Hi Yoann,
I have submitted updated fixes for CVE-2026-6429 and CVE-2026-7168 as patches 7/8 and 8/8 in a complete Scarthgap curl series:

https://patchwork.yoctoproject.org/project/oe-core/list/?series=51870

For CVE-2026-7168, the test prerequisite is separate, the curl 8.7.1 backport changes are explained, and the CURLcode-returning helpers use CURLcode.

Please consider Deepak's v3 4/5 and 5/5 patches superseded and review the new series.

Regards,
Devansh

 

On Fri, Sep 18, 2026 at 02:51 PM, Yoann Congal wrote:

On Fri Sep 18, 2026 at 11:19 AM CEST, Yoann Congal wrote:

Hello,

This patch conflict with other patches in my branch. Because this one
has issues, I will hold it for another cycle, you will have to
refresh/rebase on top of the next merge (or send me a new version that
applies on top of the -nut branch I will push/test later today)

Details of the issues below:

I forgot to add that sending partial series (only 4,5/5 and not 1,2/2)
make my tooling throw warnings... Can you send the patches as 1,2/2 in
the next iteration?

Thanks!
--
Yoann Congal
Smile ECS