Re: [OE-core] [scarthgap][PATCH 1/3] cpio: patch CVE-2026-66485

["Yoann Congal" <yoann.congal@smile.fr>]

On Sat Sep 12, 2026 at 9:15 PM CEST, Peter Marko wrote:
>
>
>> -----Original Message-----
>> From: Yoann Congal <yoann.congal@smile.fr>
>> Sent: Friday, August 28, 2026 10:25 AM
>> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>;
>> openembedded-core@lists.openembedded.org
>> Subject: Re: [OE-core] [scarthgap][PATCH 1/3] cpio: patch CVE-2026-66485
>> 
>> On Sat Aug 15, 2026 at 9:08 PM CEST, Peter Marko via lists.openembedded.org
>> wrote:
>> > From: Peter Marko <peter.marko@siemens.com>
>> >
>> > Pick patch mentioned in NVD CVE description.
>> >
>> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
>> > (From OE-Core rev: c105fbf82e2f50b05dc680e0601bf0ea3198e58c)
>> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> > ---
>> >  meta/recipes-extended/cpio/cpio_2.15.bb       |   1 +
>> >  .../cpio/files/CVE-2026-66485.patch           | 210 ++++++++++++++++++
>> >  2 files changed, 211 insertions(+)
>> >  create mode 100644 meta/recipes-extended/cpio/files/CVE-2026-66485.patch
>> 
>> Hello,
>> 
>> It looks like this series triggers ptests issues:
>> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4362
>> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4378
>> 
>> https://valkyrie.yocto.io/pub/non-release/20260824-88/testresults/qemux86-64-
>> ptest/core-image-ptest-cpio/log.do_testimage.311338.20260824214940
>> | FAIL: CVE-2019-14866 (tar header size overflow)
>> 
>> Can you look into this?
>
> I really hate the expectfail default setting, sometimes I miss the failure...
>
> Could you please take the first two patches from this series?
> Only the third one is causing the error.
> After two weeks of vacation lot of things piled up so it will take me some time to clear my backlog to be able to look at this issue.

I can take 1-2/3.

Thanks!

>
> Thanks,
>   Peter
>
>> 
>> Thanks!
>> --
>> Yoann Congal
>> Smile ECS


-- 
Yoann Congal
Smile ECS