Re: [OE-core] [scarthgap][PATCH] binutils: Add CVE-2025-69646 to "CVE:" tag

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Jul 20, 2026 at 8:03 AM CEST, Harish via lists.openembedded.org Sadineni wrote:
> On 19-07-2026 02:36 pm, Yoann Congal wrote:
>
>> CAUTION: This email comes from a non Wind River email account!
>> Do not click links or open attachments unless you recognize the sender and know the content is safe.
>>
>> On Tue Jul 14, 2026 at 2:53 PM CEST, Paul Barker via lists.openembedded.org wrote:
>>> On Mon, 2026-07-06 at 02:06 -0700, Harish.Sadineni@windriver.com wrote:
>>>> From: Harish Sadineni <Harish.Sadineni@windriver.com>
>>>>
>>>> CVE-2025-69648 was marked as a duplicate of CVE-2025-69646. The
>>>> existing patch already fixes the issue associated with both CVEs.
>>> Hi Harish,
>>>
>>> Where was this marked as a duplicate? We need a link to some evidence of
>>> this, or at least a more thorough explanation.
>> Hello,
>>
>> FYI, when reviewing this I took the fact that both NVD entries[0][1] point to the
>> same patch[2] as proof of duplication (albeit weak).
>>
>> [0]: https://nvd.nist.gov/vuln/detail/CVE-2025-69648
>> [1]: https://nvd.nist.gov/vuln/detail/CVE-2025-69646
>> [2]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=598704a00cbac5e85c2bedd363357b5bf6fcee33
> Hi Paul, Yoann,
>
> Here's more concrete evidence of the duplication:
>
> Bugzilla bug 33641 (assigned CVE-2025-69648) has been resolved as a 
> duplicate of bug 33638 (assigned CVE-2025-69646):
>
> https://sourceware.org/bugzilla/show_bug.cgi?id=33641
>
> Do you want me to send a v2 with this info added to the commit message, 
> or is this sufficient as-is?

Hello,

A v2 with the added info please :)

Thanks!

>
> Thanks,
> Harish
>>
>> Regards,
>> --
>> Yoann Congal
>> Smile ECS
>>


-- 
Yoann Congal
Smile ECS