[wrynose][PATCH] libarchive: mark CVE-2026-14164 as fixed-version

[wrynose][PATCH] libarchive: mark CVE-2026-14164 as fixed-version

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

- The RAR5 double-free in init_unpack() is a regression introduced
  upstream by commit 620bdafa on 2026-05-16 and existed only
  on the git master branch until it was fixed by PR #3071 (commit
  1c914cdf) on 2026-05-24. It was never part of an upstream release.
- The upstream release tarballs (3.6.x/3.7.x/3.8.6) use the older
  init_unpack() with unchecked calloc and no early-return path, so the
  freed window_buf/filtered_buf pointers are never left dangling and the
  double-free cannot occur.

References:
 https://nvd.nist.gov/vuln/detail/cve-2026-14164
 https://lore.kernel.org/openembedded-core/0447ebc9d29b0736de8ba0c75f155ed4f880d072.camel@pbarker.dev/

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 meta/recipes-extended/libarchive/libarchive_3.8.7.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
index e8c3a3bfe3..afc06f85d4 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
@@ -92,3 +92,7 @@ RDEPENDS:${PN}-ptest += "bsdtar bsdcpio"
 CVE_STATUS[CVE-2026-4426] = "fixed-version: fixed since 3.8.7"
 CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7"
 CVE_STATUS[CVE-2026-5745] = "fixed-version: fixed since 3.8.6"
+CVE_STATUS[CVE-2026-14164] = "fixed-version: Double-free regression in the RAR5\
+ reader's init_unpack() was introduced upstream by commit 620bdafa (2026-05-16) and existed\
+ only on the git master branch until the fix in PR #3071 (commit 1c914cdf, 2026-05-24). It was\
+ never part of an upstream release tarball."