lib3026 lib3027 \
> + lib3100 lib3101 lib3102 lib3103
> +
> +@@ -684,6 +684,9 @@ lib2404_LDADD = $(TESTUTIL_LIBS)
> + lib2502_SOURCES = lib2502.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib2502_LDADD = $(TESTUTIL_LIBS)
> +
> ++lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> ++lib2506_LDADD = $(TESTUTIL_LIBS)
> ++
> + lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib3010_LDADD = $(TESTUTIL_LIBS)
> +
> +diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c
> +new file mode 100644
> +index 0000000000..e6dde18507
> +--- /dev/null
> ++++ b/tests/libtest/lib2506.c
> +@@ -0,0 +1,71 @@
> ++/***************************************************************************
> ++ * _ _ ____ _
> ++ * Project ___| | | | _ \| |
> ++ * / __| | | | |_) | |
> ++ * | (__| |_| | _ <| |___
> ++ * \___|\___/|_| \_\_____|
> ++ *
> ++ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
> ++ *
> ++ * This software is licensed as described in the file COPYING, which
> ++ * you should have received as part of this distribution. The terms
> ++ * are also available at https://curl.se/docs/copyright.html.
> ++ *
> ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
> ++ * copies of the Software, and permit persons to whom the Software is
> ++ * furnished to do so, under the terms of the COPYING file.
> ++ *
> ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
> ++ * KIND, either express or implied.
> ++ *
> ++ * SPDX-License-Identifier: curl
> ++ *
> ++ ***************************************************************************/
> ++#include "test.h"
> ++
> ++#include "testtrace.h"
> ++
> ++static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud)
> ++{
> ++ (void)ptr;
> ++ (void)ud;
> ++ return size * nmemb;
> ++}
> ++
> ++int test(char *URL)
> ++{
> ++ CURL *curl;
> ++ int res = CURLE_OUT_OF_MEMORY;
> ++
> ++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
> ++ curl_mfprintf(stderr, "curl_global_init() failed\n");
> ++ return TEST_ERR_MAJOR_BAD;
> ++ }
> ++
> ++ curl = curl_easy_init();
> ++ if(!curl) {
> ++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
> ++ curl_global_cleanup();
> ++ return TEST_ERR_MAJOR_BAD;
> ++ }
> ++
> ++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506);
> ++ test_setopt(curl, CURLOPT_PROXY, URL);
> ++ test_setopt(curl, CURLOPT_URL, libtest_arg2);
> ++ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
> ++ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3);
> ++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
> ++ test_setopt(curl, CURLOPT_VERBOSE, 1L);
> ++
> ++ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the
> ++ credentials come from netrc */
> ++ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
> ++
> ++ res = curl_easy_perform(curl);
> ++
> ++test_cleanup:
> ++ curl_easy_cleanup(curl);
> ++ curl_global_cleanup();
> ++
> ++ return res;
> ++}
> diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
> index 2b988654c41..8e39d821626 100644
> --- a/meta/recipes-support/curl/curl_8.7.1.bb
> +++ b/meta/recipes-support/curl/curl_8.7.1.bb
> @@ -40,6 +40,7 @@ SRC_URI = " \
> file://CVE-2026-6276.patch \
> file://CVE-2026-5545.patch \
> file://CVE-2026-6253.patch \
> + file://CVE-2026-6429.patch \
> "
>
> SRC_URI:append:class-nativesdk = " \
I'll have to drop this patch because it is triggering a warning in the
autobuilder's ptest jobs qemuarm64-ptest[1] and qemux86-64-ptest[2].
It causes curl ptests 1159 & 1543 to fail :
`FAIL: 1159 - HTTP Location: and 'redirect_url' with non-supported scheme`
`FAIL: 1543 - CURLOPT_CURLU, URL with space and CURLINFO_EFFECTIVE_URL`
I'll drop the next patch of the series too (curl: fix CVE-2026-7168),
because it not applied anymore without this one.
[1] https://autobuilder.yoctoproject.org/valkyrie/#/builders/61/builds/4320
[2] https://autobuilder.yoctoproject.org/valkyrie/#/builders/73/builds/4336
--
Fabien Thomas
Smile ECS
[-- Attachment #2: Type: text/html, Size: 28658 bytes --]
^ permalink raw reply [flat|nested] 42+ messages in thread
[parent not found: <18CD4012388268D1.189677@lists.openembedded.org>]
* Re: [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168
[not found] ` <18CD4012388268D1.189677@lists.openembedded.org>
@ 2026-08-20 10:23 ` Fabien Thomas
2026-08-24 9:50 ` Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 1 reply; 42+ messages in thread
From: Fabien Thomas @ 2026-08-20 10:23 UTC (permalink / raw)
To: fabien.thomas, openembedded-core
On Wed Aug 19, 2026 at 5:56 PM CEST, Fabien Thomas via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> This patch applies the upstream backport for CVE-2026-7168.
> The upstream fix commit is referenced in [1], and the public
> CVE advisory is referenced in [2].
>
> [1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507
> [2] https://curl.se/docs/CVE-2026-7168.html
>
> (From OE-Core rev: 2fa295fe7473c6df94175de36528736bf32f1e9a)
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
> ---
> .../curl/curl/CVE-2026-7168.patch | 425 ++++++++++++++++++
> meta/recipes-support/curl/curl_8.7.1.bb | 1 +
> 2 files changed, 426 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
> new file mode 100644
> index 00000000000..0669be6546d
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
> @@ -0,0 +1,425 @@
> +From 0f0bb5efbd1e4f2199eeb98e6c62a7a67242cad2 Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Fri, 5 Jun 2026 01:22:37 -0700
> +Subject: [PATCH] setopt: clear proxy auth properties when switching
> +
> +Verify with test 1588
> +
> +Closes #21453
> +
> +CVE: CVE-2026-7168
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507]
> +
> +Backport Changes:
> +- The upstream lib/setopt.c hunk reuses Curl_auth_digest_cleanup() from the
> + newer tree. curl-8.7.1 does not expose that helper to setopt.c in the same
> + way, so this backport adds the vauth/vauth.h include before applying the
> + upstream setproxy() cleanup logic.
> +- The upstream tree already provides a CURL_DISABLE_DIGEST_AUTH fallback for
> + Curl_auth_digest_cleanup(). curl-8.7.1 does not, so this backport adds the
> + equivalent no-op macro in lib/vauth/vauth.h.
> +- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc
> + instead of the upstream tests/data/Makefile.am and
> + tests/libtest/Makefile.am lists.
> +- curl-8.7.1 uses the older libtest harness, so first.h,
> + test_lib1588(), libtest_arg4, and CURLcode result handling were adapted to
> + test.h, test(), test_argv[4], and int res.
> +- curl-8.7.1 does not define the newer digest test feature in runtests.pl.
> + This backport defines the target harness feature as digest-auth, matching
> + tests/server/disabled.c, and makes test 1588 require digest-auth.
> +- The curl-8.7.1 server harness does not handle crlf="headers" correctly on
> + response data sections for this test, so those attributes were removed from
> + the two server response blocks and datacheck. The protocol block keeps
> + crlf="headers" because runtests.pl normalizes protocol verification when any
> + crlf attribute is present.
> +
> +(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507)
> +Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> +---
> + lib/setopt.c | 18 ++++-
> + lib/vauth/vauth.h | 2 +
> + tests/data/Makefile.inc | 1 +
> + tests/data/test1588 | 106 ++++++++++++++++++++++++++
> + tests/libtest/Makefile.inc | 5 +-
> + tests/libtest/lib1588.c | 152 +++++++++++++++++++++++++++++++++++++
> + tests/runtests.pl | 2 +
> + 7 files changed, 283 insertions(+), 3 deletions(-)
> + create mode 100644 tests/data/test1588
> + create mode 100644 tests/libtest/lib1588.c
> +
> +diff --git a/lib/setopt.c b/lib/setopt.c
> +index 8a5a5d7..7eaf309 100644
> +--- a/lib/setopt.c
> ++++ b/lib/setopt.c
> +@@ -51,6 +51,7 @@
> + #include "altsvc.h"
> + #include "hsts.h"
> + #include "tftp.h"
> ++#include "vauth/vauth.h"
> + #include "strdup.h"
> + /* The last 3 #include files should be in this order */
> + #include "curl_printf.h"
> +@@ -76,6 +77,20 @@ CURLcode Curl_setstropt(char **charp, const char *s)
> + return CURLE_OK;
> + }
> +
> ++#ifndef CURL_DISABLE_PROXY
> ++static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
> ++{
> ++ if((data->set.str[STRING_PROXY] && proxy) &&
> ++ /* there was one set, is this a new one? */
> ++ !strcmp(data->set.str[STRING_PROXY], proxy))
> ++ return CURLE_OK; /* same one as before */
> ++
> ++ Curl_auth_digest_cleanup(&data->state.proxydigest);
> ++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
> ++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
> ++}
> ++#endif
> ++
> + CURLcode Curl_setblobopt(struct curl_blob **blobp,
> + const struct curl_blob *blob)
> + {
> +@@ -1139,8 +1154,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
> + * Setting it to NULL, means no proxy but allows the environment variables
> + * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
> + */
> +- result = Curl_setstropt(&data->set.str[STRING_PROXY],
> +- va_arg(param, char *));
> ++ result = setproxy(data, va_arg(param, char *));
> + break;
> +
> + case CURLOPT_PRE_PROXY:
> +diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
> +index 9da0540..bf5c7a3 100644
> +--- a/lib/vauth/vauth.h
> ++++ b/lib/vauth/vauth.h
> +@@ -119,6 +119,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
> +
> + /* This is used to clean up the digest specific data */
> + void Curl_auth_digest_cleanup(struct digestdata *digest);
> ++#else
> ++#define Curl_auth_digest_cleanup(x)
> + #endif /* !CURL_DISABLE_DIGEST_AUTH */
> +
> + #ifdef USE_GSASL
> +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
> +index f673f86..461eb37 100644
> +--- a/tests/data/Makefile.inc
> ++++ b/tests/data/Makefile.inc
> +@@ -200,6 +200,7 @@ test1540 test1541 test1542 test1543 test1544 test1545 \
> + test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \
> + test1558 test1559 test1560 test1561 test1562 test1563 test1564 test1565 \
> + test1566 test1567 test1568 test1569 test1570 \
> ++test1588 \
> + \
> + test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
> + test1598 \
> +diff --git a/tests/data/test1588 b/tests/data/test1588
> +new file mode 100644
> +index 0000000..8a3bf81
> +--- /dev/null
> ++++ b/tests/data/test1588
> +@@ -0,0 +1,106 @@
> ++<?xml version="1.0" encoding="US-ASCII"?>
> ++<testcase>
> ++<info>
> ++<keywords>
> ++HTTP
> ++HTTP GET
> ++HTTP proxy
> ++HTTP proxy Digest auth
> ++multi
> ++</keywords>
> ++</info>
> ++
> ++# Server-side
> ++<reply>
> ++
> ++# this is returned first since we get no proxy-auth
> ++<data>
> ++HTTP/1.1 407 Authorization Required to proxy me my dear
> ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
> ++Content-Length: 33
> ++
> ++And you should ignore this data.
> ++</data>
> ++
> ++# then this is returned when we get proxy-auth
> ++<data1000>
> ++HTTP/1.1 200 OK
> ++Content-Length: 21
> ++Server: no
> ++
> ++Nice proxy auth sir!
> ++</data1000>
> ++
> ++<datacheck>
> ++HTTP/1.1 407 Authorization Required to proxy me my dear
> ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
> ++Content-Length: 33
> ++
> ++HTTP/1.1 200 OK
> ++Content-Length: 21
> ++Server: no
> ++
> ++Nice proxy auth sir!
> ++HTTP/1.1 407 Authorization Required to proxy me my dear
> ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
> ++Content-Length: 33
> ++
> ++HTTP/1.1 200 OK
> ++Content-Length: 21
> ++Server: no
> ++
> ++Nice proxy auth sir!
> ++</datacheck>
> ++</reply>
> ++
> ++# Client-side
> ++<client>
> ++<server>
> ++http
> ++</server>
> ++# tool is what to use instead of 'curl'
> ++<tool>
> ++lib%TESTNUMBER
> ++</tool>
> ++<features>
> ++!SSPI
> ++crypto
> ++proxy
> ++digest-auth
> ++</features>
> ++<name>
> ++HTTP proxy auth Digest, then change proxy and do it again
> ++</name>
> ++<command>
> ++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
> ++</command>
> ++</client>
> ++
> ++# Verify data after the test has been "shot"
> ++<verify>
> ++<protocol crlf="headers">
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++</protocol>
> ++</verify>
> ++</testcase>
> +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
> +index 9d3356a..4c42d34 100644
> +--- a/tests/libtest/Makefile.inc
> ++++ b/tests/libtest/Makefile.inc
> +@@ -62,7 +62,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \
> + lib1540 lib1541 lib1542 lib1543 lib1545 \
> + lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \
> + lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \
> +- lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
> ++ lib1588 lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
> + \
> + lib1662 \
> + \
> +@@ -687,6 +687,9 @@ lib2502_LDADD = $(TESTUTIL_LIBS)
> + lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib2506_LDADD = $(TESTUTIL_LIBS)
> +
> ++lib1588_SOURCES = lib1588.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> ++lib1588_LDADD = $(TESTUTIL_LIBS)
> ++
> + lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib3010_LDADD = $(TESTUTIL_LIBS)
> +
> +diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c
> +new file mode 100644
> +index 0000000..00c6b35
> +--- /dev/null
> ++++ b/tests/libtest/lib1588.c
> +@@ -0,0 +1,152 @@
> ++/***************************************************************************
> ++ * _ _ ____ _
> ++ * Project ___| | | | _ \| |
> ++ * / __| | | | |_) | |
> ++ * | (__| |_| | _ <| |___
> ++ * \___|\___/|_| \_\_____|
> ++ *
> ++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
> ++ *
> ++ * This software is licensed as described in the file COPYING, which
> ++ * you should have received as part of this distribution. The terms
> ++ * are also available at https://curl.se/docs/copyright.html.
> ++ *
> ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
> ++ * copies of the Software, and permit persons to whom the Software is
> ++ * furnished to do so, under the terms of the COPYING file.
> ++ *
> ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
> ++ * KIND, either express or implied.
> ++ *
> ++ * SPDX-License-Identifier: curl
> ++ *
> ++ ***************************************************************************/
> ++/*
> ++ * argv1 = URL
> ++ * argv2 = proxy host
> ++ * argv3 = proxy port
> ++ * argv4 = proxyuser:password
> ++ */
> ++
> ++#include "test.h"
> ++#include "testutil.h"
> ++
> ++static CURLcode init1588(CURL *curl, const char *url,
> ++ const char *userpwd, const char *proxy)
> ++{
> ++ int res = CURLE_OK;
> ++
> ++ res_easy_setopt(curl, CURLOPT_URL, url);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_PROXY, proxy);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
> ++ if(res)
> ++ goto init_failed;
> ++#if 0
> ++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
> ++ if(res)
> ++ goto init_failed;
> ++#endif
> ++
> ++ res_easy_setopt(curl, CURLOPT_HEADER, 1L);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ return CURLE_OK; /* success */
> ++
> ++init_failed:
> ++ return (CURLcode)res; /* failure */
> ++}
> ++
> ++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
> ++ const char *proxy)
> ++{
> ++ CURLcode res = CURLE_OK;
> ++
> ++ res = init1588(curl, url, userpwd, proxy);
> ++ if(res)
> ++ return res;
> ++
> ++ return curl_easy_perform(curl);
> ++}
> ++
> ++int test(char *URL)
> ++{
> ++ int res = CURLE_OK;
> ++ CURL *curl = NULL;
> ++ const char *proxyuserpws;
> ++ struct curl_slist *host = NULL;
> ++ struct curl_slist *host2 = NULL;
> ++ char proxy1_resolve[128];
> ++ char proxy2_resolve[128];
> ++ char proxy1_connect[128];
> ++ char proxy2_connect[128];
> ++
> ++ if(test_argc < 5)
> ++ return TEST_ERR_MAJOR_BAD;
> ++ proxyuserpws = test_argv[4];
> ++
> ++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
> ++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
> ++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
> ++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
> ++
> ++ /* we connect to the fake host name but the right port number */
> ++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
> ++ "firstproxy:%s", libtest_arg3);
> ++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
> ++ "secondproxy:%s", libtest_arg3);
> ++
> ++ res_global_init(CURL_GLOBAL_ALL);
> ++ if(res)
> ++ return res;
> ++
> ++ curl = curl_easy_init();
> ++ if(!curl) {
> ++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
> ++ curl_global_cleanup();
> ++ return TEST_ERR_MAJOR_BAD;
> ++ }
> ++
> ++ host = curl_slist_append(NULL, proxy1_resolve);
> ++ if(!host)
> ++ goto test_cleanup;
> ++ host2 = curl_slist_append(host, proxy2_resolve);
> ++ if(!host2)
> ++ goto test_cleanup;
> ++ host = host2;
> ++
> ++ start_test_timing();
> ++
> ++ easy_setopt(curl, CURLOPT_RESOLVE, host);
> ++
> ++ res = run1588(curl, URL, proxyuserpws, proxy1_connect);
> ++ if(res)
> ++ goto test_cleanup;
> ++
> ++ curl_mfprintf(stderr, "lib1588: now we do the request again\n");
> ++
> ++ res = run1588(curl, URL, proxyuserpws, proxy2_connect);
> ++
> ++test_cleanup:
> ++
> ++ /* proper cleanup sequence - type PB */
> ++
> ++ curl_easy_cleanup(curl);
> ++ curl_global_cleanup();
> ++ curl_slist_free_all(host);
> ++ return res;
> ++}
> +diff --git a/tests/runtests.pl b/tests/runtests.pl
> +index ddfab20..b40df55 100755
> +--- a/tests/runtests.pl
> ++++ b/tests/runtests.pl
> +@@ -637,6 +637,8 @@ sub checksystemfeatures {
> + $feature{"Kerberos"} = $feat =~ /Kerberos/i;
> + # SPNEGO enabled
> + $feature{"SPNEGO"} = $feat =~ /SPNEGO/i;
> ++ # Digest auth enabled unless disabled by build
> ++ $feature{"digest-auth"} = 1;
> + # CharConv enabled
> + $feature{"CharConv"} = $feat =~ /CharConv/i;
> + # TLS-SRP enabled
> +--
> +2.35.6
> diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
> index 8e39d821626..7d55f72b03f 100644
> --- a/meta/recipes-support/curl/curl_8.7.1.bb
> +++ b/meta/recipes-support/curl/curl_8.7.1.bb
> @@ -41,6 +41,7 @@ SRC_URI = " \
> file://CVE-2026-5545.patch \
> file://CVE-2026-6253.patch \
> file://CVE-2026-6429.patch \
> + file://CVE-2026-7168.patch \
> "
>
> SRC_URI:append:class-nativesdk = " \
I'll have to drop this patch too because it doesn't apply anymore without
the previous patch of the series (curl: fix CVE-2026-6429) which cause some
ptest faillures.
--
Fabien Thomas
Smile ECS
^ permalink raw reply [flat|nested] 42+ messages in thread* Re: [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168
2026-08-20 10:23 ` [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168 Fabien Thomas
@ 2026-08-24 9:50 ` Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)
0 siblings, 0 replies; 42+ messages in thread
From: Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-08-24 9:50 UTC (permalink / raw)
To: fabien.thomas@smile.fr, openembedded-core@lists.openembedded.org
[-- Attachment #1: Type: text/plain, Size: 17442 bytes --]
Hi Fabien,
Thanks for your review. I have addressed this and sent the updated patch here:
openembedded-core@lists.openembedded.org | [scarthgap][PATCH v3 5/5] curl: fix CVE-2026-7168<https://lists.openembedded.org/g/openembedded-core/topic/120900349>
Regards,
Deepak
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Fabien Thomas via lists.openembedded.org <fabien.thomas=smile.fr@lists.openembedded.org>
Sent: Thursday, August 20, 2026 3:53 PM
To: fabien.thomas@smile.fr <fabien.thomas@smile.fr>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][scarthgap 23/37] curl: fix CVE-2026-7168
On Wed Aug 19, 2026 at 5:56 PM CEST, Fabien Thomas via lists.openembedded.org wrote:
> From: Deepak Rathore <deeratho@cisco.com>
>
> This patch applies the upstream backport for CVE-2026-7168.
> The upstream fix commit is referenced in [1], and the public
> CVE advisory is referenced in [2].
>
> [1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507
> [2] https://curl.se/docs/CVE-2026-7168.html
>
> (From OE-Core rev: 2fa295fe7473c6df94175de36528736bf32f1e9a)
>
> Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
> ---
> .../curl/curl/CVE-2026-7168.patch | 425 ++++++++++++++++++
> meta/recipes-support/curl/curl_8.7.1.bb | 1 +
> 2 files changed, 426 insertions(+)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
> new file mode 100644
> index 00000000000..0669be6546d
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
> @@ -0,0 +1,425 @@
> +From 0f0bb5efbd1e4f2199eeb98e6c62a7a67242cad2 Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Fri, 5 Jun 2026 01:22:37 -0700
> +Subject: [PATCH] setopt: clear proxy auth properties when switching
> +
> +Verify with test 1588
> +
> +Closes #21453
> +
> +CVE: CVE-2026-7168
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507]
> +
> +Backport Changes:
> +- The upstream lib/setopt.c hunk reuses Curl_auth_digest_cleanup() from the
> + newer tree. curl-8.7.1 does not expose that helper to setopt.c in the same
> + way, so this backport adds the vauth/vauth.h include before applying the
> + upstream setproxy() cleanup logic.
> +- The upstream tree already provides a CURL_DISABLE_DIGEST_AUTH fallback for
> + Curl_auth_digest_cleanup(). curl-8.7.1 does not, so this backport adds the
> + equivalent no-op macro in lib/vauth/vauth.h.
> +- curl-8.7.1 uses tests/data/Makefile.inc and tests/libtest/Makefile.inc
> + instead of the upstream tests/data/Makefile.am and
> + tests/libtest/Makefile.am lists.
> +- curl-8.7.1 uses the older libtest harness, so first.h,
> + test_lib1588(), libtest_arg4, and CURLcode result handling were adapted to
> + test.h, test(), test_argv[4], and int res.
> +- curl-8.7.1 does not define the newer digest test feature in runtests.pl.
> + This backport defines the target harness feature as digest-auth, matching
> + tests/server/disabled.c, and makes test 1588 require digest-auth.
> +- The curl-8.7.1 server harness does not handle crlf="headers" correctly on
> + response data sections for this test, so those attributes were removed from
> + the two server response blocks and datacheck. The protocol block keeps
> + crlf="headers" because runtests.pl normalizes protocol verification when any
> + crlf attribute is present.
> +
> +(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507)
> +Signed-off-by: Deepak Rathore <deeratho@cisco.com>
> +---
> + lib/setopt.c | 18 ++++-
> + lib/vauth/vauth.h | 2 +
> + tests/data/Makefile.inc | 1 +
> + tests/data/test1588 | 106 ++++++++++++++++++++++++++
> + tests/libtest/Makefile.inc | 5 +-
> + tests/libtest/lib1588.c | 152 +++++++++++++++++++++++++++++++++++++
> + tests/runtests.pl | 2 +
> + 7 files changed, 283 insertions(+), 3 deletions(-)
> + create mode 100644 tests/data/test1588
> + create mode 100644 tests/libtest/lib1588.c
> +
> +diff --git a/lib/setopt.c b/lib/setopt.c
> +index 8a5a5d7..7eaf309 100644
> +--- a/lib/setopt.c
> ++++ b/lib/setopt.c
> +@@ -51,6 +51,7 @@
> + #include "altsvc.h"
> + #include "hsts.h"
> + #include "tftp.h"
> ++#include "vauth/vauth.h"
> + #include "strdup.h"
> + /* The last 3 #include files should be in this order */
> + #include "curl_printf.h"
> +@@ -76,6 +77,20 @@ CURLcode Curl_setstropt(char **charp, const char *s)
> + return CURLE_OK;
> + }
> +
> ++#ifndef CURL_DISABLE_PROXY
> ++static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
> ++{
> ++ if((data->set.str[STRING_PROXY] && proxy) &&
> ++ /* there was one set, is this a new one? */
> ++ !strcmp(data->set.str[STRING_PROXY], proxy))
> ++ return CURLE_OK; /* same one as before */
> ++
> ++ Curl_auth_digest_cleanup(&data->state.proxydigest);
> ++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
> ++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
> ++}
> ++#endif
> ++
> + CURLcode Curl_setblobopt(struct curl_blob **blobp,
> + const struct curl_blob *blob)
> + {
> +@@ -1139,8 +1154,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
> + * Setting it to NULL, means no proxy but allows the environment variables
> + * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
> + */
> +- result = Curl_setstropt(&data->set.str[STRING_PROXY],
> +- va_arg(param, char *));
> ++ result = setproxy(data, va_arg(param, char *));
> + break;
> +
> + case CURLOPT_PRE_PROXY:
> +diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
> +index 9da0540..bf5c7a3 100644
> +--- a/lib/vauth/vauth.h
> ++++ b/lib/vauth/vauth.h
> +@@ -119,6 +119,8 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
> +
> + /* This is used to clean up the digest specific data */
> + void Curl_auth_digest_cleanup(struct digestdata *digest);
> ++#else
> ++#define Curl_auth_digest_cleanup(x)
> + #endif /* !CURL_DISABLE_DIGEST_AUTH */
> +
> + #ifdef USE_GSASL
> +diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
> +index f673f86..461eb37 100644
> +--- a/tests/data/Makefile.inc
> ++++ b/tests/data/Makefile.inc
> +@@ -200,6 +200,7 @@ test1540 test1541 test1542 test1543 test1544 test1545 \
> + test1550 test1551 test1552 test1553 test1554 test1555 test1556 test1557 \
> + test1558 test1559 test1560 test1561 test1562 test1563 test1564 test1565 \
> + test1566 test1567 test1568 test1569 test1570 \
> ++test1588 \
> + \
> + test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
> + test1598 \
> +diff --git a/tests/data/test1588 b/tests/data/test1588
> +new file mode 100644
> +index 0000000..8a3bf81
> +--- /dev/null
> ++++ b/tests/data/test1588
> +@@ -0,0 +1,106 @@
> ++<?xml version="1.0" encoding="US-ASCII"?>
> ++<testcase>
> ++<info>
> ++<keywords>
> ++HTTP
> ++HTTP GET
> ++HTTP proxy
> ++HTTP proxy Digest auth
> ++multi
> ++</keywords>
> ++</info>
> ++
> ++# Server-side
> ++<reply>
> ++
> ++# this is returned first since we get no proxy-auth
> ++<data>
> ++HTTP/1.1 407 Authorization Required to proxy me my dear
> ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
> ++Content-Length: 33
> ++
> ++And you should ignore this data.
> ++</data>
> ++
> ++# then this is returned when we get proxy-auth
> ++<data1000>
> ++HTTP/1.1 200 OK
> ++Content-Length: 21
> ++Server: no
> ++
> ++Nice proxy auth sir!
> ++</data1000>
> ++
> ++<datacheck>
> ++HTTP/1.1 407 Authorization Required to proxy me my dear
> ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
> ++Content-Length: 33
> ++
> ++HTTP/1.1 200 OK
> ++Content-Length: 21
> ++Server: no
> ++
> ++Nice proxy auth sir!
> ++HTTP/1.1 407 Authorization Required to proxy me my dear
> ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
> ++Content-Length: 33
> ++
> ++HTTP/1.1 200 OK
> ++Content-Length: 21
> ++Server: no
> ++
> ++Nice proxy auth sir!
> ++</datacheck>
> ++</reply>
> ++
> ++# Client-side
> ++<client>
> ++<server>
> ++http
> ++</server>
> ++# tool is what to use instead of 'curl'
> ++<tool>
> ++lib%TESTNUMBER
> ++</tool>
> ++<features>
> ++!SSPI
> ++crypto
> ++proxy
> ++digest-auth
> ++</features>
> ++<name>
> ++HTTP proxy auth Digest, then change proxy and do it again
> ++</name>
> ++<command>
> ++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
> ++</command>
> ++</client>
> ++
> ++# Verify data after the test has been "shot"
> ++<verify>
> ++<protocol crlf="headers">
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++GET http://test.remote.example.com/path/1588 HTTP/1.1
> ++Host: test.remote.example.com
> ++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
> ++Accept: */*
> ++Proxy-Connection: Keep-Alive
> ++
> ++</protocol>
> ++</verify>
> ++</testcase>
> +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
> +index 9d3356a..4c42d34 100644
> +--- a/tests/libtest/Makefile.inc
> ++++ b/tests/libtest/Makefile.inc
> +@@ -62,7 +62,7 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq \
> + lib1540 lib1541 lib1542 lib1543 lib1545 \
> + lib1550 lib1551 lib1552 lib1553 lib1554 lib1555 lib1556 lib1557 \
> + lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \
> +- lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
> ++ lib1588 lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
> + \
> + lib1662 \
> + \
> +@@ -687,6 +687,9 @@ lib2502_LDADD = $(TESTUTIL_LIBS)
> + lib2506_SOURCES = lib2506.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib2506_LDADD = $(TESTUTIL_LIBS)
> +
> ++lib1588_SOURCES = lib1588.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> ++lib1588_LDADD = $(TESTUTIL_LIBS)
> ++
> + lib3010_SOURCES = lib3010.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
> + lib3010_LDADD = $(TESTUTIL_LIBS)
> +
> +diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c
> +new file mode 100644
> +index 0000000..00c6b35
> +--- /dev/null
> ++++ b/tests/libtest/lib1588.c
> +@@ -0,0 +1,152 @@
> ++/***************************************************************************
> ++ * _ _ ____ _
> ++ * Project ___| | | | _ \| |
> ++ * / __| | | | |_) | |
> ++ * | (__| |_| | _ <| |___
> ++ * \___|\___/|_| \_\_____|
> ++ *
> ++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
> ++ *
> ++ * This software is licensed as described in the file COPYING, which
> ++ * you should have received as part of this distribution. The terms
> ++ * are also available at https://curl.se/docs/copyright.html.
> ++ *
> ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
> ++ * copies of the Software, and permit persons to whom the Software is
> ++ * furnished to do so, under the terms of the COPYING file.
> ++ *
> ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
> ++ * KIND, either express or implied.
> ++ *
> ++ * SPDX-License-Identifier: curl
> ++ *
> ++ ***************************************************************************/
> ++/*
> ++ * argv1 = URL
> ++ * argv2 = proxy host
> ++ * argv3 = proxy port
> ++ * argv4 = proxyuser:password
> ++ */
> ++
> ++#include "test.h"
> ++#include "testutil.h"
> ++
> ++static CURLcode init1588(CURL *curl, const char *url,
> ++ const char *userpwd, const char *proxy)
> ++{
> ++ int res = CURLE_OK;
> ++
> ++ res_easy_setopt(curl, CURLOPT_URL, url);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_PROXY, proxy);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
> ++ if(res)
> ++ goto init_failed;
> ++#if 0
> ++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
> ++ if(res)
> ++ goto init_failed;
> ++#endif
> ++
> ++ res_easy_setopt(curl, CURLOPT_HEADER, 1L);
> ++ if(res)
> ++ goto init_failed;
> ++
> ++ return CURLE_OK; /* success */
> ++
> ++init_failed:
> ++ return (CURLcode)res; /* failure */
> ++}
> ++
> ++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
> ++ const char *proxy)
> ++{
> ++ CURLcode res = CURLE_OK;
> ++
> ++ res = init1588(curl, url, userpwd, proxy);
> ++ if(res)
> ++ return res;
> ++
> ++ return curl_easy_perform(curl);
> ++}
> ++
> ++int test(char *URL)
> ++{
> ++ int res = CURLE_OK;
> ++ CURL *curl = NULL;
> ++ const char *proxyuserpws;
> ++ struct curl_slist *host = NULL;
> ++ struct curl_slist *host2 = NULL;
> ++ char proxy1_resolve[128];
> ++ char proxy2_resolve[128];
> ++ char proxy1_connect[128];
> ++ char proxy2_connect[128];
> ++
> ++ if(test_argc < 5)
> ++ return TEST_ERR_MAJOR_BAD;
> ++ proxyuserpws = test_argv[4];
> ++
> ++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
> ++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
> ++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
> ++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
> ++
> ++ /* we connect to the fake host name but the right port number */
> ++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
> ++ "firstproxy:%s", libtest_arg3);
> ++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
> ++ "secondproxy:%s", libtest_arg3);
> ++
> ++ res_global_init(CURL_GLOBAL_ALL);
> ++ if(res)
> ++ return res;
> ++
> ++ curl = curl_easy_init();
> ++ if(!curl) {
> ++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
> ++ curl_global_cleanup();
> ++ return TEST_ERR_MAJOR_BAD;
> ++ }
> ++
> ++ host = curl_slist_append(NULL, proxy1_resolve);
> ++ if(!host)
> ++ goto test_cleanup;
> ++ host2 = curl_slist_append(host, proxy2_resolve);
> ++ if(!host2)
> ++ goto test_cleanup;
> ++ host = host2;
> ++
> ++ start_test_timing();
> ++
> ++ easy_setopt(curl, CURLOPT_RESOLVE, host);
> ++
> ++ res = run1588(curl, URL, proxyuserpws, proxy1_connect);
> ++ if(res)
> ++ goto test_cleanup;
> ++
> ++ curl_mfprintf(stderr, "lib1588: now we do the request again\n");
> ++
> ++ res = run1588(curl, URL, proxyuserpws, proxy2_connect);
> ++
> ++test_cleanup:
> ++
> ++ /* proper cleanup sequence - type PB */
> ++
> ++ curl_easy_cleanup(curl);
> ++ curl_global_cleanup();
> ++ curl_slist_free_all(host);
> ++ return res;
> ++}
> +diff --git a/tests/runtests.pl b/tests/runtests.pl
> +index ddfab20..b40df55 100755
> +--- a/tests/runtests.pl
> ++++ b/tests/runtests.pl
> +@@ -637,6 +637,8 @@ sub checksystemfeatures {
> + $feature{"Kerberos"} = $feat =~ /Kerberos/i;
> + # SPNEGO enabled
> + $feature{"SPNEGO"} = $feat =~ /SPNEGO/i;
> ++ # Digest auth enabled unless disabled by build
> ++ $feature{"digest-auth"} = 1;
> + # CharConv enabled
> + $feature{"CharConv"} = $feat =~ /CharConv/i;
> + # TLS-SRP enabled
> +--
> +2.35.6
> diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
> index 8e39d821626..7d55f72b03f 100644
> --- a/meta/recipes-support/curl/curl_8.7.1.bb
> +++ b/meta/recipes-support/curl/curl_8.7.1.bb
> @@ -41,6 +41,7 @@ SRC_URI = " \
> file://CVE-2026-5545.patch \
> file://CVE-2026-6253.patch \
> file://CVE-2026-6429.patch \
> + file://CVE-2026-7168.patch \
> "
>
> SRC_URI:append:class-nativesdk = " \
I'll have to drop this patch too because it doesn't apply anymore without
the previous patch of the series (curl: fix CVE-2026-6429) which cause some
ptest faillures.
--
Fabien Thomas
Smile ECS
[-- Attachment #2: Type: text/html, Size: 27620 bytes --]
^ permalink raw reply [flat|nested] 42+ messages in thread