Re: [wrynose][PATCH] libarchive: fix CVE-2026-15028

["Yoann Congal" <yoann.congal@smile.fr>]

On Fri Oct 2, 2026 at 1:02 PM CEST, Jakub Szczudlo (Nokia) wrote:
> Backport patch to fix CVE-2026-15028.
>
> References:
>   https://nvd.nist.gov/vuln/detail/CVE-2026-15028
>
> Upstream fix:
>   https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2
>
> Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
> ---
>  .../libarchive/CVE-2026-15028.patch           | 41 +++++++++++++++++++
>  .../libarchive/libarchive_3.8.7.bb            |  1 +
>  2 files changed, 42 insertions(+)
>  create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch

Hello,

This CVE is in a weird state: I think NVD and Debian are wrong:
The link PR is not the right one and so the fixing commit isn't.

The correct path is: From NVD,
https://github.com/libarchive/libarchive/issues/3251 (matches CVE summary)
is fixed by https://github.com/libarchive/libarchive/pull/3252 (not 3253)
This PR contains 40b92de
Ubuntu concurs: https://ubuntu.com/security/CVE-2026-15028

To get merged, this patch need 2 things:
* an upgraded commit message with the above explanation (after you
  checked/reworded it)
* A fix on master: as far as I can tell, 40b92de is not in the 3.8.9
  used on OE-core master.

Regards,
-- 
Yoann Congal
Smile ECS