Re: [OE-core][scarthgap][PATCH 1/6] rsync: Fix CVE-2026-29518

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Jul 28, 2026 at 3:50 PM CEST, Ashishkumar Parmar -X (asparmar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> Thanks for reporting this.
>
> I checked the Debian 11 build failure. The Scarthgap rsync changes currently include <linux/openat2.h> and use SYS_openat2 unconditionally. The Debian 11 build headers do not define SYS_openat2, so the compilation fails.
>
> My local validation passed because the available build headers define SYS_openat2, so it did not cover this older-host case.
>
> I also checked whether upgrading to the upstream v3.2.7-sec-patches1 tag would resolve the problem. It would not: that tag has the same unconditional SYS_openat2 use and does not contain the required configure-time portability check.
>
> The current upstream v3.2.7-sec-patches branch includes the follow-up commit:
>  https://github.com/RsyncProject/rsync/commit/729ec83612d43e361ada1870173b525bc0b9ebac
>
> This checks for both <linux/openat2.h> and SYS_openat2 during configure, defines HAVE_OPENAT2 only when both are available, and retains the existing fallback on older systems.

Sounds good.

>
> Once you confirm,
> I will add this follow-up to the Scarthgap series and rerun both rsync-native and rsync build validation before sending a v2.

Please also test debian11 (I used a quick container to reproduce)

Thanks!
-- 
Yoann Congal
Smile ECS