[OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Leonid Iziumtsev]

This series backports upstream fixes to coreutils 9.11 to address
multiple CVEs.

Leonid Iziumtsev (2):
  coreutils: fix CVE-2026-56391
  coreutils: fix CVE-2026-56392

 .../coreutils/coreutils/CVE-2026-56391.patch  | 66 +++++++++++++++++++
 .../coreutils/coreutils/CVE-2026-56392.patch  | 65 ++++++++++++++++++
 meta/recipes-core/coreutils/coreutils_9.11.bb |  2 +
 3 files changed, 133 insertions(+)
 create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
 create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch

[OE-core][PATCH 1/2] coreutils: fix CVE-2026-56391

[Leonid Iziumtsev]

Backport patch to fix CVE-2026-56391.

Reference:
  https://nvd.nist.gov/vuln/detail/CVE-2026-56391

Upstream fix:
  https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371

Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
---
 .../coreutils/coreutils/CVE-2026-56391.patch  | 66 +++++++++++++++++++
 meta/recipes-core/coreutils/coreutils_9.11.bb |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch

diff --git a/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
new file mode 100644
index 0000000000..85745bf572
--- /dev/null
+++ b/meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
@@ -0,0 +1,66 @@
+From dadd37b60ca43b436a2287d28d6497bcc5bf4b9a Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 28 Apr 2026 11:25:00 -0700
+Subject: [PATCH] uniq: fix read overrun with -w
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* src/uniq.c (find_field): Fix typo.
+* tests/uniq/uniq.pl (add_z_variants): Test for the bug.
+
+CVE: CVE-2026-56391
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371]
+
+Backport Changes:
+- The NEWS file has not been updated.
+
+Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
+---
+ THANKS.in          | 1 +
+ src/uniq.c         | 4 ++--
+ tests/uniq/uniq.pl | 3 +++
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/THANKS.in b/THANKS.in
+index 35fee75..5a2fd35 100644
+--- a/THANKS.in
++++ b/THANKS.in
+@@ -459,6 +459,7 @@ Michail Litvak                      mci@owl.openwall.com
+ Michal Politowski                   mpol@charybda.icm.edu.pl
+ Michal Svec                         msvec@suse.cz
+ Michal Trunecka                     mtruneck@redhat.com
++Michał Majchrowicz                  mmajchrowicz@afine.com
+ Michel Robitaille                   robitail@IRO.UMontreal.CA
+ Michiel Bacchiani                   bacchian@raven.bu.edu
+ Mike Castle                         dalgoda@ix.netcom.com
+diff --git a/src/uniq.c b/src/uniq.c
+index 3046359..5834596 100644
+--- a/src/uniq.c
++++ b/src/uniq.c
+@@ -285,8 +285,8 @@ find_field (struct linebuffer const *line, idx_t *plen)
+   else
+     {
+       char *ep = lp;
+-      for (idx_t i = check_chars; 0 < i && lp < lim; i--)
+-        ep += mcel_scan (lp, lim).len;
++      for (idx_t i = check_chars; 0 < i && ep < lim; i--)
++        ep += mcel_scan (ep, lim).len;
+       len = ep - lp;
+     }
+ 
+diff --git a/tests/uniq/uniq.pl b/tests/uniq/uniq.pl
+index b558fb3..0df7ec6 100755
+--- a/tests/uniq/uniq.pl
++++ b/tests/uniq/uniq.pl
+@@ -234,6 +234,9 @@ my @Tests =
+         "  - 'separate'\n" .
+         "  - 'both'\n" .
+         "Try '$prog --help' for more information.\n"}],
++ # Test for read buffer overrun.
++ do { my $longline = "\360\237\230\200" . "A" x 255 . "\n";
++      ['146', '-w256', {IN  => $longline x 2}, {OUT => $longline}] },
+ );
+ 
+ # Locale related tests
diff --git a/meta/recipes-core/coreutils/coreutils_9.11.bb b/meta/recipes-core/coreutils/coreutils_9.11.bb
index ea2d237c3d..3e4f5fc7dc 100644
--- a/meta/recipes-core/coreutils/coreutils_9.11.bb
+++ b/meta/recipes-core/coreutils/coreutils_9.11.bb
@@ -16,6 +16,7 @@ inherit autotools gettext texinfo
 SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \
            file://remove-usr-local-lib-from-m4.patch \
            file://run-ptest \
+           file://CVE-2026-56391.patch \
            "
 SRC_URI[sha256sum] = "394024eda0a5955217ceda9cd1201e65dc8fa3aa29c2951135a49521d57c3cc3"
 

[OE-core][PATCH 2/2] coreutils: fix CVE-2026-56392

[Leonid Iziumtsev]

Backport patch to fix CVE-2026-56392.

Reference:
  https://nvd.nist.gov/vuln/detail/CVE-2026-56392

Upstream fix:
  https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
---
 .../coreutils/coreutils/CVE-2026-56392.patch  | 65 +++++++++++++++++++
 meta/recipes-core/coreutils/coreutils_9.11.bb |  1 +
 2 files changed, 66 insertions(+)
 create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch

diff --git a/meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch b/meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch
new file mode 100644
index 0000000000..8468b4d288
--- /dev/null
+++ b/meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch
@@ -0,0 +1,65 @@
+From aa3f6d91fdddcc45c5bb656168f7d20808991fe0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
+Date: Tue, 28 Apr 2026 20:33:10 +0100
+Subject: [PATCH] unexpand: fix heap overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* src/unexpand.c (unexpand): Use xinmalloc() to gracefully
+handle overflow.  Also use the runtime locale specific MB_CUR_MAX
+rather than the worst case MB_LEN_MAX.
+* tests/unexpand/mb.sh: Add a test case that fails in a default
+glibc build with either MB_CUR_MAX or MB_LEN_MAX.
+* NEWS: Mention the bug fix.
+Reported by Michał Majchrowicz.
+
+CVE: CVE-2026-56392
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d]
+
+Backport Changes:
+- The NEWS file has not been updated.
+
+Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
+---
+ src/unexpand.c       | 2 +-
+ tests/unexpand/mb.sh | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/src/unexpand.c b/src/unexpand.c
+index 4fbf9d3..761c8ea 100644
+--- a/src/unexpand.c
++++ b/src/unexpand.c
+@@ -131,7 +131,7 @@ unexpand (void)
+   /* The worst case is a non-blank character, then one blank, then a
+      tab stop, then MAX_COLUMN_WIDTH - 1 blanks, then a non-blank; so
+      allocate MAX_COLUMN_WIDTH bytes to store the blanks.  */
+-  pending_blank = ximalloc (max_column_width * sizeof (char) * MB_LEN_MAX);
++  pending_blank = xinmalloc (max_column_width, MB_CUR_MAX);
+ 
+   while (true)
+     {
+diff --git a/tests/unexpand/mb.sh b/tests/unexpand/mb.sh
+index 76a2679..076a1c1 100755
+--- a/tests/unexpand/mb.sh
++++ b/tests/unexpand/mb.sh
+@@ -17,6 +17,7 @@
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
+ print_ver_ unexpand printf
++getlimits_
+ 
+ test "$LOCALE_FR_UTF8" != none || skip_ "French UTF-8 locale not available"
+ export LC_ALL="$LOCALE_FR_UTF8"
+@@ -161,4 +162,11 @@ EOF
+ unexpand -a ./in ./in > out || fail=1
+ compare exp out > /dev/null 2>&1 || fail=1
+ 
++# Ensure overflow is handed gracefully
++# coreutils v9.11 induced a buffer overflow with mb_mul=4 (or 16).
++for mb_mul in 4 6; do
++  printf '   \n' | unexpand -t $(expr $SIZE_MAX / $mb_mul + 1) 2>err; ret=$?
++  test "$ret" = 1 || test "$ret" = 0 || { cat err; fail=1; }
++done
++
+ Exit $fail
diff --git a/meta/recipes-core/coreutils/coreutils_9.11.bb b/meta/recipes-core/coreutils/coreutils_9.11.bb
index 3e4f5fc7dc..63f7810e88 100644
--- a/meta/recipes-core/coreutils/coreutils_9.11.bb
+++ b/meta/recipes-core/coreutils/coreutils_9.11.bb
@@ -17,6 +17,7 @@ SRC_URI = "${GNU_MIRROR}/coreutils/${BP}.tar.xz \
            file://remove-usr-local-lib-from-m4.patch \
            file://run-ptest \
            file://CVE-2026-56391.patch \
+           file://CVE-2026-56392.patch \
            "
 SRC_URI[sha256sum] = "394024eda0a5955217ceda9cd1201e65dc8fa3aa29c2951135a49521d57c3cc3"
 

[OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Collin Funk]

Leonid Iziumtsev said:

> This series backports upstream fixes to coreutils 9.11 to address
> multiple CVEs.
> 
> Leonid Iziumtsev (2):
>   coreutils: fix CVE-2026-56391
>   coreutils: fix CVE-2026-56392
> 
>  .../coreutils/coreutils/CVE-2026-56391.patch  | 66 +++++++++++++++++++
>  .../coreutils/coreutils/CVE-2026-56392.patch  | 65 ++++++++++++++++++
>  meta/recipes-core/coreutils/coreutils_9.11.bb |  2 +
>  3 files changed, 133 insertions(+)
>  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
>  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch

Note that CVEs don't really have a security impact. I'm mildly annoyed
there were assigned. It seems that Afine's entire existence as a company
is sending LLM generated essays to maintainers, bogus a large portion of
the time. For the others, which have dubious security implications, they
file CVEs with exaggerations [1].

Theoretically CVE-2026-56392 could allow problematic writes to the heap,
but that would require you to run it with untrusted slop as the input
and as arguments. If someone can do that on your system, they have much
better things to do.

Collin

[1] https://seclists.org/oss-sec/2026/q3/276

Re: [OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Richard Purdie]

On Fri, 2026-07-31 at 17:11 -0700, Collin Funk via lists.openembedded.org wrote:
> Leonid Iziumtsev said:
> 
> > This series backports upstream fixes to coreutils 9.11 to address
> > multiple CVEs.
> > 
> > Leonid Iziumtsev (2):
> >   coreutils: fix CVE-2026-56391
> >   coreutils: fix CVE-2026-56392
> > 
> >  .../coreutils/coreutils/CVE-2026-56391.patch  | 66 +++++++++++++++++++
> >  .../coreutils/coreutils/CVE-2026-56392.patch  | 65 ++++++++++++++++++
> >  meta/recipes-core/coreutils/coreutils_9.11.bb |  2 +
> >  3 files changed, 133 insertions(+)
> >  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
> >  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch
> 
> Note that CVEs don't really have a security impact. I'm mildly annoyed
> there were assigned. It seems that Afine's entire existence as a company
> is sending LLM generated essays to maintainers, bogus a large portion of
> the time. For the others, which have dubious security implications, they
> file CVEs with exaggerations [1].
> 
> Theoretically CVE-2026-56392 could allow problematic writes to the heap,
> but that would require you to run it with untrusted slop as the input
> and as arguments. If someone can do that on your system, they have much
> better things to do.

Sadly, I suspect this is becoming all the more common and I share your
frustrations.

We have an difficult position on whether to take things or not as we
probably don't have the time/experience to tell in many cases and not
taking a CVE fix means we'd get beaten over the head with the patch for
ever more as "there is a security problem" :(.

Cheers,

Richard

Re: [OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Collin Funk]

Richard Purdie <richard.purdie@linuxfoundation.org> writes:

> Sadly, I suspect this is becoming all the more common and I share your
> frustrations.
>
> We have an difficult position on whether to take things or not as we
> probably don't have the time/experience to tell in many cases and not
> taking a CVE fix means we'd get beaten over the head with the patch for
> ever more as "there is a security problem" :(.

Perfectly understandable.

By the way, I suggest applying this patch as well [1]. In the 9.11
release, short writes could cause issues with 'tee'. It was a silly
mistake on my part, and cause SUSE some issues.

The patch applies with NEWS removed. E.g., like this:

   $ sed '1,49d' 0d6fcb99d691d920961938e61c43478566ef626e.patch > fix.patch
   $ patch -p1 < fix.patch

Collin

[1] https://github.com/coreutils/coreutils/commit/0d6fcb99d691d920961938e61c43478566ef626e.patch

Re: [OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Richard Purdie]

On Sat, 2026-08-01 at 00:02 -0700, Collin Funk wrote:
> Richard Purdie <richard.purdie@linuxfoundation.org> writes:
> 
> > Sadly, I suspect this is becoming all the more common and I share your
> > frustrations.
> > 
> > We have an difficult position on whether to take things or not as we
> > probably don't have the time/experience to tell in many cases and not
> > taking a CVE fix means we'd get beaten over the head with the patch for
> > ever more as "there is a security problem" :(.
> 
> Perfectly understandable.
> 
> By the way, I suggest applying this patch as well [1]. In the 9.11
> release, short writes could cause issues with 'tee'. It was a silly
> mistake on my part, and cause SUSE some issues.
> 
> The patch applies with NEWS removed. E.g., like this:
> 
>    $ sed '1,49d' 0d6fcb99d691d920961938e61c43478566ef626e.patch > fix.patch
>    $ patch -p1 < fix.patch

Thanks for the pointer!

I've put that in the queue to add.

Cheers,

Richard