[OE-core][PATCH v3 1/9] cve-exclusions: set status for CVE-2019-14899

[Junjie Cao <junjie.cao@linux.dev>]

A network-adjacent attacker can send packets addressed to a host's VPN
tunnel address over the physical interface. Because Linux uses the weak
host model by default, the host replies, which lets the attacker infer
the tunnel address, confirm active connections and eventually inject
into the tunneled TCP stream.

No upstream kernel fix exists. The disclosure notes that reverse path
filtering is not a complete solution because the attack also works over
IPv6, which has no rp_filter; the mitigation that shipped was a firewall
rule added to wg-quick(8) in userspace:

  https://www.openwall.com/lists/oss-security/2019/12/05/1
  https://lore.kernel.org/all/20191205191318.GA44156@zx2c4.com/

Distribution trackers record the same state: Ubuntu has it deferred
since 2019-12-13, Debian does not track it against the kernel, and Red
Hat scopes it to openvpn:

  https://ubuntu.com/security/CVE-2019-14899
  https://security-tracker.debian.org/tracker/CVE-2019-14899

Record it unpatched so it stays visible rather than excluded.

CC: Paul Barker <paul@pbarker.dev>
AI-Generated: Uses Claude (claude-opus-5)
Signed-off-by: Junjie Cao <junjie.cao@linux.dev>
---
v3:
- use "unpatched" instead of "upstream-wontfix": there is no upstream
  statement, only distribution and disclosure sources

v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/

 meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index d27d764..5ed4a00 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -192,3 +192,10 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from 6.18"
 # Fix https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3
 # Backport https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906
 CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
+
+# Consequence of the default weak host model, not a specific defect;
+# mitigation is firewall configuration only (rp_filter for IPv4, a
+# strong host model rule such as wg-quick(8)'s, which also covers IPv6).
+# https://ubuntu.com/security/CVE-2019-14899
+CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \
+host model, no upstream kernel fix, mitigated by firewall configuration"
-- 
2.43.0