Re: [OE-core][scarthgap][PATCH 1/6] libxml2: Security Fix for CVE-2026-86137

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Sep 21, 2026 at 5:00 PM CEST, Yoann Congal wrote:
> On Mon Sep 21, 2026 at 2:38 PM CEST, Yoann Congal wrote:
>> On Thu Sep 10, 2026 at 10:03 PM CEST, Siddharth Doshi via lists.openembedded.org wrote:
>>> From: Siddharth Doshi <sdoshi@mvista.com>
>>>
>>> Picking patch as per [1], and same patch is mentioned in [2]
>>>
>>> References:
>>> [1] https://nvd.nist.gov/vuln/detail/CVE-2026-86137
>>> [2] https://security-tracker.debian.org/tracker/CVE-2026-86137
>>>
>>> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
>>> ---
>>>  .../libxml/libxml2/CVE-2026-86137.patch       | 48 +++++++++++++++++++
>>>  meta/recipes-core/libxml/libxml2_2.12.10.bb   |  1 +
>>>  2 files changed, 49 insertions(+)
>>>  create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-86137.patch
>>
>> Hello,
>>
>> It looks like something in this series is breaking ptests:
>> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4604
>> https://valkyrie.yocto.io/pub/non-release/20260921-71/testresults/qemux86-64-ptest/core-image-ptest-libxml2/log.do_testimage.364096.20260921110838
>> |  1314	Running runtest
>> |  1315	Validation for ./test/VCM/21.xml failed
>> |  1316	Validation for ./test/VCM/AttributeNmtokens.xml failed
>> |  1317	Validation for ./test/VCM/v10.xml failed
>> |  1318	Validation for ./test/VCM/v11.xml failed
>> |  1319	Validation for ./test/VCM/v12.xml failed
>> |  1320	Validation for ./test/VCM/v13.xml failed
>> |  1321	Validation for ./test/VCM/v14.xml failed
>> |  1322	Validation for ./test/VCM/v15.xml failed
>> |  1323	Validation for ./test/VCM/v16.xml failed
>> |  1324	Validation for ./test/VCM/v17.xml failed
>> |  1325	Validation for ./test/VCM/v18.xml failed
>> |  1326	Validation for ./test/VCM/v19.xml failed
>> |  1327	Validation for ./test/VCM/v20.xml failed
>> |  1328	Validation for ./test/VCM/v21.xml failed
>> |  1329	Validation for ./test/VCM/v22.xml failed
>> |  1330	Validation for ./test/VCM/v23.xml failed
>> |  1331	Validation for ./test/VCM/v24.xml failed
>> |  1332	Validation for ./test/VCM/v4.xml failed
>> |  1333	Validation for ./test/VCM/v5.xml failed
>> |  1334	Validation for ./test/VCM/v6.xml failed
>> |  1335	Validation for ./test/VCM/v7.xml failed
>> |  1336	Validation for ./test/VCM/v8.xml failed
>> |  1337	Validation for ./test/VCM/v9.xml failed
>> |  1338	file result/VC/ElementValid2 is 111 bytes, result is 227 bytes
>> |  1339	Error for ./test/VC/ElementValid2 failed
>>
>> Can you look into it?
>>
>> Thanks!
>
> This also fails on arm64:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4577
>
> Regards,

Hello,

FYI, A similar series was sent that did not break ptests in my testing:
https://lore.kernel.org/all/20260929041836.2217090-1-hthakar@cisco.com/
So, I'll continue with Hetvi's for now.

Regards,
-- 
Yoann Congal
Smile ECS