[PATCH] zlib: patch CVE-2026-85091 and CVE-2026-76844

[PATCH] zlib: patch CVE-2026-85091 and CVE-2026-76844

[Prasanth R]

From: Prasanth R <ragaprasanth@gmail.com>

Backport the upstream fix. It covers both CVEs.
CVE-2026-85091 & CVE-2026-76844

Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
---
 .../zlib/zlib/CVE-2026-85091.patch            | 31 +++++++++++++++++++
 meta/recipes-core/zlib/zlib_1.3.2.bb          |  1 +
 2 files changed, 32 insertions(+)
 create mode 100644 meta/recipes-core/zlib/zlib/CVE-2026-85091.patch

diff --git a/meta/recipes-core/zlib/zlib/CVE-2026-85091.patch b/meta/recipes-core/zlib/zlib/CVE-2026-85091.patch
new file mode 100644
index 0000000000..005d986be0
--- /dev/null
+++ b/meta/recipes-core/zlib/zlib/CVE-2026-85091.patch
@@ -0,0 +1,31 @@
+From df84af25dc1942490e1d1c899a07619152a46148 Mon Sep 17 00:00:00 2001
+From: Mark Adler <git@madler.net>
+Date: Wed, 16 Sep 2026 16:26:14 -0700
+Subject: [PATCH] Fix buffer overflow bug in non-blocking gzwrite.
+
+This addresses CVE-2026-85091.
+
+CVE: CVE-2026-85091 CVE-2026-76844
+Upstream-Status: Backport [https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148]
+Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp>
+---
+ gzwrite.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/gzwrite.c b/gzwrite.c
+index b217b85..5123292 100644
+--- a/gzwrite.c
++++ b/gzwrite.c
+@@ -242,8 +242,11 @@ local z_size_t gz_write(gz_statep state, voidpc buf, z_size_t len) {
+             n -= state->strm.avail_in;
+             state->x.pos += n;
+             len -= n;
+-            if (ret == -1)
++            if (ret == -1) {
++                state->strm.avail_in = 0;
++                state->strm.next_in = state->in;
+                 return state->again ? put - len : 0;
++            }
+         } while (len);
+     }
+ 
diff --git a/meta/recipes-core/zlib/zlib_1.3.2.bb b/meta/recipes-core/zlib/zlib_1.3.2.bb
index 8a23d98cd3..c6619f81cc 100644
--- a/meta/recipes-core/zlib/zlib_1.3.2.bb
+++ b/meta/recipes-core/zlib/zlib_1.3.2.bb
@@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = "file://zlib.h;beginline=6;endline=23;md5=5377232268e952e9ef6
 # The source tarball needs to be .gz as only the .gz ends up in fossils/
 SRC_URI = "https://zlib.net/${BP}.tar.gz \
            file://run-ptest \
+           file://CVE-2026-85091.patch \
            "
 UPSTREAM_CHECK_URI = "http://zlib.net/"
 
-- 
2.34.1

Re: [PATCH] zlib: patch CVE-2026-85091 and CVE-2026-76844

[Paul Barker]

On Fri Oct 30, 2026 at 5:05 AM GMT, Prasanth R wrote:
> From: Prasanth R <ragaprasanth@gmail.com>
>
> Backport the upstream fix. It covers both CVEs.
> CVE-2026-85091 & CVE-2026-76844

Hi Prasanth,

This troubled me as two CVE ids shouldn't really be pointing at a single
simple fix. So I looked into it some more...

CVE-2026-76844 currently points at zlib in error [1], so this one should
be resolved by setting CVE_STATUS rather than by assigning two CVE ids
to the same patch. Please could you send a v2 for CVE-2026-85091, along
with a CVE_STATUS assignment for CVE-2026-76844?

[1]: https://github.com/madler/zlib/issues/1330

Best regards,

-- 
Paul Barker

RE: [OE-core] [PATCH] zlib: patch CVE-2026-85091 and CVE-2026-76844

[Marko, Peter]

Also note that for master, there is a new tag since yesterday.
Patches are then only for the older releases.

Peter

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-
> core@lists.openembedded.org> On Behalf Of Paul Barker
> Sent: Thursday, November 5, 2026 4:03 PM
> To: Prasanth R <ragaprasanth@gmail.com>; openembedded-
> core@lists.openembedded.org
> Cc: Prasanth R <prasanth.r@lineo.co.jp>
> Subject: Re: [OE-core] [PATCH] zlib: patch CVE-2026-85091 and CVE-2026-
> 76844
> 
> On Fri Oct 30, 2026 at 5:05 AM GMT, Prasanth R wrote:
> > From: Prasanth R <ragaprasanth@gmail.com>
> >
> > Backport the upstream fix. It covers both CVEs.
> > CVE-2026-85091 & CVE-2026-76844
> 
> Hi Prasanth,
> 
> This troubled me as two CVE ids shouldn't really be pointing at a single
> simple fix. So I looked into it some more...
> 
> CVE-2026-76844 currently points at zlib in error [1], so this one should
> be resolved by setting CVE_STATUS rather than by assigning two CVE ids
> to the same patch. Please could you send a v2 for CVE-2026-85091, along
> with a CVE_STATUS assignment for CVE-2026-76844?
> 
> [1]: https://github.com/madler/zlib/issues/1330
> 
> Best regards,
> 
> --
> Paul Barker

Re: [OE-core] [PATCH] zlib: patch CVE-2026-85091 and CVE-2026-76844

[Paul Barker]

>> -----Original Message-----
>> From: openembedded-core@lists.openembedded.org <openembedded-
>> core@lists.openembedded.org> On Behalf Of Paul Barker
>> Sent: Thursday, November 5, 2026 4:03 PM
>> To: Prasanth R <ragaprasanth@gmail.com>; openembedded-
>> core@lists.openembedded.org
>> Cc: Prasanth R <prasanth.r@lineo.co.jp>
>> Subject: Re: [OE-core] [PATCH] zlib: patch CVE-2026-85091 and CVE-2026-
>> 76844
>> 
>> On Fri Oct 30, 2026 at 5:05 AM GMT, Prasanth R wrote:
>> > From: Prasanth R <ragaprasanth@gmail.com>
>> >
>> > Backport the upstream fix. It covers both CVEs.
>> > CVE-2026-85091 & CVE-2026-76844
>> 
>> Hi Prasanth,
>> 
>> This troubled me as two CVE ids shouldn't really be pointing at a single
>> simple fix. So I looked into it some more...
>> 
>> CVE-2026-76844 currently points at zlib in error [1], so this one should
>> be resolved by setting CVE_STATUS rather than by assigning two CVE ids
>> to the same patch. Please could you send a v2 for CVE-2026-85091, along
>> with a CVE_STATUS assignment for CVE-2026-76844?
>> 
>> [1]: https://github.com/madler/zlib/issues/1330

On Thu Nov 5, 2026 at 3:08 PM GMT, Peter Marko wrote:
> Also note that for master, there is a new tag since yesterday.
> Patches are then only for the older releases.

Thanks for the update Peter.

In this case we just need the CVE_STATUS assignment for CVE-2026-76844,
as CVE-2026-85091 is fixed in zlib 1.4.

Best regards,

-- 
Paul Barker