Re: [OE-core] [PATCH] zlib: patch CVE-2026-85091 and CVE-2026-76844

["Paul Barker" <paul@pbarker.dev>]

>> -----Original Message-----
>> From: openembedded-core@lists.openembedded.org <openembedded-
>> core@lists.openembedded.org> On Behalf Of Paul Barker
>> Sent: Thursday, November 5, 2026 4:03 PM
>> To: Prasanth R <ragaprasanth@gmail.com>; openembedded-
>> core@lists.openembedded.org
>> Cc: Prasanth R <prasanth.r@lineo.co.jp>
>> Subject: Re: [OE-core] [PATCH] zlib: patch CVE-2026-85091 and CVE-2026-
>> 76844
>> 
>> On Fri Oct 30, 2026 at 5:05 AM GMT, Prasanth R wrote:
>> > From: Prasanth R <ragaprasanth@gmail.com>
>> >
>> > Backport the upstream fix. It covers both CVEs.
>> > CVE-2026-85091 & CVE-2026-76844
>> 
>> Hi Prasanth,
>> 
>> This troubled me as two CVE ids shouldn't really be pointing at a single
>> simple fix. So I looked into it some more...
>> 
>> CVE-2026-76844 currently points at zlib in error [1], so this one should
>> be resolved by setting CVE_STATUS rather than by assigning two CVE ids
>> to the same patch. Please could you send a v2 for CVE-2026-85091, along
>> with a CVE_STATUS assignment for CVE-2026-76844?
>> 
>> [1]: https://github.com/madler/zlib/issues/1330

On Thu Nov 5, 2026 at 3:08 PM GMT, Peter Marko wrote:
> Also note that for master, there is a new tag since yesterday.
> Patches are then only for the older releases.

Thanks for the update Peter.

In this case we just need the CVE_STATUS assignment for CVE-2026-76844,
as CVE-2026-85091 is fixed in zlib 1.4.

Best regards,

-- 
Paul Barker