Re: [OE-core][wrynose][PATCH 1/3] busybox: fix CVE-2026-38752

["Yoann Congal" <yoann.congal@smile.fr>]

On Fri Oct 16, 2026 at 8:53 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix shown in [1].
> The advisory identifying the fix is referenced in [2].
>
> [1] https://lists.busybox.net/pipermail/busybox/2026-June/092351.html
> [2] https://nvd.nist.gov/vuln/detail/cve-2026-38752
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
>  .../busybox/busybox/CVE-2026-38752.patch      | 83 +++++++++++++++++++
>  meta/recipes-core/busybox/busybox_1.37.0.bb   |  1 +
>  2 files changed, 84 insertions(+)
>  create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
>
> diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
> new file mode 100644
> index 00000000000..52cba2417e7
> --- /dev/null
> +++ b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
> @@ -0,0 +1,83 @@
> +From e886726a2f0ad397666687a5fc65c4e80240f964 Mon Sep 17 00:00:00 2001
> +From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> +Date: Tue, 16 Jun 2026 12:16:05 +0900
> +Subject: [PATCH] awk: fix stack overflow in evaluate()
> +
> +Recursive awk functions can keep re-entering evaluate() until the
> +process stack is exhausted. Track active function-call depth and report a
> +normal awk error once the limit is reached instead of overflowing the
> +stack.
> +
> +CVE: CVE-2026-38752
> +Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2026-June/092351.html]
> +
> +Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>

Hello,

For the whole series:
Those patches are needed for master and blacksail.

Also, I don't like using new "Submitted" patches in stable for maintained
project. I know busybox maintenance is not ideal right now but maybe we
should ping/help upstream to get these fixes merged?

Regards,
-- 
Yoann Congal
Smile ECS