[wrynose][PATCH] libarchive: mark CVE-2026-14164 as not-applicable-platform

[wrynose][PATCH] libarchive: mark CVE-2026-14164 as not-applicable-platform

[daniel.turull]

From: Daniel Turull <daniel.turull@ericsson.com>

- The RAR5 double-free in init_unpack() is a regression introduced
  upstream by commit 620bdafa on 2026-05-16 and existed only
  on the git master branch until it was fixed by PR #3071 (commit
  1c914cdf) on 2026-05-24. It was never part of an upstream release.
- The upstream release tarballs (3.6.x/3.7.x/3.8.6) use the older
  init_unpack() with unchecked calloc and no early-return path, so the
  freed window_buf/filtered_buf pointers are never left dangling and the
  double-free cannot occur.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-14164

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
---
 meta/recipes-extended/libarchive/libarchive_3.8.7.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
index e8c3a3bfe3..0926acd8f9 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
@@ -92,3 +92,7 @@ RDEPENDS:${PN}-ptest += "bsdtar bsdcpio"
 CVE_STATUS[CVE-2026-4426] = "fixed-version: fixed since 3.8.7"
 CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7"
 CVE_STATUS[CVE-2026-5745] = "fixed-version: fixed since 3.8.6"
+CVE_STATUS[CVE-2026-14164] = "not-applicable-platform: Double-free regression in the RAR5\
+ reader's init_unpack() was introduced upstream by commit 620bdafa (2026-05-16) and existed\
+ only on the git master branch until the fix in PR #3071 (commit 1c914cdf, 2026-05-24). It was\
+ never part of an upstream release tarball."

Re: [OE-core] [wrynose][PATCH] libarchive: mark CVE-2026-14164 as not-applicable-platform

[Yoann Congal]

On Mon Aug 17, 2026 at 12:59 PM CEST, Daniel Turull via lists.openembedded.org wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> - The RAR5 double-free in init_unpack() is a regression introduced
>   upstream by commit 620bdafa on 2026-05-16 and existed only
>   on the git master branch until it was fixed by PR #3071 (commit
>   1c914cdf) on 2026-05-24. It was never part of an upstream release.
> - The upstream release tarballs (3.6.x/3.7.x/3.8.6) use the older
>   init_unpack() with unchecked calloc and no early-return path, so the
>   freed window_buf/filtered_buf pointers are never left dangling and the
>   double-free cannot occur.
>
> References:
>   https://nvd.nist.gov/vuln/detail/CVE-2026-14164
>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> ---
>  meta/recipes-extended/libarchive/libarchive_3.8.7.bb | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
> index e8c3a3bfe3..0926acd8f9 100644
> --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
> +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
> @@ -92,3 +92,7 @@ RDEPENDS:${PN}-ptest += "bsdtar bsdcpio"
>  CVE_STATUS[CVE-2026-4426] = "fixed-version: fixed since 3.8.7"
>  CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7"
>  CVE_STATUS[CVE-2026-5745] = "fixed-version: fixed since 3.8.6"
> +CVE_STATUS[CVE-2026-14164] = "not-applicable-platform: Double-free regression in the RAR5\
> + reader's init_unpack() was introduced upstream by commit 620bdafa (2026-05-16) and existed\
> + only on the git master branch until the fix in PR #3071 (commit 1c914cdf, 2026-05-24). It was\
> + never part of an upstream release tarball."

Hello,

I don't think not-applicable-platform is the right flag for this
CVE_STATUS. See cve-check-map.conf[0]:
> [not-applicable-platform] use when vulnerability affects other platform (e.g. Windows or Debian)

How about "fixed-version"?

Regards,

[0]: https://git.openembedded.org/openembedded-core/tree/meta/conf/cve-check-map.conf?h=wrynose
-- 
Yoann Congal
Smile ECS

Re: [OE-core] [wrynose][PATCH] libarchive: mark CVE-2026-14164 as not-applicable-platform

[Daniel Turull]

On Wed, 2026-09-02 at 11:18 +0200, Yoann Congal wrote:
> On Mon Aug 17, 2026 at 12:59 PM CEST, Daniel Turull via lists.openembedded.org wrote:
> > From: Daniel Turull <daniel.turull@ericsson.com>
> > 
> > - The RAR5 double-free in init_unpack() is a regression introduced
> >   upstream by commit 620bdafa on 2026-05-16 and existed only
> >   on the git master branch until it was fixed by PR #3071 (commit
> >   1c914cdf) on 2026-05-24. It was never part of an upstream release.
> > - The upstream release tarballs (3.6.x/3.7.x/3.8.6) use the older
> >   init_unpack() with unchecked calloc and no early-return path, so the
> >   freed window_buf/filtered_buf pointers are never left dangling and the
> >   double-free cannot occur.
> > 
> > References:
> >   
> > 
> > Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> > ---
> >  meta/recipes-extended/libarchive/libarchive_3.8.7.bb | 4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-
> > extended/libarchive/libarchive_3.8.7.bb
> > index e8c3a3bfe3..0926acd8f9 100644
> > --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
> > +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb
> > @@ -92,3 +92,7 @@ RDEPENDS:${PN}-ptest += "bsdtar bsdcpio"
> >  CVE_STATUS[CVE-2026-4426] = "fixed-version: fixed since 3.8.7"
> >  CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7"
> >  CVE_STATUS[CVE-2026-5745] = "fixed-version: fixed since 3.8.6"
> > +CVE_STATUS[CVE-2026-14164] = "not-applicable-platform: Double-free regression in the RAR5\
> > + reader's init_unpack() was introduced upstream by commit 620bdafa (2026-05-16) and existed\
> > + only on the git master branch until the fix in PR #3071 (commit 1c914cdf, 2026-05-24). It was\
> > + never part of an upstream release tarball."
> 
> Hello,
> 
> I don't think not-applicable-platform is the right flag for this
> CVE_STATUS. See cve-check-map.conf[0]:
> > [not-applicable-platform] use when vulnerability affects other platform (e.g. Windows or Debian)
> 
> How about "fixed-version"?

Sure. I'll send a v2 with it. also for scarthgap

Daniel