Re: [OE-core] [scarthgap][PATCH] improve_kernel_cve_report: fix crash on entries without detail

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Sep 1, 2026 at 9:42 PM CEST, Hiago De Franco via lists.openembedded.org wrote:
> When the CNA reports Unpatched and the scan reports Patched, cve_update()
> reads cve_data[cve]['detail'] unguarded. cve-check only writes 'detail'
> for CVEs carrying a CVE_STATUS varflag, so an entry marked Patched by an
> NVD version comparison has no such key and the script aborts with
> KeyError: 'detail' on ordinary cve-check output. The unhandled-update
> warning below makes the same assumption.
>
> Use .get() in both places. A missing detail falls through to the CNA
> verdict, and only an explicit CVE_STATUS = "backported-patch" outranks
> it, which is what the guard was added for.
>
> Tested by calling cve_update() with a Patched entry carrying no detail:
> before it raises KeyError, after it takes the CNA's Unpatched verdict,
> while an entry with detail = "backported-patch" stays Patched either way.
>
> AI-Generated: Uses Claude (claude-opus-5)
> Fixes: d317e2a52bd2 ("improve_kernel_cve_report: do not override backported-patch")
> Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
> ---
>  scripts/contrib/improve_kernel_cve_report.py | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Hello,

If I'm not mistaken, this patch is the squash of 80ff4903ea1 and
f5da16b0d3c. I'd rather have 2 clean cherry-picks, this make tracking
which patch is needed or not easier.

Can you send the 2 cherry-picks as a series?

Thanks!
-- 
Yoann Congal
Smile ECS