Re: [Buildroot] [PATCH] package/bubblewrap: security bump to version 0.12.0

From: Julien Olivain via buildroot <buildroot@buildroot.org>
To: Adrian Perez de Castro <aperez@igalia.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/bubblewrap: security bump to version 0.12.0
Date: Thu, 10 Sep 2026 22:01:38 +0200	[thread overview]
Message-ID: <98a3e0f65ab3ed8e1b2723d620cce2d1@free.fr> (raw)
In-Reply-To: <20260910095223.1597453-1-aperez@igalia.com>

On 10/09/2026 11:52, Adrian Perez de Castro wrote:
> Fixes a sandbox escape through symlink traversal tracked in
> CVE-2026-87766, which affects all previous versions.
> 
> Using the bwrap binary with the setuid bit set is no longer supported
> and user namespaces are now always required, so a kernel config fixup
> is applied.
> 
> A new build option allows indicating the minimum kernel version that
> will be used, which removes code used for backwards compatibility with
> kernels older than 5.6.0 when a newer version is specified. Passing
> $(LINUX_VERSION_PROBED) seems reasonable here.
> 
> This version also changed the license from LGPL-2.0+ to LGPL-2.1+,
> hence the updated hash.
> 
> Release notes:
> 
>   https://github.com/containers/bubblewrap/releases/tag/v0.12.0
> 
> Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>

Applied to master, thanks. For info, I fixed the linux config fixup (no
pun intended). The "_LINUX" was missing and the fixup was not applied. 
See:
https://gitlab.com/buildroot.org/buildroot/-/commit/4cb6193d2eca39b1bd79ff4867c842f507f692b8

Best regards.

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot