Re: [OE-core] [scarthgap][PATCH 1/3] cpio: patch CVE-2026-66485

["Yoann Congal" <yoann.congal@smile.fr>]

On Sat Aug 15, 2026 at 9:08 PM CEST, Peter Marko via lists.openembedded.org wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> Pick patch mentioned in NVD CVE description.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> (From OE-Core rev: c105fbf82e2f50b05dc680e0601bf0ea3198e58c)
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  meta/recipes-extended/cpio/cpio_2.15.bb       |   1 +
>  .../cpio/files/CVE-2026-66485.patch           | 210 ++++++++++++++++++
>  2 files changed, 211 insertions(+)
>  create mode 100644 meta/recipes-extended/cpio/files/CVE-2026-66485.patch

Hello,

It looks like this series triggers ptests issues:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4362
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4378

https://valkyrie.yocto.io/pub/non-release/20260824-88/testresults/qemux86-64-ptest/core-image-ptest-cpio/log.do_testimage.311338.20260824214940
| FAIL: CVE-2019-14866 (tar header size overflow)

Can you look into this?

Thanks!
-- 
Yoann Congal
Smile ECS