[OE-core][wrynose][PATCH 1/3] busybox: fix CVE-2026-38752

[OE-core][wrynose][PATCH 1/3] busybox: fix CVE-2026-38752

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix shown in [1].
The advisory identifying the fix is referenced in [2].

[1] https://lists.busybox.net/pipermail/busybox/2026-June/092351.html
[2] https://nvd.nist.gov/vuln/detail/cve-2026-38752

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../busybox/busybox/CVE-2026-38752.patch      | 83 +++++++++++++++++++
 meta/recipes-core/busybox/busybox_1.37.0.bb   |  1 +
 2 files changed, 84 insertions(+)
 create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38752.patch

diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
new file mode 100644
index 00000000000..52cba2417e7
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
@@ -0,0 +1,83 @@
+From e886726a2f0ad397666687a5fc65c4e80240f964 Mon Sep 17 00:00:00 2001
+From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Date: Tue, 16 Jun 2026 12:16:05 +0900
+Subject: [PATCH] awk: fix stack overflow in evaluate()
+
+Recursive awk functions can keep re-entering evaluate() until the
+process stack is exhausted. Track active function-call depth and report a
+normal awk error once the limit is reached instead of overflowing the
+stack.
+
+CVE: CVE-2026-38752
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2026-June/092351.html]
+
+Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ editors/awk.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/editors/awk.c b/editors/awk.c
+index 64e752f..299e480 100644
+--- a/editors/awk.c
++++ b/editors/awk.c
+@@ -638,6 +638,7 @@ struct globals2 {
+ 	smalluint exitcode;
+ 
+ 	unsigned evaluate__seed;
++	unsigned evaluate__func_depth;
+ 	var *evaluate__fnargs;
+ 	regex_t evaluate__sreg;
+ 
+@@ -709,6 +710,7 @@ static const char EMSG_UNEXP_TOKEN[] ALIGN1 = "Unexpected token";
+ static const char EMSG_DIV_BY_ZERO[] ALIGN1 = "Division by zero";
+ static const char EMSG_INV_FMT[] ALIGN1 = "Invalid format specifier";
+ static const char EMSG_TOO_FEW_ARGS[] ALIGN1 = "Too few arguments";
++static const char EMSG_RECURSION[] ALIGN1 = "Recursion limit exceeded";
+ static const char EMSG_NOT_ARRAY[] ALIGN1 = "Not an array";
+ static const char EMSG_POSSIBLE_ERROR[] ALIGN1 = "Possible syntax error";
+ static const char EMSG_UNDEF_FUNC[] ALIGN1 = "Call to undefined function";
+@@ -2994,6 +2996,7 @@ static var *evaluate(node *op, var *res)
+ #define fnargs (G.evaluate__fnargs)
+ /* seed is initialized to 1 */
+ #define seed   (G.evaluate__seed)
++#define func_depth (G.evaluate__func_depth)
+ #define sreg   (G.evaluate__sreg)
+ 
+ 	var *tmpvars;
+@@ -3305,13 +3308,17 @@ static var *evaluate(node *op, var *res)
+ 			var *argvars, *sv_fnargs;
+ 			const char *sv_progname;
+ 			int nargs, i;
++			enum { MAX_AWK_FUNC_DEPTH = 1000 };
+ 
+ 			debug_printf_eval("FUNC\n");
+ 
+ 			if (!op->r.f->defined)
+ 				syntax_error(EMSG_UNDEF_FUNC);
++			if (func_depth >= MAX_AWK_FUNC_DEPTH)
++				syntax_error(EMSG_RECURSION);
+ 
+ 			/* The body might be empty, still has to eval the args */
++			func_depth++;
+ 			nargs = op->r.f->nargs;
+ 			argvars = nvalloc(nargs);
+ 			i = 0;
+@@ -3339,6 +3346,7 @@ static var *evaluate(node *op, var *res)
+ 
+ 			g_progname = sv_progname;
+ 			fnargs = sv_fnargs;
++			func_depth--;
+ 
+ 			break;
+ 		}
+@@ -3696,6 +3704,7 @@ static var *evaluate(node *op, var *res)
+ 	return res;
+ #undef fnargs
+ #undef seed
++#undef func_depth
+ #undef sreg
+ }
+ 
+-- 
+2.35.6
diff --git a/meta/recipes-core/busybox/busybox_1.37.0.bb b/meta/recipes-core/busybox/busybox_1.37.0.bb
index b020c923be3..d4352fd4cbe 100644
--- a/meta/recipes-core/busybox/busybox_1.37.0.bb
+++ b/meta/recipes-core/busybox/busybox_1.37.0.bb
@@ -66,6 +66,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://CVE-2024-58251.patch \
            file://CVE-2026-29004-01.patch \
            file://CVE-2026-29004-02.patch \
+           file://CVE-2026-38752.patch \
            file://CVE-2026-38754.patch \
            "
 SRC_URI:append:libc-musl = " file://musl.cfg"
-- 
2.35.6

[OE-core][wrynose][PATCH 2/3] busybox: fix CVE-2026-38753

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix shown in [1].
The advisory identifying the fix is referenced in [2].

[1] https://lists.busybox.net/pipermail/busybox/2026-June/092352.html
[2] https://nvd.nist.gov/vuln/detail/cve-2026-38753

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../busybox/busybox/CVE-2026-38753.patch      | 54 +++++++++++++++++++
 meta/recipes-core/busybox/busybox_1.37.0.bb   |  1 +
 2 files changed, 55 insertions(+)
 create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38753.patch

diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38753.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38753.patch
new file mode 100644
index 00000000000..b7095b0d379
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2026-38753.patch
@@ -0,0 +1,54 @@
+From 2ab1e56dbb740769b703822d839222c68813a97b Mon Sep 17 00:00:00 2001
+From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Date: Tue, 16 Jun 2026 12:18:43 +0900
+Subject: [PATCH] awk: fix use-after-free in awk_sub()
+
+awk_sub() receives the replacement text as a pointer into awk variable
+storage. Evaluating the regular expression argument can change that
+storage through as_regex(), leaving the replacement pointer dangling
+before strlen() and the replacement loop use it.
+
+Copy the replacement string before calling as_regex() so substitution
+uses stable storage for the duration of the operation.
+
+CVE: CVE-2026-38753
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2026-June/092352.html]
+
+Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ editors/awk.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/editors/awk.c b/editors/awk.c
+index 299e480..e0781ee 100644
+--- a/editors/awk.c
++++ b/editors/awk.c
+@@ -2561,6 +2561,7 @@ static char *awk_printf(node *n, size_t *len)
+ static int awk_sub(node *rn, const char *repl, int nm, var *src, var *dest /*,int subexp*/)
+ {
+ 	char *resbuf;
++	char *repl_copy;
+ 	const char *sp;
+ 	int match_no, residx, replen, resbufsize;
+ 	int regexec_flags;
+@@ -2578,7 +2579,9 @@ static int awk_sub(node *rn, const char *repl, int nm, var *src, var *dest /*,in
+ 	resbuf = NULL;
+ 	residx = 0;
+ 	match_no = 0;
++	repl_copy = xstrdup(repl);
+ 	regex = as_regex(rn, &sreg);
++	repl = repl_copy;
+ 	sp = getvar_s(src ? src : intvar[F0]);
+ #if defined(REG_STARTEND)
+ 	src_string = sp;
+@@ -2668,6 +2671,7 @@ static int awk_sub(node *rn, const char *repl, int nm, var *src, var *dest /*,in
+ 	setvar_p(dest ? dest : intvar[F0], resbuf);
+ 	if (regex == &sreg)
+ 		regfree(regex);
++	free(repl_copy);
+ 	return match_no;
+ }
+ 
+-- 
+2.35.6
diff --git a/meta/recipes-core/busybox/busybox_1.37.0.bb b/meta/recipes-core/busybox/busybox_1.37.0.bb
index d4352fd4cbe..8da8338a57b 100644
--- a/meta/recipes-core/busybox/busybox_1.37.0.bb
+++ b/meta/recipes-core/busybox/busybox_1.37.0.bb
@@ -67,6 +67,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://CVE-2026-29004-01.patch \
            file://CVE-2026-29004-02.patch \
            file://CVE-2026-38752.patch \
+           file://CVE-2026-38753.patch \
            file://CVE-2026-38754.patch \
            "
 SRC_URI:append:libc-musl = " file://musl.cfg"
-- 
2.35.6

[OE-core][wrynose][PATCH 3/3] busybox: fix CVE-2026-38755

[Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix shown in [1].
The advisory identifying the fix is referenced in [2].

[1] https://lists.busybox.net/pipermail/busybox/2026-June/092354.html
[2] https://nvd.nist.gov/vuln/detail/cve-2026-38755

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../busybox/busybox/CVE-2026-38755.patch      | 70 +++++++++++++++++++
 meta/recipes-core/busybox/busybox_1.37.0.bb   |  1 +
 2 files changed, 71 insertions(+)
 create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38755.patch

diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38755.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38755.patch
new file mode 100644
index 00000000000..4e79e3847f4
--- /dev/null
+++ b/meta/recipes-core/busybox/busybox/CVE-2026-38755.patch
@@ -0,0 +1,70 @@
+From 0efa89307bb63c456d25adfb352c3dcc48d8760b Mon Sep 17 00:00:00 2001
+From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Date: Tue, 16 Jun 2026 12:19:27 +0900
+Subject: [PATCH] ash: fix stack overflow in evalfun()
+
+Recursive shell functions can repeatedly enter evalfun() until the
+process stack is exhausted. Track active shell function calls and raise a
+normal shell error when the recursion limit is reached.
+
+The counter is decremented through the existing funcdone cleanup path so
+errors raised from inside the function body unwind it correctly.
+
+CVE: CVE-2026-38755
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2026-June/092354.html]
+
+Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ shell/ash.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/shell/ash.c b/shell/ash.c
+index bbd7307..a66d3cc 100644
+--- a/shell/ash.c
++++ b/shell/ash.c
+@@ -414,6 +414,7 @@ struct globals_misc {
+ 	int shlvl;
+ #define rootshell (!shlvl)
+ 	int errlinno;
++	unsigned func_depth;
+ 
+ 	char *minusc;  /* argument to -c option */
+ 
+@@ -506,6 +507,7 @@ extern struct globals_misc *BB_GLOBAL_CONST ash_ptr_to_globals_misc;
+ #define rootpid     (G_misc.rootpid    )
+ #define shlvl       (G_misc.shlvl      )
+ #define errlinno    (G_misc.errlinno   )
++#define func_depth  (G_misc.func_depth )
+ #define minusc      (G_misc.minusc     )
+ #define curdir      (G_misc.curdir     )
+ #define physdir     (G_misc.physdir    )
+@@ -9920,6 +9922,10 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
+ 	int savefuncline;
+ 	char *savefuncname;
+ 	char *savetrap = NULL;
++	enum { MAX_ASH_FUNC_DEPTH = 1000 };
++
++	if (func_depth >= MAX_ASH_FUNC_DEPTH)
++		ash_msg_and_raise_error("function recursion limit exceeded");
+ 
+ 	if (!Eflag) {
+ 		savetrap = trap[NTRAP_ERR];
+@@ -9938,6 +9944,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
+ 	exception_handler = &jmploc;
+ 	shellparam.malloced = 0;
+ 	func->count++;
++	func_depth++;
+ 	funcname = func->n.ndefun.text;
+ 	funcline = func->n.ndefun.linno;
+ 	INT_ON;
+@@ -9959,6 +9966,7 @@ evalfun(struct funcnode *func, int argc, char **argv, int flags)
+ 	}
+ 	funcline = savefuncline;
+ 	lineno = savelineno;
++	func_depth--;
+ 	freefunc(func);
+ 	freeparam(&shellparam);
+ 	shellparam = saveparam;
+-- 
+2.35.6
diff --git a/meta/recipes-core/busybox/busybox_1.37.0.bb b/meta/recipes-core/busybox/busybox_1.37.0.bb
index 8da8338a57b..744ab03451a 100644
--- a/meta/recipes-core/busybox/busybox_1.37.0.bb
+++ b/meta/recipes-core/busybox/busybox_1.37.0.bb
@@ -69,6 +69,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \
            file://CVE-2026-38752.patch \
            file://CVE-2026-38753.patch \
            file://CVE-2026-38754.patch \
+           file://CVE-2026-38755.patch \
            "
 SRC_URI:append:libc-musl = " file://musl.cfg"
 SRC_URI:append:x86-64 = " file://sha_accel.cfg"
-- 
2.35.6

Re: [OE-core][wrynose][PATCH 1/3] busybox: fix CVE-2026-38752

[Yoann Congal]

On Fri Oct 16, 2026 at 8:53 AM CEST, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via lists.openembedded.org wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> This patch applies the upstream fix shown in [1].
> The advisory identifying the fix is referenced in [2].
>
> [1] https://lists.busybox.net/pipermail/busybox/2026-June/092351.html
> [2] https://nvd.nist.gov/vuln/detail/cve-2026-38752
>
> Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
> ---
>  .../busybox/busybox/CVE-2026-38752.patch      | 83 +++++++++++++++++++
>  meta/recipes-core/busybox/busybox_1.37.0.bb   |  1 +
>  2 files changed, 84 insertions(+)
>  create mode 100644 meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
>
> diff --git a/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
> new file mode 100644
> index 00000000000..52cba2417e7
> --- /dev/null
> +++ b/meta/recipes-core/busybox/busybox/CVE-2026-38752.patch
> @@ -0,0 +1,83 @@
> +From e886726a2f0ad397666687a5fc65c4e80240f964 Mon Sep 17 00:00:00 2001
> +From: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> +Date: Tue, 16 Jun 2026 12:16:05 +0900
> +Subject: [PATCH] awk: fix stack overflow in evaluate()
> +
> +Recursive awk functions can keep re-entering evaluate() until the
> +process stack is exhausted. Track active function-call depth and report a
> +normal awk error once the limit is reached instead of overflowing the
> +stack.
> +
> +CVE: CVE-2026-38752
> +Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2026-June/092351.html]
> +
> +Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com>
> +Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>

Hello,

For the whole series:
Those patches are needed for master and blacksail.

Also, I don't like using new "Submitted" patches in stable for maintained
project. I know busybox maintenance is not ideal right now but maybe we
should ping/help upstream to get these fixes merged?

Regards,
-- 
Yoann Congal
Smile ECS