Re: [OE-core][master][PATCH] vim: minor update to 9.2.0340 to fix CVEs

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Tue Apr 14, 2026 at 9:54 AM CEST, Adarsh Jagadish Kamini wrote:
> From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
>
> CVEs fixed: CVE-2026-34714 and CVE-2026-33412
> Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
> ---

Hi Adarsh,

Thanks for your patch.

It looks like you will need to drop some vim patches, at least the
CVE-2026-33412.patch one. Right now, vim does not build with your
changes:

ERROR: vim-9.2.0340-r0 do_patch: Applying patch '/srv/pokybuild/yocto-worker/musl-qemux86/build/layers/openembedded-core/meta/recipes-support/vim/files/CVE-2026-33412.patch' on target directory '/srv/pokybuild/yocto-worker/musl-qemux86/build/build/tmp/work/core2-32-poky-linux-musl/vim/9.2.0340/sources/vim-9.2.0340'
CmdError('quilt --quiltrc /srv/pokybuild/yocto-worker/musl-qemux86/build/build/tmp/work/core2-32-poky-linux-musl/vim/9.2.0340/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout: Applying patch CVE-2026-33412.patch
patching file src/os_unix.c
Hunk #1 FAILED at 7106.
1 out of 1 hunk FAILED -- rejects in file src/os_unix.c
Patch CVE-2026-33412.patch can be reverse-applied

stderr: ')

https://autobuilder.yoctoproject.org/valkyrie/#/builders/6/builds/3620

Can you send a new version fixing this?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com