[OE-core][scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[OE-core][scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Siddharth]

From: Siddharth Doshi <sdoshi@mvista.com>

Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-86137
[2] https://security-tracker.debian.org/tracker/CVE-2026-86137

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 .../libxml/libxml2/CVE-2026-86137.patch       | 48 +++++++++++++++++++
 meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
 2 files changed, 49 insertions(+)
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch
new file mode 100644
index 0000000000..e8ccd93142
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch
@@ -0,0 +1,48 @@
+From 76fe08d97de88bfaef2f7d5cd27f11954cc5bee2 Mon Sep 17 00:00:00 2001
+From: Hieu Le Minh <leminhhieu.opensource@gmail.com>
+Date: Sat, 18 Apr 2026 21:18:24 +0700
+Subject: [PATCH] xmlregexp: Prevent out-of-bounds read in NXT macro
+
+Fixes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1099
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2]
+CVE: CVE-2026-86137
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ xmlregexp.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/xmlregexp.c b/xmlregexp.c
+index f434a0c..5e15311 100644
+--- a/xmlregexp.c
++++ b/xmlregexp.c
+@@ -56,7 +56,9 @@
+     xmlRegexpErrCompile(ctxt, str);
+ #define NEXT ctxt->cur++
+ #define CUR (*(ctxt->cur))
+-#define NXT(index) (ctxt->cur[index])
++#define NXT(index)									\
++    (((size_t)(ctxt->cur + index - ctxt->string) < ctxt->len)				\
++      ? ctxt->cur[index] : 0)
+ 
+ #define NEXTL(l) ctxt->cur += l;
+ #define XML_REG_STRING_SEPARATOR '|'
+@@ -245,6 +247,7 @@ typedef xmlRegParserCtxt *xmlRegParserCtxtPtr;
+ struct _xmlAutomata {
+     xmlChar *string;
+     xmlChar *cur;
++    size_t len;
+ 
+     int error;
+     int neg;
+@@ -700,6 +703,7 @@ xmlRegNewParserCtxt(const xmlChar *string) {
+     memset(ret, 0, sizeof(xmlRegParserCtxt));
+     if (string != NULL)
+ 	ret->string = xmlStrdup(string);
++	ret->len = strlen((const char *) ret->string);
+     ret->cur = ret->string;
+     ret->neg = 0;
+     ret->negs = 0;
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index d476ba14b6..e4db345af4 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -32,6 +32,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://CVE-2026-0992-03.patch \
            file://CVE-2026-1757.patch \
            file://CVE-2026-11979.patch \
+           file://CVE-2026-86137.patch \
            "
 
 SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
-- 
2.34.1

[OE-core][scarthgap][PATCH 2/6] libxml2: Security Fix for CVE-2026-86138

[Siddharth]

From: Siddharth Doshi <sdoshi@mvista.com>

Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-86138
[2] https://security-tracker.debian.org/tracker/CVE-2026-86138

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 .../libxml/libxml2/CVE-2026-86138.patch       | 53 +++++++++++++++++++
 meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch
new file mode 100644
index 0000000000..14ddff8215
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86138.patch
@@ -0,0 +1,53 @@
+From 6261b1ca983717c71a9c0409ff045ee9c81ff3b6 Mon Sep 17 00:00:00 2001
+From: mohammadmseet-hue <mohammadmseet@gmail.com>
+Date: Thu, 16 Apr 2026 02:54:24 +0200
+Subject: [PATCH 2/6] fix: add overflow checks to xmlDictAddQString in dict.c
+
+xmlDictAddString has overflow guards for pool size calculations, but its
+sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1
+addition can overflow unsigned int, and 4 * (overflowed_value) produces
+a small allocation, leading to heap buffer overflow when memcpy writes
+the prefix and name.
+
+Add the same SIZE_MAX-based overflow guards and safe size_t cast.
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4]
+CVE: CVE-2026-86138
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ dict.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/dict.c b/dict.c
+index d7156ed..ae0210e 100644
+--- a/dict.c
++++ b/dict.c
+@@ -225,10 +225,21 @@ xmlDictAddQString(xmlDictPtr dict, const xmlChar *prefix, unsigned int plen,
+             return(NULL);
+         }
+ 
+-        if (size == 0) size = 1000;
+-	else size *= 4; /* exponential growth */
+-        if (size < 4 * (namelen + plen + 1))
+-	    size = 4 * (namelen + plen + 1); /* just in case ! */
++        if (size == 0) {
++            size = 1000;
++        } else {
++            if (size < (SIZE_MAX - sizeof(xmlDictStrings)) / 4)
++                size *= 4; /* exponential growth */
++            else
++                size = SIZE_MAX - sizeof(xmlDictStrings);
++        }
++        if (size / 4 < namelen + plen + 1) {
++            if ((size_t) namelen + plen + 1 <
++                    (SIZE_MAX - sizeof(xmlDictStrings)) / 4)
++                size = 4 * ((size_t) namelen + plen + 1); /* just in case ! */
++            else
++                return(NULL);
++        }
+ 	pool = (xmlDictStringsPtr) xmlMalloc(sizeof(xmlDictStrings) + size);
+ 	if (pool == NULL)
+ 	    return(NULL);
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index e4db345af4..28ae601118 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -33,6 +33,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://CVE-2026-1757.patch \
            file://CVE-2026-11979.patch \
            file://CVE-2026-86137.patch \
+           file://CVE-2026-86138.patch \
            "
 
 SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
-- 
2.34.1

[OE-core][scarthgap][PATCH 3/6] libxml2: set CVE_STATUS for CVE-2026-86139

[Siddharth]

From: Siddharth Doshi <sdoshi@mvista.com>

Analysis:
- The patch adds return NULL guard when xmlStrlen returns 0. [1]
- However, in libxml2-2.10.12, an older iteration of the guard clause is present, which was removed in future versions and then added back as patch via CVE-2026-86139.
- Hence, adding the patch as fixed-version.

Reference:
[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-86139

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 meta/recipes-core/libxml/libxml2_2.12.10.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 28ae601118..581f38197f 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -46,6 +46,9 @@ CVE_STATUS[CVE-2023-45322] = "disputed: issue requires memory allocation to fail
 # https://gitlab.gnome.org/GNOME/libxml2/-/issues/958
 CVE_STATUS[CVE-2025-8732] = "disputed: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided.  https://gitlab.gnome.org/GNOME/libxml2/-/issues/958"
 
+#The codebase contains an older iteration of the guard clause if (!(len > 0)) return(NULL); which inherently mitigates the len == 0 attack vector described in CVE-2026-86139.
+CVE_STATUS[CVE-2026-86139] = "fixed-version: Length guard safety logic natively present in version 2.12.10 protects against zero-length integer overflows."
+
 BINCONFIG = "${bindir}/xml2-config"
 
 PACKAGECONFIG ??= "python \
-- 
2.34.1

[OE-core][scarthgap][PATCH 4/6] libxml2: Security Fix for CVE-2026-86140

[Siddharth]

From: Siddharth Doshi <sdoshi@mvista.com>

Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-86140
[2] https://security-tracker.debian.org/tracker/CVE-2026-86140

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 .../libxml/libxml2/CVE-2026-86140.patch       | 57 +++++++++++++++++++
 meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
 2 files changed, 58 insertions(+)
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch
new file mode 100644
index 0000000000..c7b6ace560
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86140.patch
@@ -0,0 +1,57 @@
+From 9a21b9dbb096f9e612f37ba72df6a2fb6a60c60c Mon Sep 17 00:00:00 2001
+From: mohammadmseet-hue <mohammadmseet@gmail.com>
+Date: Thu, 16 Apr 2026 02:54:37 +0200
+Subject: [PATCH 3/6] fix: add bounds checks to xmlSnprintfElements in valid.c
+
+CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat()
+writes, but the sibling function xmlSnprintfElements has the identical
+unfixed pattern. The strcat(buf, "(") before the while loop and
+strcat(buf, ")") after the loop exit have no bounds checks.
+
+Add remaining-space checks before both strcat calls, with early return
+and ellipsis when space is insufficient.
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/d1686f91dbda141a752200419d35639fd6b38340]
+CVE: CVE-2026-86140
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ valid.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/valid.c b/valid.c
+index ae4bb82..718e6d8 100644
+--- a/valid.c
++++ b/valid.c
+@@ -5047,7 +5047,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
+     int len;
+ 
+     if (node == NULL) return;
+-    if (glob) strcat(buf, "(");
++    len = strlen(buf);
++    if (glob) {
++        if (size - len < 50) {
++            if ((size - len > 4) && (buf[len - 1] != '.'))
++                strcat(buf, " ...");
++            return;
++        }
++        strcat(buf, "(");
++    }
+     cur = node;
+     while (cur != NULL) {
+ 	len = strlen(buf);
+@@ -5111,7 +5119,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
+ 	}
+ 	cur = cur->next;
+     }
+-    if (glob) strcat(buf, ")");
++    if (glob) {
++        len = strlen(buf);
++        if (size - len > 1)
++            strcat(buf, ")");
++    }
+ }
+ 
+ /**
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 581f38197f..b3f6a482d2 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -34,6 +34,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://CVE-2026-11979.patch \
            file://CVE-2026-86137.patch \
            file://CVE-2026-86138.patch \
+           file://CVE-2026-86140.patch \
            "
 
 SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
-- 
2.34.1

[OE-core][scarthgap][PATCH 5/6] libxml2: Security Fix for CVE-2026-86141

[Siddharth]

From: Siddharth Doshi <sdoshi@mvista.com>

Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-86141
[2] https://security-tracker.debian.org/tracker/CVE-2026-86141

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 .../libxml/libxml2/CVE-2026-86141.patch       | 36 +++++++++++++++++++
 meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch
new file mode 100644
index 0000000000..cea31d8d14
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86141.patch
@@ -0,0 +1,36 @@
+From e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Mon, 4 May 2026 07:56:18 +0200
+Subject: [PATCH] xmlregexp: Calc string length after null checking
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55]
+CVE: CVE-2026-86141
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ xmlregexp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/xmlregexp.c b/xmlregexp.c
+index 5e15311..1c1b25e 100644
+--- a/xmlregexp.c
++++ b/xmlregexp.c
+@@ -702,8 +702,12 @@ xmlRegNewParserCtxt(const xmlChar *string) {
+ 	return(NULL);
+     memset(ret, 0, sizeof(xmlRegParserCtxt));
+     if (string != NULL)
+-	ret->string = xmlStrdup(string);
+-	ret->len = strlen((const char *) ret->string);
++         ret->string = xmlStrdup(string);
++         if (ret->string == NULL) {
++             xmlFree(ret);
++             return(NULL);
++         }
++        ret->len = strlen((const char *) ret->string);
+     ret->cur = ret->string;
+     ret->neg = 0;
+     ret->negs = 0;
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index b3f6a482d2..2869aa46ac 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -35,6 +35,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://CVE-2026-86137.patch \
            file://CVE-2026-86138.patch \
            file://CVE-2026-86140.patch \
+           file://CVE-2026-86141.patch \
            "
 
 SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
-- 
2.34.1

[OE-core][scarthgap][PATCH 6/6] libxml2: Security Fix for CVE-2026-86143

[Siddharth]

From: Siddharth Doshi <sdoshi@mvista.com>

Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-86143
[2] https://security-tracker.debian.org/tracker/CVE-2026-86143

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
---
 .../libxml/libxml2/CVE-2026-86143.patch       | 61 +++++++++++++++++++
 meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
 2 files changed, 62 insertions(+)
 create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch

diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch
new file mode 100644
index 0000000000..e3f1197e2d
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-86143.patch
@@ -0,0 +1,61 @@
+From 90f293ba74d28b1d570920382e707586f68ebf35 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Mon, 4 May 2026 09:54:34 +0200
+Subject: [PATCH] xmlIO: Check for int overflow before calling writecallback
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/90f293ba74d28b1d570920382e707586f68ebf35]
+CVE: CVE-2026-86143
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ xmlIO.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/xmlIO.c b/xmlIO.c
+index 95d2715..a117228 100644
+--- a/xmlIO.c
++++ b/xmlIO.c
+@@ -3378,6 +3378,11 @@ xmlOutputBufferWrite(xmlOutputBufferPtr out, int len, const char *buf) {
+             if ((nbchars < MINLEN) && (len <= 0))
+                 goto done;
+ 
++            if (nbchars >= INT_MAX) {
++                out->error = XML_ERR_INTERNAL_ERROR;
++                return(-1);
++            }
++
+ 	    /*
+ 	     * second write the stuff to the I/O channel
+ 	     */
+@@ -3667,15 +3672,25 @@ xmlOutputBufferFlush(xmlOutputBufferPtr out) {
+      */
+     if ((out->conv != NULL) && (out->encoder != NULL) &&
+ 	(out->writecallback != NULL)) {
++        size_t bufsize = xmlBufUse(out->conv);
++        if (bufsize >= INT_MAX) {
++            out->error = XML_ERR_INTERNAL_ERROR;
++            return(-1);
++        }
+ 	ret = out->writecallback(out->context,
+                                  (const char *)xmlBufContent(out->conv),
+-                                 xmlBufUse(out->conv));
++                                 bufsize);
+ 	if (ret >= 0)
+ 	    xmlBufShrink(out->conv, ret);
+     } else if (out->writecallback != NULL) {
++        size_t bufsize = xmlBufUse(out->buffer);
++        if (bufsize >= INT_MAX) {
++            out->error = XML_ERR_INTERNAL_ERROR;
++            return(-1);
++        }
+ 	ret = out->writecallback(out->context,
+                                  (const char *)xmlBufContent(out->buffer),
+-                                 xmlBufUse(out->buffer));
++                                 bufsize);
+ 	if (ret >= 0)
+ 	    xmlBufShrink(out->buffer, ret);
+     }
+-- 
+2.34.1
+
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 2869aa46ac..a15de5d353 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -36,6 +36,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
            file://CVE-2026-86138.patch \
            file://CVE-2026-86140.patch \
            file://CVE-2026-86141.patch \
+           file://CVE-2026-86143.patch \
            "
 
 SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
-- 
2.34.1

Re: [OE-core][scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Yoann Congal]

On Thu Sep 10, 2026 at 10:03 PM CEST, Siddharth Doshi via lists.openembedded.org wrote:
> From: Siddharth Doshi <sdoshi@mvista.com>
>
> Picking patch as per [1], and same patch is mentioned in [2]
>
> References:
> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-86137
> [2] https://security-tracker.debian.org/tracker/CVE-2026-86137
>
> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
> ---
>  .../libxml/libxml2/CVE-2026-86137.patch       | 48 +++++++++++++++++++
>  meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
>  2 files changed, 49 insertions(+)
>  create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch

Hello,

As far as I know, this CVE also affect wrynose. Can you send a patch
there so I can accept this here?

Thanks!
-- 
Yoann Congal
Smile ECS

Re: [scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Siddharth Doshi]

[-- Attachment #1: Type: text/plain, Size: 518 bytes --]

Hello Yoann,

Richard sent a patch to master for libxml2--> libxml2: upgrade 2.15.3 -> 2.15.4 which fixes these CVE's
(ref: https://lists.openembedded.org/g/openembedded-core/message/245203 )

The same patch sent by Richard is applicable to wrynose too and considering that i didn't send a patch to version upgrade libxml2 for wrynose.
However, if you still feel i should send the same thing for wrynose, i would do it.

Could you let me know i should proceed for it according to you ?

Regards,
Siddharth

[-- Attachment #2: Type: text/html, Size: 689 bytes --]

Re: [OE-core] [scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Yoann Congal]

[-- Attachment #1: Type: text/plain, Size: 942 bytes --]

Le ven. 11 sept. 2026, 15:24, Siddharth Doshi via lists.openembedded.org
<sdoshi=mvista.com@lists.openembedded.org> a écrit :

> Hello Yoann,
>
> Richard sent a patch to master for libxml2--> libxml2: upgrade 2.15.3 ->
> 2.15.4 which fixes these CVE's
> (ref: https://lists.openembedded.org/g/openembedded-core/message/245203)
>
> The same patch sent by Richard is applicable to wrynose too and
> considering that i didn't send a patch to version upgrade libxml2 for
> wrynose.
> However, if you still feel i should send the same thing for wrynose, i
> would do it.
>
> Could you let me know i should proceed for it according to you ?
>


In general, I'd like a backport, please (it's way easier to track & manage)

In this particular case, have you checked that the upgrade is ok for stable
inclusion? I also seem to remember a recent libxml2 upgrade breaking
systemd. Is it this one?

Regards,
-- 
Yoann Congal

[-- Attachment #2: Type: text/html, Size: 1681 bytes --]

Re: [scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Siddharth Doshi]

[-- Attachment #1: Type: text/plain, Size: 768 bytes --]

Hello Yoann,

I have sent the backported patch for wrynose -> https://lists.openembedded.org/g/openembedded-core/message/245665

> 
> In this particular case, have you checked that the upgrade is ok for
> stable inclusion? I also seem to remember a recent libxml2 upgrade
> breaking systemd. Is it this one?
> 

- To make sure this patch doesn't break systemd, I ran a clean build -> bitbake -c cleanall libxml2 libxml2-native glib-2.0 glib-2.0-native shared-mime-info-native python3-lxml-native systemd && bitbake systemd.
- Everything compiles successfully without errors
- However, if it still throws error on autobuilder due to environment difference, i would revert the upgrade and backport all the patches for libxml2-2.15.3.

Regards,
Siddharth

[-- Attachment #2: Type: text/html, Size: 2260 bytes --]

Re: [OE-core][scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Yoann Congal]

On Thu Sep 10, 2026 at 10:03 PM CEST, Siddharth Doshi via lists.openembedded.org wrote:
> From: Siddharth Doshi <sdoshi@mvista.com>
>
> Picking patch as per [1], and same patch is mentioned in [2]
>
> References:
> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-86137
> [2] https://security-tracker.debian.org/tracker/CVE-2026-86137
>
> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
> ---
>  .../libxml/libxml2/CVE-2026-86137.patch       | 48 +++++++++++++++++++
>  meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
>  2 files changed, 49 insertions(+)
>  create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch

Hello,

It looks like something in this series is breaking ptests:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4604
https://valkyrie.yocto.io/pub/non-release/20260921-71/testresults/qemux86-64-ptest/core-image-ptest-libxml2/log.do_testimage.364096.20260921110838
|  1314	Running runtest
|  1315	Validation for ./test/VCM/21.xml failed
|  1316	Validation for ./test/VCM/AttributeNmtokens.xml failed
|  1317	Validation for ./test/VCM/v10.xml failed
|  1318	Validation for ./test/VCM/v11.xml failed
|  1319	Validation for ./test/VCM/v12.xml failed
|  1320	Validation for ./test/VCM/v13.xml failed
|  1321	Validation for ./test/VCM/v14.xml failed
|  1322	Validation for ./test/VCM/v15.xml failed
|  1323	Validation for ./test/VCM/v16.xml failed
|  1324	Validation for ./test/VCM/v17.xml failed
|  1325	Validation for ./test/VCM/v18.xml failed
|  1326	Validation for ./test/VCM/v19.xml failed
|  1327	Validation for ./test/VCM/v20.xml failed
|  1328	Validation for ./test/VCM/v21.xml failed
|  1329	Validation for ./test/VCM/v22.xml failed
|  1330	Validation for ./test/VCM/v23.xml failed
|  1331	Validation for ./test/VCM/v24.xml failed
|  1332	Validation for ./test/VCM/v4.xml failed
|  1333	Validation for ./test/VCM/v5.xml failed
|  1334	Validation for ./test/VCM/v6.xml failed
|  1335	Validation for ./test/VCM/v7.xml failed
|  1336	Validation for ./test/VCM/v8.xml failed
|  1337	Validation for ./test/VCM/v9.xml failed
|  1338	file result/VC/ElementValid2 is 111 bytes, result is 227 bytes
|  1339	Error for ./test/VC/ElementValid2 failed

Can you look into it?

Thanks!
-- 
Yoann Congal
Smile ECS

Re: [OE-core][scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Yoann Congal]

On Mon Sep 21, 2026 at 2:38 PM CEST, Yoann Congal wrote:
> On Thu Sep 10, 2026 at 10:03 PM CEST, Siddharth Doshi via lists.openembedded.org wrote:
>> From: Siddharth Doshi <sdoshi@mvista.com>
>>
>> Picking patch as per [1], and same patch is mentioned in [2]
>>
>> References:
>> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-86137
>> [2] https://security-tracker.debian.org/tracker/CVE-2026-86137
>>
>> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
>> ---
>>  .../libxml/libxml2/CVE-2026-86137.patch       | 48 +++++++++++++++++++
>>  meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
>>  2 files changed, 49 insertions(+)
>>  create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch
>
> Hello,
>
> It looks like something in this series is breaking ptests:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4604
> https://valkyrie.yocto.io/pub/non-release/20260921-71/testresults/qemux86-64-ptest/core-image-ptest-libxml2/log.do_testimage.364096.20260921110838
> |  1314	Running runtest
> |  1315	Validation for ./test/VCM/21.xml failed
> |  1316	Validation for ./test/VCM/AttributeNmtokens.xml failed
> |  1317	Validation for ./test/VCM/v10.xml failed
> |  1318	Validation for ./test/VCM/v11.xml failed
> |  1319	Validation for ./test/VCM/v12.xml failed
> |  1320	Validation for ./test/VCM/v13.xml failed
> |  1321	Validation for ./test/VCM/v14.xml failed
> |  1322	Validation for ./test/VCM/v15.xml failed
> |  1323	Validation for ./test/VCM/v16.xml failed
> |  1324	Validation for ./test/VCM/v17.xml failed
> |  1325	Validation for ./test/VCM/v18.xml failed
> |  1326	Validation for ./test/VCM/v19.xml failed
> |  1327	Validation for ./test/VCM/v20.xml failed
> |  1328	Validation for ./test/VCM/v21.xml failed
> |  1329	Validation for ./test/VCM/v22.xml failed
> |  1330	Validation for ./test/VCM/v23.xml failed
> |  1331	Validation for ./test/VCM/v24.xml failed
> |  1332	Validation for ./test/VCM/v4.xml failed
> |  1333	Validation for ./test/VCM/v5.xml failed
> |  1334	Validation for ./test/VCM/v6.xml failed
> |  1335	Validation for ./test/VCM/v7.xml failed
> |  1336	Validation for ./test/VCM/v8.xml failed
> |  1337	Validation for ./test/VCM/v9.xml failed
> |  1338	file result/VC/ElementValid2 is 111 bytes, result is 227 bytes
> |  1339	Error for ./test/VC/ElementValid2 failed
>
> Can you look into it?
>
> Thanks!

This also fails on arm64:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4577

Regards,
-- 
Yoann Congal
Smile ECS

Re: [OE-core][scarthgap][PATCH 5/6] libxml2: Security Fix for CVE-2026-86141

[Triet Hoang]

On Fri, 11 Sep 2026 01:33:28 +0530 Siddharth Doshi wrote:

> +---
> + xmlregexp.c | 8 ++++++--
> + 1 file changed, 6 insertions(+), 2 deletions(-)
> +
> +diff --git a/xmlregexp.c b/xmlregexp.c
> +index 5e15311..1c1b25e 100644
> +--- a/xmlregexp.c
> ++++ b/xmlregexp.c
> +@@ -702,8 +702,12 @@ xmlRegNewParserCtxt(const xmlChar *string) {
> + 	return(NULL);
> +     memset(ret, 0, sizeof(xmlRegParserCtxt));
> +     if (string != NULL)
> +-	ret->string = xmlStrdup(string);
> +-	ret->len = strlen((const char *) ret->string);
> ++         ret->string = xmlStrdup(string);
> ++         if (ret->string == NULL) {
> ++             xmlFree(ret);
> ++             return(NULL);
> ++         }
> ++        ret->len = strlen((const char *) ret->string);
> +     ret->cur = ret->string;
> +     ret->neg = 0;
> +     ret->negs = 0;
> +-- 

The hunk keeps the brace-less if (string != NULL), so only ret->string = xmlStrdup(string);
is conditional. The NULL check below it always runs, and xmlRegNewParserCtxt() returns NULL
for every caller that passes string == NULL.

I think we need to backport [1] first before applying this patch.

[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a354d5b3072feaf64b5f6ea4b35e1bef35b7f65

BR,
Triet Hoang

Re: [OE-core][scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

[Yoann Congal]

On Mon Sep 21, 2026 at 5:00 PM CEST, Yoann Congal wrote:
> On Mon Sep 21, 2026 at 2:38 PM CEST, Yoann Congal wrote:
>> On Thu Sep 10, 2026 at 10:03 PM CEST, Siddharth Doshi via lists.openembedded.org wrote:
>>> From: Siddharth Doshi <sdoshi@mvista.com>
>>>
>>> Picking patch as per [1], and same patch is mentioned in [2]
>>>
>>> References:
>>> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-86137
>>> [2] https://security-tracker.debian.org/tracker/CVE-2026-86137
>>>
>>> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
>>> ---
>>>  .../libxml/libxml2/CVE-2026-86137.patch       | 48 +++++++++++++++++++
>>>  meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
>>>  2 files changed, 49 insertions(+)
>>>  create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch
>>
>> Hello,
>>
>> It looks like something in this series is breaking ptests:
>> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4604
>> https://valkyrie.yocto.io/pub/non-release/20260921-71/testresults/qemux86-64-ptest/core-image-ptest-libxml2/log.do_testimage.364096.20260921110838
>> |  1314	Running runtest
>> |  1315	Validation for ./test/VCM/21.xml failed
>> |  1316	Validation for ./test/VCM/AttributeNmtokens.xml failed
>> |  1317	Validation for ./test/VCM/v10.xml failed
>> |  1318	Validation for ./test/VCM/v11.xml failed
>> |  1319	Validation for ./test/VCM/v12.xml failed
>> |  1320	Validation for ./test/VCM/v13.xml failed
>> |  1321	Validation for ./test/VCM/v14.xml failed
>> |  1322	Validation for ./test/VCM/v15.xml failed
>> |  1323	Validation for ./test/VCM/v16.xml failed
>> |  1324	Validation for ./test/VCM/v17.xml failed
>> |  1325	Validation for ./test/VCM/v18.xml failed
>> |  1326	Validation for ./test/VCM/v19.xml failed
>> |  1327	Validation for ./test/VCM/v20.xml failed
>> |  1328	Validation for ./test/VCM/v21.xml failed
>> |  1329	Validation for ./test/VCM/v22.xml failed
>> |  1330	Validation for ./test/VCM/v23.xml failed
>> |  1331	Validation for ./test/VCM/v24.xml failed
>> |  1332	Validation for ./test/VCM/v4.xml failed
>> |  1333	Validation for ./test/VCM/v5.xml failed
>> |  1334	Validation for ./test/VCM/v6.xml failed
>> |  1335	Validation for ./test/VCM/v7.xml failed
>> |  1336	Validation for ./test/VCM/v8.xml failed
>> |  1337	Validation for ./test/VCM/v9.xml failed
>> |  1338	file result/VC/ElementValid2 is 111 bytes, result is 227 bytes
>> |  1339	Error for ./test/VC/ElementValid2 failed
>>
>> Can you look into it?
>>
>> Thanks!
>
> This also fails on arm64:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4577
>
> Regards,

Hello,

FYI, A similar series was sent that did not break ptests in my testing:
https://lore.kernel.org/all/20260929041836.2217090-1-hthakar@cisco.com/
So, I'll continue with Hetvi's for now.

Regards,
-- 
Yoann Congal
Smile ECS