* [OE-core][wrynose 00/35] Patch review
@ 2026-11-11 9:02 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 01/35] bluez5: Fix error handling for AVDTP_OPEN cmd Yoann Congal
` (35 more replies)
0 siblings, 36 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for wrynose and have comments back by
end of day Thursday, November 12.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/5102
* qemuarm64-musl-ptest failed with 15814 – qemuarm64 musl ptest failures
retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/109/builds/1543
The following changes since commit 2285da08068a6d1b4a64c9a52d85a58be50e4679:
openssh: fix CVE-2026-123158 (aka "sshhole") (2026-11-06 17:15:59 +0100)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/wrynose-review
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review
for you to fetch changes up to 33a6bd6cc8a9a976902081642414bd67adc74879:
populate_sdk_ext: Fix locale error handling in SDK (2026-11-11 00:22:27 +0100)
----------------------------------------------------------------
Adrian Freihofer (1):
kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps
Benjamin Robin (4):
spdx_common: simplify get_patched_src() implementation
spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
package: no longer modify paths in save_debugsources_info()
Bruce Ashfield (3):
linux-yocto/6.18: aufs: refresh to upstream aufs6.18
linux-yocto/6.18: update to v6.18.57
linux-yocto/6.18: update to v6.18.59
Deepak Rathore (1):
gnupg: Fix CVE-2026-105712
Jaipaul Cheernam (1):
bind: upgrade 9.20.29 -> 9.20.30
Jeroen Hofstee (1):
python3-pip: patch the vendored python3-certifi
Jinwang Li (5):
bluez5: Fix error handling for AVDTP_OPEN cmd
bluez5: Fix GET_CONFIGURATION cmd
bluez5: Return correct error when SEP is inuse
bluez5: Fix ABORT response being discarded
bluez5: Fix u128_to_string skipping data[4]
Peter Marko (7):
boost: patch CVE-2023-34399
go: upgrade 1.26.9 -> 1.26.10
glib-2.0: patch CVE-2026-16118
python3: upgrade 3.14.9 -> 3.14.10
systemd: add iproute2-devlink runtime dependency to udev
dropbear: add follow-up patches for CVE-2019-6111
dropbear: patch CVE-2026-35385
Richard Purdie (2):
recipe_sanity: Drop rename overwrite detection
populate_sdk_ext: Fix locale error handling in SDK
Ross Burton (4):
python3: upgrade 3.14.7 -> 3.14.9
python3: skip test.test_readline.TestHistoryManipulation on musl
piglit: fix build with Python 3.14.9
groff: build less in groff-native
Shantanu Majumdar (1):
gstreamer1.0-plugins-bad: use gtk+3 dependency name
Theo Gaige (Schneider Electric) (1):
python3-pyelftools: add missing runtime dependencies
Yoann Congal (1):
scripts/install-buildtools: Update to 6.0.4
Yogita Urade (3):
python3-urllib3: Fix CVE-2026-44432
python3-urllib3: Fix CVE-2026-97687
python3-urllib3: Fix CVE-2026-97688
meta/classes-recipe/kernel-fit-image.bbclass | 14 +-
meta/classes-recipe/populate_sdk_ext.bbclass | 2 +-
meta/classes/recipe_sanity.bbclass | 21 -
meta/lib/oe/package.py | 54 +--
meta/lib/oe/spdx30_tasks.py | 1 -
meta/lib/oe/spdx_common.py | 125 +++--
...1-avoid-start-failure-with-bind-user.patch | 2 +-
...kport-ax_prog_cc_for_build.m4-macros.patch | 2 +-
...d-V-and-start-log-hide-build-options.patch | 4 +-
...ching-for-json-headers-searches-sysr.patch | 4 +-
.../recipes-connectivity/bind/bind/conf.patch | 2 +-
...t.d-add-support-for-read-only-rootfs.patch | 2 +-
.../bind/make-etc-initd-bind-stop-work.patch | 2 +-
.../bind/{bind_9.20.29.bb => bind_9.20.30.bb} | 2 +-
meta/recipes-connectivity/bluez5/bluez5.inc | 5 +
...0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch | 36 ++
...ix-error-handling-for-AVDTP_OPEN-cmd.patch | 48 ++
...turn-correct-error-when-SEP-is-inuse.patch | 32 ++
...x-Fix-ABORT-response-being-discarded.patch | 44 ++
...p-Fix-u128_to_string-skipping-data-4.patch | 33 ++
.../dropbear/dropbear/CVE-2019-6111-01.patch | 364 ++++++++++++++
.../dropbear/dropbear/CVE-2019-6111-02.patch | 43 ++
.../dropbear/dropbear/CVE-2019-6111-03.patch | 34 ++
.../dropbear/dropbear/CVE-2019-6111-04.patch | 43 ++
.../dropbear/dropbear/CVE-2026-35385.patch | 42 ++
.../recipes-core/dropbear/dropbear_2025.89.bb | 5 +
.../glib-2.0/files/CVE-2026-16118.patch | 48 ++
meta/recipes-core/glib-2.0/glib.inc | 1 +
meta/recipes-core/systemd/systemd_259.5.bb | 1 +
.../go/{go-1.26.9.inc => go-1.26.10.inc} | 2 +-
..._1.26.9.bb => go-binary-native_1.26.10.bb} | 6 +-
...1.26.9.bb => go-cross-canadian_1.26.10.bb} | 0
...go-cross_1.26.9.bb => go-cross_1.26.10.bb} | 0
...sssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} | 0
...untime_1.26.9.bb => go-runtime_1.26.10.bb} | 0
.../go/{go_1.26.9.bb => go_1.26.10.bb} | 0
.../python3-pip/0001-Remove-emsign-437.patch | 142 ++++++
...tore-unaffected-emSign-roots-439-440.patch | 108 +++++
.../python/python3-pip_26.0.1.bb | 2 +
.../python/python3-pyelftools_0.32.bb | 8 +-
.../python3-urllib3/CVE-2026-44432.patch | 157 ++++++
.../python3-urllib3/CVE-2026-97687_p1.patch | 277 +++++++++++
.../python3-urllib3/CVE-2026-97687_p2.patch | 450 ++++++++++++++++++
.../CVE-2026-97688-regression.patch | 29 ++
.../python3-urllib3/CVE-2026-97688.patch | 107 +++++
.../python/python3-urllib3_2.6.3.bb | 5 +
...shebang-overflow-on-python-config.py.patch | 2 +-
...-use-prefix-value-from-build-configu.patch | 2 +-
...-qemu-wrapper-when-gathering-profile.patch | 2 +-
...est_sysconfig-for-posix_user-purelib.patch | 2 +-
.../python/python3/makerace.patch | 2 +-
.../{python3_3.14.7.bb => python3_3.14.10.bb} | 7 +-
.../groff/files/build-less.patch | 24 +
meta/recipes-extended/groff/groff_1.24.1.bb | 8 +-
...-reproducible_mtime-should-be-an-int.patch | 33 ++
meta/recipes-graphics/piglit/piglit_git.bb | 1 +
.../linux/linux-yocto-rt_6.18.bb | 6 +-
.../linux/linux-yocto-tiny_6.18.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +-
.../gstreamer1.0-plugins-bad_1.28.5.bb | 2 +-
.../boost/boost/CVE-2023-34399.patch | 35 ++
meta/recipes-support/boost/boost_1.90.0.bb | 1 +
.../gnupg/CVE-2026-105712-regression.patch | 39 ++
.../gnupg/gnupg/CVE-2026-105712.patch | 194 ++++++++
meta/recipes-support/gnupg/gnupg_2.5.17.bb | 2 +
scripts/install-buildtools | 4 +-
66 files changed, 2554 insertions(+), 151 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch
create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch
rename meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} (90%)
rename meta/recipes-devtools/go/{go-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} (80%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} (100%)
create mode 100644 meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.10.bb} (98%)
create mode 100644 meta/recipes-extended/groff/files/build-less.patch
create mode 100644 meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch
create mode 100644 meta/recipes-support/boost/boost/CVE-2023-34399.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch
^ permalink raw reply [flat|nested] 39+ messages in thread
* [OE-core][wrynose 01/35] bluez5: Fix error handling for AVDTP_OPEN cmd
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 02/35] bluez5: Fix GET_CONFIGURATION cmd Yoann Congal
` (34 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Jinwang Li <jinwang.li@oss.qualcomm.com>
Return BAD_STATE instead of BAD_ACP_SEID when the SEID maps to a
valid local SEP.
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
...ix-error-handling-for-AVDTP_OPEN-cmd.patch | 48 +++++++++++++++++++
2 files changed, 49 insertions(+)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch
diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index d857c23a577..169269d3771 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -76,6 +76,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://0001-src-device-Fix-stored-gatt-cache-DB-Hash-value-no.patch \
file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \
file://0001-adapter-restrict-delta-0-RSSI-to-proximity-filters.patch \
+ file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \
"
S = "${UNPACKDIR}/bluez-${PV}"
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch
new file mode 100644
index 00000000000..ba77d1e0469
--- /dev/null
+++ b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch
@@ -0,0 +1,48 @@
+From 4e0aba5a8ebd969b68cd3442e9f8066a4b15a366 Mon Sep 17 00:00:00 2001
+From: Simon Mikuda <simon.mikuda@streamunlimited.com>
+Date: Mon, 8 Jun 2026 13:29:23 +0200
+Subject: [PATCH] avdtp: Fix error handling for AVDTP_OPEN cmd
+
+We have to return BAD_STATE when local SEP is available instead of
+BAD_ACP_SEID.
+
+This fixes: AVDTP/SNK/ACP/SIG/SMG/BI-26-C
+Upstream-Status: Backport [https://github.com/bluez/bluez/commit/7c1c90f7b6d0f653c581878a039e2d02362f33f5]
+Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
+---
+ profiles/audio/avdtp.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
+index b57ba609b..56d27b973 100644
+--- a/profiles/audio/avdtp.c
++++ b/profiles/audio/avdtp.c
+@@ -1777,13 +1777,14 @@ static gboolean avdtp_open_cmd(struct avdtp *session, uint8_t transaction,
+ return FALSE;
+ }
+
+- stream = find_stream_by_lseid(session, req->acp_seid);
+- if (!stream) {
++ sep = find_local_sep_by_seid(session, req->acp_seid);
++ if (!sep) {
+ err = AVDTP_BAD_ACP_SEID;
+ goto failed;
+ }
+
+- if (stream->state != AVDTP_STATE_CONFIGURED) {
++ stream = find_stream_by_lsep(session, sep);
++ if (!stream || stream->state != AVDTP_STATE_CONFIGURED) {
+ err = AVDTP_BAD_STATE;
+ goto failed;
+ }
+@@ -1796,7 +1797,6 @@ static gboolean avdtp_open_cmd(struct avdtp *session, uint8_t transaction,
+ AVDTP_OPEN, NULL, 0);
+ }
+
+- sep = stream->lsep;
+ if (sep->ind && sep->ind->open && !session->pending_open) {
+ if (!sep->ind->open(session, sep, stream, &err,
+ sep->user_data))
+--
+2.34.1
+
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 02/35] bluez5: Fix GET_CONFIGURATION cmd
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 01/35] bluez5: Fix error handling for AVDTP_OPEN cmd Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 03/35] bluez5: Return correct error when SEP is inuse Yoann Congal
` (33 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Jinwang Li <jinwang.li@oss.qualcomm.com>
Check the resolved stream instead of an always-NULL sep pointer
when testing for BAD_ACP_SEID.
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
...0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch | 36 +++++++++++++++++++
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch
diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index 169269d3771..7e05bda4f13 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -77,6 +77,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://0001-profile-Set-L2CAP-IMTU-for-OBEX-profile-listeners.patch \
file://0001-adapter-restrict-delta-0-RSSI-to-proximity-filters.patch \
file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \
+ file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \
"
S = "${UNPACKDIR}/bluez-${PV}"
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch
new file mode 100644
index 00000000000..3226ba39bec
--- /dev/null
+++ b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch
@@ -0,0 +1,36 @@
+From 8e5ca68aeee22970e3ccf3bbb30c050938ba09a2 Mon Sep 17 00:00:00 2001
+From: Simon Mikuda <simon.mikuda@streamunlimited.com>
+Date: Mon, 8 Jun 2026 13:29:22 +0200
+Subject: [PATCH] avdtp: Fix GET_CONFIGURATION cmd
+
+This fixes AVDTP/SNK/ACP/SIG/SMG/BV-12-C
+Upstream-Status: Backport [https://github.com/bluez/bluez/commit/60437c06560e46d211aaf99620cc9510dfd8081f]
+Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
+---
+ profiles/audio/avdtp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
+index d475a545e..7cfc9a80d 100644
+--- a/profiles/audio/avdtp.c
++++ b/profiles/audio/avdtp.c
+@@ -1641,7 +1641,6 @@ static gboolean avdtp_getconf_cmd(struct avdtp *session, uint8_t transaction,
+ struct seid_req *req, int size)
+ {
+ GSList *l;
+- struct avdtp_local_sep *sep = NULL;
+ struct avdtp_stream *stream;
+ int rsp_size;
+ uint8_t err;
+@@ -1656,7 +1655,7 @@ static gboolean avdtp_getconf_cmd(struct avdtp *session, uint8_t transaction,
+ memset(buf, 0, sizeof(buf));
+
+ stream = find_stream_by_lseid(session, req->acp_seid);
+- if (!sep) {
++ if (!stream) {
+ err = AVDTP_BAD_ACP_SEID;
+ goto failed;
+ }
+--
+2.34.1
+
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 03/35] bluez5: Return correct error when SEP is inuse
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 01/35] bluez5: Fix error handling for AVDTP_OPEN cmd Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 02/35] bluez5: Fix GET_CONFIGURATION cmd Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 04/35] bluez5: Fix ABORT response being discarded Yoann Congal
` (32 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Jinwang Li <jinwang.li@oss.qualcomm.com>
Reject AVDTP_SET_CONFIGURATION with SEP_IN_USE when the SEID is
already bound to an active stream.
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
...turn-correct-error-when-SEP-is-inuse.patch | 32 +++++++++++++++++++
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch
diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index 7e05bda4f13..de9835e5a7f 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -78,6 +78,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://0001-adapter-restrict-delta-0-RSSI-to-proximity-filters.patch \
file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \
file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \
+ file://0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch \
"
S = "${UNPACKDIR}/bluez-${PV}"
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch
new file mode 100644
index 00000000000..583e2c2e230
--- /dev/null
+++ b/meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch
@@ -0,0 +1,32 @@
+From f1bbe63447bcc69beb546bc1e26a4e99c529d70e Mon Sep 17 00:00:00 2001
+From: Simon Mikuda <simon.mikuda@streamunlimited.com>
+Date: Tue, 9 Jun 2026 23:30:13 +0200
+Subject: [PATCH] avdtp: Return correct error when SEP is inuse
+
+This fixes AVDTP/SNK/ACP/SIG/SMG/BI-08-C
+Upstream-Status: Backport [https://github.com/bluez/bluez/commit/39ad431de60b896a03904887a0f1d0285b719edd]
+Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
+---
+ profiles/audio/avdtp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/profiles/audio/avdtp.c b/profiles/audio/avdtp.c
+index 7cfc9a80d..b57ba609b 100644
+--- a/profiles/audio/avdtp.c
++++ b/profiles/audio/avdtp.c
+@@ -1556,6 +1556,12 @@ static gboolean avdtp_setconf_cmd(struct avdtp *session, uint8_t transaction,
+ goto failed;
+ }
+
++ /* check if SEID is in use */
++ if (find_stream_by_lsep(session, sep)) {
++ err = AVDTP_SEP_IN_USE;
++ goto failed;
++ }
++
+ switch (sep->info.type) {
+ case AVDTP_SEP_TYPE_SOURCE:
+ service = btd_device_get_service(session->device,
+--
+2.34.1
+
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 04/35] bluez5: Fix ABORT response being discarded
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (2 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 03/35] bluez5: Return correct error when SEP is inuse Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 05/35] bluez5: Fix u128_to_string skipping data[4] Yoann Congal
` (31 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Jinwang Li <jinwang.li@oss.qualcomm.com>
Send the ABORT response after transfer_complete(), since it clears
the pending tx queue and was discarding the response first.
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: upstream commit 27b8778e630e ("bluez5: Fix ABORT response being
discarded")]
---
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
...x-Fix-ABORT-response-being-discarded.patch | 44 +++++++++++++++++++
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch
diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index de9835e5a7f..db650acdd03 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -79,6 +79,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch \
file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \
file://0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch \
+ file://0001-gobex-Fix-ABORT-response-being-discarded.patch \
"
S = "${UNPACKDIR}/bluez-${PV}"
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch
new file mode 100644
index 00000000000..5c0d7414ee6
--- /dev/null
+++ b/meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch
@@ -0,0 +1,44 @@
+From 38a88cc433e0bc3cccb6dab126e484fc06ccd8bb Mon Sep 17 00:00:00 2001
+From: Jinwang Li <jinwang.li@oss.qualcomm.com>
+Date: Thu, 27 Aug 2026 16:36:51 +0800
+Subject: [PATCH] gobex: Fix ABORT response being discarded
+
+g_obex_drop_tx_queue() in transfer_complete() clears any pending tx,
+so the ABORT success response should be enqueued after transfer_complete().
+
+Fixes the following PTS test cases:
+- OPP/SR/OPH/BV-27-I
+- FTP/SR/OTR/BV-02-C
+- PBAP/PSE/PDF/BV-06-I
+- PBAP/PSE/PBF/BV-03-I
+
+Fixes: 7a35c12a6ceb ("gobex: Fix segfault caused by interrupted transfer")
+Upstream-Status: Backport [https://github.com/bluez/bluez/commit/d094be10ff0cc9d48714d35557e0fd297f36f907]
+Assisted-by: Claude:claude-sonnet-5
+Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
+---
+ gobex/gobex-transfer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c
+index c94d018b2..e4c7c557d 100644
+--- a/gobex/gobex-transfer.c
++++ b/gobex/gobex-transfer.c
+@@ -314,11 +314,12 @@ static void transfer_abort_req(GObex *obex, GObexPacket *req, gpointer user_data
+
+ err = g_error_new(G_OBEX_ERROR, G_OBEX_ERROR_CANCELLED,
+ "Request was aborted");
+- rsp = g_obex_packet_new(G_OBEX_RSP_SUCCESS, TRUE, G_OBEX_HDR_INVALID);
+- g_obex_send(obex, rsp, NULL);
+
+ transfer_complete(transfer, err);
+ g_error_free(err);
++
++ rsp = g_obex_packet_new(G_OBEX_RSP_SUCCESS, TRUE, G_OBEX_HDR_INVALID);
++ g_obex_send(obex, rsp, NULL);
+ }
+
+ static guint8 put_get_bytes(struct transfer *transfer, GObexPacket *req)
+--
+2.34.1
+
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 05/35] bluez5: Fix u128_to_string skipping data[4]
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (3 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 04/35] bluez5: Fix ABORT response being discarded Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 06/35] gstreamer1.0-plugins-bad: use gtk+3 dependency name Yoann Congal
` (30 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Jinwang Li <jinwang.li@oss.qualcomm.com>
data[3] was used twice, skipping data[4] in the output string.
Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
...p-Fix-u128_to_string-skipping-data-4.patch | 33 +++++++++++++++++++
2 files changed, 34 insertions(+)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch
diff --git a/meta/recipes-connectivity/bluez5/bluez5.inc b/meta/recipes-connectivity/bluez5/bluez5.inc
index db650acdd03..75d76cf96de 100644
--- a/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -80,6 +80,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
file://0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch \
file://0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch \
file://0001-gobex-Fix-ABORT-response-being-discarded.patch \
+ file://0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch \
"
S = "${UNPACKDIR}/bluez-${PV}"
diff --git a/meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch b/meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch
new file mode 100644
index 00000000000..338bc228c16
--- /dev/null
+++ b/meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch
@@ -0,0 +1,33 @@
+From 198f4e0785644cea2b2154b383fc4ad354707947 Mon Sep 17 00:00:00 2001
+From: Jinwang Li <jinwang.li@oss.qualcomm.com>
+Date: Wed, 23 Sep 2026 11:29:57 +0800
+Subject: [PATCH] obexd/pbap: Fix u128_to_string skipping data[4]
+
+u128_to_string uses data[3] twice causing data[4] to be skipped and
+DatabaseIdentifier, PrimaryCounter and SecondaryCounter properties to
+be printed with wrong values.
+
+Fixes: 5ee26d43c65c ("obexd/client: Add DatabaseIdentifier property")
+Upstream-Status: Backport [https://github.com/bluez/bluez/commit/8b4a4176063831476bc9244d20f43b552e4b5554]
+Assisted-by: opencode:claude-sonnet-5
+Signed-off-by: Jinwang Li <jinwang.li@oss.qualcomm.com>
+---
+ obexd/client/pbap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/obexd/client/pbap.c b/obexd/client/pbap.c
+index 0f575e61e..d89b6aafa 100644
+--- a/obexd/client/pbap.c
++++ b/obexd/client/pbap.c
+@@ -1098,7 +1098,7 @@ static int u128_to_string(uint8_t *data, char *str, size_t len)
+ return snprintf(str, len, "%02X%02X%02X%02X%02X%02X%02X%02X"
+ "%02X%02X%02X%02X%02X%02X%02X%02X",
+ data[0], data[1], data[2], data[3],
+- data[3], data[5], data[6], data[7],
++ data[4], data[5], data[6], data[7],
+ data[8], data[9], data[10], data[11],
+ data[12], data[13], data[14], data[15]);
+ }
+--
+2.34.1
+
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 06/35] gstreamer1.0-plugins-bad: use gtk+3 dependency name
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (4 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 05/35] bluez5: Fix u128_to_string skipping data[4] Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 07/35] spdx_common: simplify get_patched_src() implementation Yoann Congal
` (29 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Shantanu Majumdar <shanmaju@qti.qualcomm.com>
Replace the PACKAGECONFIG gtk3 dependency from gtk3+ to
gtk+3 to match the recipe name used in OE-Core.
Signed-off-by: Shantanu Majumdar <shanmaju@qti.qualcomm.com>
Signed-off-by: Tushar Darote <tdarote@qti.qualcomm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 7993331246ac675eef1712ea7fba770518cef5b1)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb
index 17e49ebbda2..1b6a8ac30ba 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad_1.28.5.bb
@@ -49,7 +49,7 @@ PACKAGECONFIG[faac] = "-Dfaac=enabled,-Dfaac=disabled,faac"
PACKAGECONFIG[faad] = "-Dfaad=enabled,-Dfaad=disabled,faad2"
PACKAGECONFIG[fdkaac] = "-Dfdkaac=enabled,-Dfdkaac=disabled,fdk-aac"
PACKAGECONFIG[fluidsynth] = "-Dfluidsynth=enabled,-Dfluidsynth=disabled,fluidsynth"
-PACKAGECONFIG[gtk3] = "-Dgtk3=enabled,-Dgtk3=disabled,gtk3+"
+PACKAGECONFIG[gtk3] = "-Dgtk3=enabled,-Dgtk3=disabled,gtk+3"
PACKAGECONFIG[hls] = "-Dhls=enabled,-Dhls=disabled,"
# Pick atleast one crypto backend below when enabling hls
PACKAGECONFIG[nettle] = "-Dhls-crypto=nettle,,nettle"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 07/35] spdx_common: simplify get_patched_src() implementation
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (5 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 06/35] gstreamer1.0-plugins-bad: use gtk+3 dependency name Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 08/35] spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src() Yoann Congal
` (28 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Benjamin Robin <benjamin.robin@bootlin.com>
The behavior remains unchanged:
- Instead of saving and restoring the values of various variables, use a
copy of the data store via `d.createCopy()`. This prevents side effects
for other tasks.
- This allows removing the `try ... finally` block.
- The function `is_work_shared_spdx()` no longer needs to be called twice.
- In the work-shared case, there is no need to modify `WORKDIR` since no
task is executed from that branch.
Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e0bf8e7c5be3d87376a6c2aab5aca07fd0813763)
Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/lib/oe/spdx_common.py | 81 ++++++++++++++++++--------------------
1 file changed, 39 insertions(+), 42 deletions(-)
diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py
index 6b1a409c40c..9d1e22629b2 100644
--- a/meta/lib/oe/spdx_common.py
+++ b/meta/lib/oe/spdx_common.py
@@ -172,50 +172,47 @@ def get_patched_src(d):
Save patched source of the recipe in SPDX_WORKDIR.
"""
spdx_workdir = d.getVar("SPDXWORK")
- spdx_sysroot_native = d.getVar("STAGING_DIR_NATIVE")
- workdir = d.getVar("WORKDIR")
+ # The kernel class functions require it to be on work-shared, so we don't change WORKDIR
+ if not is_work_shared_spdx(d):
+ spdx_sysroot_native = d.getVar("STAGING_DIR_NATIVE")
+ localdata = d.createCopy()
- try:
- # The kernel class functions require it to be on work-shared, so we dont change WORKDIR
- if not is_work_shared_spdx(d):
- # Change the WORKDIR to make do_unpack do_patch run in another dir.
- d.setVar("WORKDIR", spdx_workdir)
- # Restore the original path to recipe's native sysroot (it's relative to WORKDIR).
- d.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native)
-
- # The changed 'WORKDIR' also caused 'B' changed, create dir 'B' for the
- # possibly requiring of the following tasks (such as some recipes's
- # do_patch required 'B' existed).
- bb.utils.mkdirhier(d.getVar("B"))
-
- bb.build.exec_func("do_unpack", d)
-
- if d.getVar("SRC_URI") != "":
- if bb.data.inherits_class("dos2unix", d):
- bb.build.exec_func("do_convert_crlf_to_lf", d)
- bb.build.exec_func("do_patch", d)
-
- # Copy source from work-share to spdx_workdir
- if is_work_shared_spdx(d):
- share_src = d.getVar("S")
- d.setVar("WORKDIR", spdx_workdir)
- d.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native)
- # Copy source to ${SPDXWORK}, same basename dir of ${S};
- src_dir = spdx_workdir + "/" + os.path.basename(share_src)
- # For kernel souce, rename suffix dir 'kernel-source'
- # to ${BP} (${BPN}-${PV})
- if bb.data.inherits_class("kernel", d):
- src_dir = spdx_workdir + "/" + d.getVar("BP")
-
- bb.note(f"copyhardlinktree {share_src} to {src_dir}")
- oe.path.copyhardlinktree(share_src, src_dir)
-
- # Some userland has no source.
- if not os.path.exists(spdx_workdir):
- bb.utils.mkdirhier(spdx_workdir)
- finally:
- d.setVar("WORKDIR", workdir)
+ # Change the WORKDIR to make do_unpack do_patch run in another dir.
+ localdata.setVar("WORKDIR", spdx_workdir)
+ # Restore the original path to recipe's native sysroot (it's relative to WORKDIR).
+ localdata.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native)
+
+ # The changed 'WORKDIR' also caused 'B' changed, create dir 'B' for the
+ # possibly requiring of the following tasks (such as some recipe's
+ # do_patch required 'B' existed).
+ bb.utils.mkdirhier(localdata.getVar("B"))
+
+ bb.build.exec_func("do_unpack", localdata)
+
+ if localdata.getVar("SRC_URI") != "":
+ if bb.data.inherits_class("dos2unix", localdata):
+ bb.build.exec_func("do_convert_crlf_to_lf", localdata)
+ bb.build.exec_func("do_patch", localdata)
+
+ # Copy source from work-shared to spdx_workdir
+ else:
+ share_src = d.getVar("S")
+
+ if bb.data.inherits_class("kernel", d):
+ # For kernel source, rename suffix dir 'kernel-source' to ${BP} (${BPN}-${PV})
+ dir_name = d.getVar("BP")
+ else:
+ # Copy source to ${SPDXWORK}, same basename dir of ${S}
+ dir_name = os.path.basename(share_src)
+
+ src_dir = f"{spdx_workdir}/{dir_name}"
+ bb.note(f"copyhardlinktree {share_src} to {src_dir}")
+ oe.path.copyhardlinktree(share_src, src_dir)
+
+ # Some userland has no source.
+ if not os.path.exists(spdx_workdir):
+ bb.utils.mkdirhier(spdx_workdir)
def has_task(d, task):
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 08/35] spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (6 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 07/35] spdx_common: simplify get_patched_src() implementation Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 09/35] spdx_common: In get_patched_src() ensure kernel dir name to be ${BP} Yoann Congal
` (27 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Benjamin Robin <benjamin.robin@bootlin.com>
This change will affect the SPDX output: the source file path will no
longer be prefixed by `sources/`.
The rest of the changes are safe because:
- `S` should reference `UNPACKDIR` and not directly reference `WORKDIR`.
- After analyzing all public layers, no `do_unpack()` or `do_patch()` was
found to reference the `${B}` variable. The comment mentioning the
`${B}` variable traces back to [1] (though no further explanation was
provided).
Additionally, this ensures proper capture of sources if the recipe
modifies `UNPACKDIR` outside of `WORKDIR` (though such cases should be
rare).
With these changes, SPDXWORK is no longer a working directory which is
"temporary" replacing WORKDIR, it is now a "temporary" directory containing
unpacked source files.
The run.do_patch.XXXX and associated files are now stored in ${WORKDIR}/temp.
[1] https://github.com/doubleopen-io/meta-doubleopen/blob/e84f0c32663da9c743e4f1802042b733df0e36d7/classes/doubleopen.bbclass#L285
Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit aa44a0f0eb5e260959ebd77f439a5d25b3c1aa2a)
Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: The SPDX change was judged a divergence from usual design where
source paths do not have this "sources/" prefix. So, this patch is a bug
fix. See https://lore.kernel.org/all/DM9S9QJC41I5.HBYN1E0X32YB@smile.fr/ ]
---
meta/lib/oe/spdx30_tasks.py | 1 -
meta/lib/oe/spdx_common.py | 18 +++++-------------
2 files changed, 5 insertions(+), 14 deletions(-)
diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py
index 1821dd7de4a..862e57c3d12 100644
--- a/meta/lib/oe/spdx30_tasks.py
+++ b/meta/lib/oe/spdx30_tasks.py
@@ -873,7 +873,6 @@ def create_spdx(d):
lambda filepath: [oe.spdx30.software_SoftwarePurpose.source],
license_data,
ignore_dirs=[".git"],
- ignore_top_level_dirs=["temp"],
archive=None,
)
build_inputs |= files
diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py
index 9d1e22629b2..013f23ae7c6 100644
--- a/meta/lib/oe/spdx_common.py
+++ b/meta/lib/oe/spdx_common.py
@@ -169,28 +169,20 @@ def collect_package_providers(d, direct_deps):
def get_patched_src(d):
"""
- Save patched source of the recipe in SPDX_WORKDIR.
+ Save patched source of the recipe in SPDXWORK.
"""
spdx_workdir = d.getVar("SPDXWORK")
- # The kernel class functions require it to be on work-shared, so we don't change WORKDIR
+ # Do not unpack the sources again for the recipe using work-shared
if not is_work_shared_spdx(d):
- spdx_sysroot_native = d.getVar("STAGING_DIR_NATIVE")
localdata = d.createCopy()
- # Change the WORKDIR to make do_unpack do_patch run in another dir.
- localdata.setVar("WORKDIR", spdx_workdir)
- # Restore the original path to recipe's native sysroot (it's relative to WORKDIR).
- localdata.setVar("STAGING_DIR_NATIVE", spdx_sysroot_native)
-
- # The changed 'WORKDIR' also caused 'B' changed, create dir 'B' for the
- # possibly requiring of the following tasks (such as some recipe's
- # do_patch required 'B' existed).
- bb.utils.mkdirhier(localdata.getVar("B"))
+ # Change the UNPACKDIR to make do_unpack do_patch run in another dir.
+ localdata.setVar("UNPACKDIR", spdx_workdir)
bb.build.exec_func("do_unpack", localdata)
- if localdata.getVar("SRC_URI") != "":
+ if localdata.getVar("SRC_URI"):
if bb.data.inherits_class("dos2unix", localdata):
bb.build.exec_func("do_convert_crlf_to_lf", localdata)
bb.build.exec_func("do_patch", localdata)
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 09/35] spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (7 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 08/35] spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src() Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 10/35] package: no longer modify paths in save_debugsources_info() Yoann Congal
` (26 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Benjamin Robin <benjamin.robin@bootlin.com>
If a kernel recipe is using a tar file instead of git repository, it is
necessary to override `S` to point to the unpacked tar archive.
In this case `${S}` is not going to be in work-shared. So we must handle
this case in get_patched_src() to ensure that the kernel is extracted in
the following path: `${SPDXWORK}/${BP}`.
For a full detailed analysis see [1], but in summary this change is
necessary because:
- In `save_debugsources_info()` the sources are extracted from the debug
symbol. For the kernel Linux the source file path is modified to look
like `${BP}/init/main.c` (`${KERNEL_SRC_PATH}` is replaced by `${BP}`).
- In `get_patched_src()` the sources of the recipe are extracted (again)
in a sub-directory of `${SPDXWORK}`. If `${S}` is in work-shared and if
the recipe inherits the kernel class, then the sources are extracted in
`${SPDXWORK}/${BP}`.
- In `add_package_files()`, with topdir equal to `${SPDXWORK}`, all the
files (recursively) found in topdir are listed. For each source file,
if the file path (relative to topdir) is in the list of source files
retrieved by save_debugsources_info, then the file is added to the SPDX
SBoM.
- If we are using a tar archive, `${S}` is set for example to
`${UNPACKDIR}/linux-${PV}`, so in `get_patched_src()` the sources are
extracted in `${SPDXWORK}/sources/linux-${PV}` since
`UNPACKDIR = ${WORKDIR}/sources`. `${BP}/init/main.c` is not in
`${SPDXWORK}`, but `sources/linux-${PV}/init/main.c` is.
[1] https://github.com/bootlin/yocto-kiss/pull/26#discussion_r3626224833
Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9bb9763c4c857edfc64aa2ad189a78a4bfb0c897)
Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/lib/oe/spdx_common.py | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py
index 013f23ae7c6..e40cf36bba1 100644
--- a/meta/lib/oe/spdx_common.py
+++ b/meta/lib/oe/spdx_common.py
@@ -187,6 +187,14 @@ def get_patched_src(d):
bb.build.exec_func("do_convert_crlf_to_lf", localdata)
bb.build.exec_func("do_patch", localdata)
+ if bb.data.inherits_class("kernel", localdata):
+ # For kernel source, rename suffix dir to ${BP} (${BPN}-${PV})
+ dir_name = localdata.getVar("BP")
+ kernel_dst_path = f"{spdx_workdir}/{dir_name}"
+ kernel_src_path = localdata.getVar("S")
+ if not os.path.exists(kernel_dst_path):
+ shutil.move(kernel_src_path, kernel_dst_path)
+
# Copy source from work-shared to spdx_workdir
else:
share_src = d.getVar("S")
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 10/35] package: no longer modify paths in save_debugsources_info()
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (8 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 09/35] spdx_common: In get_patched_src() ensure kernel dir name to be ${BP} Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 11/35] python3-pyelftools: add missing runtime dependencies Yoann Congal
` (25 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Benjamin Robin <benjamin.robin@bootlin.com>
The source files saved in `${PN}-debugsources.json.zstd` are now saved as
is: "/usr/src/kernel/" is no longer replaced by "${BP}/". However, the
file list is still filtered to exclude "<internal>" or "<built-in>", ...
With this modification, the content of `${PN}-debugsources.json.zstd`
is no longer specific or tied to SPDX generation.
The logic that modified the source file paths to match what SPDX
generation expects is now in `oe.spdx_common.get_compiled_sources()`.
Furthermore, previously, for all non-kernel recipes the source paths were
never "resolved", since the KERNEL_SRC_PATH variable is always defined.
So the returned source file paths always started with
`/usr/src/debug/${PN}/${PV}` (the value of TARGET_DBGSRC_DIR).
Update the source file paths to match what the SPDX generation expects:
- In `get_patched_src()`, the sources of the recipe are extracted
(again). The unpack task runs in a modified local context with
UNPACKDIR set to the value of `${SPDXWORK}`, so the sources end up
extracted in a sub-directory of `${SPDXWORK}`.
- In `add_package_files()`, all files below topdir, set to `${SPDXWORK}`,
are (recursively) listed. For each source file, if its path (relative
to topdir) is in the list returned by `get_compiled_sources()`, the
file is added to the SPDX SBoM.
Handle this by replacing ${TARGET_DBGSRC_DIR} with the relative path of
${S} relative to ${UNPACKDIR}. If ${S} is not relative to ${UNPACKDIR},
do nothing.
Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b567c2f0d91fbf36886d0c3a6f6ea90c07771044)
Signed-off-by: Kazuyoshi Akiyama <kazuyoshi_akiyama@jp.honda>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/lib/oe/package.py | 54 ++++++++++++++++++--------------------
meta/lib/oe/spdx_common.py | 42 ++++++++++++++++++++++++-----
2 files changed, 61 insertions(+), 35 deletions(-)
diff --git a/meta/lib/oe/package.py b/meta/lib/oe/package.py
index c375acc1242..bef3c92a259 100644
--- a/meta/lib/oe/package.py
+++ b/meta/lib/oe/package.py
@@ -1060,37 +1060,33 @@ def copydebugsources(debugsrcdir, sources, d):
os.rmdir(p)
@bb.parse.vardepsexclude("BB_NUMBER_THREADS")
-def save_debugsources_info(debugsrcdir, sources_raw, d):
+def save_debugsources_info(sources_raw, d):
import json
import bb.compress.zstd
- if debugsrcdir and sources_raw:
- debugsources_file = d.expand("${PKGDESTWORK}/debugsources/${PN}-debugsources.json.zstd")
- debugsources_dir = os.path.dirname(debugsources_file)
- if not os.path.isdir(debugsources_dir):
- bb.utils.mkdirhier(debugsources_dir)
- bb.utils.remove(debugsources_file)
- workdir = d.getVar("WORKDIR")
- pn = d.getVar('PN')
-
- # Kernel sources are in a different directory and are special case
- # we format the sources as expected by spdx by replacing /usr/src/kernel/
- # into BP/
- kernel_src = d.getVar('KERNEL_SRC_PATH')
- bp = d.getVar('BP')
- sources_dict = {}
- for file, src_files in sources_raw:
- file_clean = file.replace(f"{workdir}/package/","")
- sources_clean = [
- src.replace(f"{debugsrcdir}/{pn}/", "")
- if not kernel_src else src.replace(f"{kernel_src}/", f"{bp}/")
- for src in src_files
- if not any(keyword in src for keyword in ("<internal>", "<built-in>")) and not src.endswith("/")
- ]
- sources_dict[file_clean] = sorted(sources_clean)
- num_threads = int(d.getVar("BB_NUMBER_THREADS"))
- with bb.compress.zstd.open(debugsources_file, "wt", encoding="utf-8", num_threads=num_threads) as f:
- json.dump(sources_dict, f, sort_keys=True)
+ if not sources_raw:
+ return
+
+ debugsources_file = d.expand("${PKGDESTWORK}/debugsources/${PN}-debugsources.json.zstd")
+ debugsources_dir = os.path.dirname(debugsources_file)
+ if not os.path.isdir(debugsources_dir):
+ bb.utils.mkdirhier(debugsources_dir)
+ bb.utils.remove(debugsources_file)
+
+ workdir = d.getVar("WORKDIR")
+
+ def _filter_src_file(src):
+ if src.endswith("/"):
+ return False
+ return not any(keyword in src for keyword in ("<internal>", "<built-in>"))
+
+ sources_dict = {}
+ for file, src_files in sources_raw:
+ file_clean = file.replace(f"{workdir}/package/", "")
+ sources_dict[file_clean] = sorted(filter(_filter_src_file, src_files))
+ num_threads = int(d.getVar("BB_NUMBER_THREADS"))
+ with bb.compress.zstd.open(debugsources_file, "wt", encoding="utf-8", num_threads=num_threads) as f:
+ json.dump(sources_dict, f, sort_keys=True)
@bb.parse.vardepsexclude("BB_NUMBER_THREADS")
def read_debugsources_info(d):
@@ -1337,7 +1333,7 @@ def process_split_and_strip_files(d):
copydebugsources(dv["srcdir"], sources, d)
# Save source info to be accessible to other tasks
- save_debugsources_info(dv["srcdir"], results, d)
+ save_debugsources_info(results, d)
#
# End of debug splitting
#
diff --git a/meta/lib/oe/spdx_common.py b/meta/lib/oe/spdx_common.py
index e40cf36bba1..f885f1832ae 100644
--- a/meta/lib/oe/spdx_common.py
+++ b/meta/lib/oe/spdx_common.py
@@ -277,14 +277,44 @@ def get_compiled_sources(d):
bb.debug(1, "Do not have debugsources.list. Skipping")
return [], []
- # Sources are not split now in SPDX, so we aggregate them
- sources = set(itertools.chain.from_iterable(source_info.values()))
- # Check extensions of files
+ unpackdir = d.getVar("UNPACKDIR")
+ srcdir = d.getVar("S")
+ bp = d.getVar("BP")
+ kernel_src = d.getVar("KERNEL_SRC_PATH")
+ dbgsrc_dir = d.getVar("TARGET_DBGSRC_DIR")
+
+ # Compute the relative path of source directory from ${UNPACKDIR}.
+ # The goal is to replace ${TARGET_DBGSRC_DIR} by this relative path.
+ srcdir_rel = None
+ if srcdir and unpackdir:
+ srcdir_rel = os.path.relpath(srcdir, unpackdir)
+ if srcdir_rel.startswith(".."):
+ srcdir_rel = None
+
+ sources = set()
types = set()
- for src in sources:
+
+ # Sources are not split now in SPDX, so we aggregate them
+ for src in set(itertools.chain.from_iterable(source_info.values())):
+ # In the common case, the sources are located in ${S}. To format them as
+ # expected by SPDX, we replace /usr/src/debug/${PN}/${PV} with the path
+ # of ${S} relative to ${UNPACKDIR}.
+ if dbgsrc_dir and srcdir_rel:
+ src = src.replace(f"{dbgsrc_dir}/", f"{srcdir_rel}/")
+
+ # Kernel sources are in a different directory and are special case
+ # we format the sources as expected by spdx by replacing /usr/src/kernel/
+ # into ${BP}/
+ if kernel_src and bp:
+ src = src.replace(f"{kernel_src}/", f"{bp}/")
+
+ sources.add(src)
+
+ # Check extensions of files
basename = os.path.basename(src)
ext = basename.partition(".")[2]
- if ext not in types and ext:
+ if ext:
types.add(ext)
- bb.debug(1, f"Num of sources: {len(sources)} and types: {len(types)} {str(types)}")
+
+ bb.debug(1, f"Num of sources: {len(sources)} and types: {len(types)} {types!s}")
return sources, types
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 11/35] python3-pyelftools: add missing runtime dependencies
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (9 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 10/35] package: no longer modify paths in save_debugsources_info() Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 12/35] kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps Yoann Congal
` (24 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
python3-asyncio and python3-json are needed as runtime dependencies of
python3-pyelftools else the readelf.py script run into the following errors :
```
Traceback (most recent call last):
File "/bin/readelf.py", line 30, in <module>
from elftools.common.utils import bytes2str, iterbytes
File "/usr/lib/python3.14/site-packages/elftools/common/utils.py", line 11, in <module>
from ..construct import ConstructError, ULInt8
File "/usr/lib/python3.14/site-packages/elftools/construct/__init__.py", line 36, in <module>
from .debug import Probe, Debugger
File "/usr/lib/python3.14/site-packages/elftools/construct/debug.py", line 7, in <module>
import pdb
File "/usr/lib/python3.14/pdb.py", line 87, in <module>
import asyncio
ModuleNotFoundError: No module named 'asyncio'
```
```
Traceback (most recent call last):
File "/bin/readelf.py", line 30, in <module>
from elftools.common.utils import bytes2str, iterbytes
File "/usr/lib/python3.14/site-packages/elftools/common/utils.py", line 11, in <module>
from ..construct import ConstructError, ULInt8
File "/usr/lib/python3.14/site-packages/elftools/construct/__init__.py", line 36, in <module>
from .debug import Probe, Debugger
File "/usr/lib/python3.14/site-packages/elftools/construct/debug.py", line 7, in <module>
import pdb
File "/usr/lib/python3.14/pdb.py", line 77, in <module>
import json
ModuleNotFoundError: No module named 'json'
```
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Reviewed-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
Reviewed-by: Wahid ESSID <wahid.essid@se.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0dc1a2f9df58cf2dd1418426e38e95372aecdcde)
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3-pyelftools_0.32.bb | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/python/python3-pyelftools_0.32.bb b/meta/recipes-devtools/python/python3-pyelftools_0.32.bb
index 7e50cef2488..76cf22266bc 100644
--- a/meta/recipes-devtools/python/python3-pyelftools_0.32.bb
+++ b/meta/recipes-devtools/python/python3-pyelftools_0.32.bb
@@ -12,4 +12,10 @@ inherit pypi python_setuptools_build_meta
BBCLASSEXTEND = "native"
-RDEPENDS:${PN} += "python3-debugger python3-pprint python3-logging"
+RDEPENDS:${PN} += " \
+ python3-debugger \
+ python3-pprint \
+ python3-logging \
+ python3-asyncio \
+ python3-json \
+"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 12/35] kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (10 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 11/35] python3-pyelftools: add missing runtime dependencies Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 13/35] boost: patch CVE-2023-34399 Yoann Congal
` (23 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Adrian Freihofer <adrian.freihofer@siemens.com>
do_compile only reads the per-loadable flags of the FIT_LOADABLE_*
variables with d.getVarFlag('FIT_LOADABLE_*', loadable), never their
values. As the flag names are not literals, bitbake cannot track these
accesses, so the flags are not part of the do_compile signature.
Changing e.g. FIT_LOADABLE_LOADADDRESS[atf] did not trigger a rebuild
and a stale FIT image was reused.
When FIT_LOADABLES is set, add the FIT_LOADABLE_* variables to
do_compile[vardeps] with a single appendVarFlag call after the loop
that already processes them.
Referencing a variable includes all its flags in the signature.
While at it, fix the duplicated word in the comment.
This is a fixup for commit 2535427d8de0
"kernel-fit-image: support arbitrary loadables"
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 418a35dd0b4a6d0ccddb49047f059120907f6061)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes-recipe/kernel-fit-image.bbclass | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/meta/classes-recipe/kernel-fit-image.bbclass b/meta/classes-recipe/kernel-fit-image.bbclass
index cfe43a5a306..db4798d0818 100644
--- a/meta/classes-recipe/kernel-fit-image.bbclass
+++ b/meta/classes-recipe/kernel-fit-image.bbclass
@@ -32,17 +32,19 @@ python () {
# Parse loadables config
loadables = d.getVar('FIT_LOADABLES')
if loadables:
- # Check that the loadables configuration variables are not set directly
- # directly, then assign them a synthetic value for testability purposes
- for v in ['FIT_LOADABLE_ARCH', 'FIT_LOADABLE_COMPRESSION',
- 'FIT_LOADABLE_DESCRIPTION', 'FIT_LOADABLE_ENTRYPOINT',
- 'FIT_LOADABLE_FILENAME', 'FIT_LOADABLE_LOADADDRESS',
- 'FIT_LOADABLE_OS', 'FIT_LOADABLE_TYPE']:
+ # Forbid direct assignment, set synthetic values for testability and
+ # add the vars to vardeps so their flags are part of the signature.
+ loadable_vars = ['FIT_LOADABLE_ARCH', 'FIT_LOADABLE_COMPRESSION',
+ 'FIT_LOADABLE_DESCRIPTION', 'FIT_LOADABLE_ENTRYPOINT',
+ 'FIT_LOADABLE_FILENAME', 'FIT_LOADABLE_LOADADDRESS',
+ 'FIT_LOADABLE_OS', 'FIT_LOADABLE_TYPE']
+ for v in loadable_vars:
if d.getVar(v):
raise bb.parse.SkipRecipe("You cannot use %s as a variable, you can only set flags." % v)
synt_value = " ? ".join([ d.getVarFlag(v, loadable) or "" for loadable in loadables.split() ])
d.setVar(v, synt_value)
+ d.appendVarFlag('do_compile', 'vardeps', ' ' + ' '.join(loadable_vars))
}
do_configure[noexec] = "1"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 13/35] boost: patch CVE-2023-34399
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (11 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 12/35] kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 14/35] go: upgrade 1.26.9 -> 1.26.10 Yoann Congal
` (22 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ba56fd3e9258e2351c31a402d63ac470d43c8d54)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../boost/boost/CVE-2023-34399.patch | 35 +++++++++++++++++++
meta/recipes-support/boost/boost_1.90.0.bb | 1 +
2 files changed, 36 insertions(+)
create mode 100644 meta/recipes-support/boost/boost/CVE-2023-34399.patch
diff --git a/meta/recipes-support/boost/boost/CVE-2023-34399.patch b/meta/recipes-support/boost/boost/CVE-2023-34399.patch
new file mode 100644
index 00000000000..f2dbccd67e9
--- /dev/null
+++ b/meta/recipes-support/boost/boost/CVE-2023-34399.patch
@@ -0,0 +1,35 @@
+From d772add4873bb2501d67554190c4272294d659f9 Mon Sep 17 00:00:00 2001
+From: Johnathan <39648915+TrebledJ@users.noreply.github.com>
+Date: Wed, 19 Aug 2026 16:50:08 +0200
+Subject: [PATCH] Reject a negative class id when loading a pointer (#332)
+
+A pointer carries the class id of what it points at, and a null pointer
+carries -1. On the way back in, only -1 was recognised as the null tag,
+and the id then indexed the class table with an upper bound check but no
+lower bound one, so an archive carrying any other negative id read that
+table at an offset of its own choosing. This is CVE-2023-34399.
+
+Treat every negative id as the null tag. No archive a released version
+ever wrote carries one other than -1, so nothing that used to load stops
+loading.
+
+CVE: CVE-2023-34399
+Upstream-Status: Backport [https://github.com/boostorg/serialization/commit/d772add4873bb2501d67554190c4272294d659f9]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libs/serialization/src/basic_iarchive.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libs/serialization/src/basic_iarchive.cpp b/libs/serialization/src/basic_iarchive.cpp
+index 1c6eb2047..b5c63c9ad 100644
+--- a/libs/serialization/src/basic_iarchive.cpp
++++ b/libs/serialization/src/basic_iarchive.cpp
+@@ -427,7 +427,7 @@ basic_iarchive_impl::load_pointer(
+ class_id_type cid;
+ load(ar, cid);
+
+- if(BOOST_SERIALIZATION_NULL_POINTER_TAG == cid){
++ if(/* BOOST_SERIALIZATION_NULL_POINTER_TAG */ cid < 0){
+ t = NULL;
+ return bpis_ptr;
+ }
diff --git a/meta/recipes-support/boost/boost_1.90.0.bb b/meta/recipes-support/boost/boost_1.90.0.bb
index 4b580d078be..c66f182384d 100644
--- a/meta/recipes-support/boost/boost_1.90.0.bb
+++ b/meta/recipes-support/boost/boost_1.90.0.bb
@@ -4,4 +4,5 @@ require boost.inc
SRC_URI += "file://boost-math-disable-pch-for-gcc.patch \
file://0001-Don-t-set-up-arch-instruction-set-flags-we-do-that-o.patch \
file://0001-dont-setup-compiler-flags-m32-m64.patch \
+ file://CVE-2023-34399.patch \
"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 14/35] go: upgrade 1.26.9 -> 1.26.10
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (12 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 13/35] boost: patch CVE-2023-34399 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 15/35] glib-2.0: patch CVE-2026-16118 Yoann Congal
` (21 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Upgrade to latest 1.26.x release [1]:
$ git --no-pager log --oneline go1.26.9..go1.26.10
4e8c85f531 (tag: go1.26.10) [release-branch.go1.26] go1.26.10
aa64342a9e [release-branch.go1.26] crypto/x509: distrust a handful of intermediates
51e7ce32a8 [release-branch.go1.26] cmd/internal/moddeps: restore tests
Fixes CVE-2026-111943
Release information: [2]
[1] https://github.com/golang/go/compare/go1.26.9...go1.26.10
[2] https://groups.google.com/g/golang-announce/c/66pojueaQek
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a typo in git log command]
---
meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} | 2 +-
...-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} | 6 +++---
...ross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} | 0
.../go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} | 0
.../go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} | 0
.../go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} | 0
meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} | 0
7 files changed, 4 insertions(+), 4 deletions(-)
rename meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} (90%)
rename meta/recipes-devtools/go/{go-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} (80%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} (100%)
rename meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} (100%)
diff --git a/meta/recipes-devtools/go/go-1.26.9.inc b/meta/recipes-devtools/go/go-1.26.10.inc
similarity index 90%
rename from meta/recipes-devtools/go/go-1.26.9.inc
rename to meta/recipes-devtools/go/go-1.26.10.inc
index e2657cf8ad8..035da371f22 100644
--- a/meta/recipes-devtools/go/go-1.26.9.inc
+++ b/meta/recipes-devtools/go/go-1.26.10.inc
@@ -16,4 +16,4 @@ SRC_URI += "\
file://0009-go-Filter-build-paths-on-staticly-linked-arches.patch \
file://0010-cmd-go-clear-GOROOT-for-func-ldShared-when-trimpath-.patch \
"
-SRC_URI[main.sha256sum] = "9735d7dcdb65b35d3fa577f04064737c03b89cf1a2b71e6e69fe2f3c6f9fd4ca"
+SRC_URI[main.sha256sum] = "fd63e883ba2f2bfca93c1646b31ebef63e2b1e4d2b317c9789d976a68d81f36f"
diff --git a/meta/recipes-devtools/go/go-binary-native_1.26.9.bb b/meta/recipes-devtools/go/go-binary-native_1.26.10.bb
similarity index 80%
rename from meta/recipes-devtools/go/go-binary-native_1.26.9.bb
rename to meta/recipes-devtools/go/go-binary-native_1.26.10.bb
index a42ce443604..67201c8b748 100644
--- a/meta/recipes-devtools/go/go-binary-native_1.26.9.bb
+++ b/meta/recipes-devtools/go/go-binary-native_1.26.10.bb
@@ -9,9 +9,9 @@ PROVIDES = "go-native"
# Checksums available at https://go.dev/dl/
SRC_URI = "https://dl.google.com/go/go${PV}.${BUILD_GOOS}-${BUILD_GOARCH}.tar.gz;name=go_${BUILD_GOTUPLE}"
-SRC_URI[go_linux_amd64.sha256sum] = "42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
-SRC_URI[go_linux_arm64.sha256sum] = "4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052"
-SRC_URI[go_linux_ppc64le.sha256sum] = "a21a65001146ca0c6c022c690d5418f8298c5513a81fb5eed42f6cdb29f40063"
+SRC_URI[go_linux_amd64.sha256sum] = "ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5"
+SRC_URI[go_linux_arm64.sha256sum] = "3f4227ce7b206a513e794f1393adb473a07b46e94d18bd15d1c684bbb7319797"
+SRC_URI[go_linux_ppc64le.sha256sum] = "4492031a19657de3bd7e4c48dce9d9e5aa7b668300f7c2c98e620b9ac0ee84ee"
UPSTREAM_CHECK_URI = "https://golang.org/dl/"
UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux"
diff --git a/meta/recipes-devtools/go/go-cross-canadian_1.26.9.bb b/meta/recipes-devtools/go/go-cross-canadian_1.26.10.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-cross-canadian_1.26.9.bb
rename to meta/recipes-devtools/go/go-cross-canadian_1.26.10.bb
diff --git a/meta/recipes-devtools/go/go-cross_1.26.9.bb b/meta/recipes-devtools/go/go-cross_1.26.10.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-cross_1.26.9.bb
rename to meta/recipes-devtools/go/go-cross_1.26.10.bb
diff --git a/meta/recipes-devtools/go/go-crosssdk_1.26.9.bb b/meta/recipes-devtools/go/go-crosssdk_1.26.10.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-crosssdk_1.26.9.bb
rename to meta/recipes-devtools/go/go-crosssdk_1.26.10.bb
diff --git a/meta/recipes-devtools/go/go-runtime_1.26.9.bb b/meta/recipes-devtools/go/go-runtime_1.26.10.bb
similarity index 100%
rename from meta/recipes-devtools/go/go-runtime_1.26.9.bb
rename to meta/recipes-devtools/go/go-runtime_1.26.10.bb
diff --git a/meta/recipes-devtools/go/go_1.26.9.bb b/meta/recipes-devtools/go/go_1.26.10.bb
similarity index 100%
rename from meta/recipes-devtools/go/go_1.26.9.bb
rename to meta/recipes-devtools/go/go_1.26.10.bb
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 15/35] glib-2.0: patch CVE-2026-16118
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (13 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 14/35] go: upgrade 1.26.9 -> 1.26.10 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 16/35] python3-pip: patch the vendored python3-certifi Yoann Congal
` (20 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../glib-2.0/files/CVE-2026-16118.patch | 48 +++++++++++++++++++
meta/recipes-core/glib-2.0/glib.inc | 1 +
2 files changed, 49 insertions(+)
create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch
diff --git a/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch b/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch
new file mode 100644
index 00000000000..72a387079e0
--- /dev/null
+++ b/meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch
@@ -0,0 +1,48 @@
+From ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5 Mon Sep 17 00:00:00 2001
+From: Kashyap Ekbote <kashyap.ekbote@gmail.com>
+Date: Wed, 5 Aug 2026 20:50:10 +0530
+Subject: [PATCH] Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c
+
+Fix out-of-bounds write in the byte-swap routine of
+_xdg_mime_magic_parse_magic_line(). On little-endian systems, the
+write side of the swap casts the base pointer to a wider type before
+adding the byte offset, causing pointer arithmetic to scale by
+sizeof(type) instead of 1. With value_length=4 and word_size=2, the
+loop writes 2 bytes past the allocated matchlet->value buffer at i=2.
+
+Parenthesize (ptr + i) before the cast so both the read and write
+sides use byte offsets.
+
+Upstream: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41
+
+CVE: CVE-2026-16118
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ gio/xdgmime/xdgmimemagic.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/gio/xdgmime/xdgmimemagic.c b/gio/xdgmime/xdgmimemagic.c
+index 98a1274c8..fe374eb4e 100644
+--- a/gio/xdgmime/xdgmimemagic.c
++++ b/gio/xdgmime/xdgmimemagic.c
+@@ -483,15 +483,15 @@ _xdg_mime_magic_parse_magic_line (FILE *magic_file,
+ for (i = 0; i < matchlet->value_length; i = i + matchlet->word_size)
+ {
+ if (matchlet->word_size == 2)
+- *((xdg_uint16_t *) matchlet->value + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i)));
++ *((xdg_uint16_t *) (matchlet->value + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i)));
+ else if (matchlet->word_size == 4)
+- *((xdg_uint32_t *) matchlet->value + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i)));
++ *((xdg_uint32_t *) (matchlet->value + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i)));
+ if (matchlet->mask)
+ {
+ if (matchlet->word_size == 2)
+- *((xdg_uint16_t *) matchlet->mask + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i)));
++ *((xdg_uint16_t *) (matchlet->mask + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i)));
+ else if (matchlet->word_size == 4)
+- *((xdg_uint32_t *) matchlet->mask + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i)));
++ *((xdg_uint32_t *) (matchlet->mask + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i)));
+
+ }
+ }
diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc
index 7e7725f9bd3..aec875a3dff 100644
--- a/meta/recipes-core/glib-2.0/glib.inc
+++ b/meta/recipes-core/glib-2.0/glib.inc
@@ -237,6 +237,7 @@ SRC_URI += "\
file://skip-timeout.patch \
file://CVE-2026-58016-1.patch \
file://CVE-2026-58016-2.patch \
+ file://CVE-2026-16118.patch \
"
SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 16/35] python3-pip: patch the vendored python3-certifi
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (14 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 15/35] glib-2.0: patch CVE-2026-16118 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 17/35] python3: upgrade 3.14.7 -> 3.14.9 Yoann Congal
` (19 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Jeroen Hofstee <jhofstee@victronenergy.com>
Like python3-certifi: remove emSign CAs.
See https://emudhra.we-have-a-problem.com.
Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python3-pip/0001-Remove-emsign-437.patch | 142 ++++++++++++++++++
...tore-unaffected-emSign-roots-439-440.patch | 108 +++++++++++++
.../python/python3-pip_26.0.1.bb | 2 +
3 files changed, 252 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch
create mode 100644 meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch
diff --git a/meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch b/meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch
new file mode 100644
index 00000000000..31baa73511d
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch
@@ -0,0 +1,142 @@
+From 0802dcc6194b35b0eeb86e52248ace5eadc300cd Mon Sep 17 00:00:00 2001
+From: Alex Gaynor <alex.gaynor@gmail.com>
+Date: Sun, 18 Oct 2026 12:19:26 -0400
+Subject: [PATCH 1/2] Remove emsign (#437)
+
+* Remove emSign CAs
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+
+* 2026.10.18
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+---------
+
+Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
+(cherry picked from commit 5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8)
+
+Upstream-Status: Backport [https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8]
+---
+ certifi/cacert.pem | 104 ---------------------------------------------
+ 1 file changed, 104 deletions(-)
+
+diff --git a/certifi/cacert.pem b/certifi/cacert.pem
+index fac3c31..d4e81a7 100644
+--- a/certifi/cacert.pem
++++ b/certifi/cacert.pem
+@@ -2954,110 +2954,6 @@ jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw
+ 3kAP+HwV96LOPNdeE4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0=
+ -----END CERTIFICATE-----
+
+-# Issuer: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI
+-# Subject: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI
+-# Label: "emSign Root CA - G1"
+-# Serial: 235931866688319308814040
+-# MD5 Fingerprint: 9c:42:84:57:dd:cb:0b:a7:2e:95:ad:b6:f3:da:bc:ac
+-# SHA1 Fingerprint: 8a:c7:ad:8f:73:ac:4e:c1:b5:75:4d:a5:40:f4:fc:cf:7c:b5:8e:8c
+-# SHA256 Fingerprint: 40:f6:af:03:46:a9:9a:a1:cd:1d:55:5a:4e:9c:ce:62:c7:f9:63:46:03:ee:40:66:15:83:3d:c8:c8:d0:03:67
+------BEGIN CERTIFICATE-----
+-MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD
+-VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU
+-ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH
+-MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO
+-MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv
+-Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN
+-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz
+-f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO
+-8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq
+-d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM
+-tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt
+-Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB
+-o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD
+-AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x
+-PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM
+-wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d
+-GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH
+-6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby
+-RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx
+-iN66zB+Afko=
+------END CERTIFICATE-----
+-
+-# Issuer: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited OU=emSign PKI
+-# Subject: CN=emSign ECC Root CA - G3 O=eMudhra Technologies Limited OU=emSign PKI
+-# Label: "emSign ECC Root CA - G3"
+-# Serial: 287880440101571086945156
+-# MD5 Fingerprint: ce:0b:72:d1:9f:88:8e:d0:50:03:e8:e3:b8:8b:67:40
+-# SHA1 Fingerprint: 30:43:fa:4f:f2:57:dc:a0:c3:80:ee:2e:58:ea:78:b2:3f:e6:bb:c1
+-# SHA256 Fingerprint: 86:a1:ec:ba:08:9c:4a:8d:3b:be:27:34:c6:12:ba:34:1d:81:3e:04:3c:f9:e8:a8:62:cd:5c:57:a3:6b:be:6b
+------BEGIN CERTIFICATE-----
+-MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQG
+-EwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNo
+-bm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0g
+-RzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJ
+-TjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9s
+-b2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMw
+-djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0
+-WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xyS
+-fvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuB
+-zhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggq
+-hkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWB
+-CUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD
+-+JbNR6iC8hZVdyR+EhCVBCyj
+------END CERTIFICATE-----
+-
+-# Issuer: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI
+-# Subject: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI
+-# Label: "emSign Root CA - C1"
+-# Serial: 825510296613316004955058
+-# MD5 Fingerprint: d8:e3:5d:01:21:fa:78:5a:b0:df:ba:d2:ee:2a:5f:68
+-# SHA1 Fingerprint: e7:2e:f1:df:fc:b2:09:28:cf:5d:d4:d5:67:37:b1:51:cb:86:4f:01
+-# SHA256 Fingerprint: 12:56:09:aa:30:1d:a0:a2:49:b9:7a:82:39:cb:6a:34:21:6f:44:dc:ac:9f:39:54:b1:42:92:f2:e8:c8:60:8f
+------BEGIN CERTIFICATE-----
+-MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG
+-A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg
+-SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw
+-MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
+-biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v
+-dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ
+-BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ
+-HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH
+-3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH
+-GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c
+-xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1
+-aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq
+-TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+-BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87
+-/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4
+-kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG
+-YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT
+-+xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo
+-WXzhriKi4gp6D/piq1JM4fHfyr6DDUI=
+------END CERTIFICATE-----
+-
+-# Issuer: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI
+-# Subject: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI
+-# Label: "emSign ECC Root CA - C3"
+-# Serial: 582948710642506000014504
+-# MD5 Fingerprint: 3e:53:b3:a3:81:ee:d7:10:f8:d3:b0:1d:17:92:f5:d5
+-# SHA1 Fingerprint: b6:af:43:c2:9b:81:53:7d:f6:ef:6b:c3:1f:1f:60:15:0c:ee:48:66
+-# SHA256 Fingerprint: bc:4d:80:9b:15:18:9d:78:db:3e:1d:8c:f4:f9:72:6a:79:5d:a1:64:3c:a5:f1:35:8e:1d:db:0e:dc:0d:7e:b3
+------BEGIN CERTIFICATE-----
+-MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG
+-EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx
+-IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw
+-MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
+-biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND
+-IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci
+-MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti
+-sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O
+-BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
+-Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c
+-3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J
+-0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ==
+------END CERTIFICATE-----
+-
+ # Issuer: CN=Hongkong Post Root CA 3 O=Hongkong Post
+ # Subject: CN=Hongkong Post Root CA 3 O=Hongkong Post
+ # Label: "Hongkong Post Root CA 3"
+--
+2.53.0
+
diff --git a/meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch b/meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch
new file mode 100644
index 00000000000..f129adc4bbc
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch
@@ -0,0 +1,108 @@
+From e82ee82a34e70a4fbf5003ba6cf2fcd62a24d764 Mon Sep 17 00:00:00 2001
+From: Nathan Neulinger <nneul@neulinger.org>
+Date: Mon, 19 Oct 2026 21:10:51 -0500
+Subject: [PATCH 2/2] Restore unaffected emSign roots (#439) (#440)
+
+(cherry picked from commit 662df63d7906df66f1f07c0751a3dfe9da14d914)
+Upstream-Status: Backport [https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914]
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+---
+ certifi/cacert.pem | 81 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 81 insertions(+)
+
+diff --git a/certifi/cacert.pem b/certifi/cacert.pem
+index d4e81a7..4c74ecd 100644
+--- a/certifi/cacert.pem
++++ b/certifi/cacert.pem
+@@ -2954,6 +2954,87 @@ jWZSaX5LaAzHHjcng6WMxwLkFM1JAbBzs/3GkDpv0mztO+7skb6iQ12LAEpmJURw
+ 3kAP+HwV96LOPNdeE4yBFxgX0b3xdxA61GU5wSesVywlVP+i2k+KYTlerj1KjL0=
+ -----END CERTIFICATE-----
+
++# Issuer: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI
++# Subject: CN=emSign Root CA - G1 O=eMudhra Technologies Limited OU=emSign PKI
++# Label: "emSign Root CA - G1"
++# Serial: 235931866688319308814040
++# MD5 Fingerprint: 9c:42:84:57:dd:cb:0b:a7:2e:95:ad:b6:f3:da:bc:ac
++# SHA1 Fingerprint: 8a:c7:ad:8f:73:ac:4e:c1:b5:75:4d:a5:40:f4:fc:cf:7c:b5:8e:8c
++# SHA256 Fingerprint: 40:f6:af:03:46:a9:9a:a1:cd:1d:55:5a:4e:9c:ce:62:c7:f9:63:46:03:ee:40:66:15:83:3d:c8:c8:d0:03:67
++-----BEGIN CERTIFICATE-----
++MIIDlDCCAnygAwIBAgIKMfXkYgxsWO3W2DANBgkqhkiG9w0BAQsFADBnMQswCQYD
++VQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBU
++ZWNobm9sb2dpZXMgTGltaXRlZDEcMBoGA1UEAxMTZW1TaWduIFJvb3QgQ0EgLSBH
++MTAeFw0xODAyMTgxODMwMDBaFw00MzAyMTgxODMwMDBaMGcxCzAJBgNVBAYTAklO
++MRMwEQYDVQQLEwplbVNpZ24gUEtJMSUwIwYDVQQKExxlTXVkaHJhIFRlY2hub2xv
++Z2llcyBMaW1pdGVkMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEcxMIIBIjAN
++BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAk0u76WaK7p1b1TST0Bsew+eeuGQz
++f2N4aLTNLnF115sgxk0pvLZoYIr3IZpWNVrzdr3YzZr/k1ZLpVkGoZM0Kd0WNHVO
++8oG0x5ZOrRkVUkr+PHB1cM2vK6sVmjM8qrOLqs1D/fXqcP/tzxE7lM5OMhbTI0Aq
++d7OvPAEsbO2ZLIvZTmmYsvePQbAyeGHWDV/D+qJAkh1cF+ZwPjXnorfCYuKrpDhM
++tTk1b+oDafo6VGiFbdbyL0NVHpENDtjVaqSW0RM8LHhQ6DqS0hdW5TUaQBw+jSzt
++Od9C4INBdN+jzcKGYEho42kLVACL5HZpIQ15TjQIXhTCzLG3rdd8cIrHhQIDAQAB
++o0IwQDAdBgNVHQ4EFgQU++8Nhp6w492pufEhF38+/PB3KxowDgYDVR0PAQH/BAQD
++AgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAFn/8oz1h31x
++PaOfG1vR2vjTnGs2vZupYeveFix0PZ7mddrXuqe8QhfnPZHr5X3dPpzxz5KsbEjM
++wiI/aTvFthUvozXGaCocV685743QNcMYDHsAVhzNixl03r4PEuDQqqE/AjSxcM6d
++GNYIAwlG7mDgfrbESQRRfXBgvKqy/3lyeqYdPV8q+Mri/Tm3R7nrft8EI6/6nAYH
++6ftjk4BAtcZsCjEozgyfz7MjNYBBjWzEN3uBL4ChQEKF6dk4jeihU80Bv2noWgby
++RQuQ+q7hv53yrlc8pa6yVvSLZUDp/TGBLPQ5Cdjua6e0ph0VpZj3AYHYhX3zUVxx
++iN66zB+Afko=
++-----END CERTIFICATE-----
++
++# Issuer: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI
++# Subject: CN=emSign Root CA - C1 O=eMudhra Inc OU=emSign PKI
++# Label: "emSign Root CA - C1"
++# Serial: 825510296613316004955058
++# MD5 Fingerprint: d8:e3:5d:01:21:fa:78:5a:b0:df:ba:d2:ee:2a:5f:68
++# SHA1 Fingerprint: e7:2e:f1:df:fc:b2:09:28:cf:5d:d4:d5:67:37:b1:51:cb:86:4f:01
++# SHA256 Fingerprint: 12:56:09:aa:30:1d:a0:a2:49:b9:7a:82:39:cb:6a:34:21:6f:44:dc:ac:9f:39:54:b1:42:92:f2:e8:c8:60:8f
++-----BEGIN CERTIFICATE-----
++MIIDczCCAlugAwIBAgILAK7PALrEzzL4Q7IwDQYJKoZIhvcNAQELBQAwVjELMAkG
++A1UEBhMCVVMxEzARBgNVBAsTCmVtU2lnbiBQS0kxFDASBgNVBAoTC2VNdWRocmEg
++SW5jMRwwGgYDVQQDExNlbVNpZ24gUm9vdCBDQSAtIEMxMB4XDTE4MDIxODE4MzAw
++MFoXDTQzMDIxODE4MzAwMFowVjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
++biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMRwwGgYDVQQDExNlbVNpZ24gUm9v
++dCBDQSAtIEMxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz+upufGZ
++BczYKCFK83M0UYRWEPWgTywS4/oTmifQz/l5GnRfHXk5/Fv4cI7gklL35CX5VIPZ
++HdPIWoU/Xse2B+4+wM6ar6xWQio5JXDWv7V7Nq2s9nPczdcdioOl+yuQFTdrHCZH
++3DspVpNqs8FqOp099cGXOFgFixwR4+S0uF2FHYP+eF8LRWgYSKVGczQ7/g/IdrvH
++GPMF0Ybzhe3nudkyrVWIzqa2kbBPrH4VI5b2P/AgNBbeCsbEBEV5f6f9vtKppa+c
++xSMq9zwhbL2vj07FOrLzNBL834AaSaTUqZX3noleoomslMuoaJuvimUnzYnu3Yy1
++aylwQ6BpC+S5DwIDAQABo0IwQDAdBgNVHQ4EFgQU/qHgcB4qAzlSWkK+XJGFehiq
++TbUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
++BQADggEBAMJKVvoVIXsoounlHfv4LcQ5lkFMOycsxGwYFYDGrK9HWS8mC+M2sO87
++/kOXSTKZEhVb3xEp/6tT+LvBeA+snFOvV71ojD1pM/CjoCNjO2RnIkSt1XHLVip4
++kqNPEjE2NuLe/gDEo2APJ62gsIq1NnpSob0n9CAnYuhNlCQT5AoE6TyrLshDCUrG
++YQTlSTR+08TI9Q/Aqum6VF7zYytPT1DU/rl7mYw9wC68AivTxEDkigcxHpvOJpkT
+++xHqmiIMERnHXhuBUDDIlhJu58tBf5E7oke3VIAb3ADMmpDqw8NQBmIMMMAVSKeo
++WXzhriKi4gp6D/piq1JM4fHfyr6DDUI=
++-----END CERTIFICATE-----
++
++# Issuer: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI
++# Subject: CN=emSign ECC Root CA - C3 O=eMudhra Inc OU=emSign PKI
++# Label: "emSign ECC Root CA - C3"
++# Serial: 582948710642506000014504
++# MD5 Fingerprint: 3e:53:b3:a3:81:ee:d7:10:f8:d3:b0:1d:17:92:f5:d5
++# SHA1 Fingerprint: b6:af:43:c2:9b:81:53:7d:f6:ef:6b:c3:1f:1f:60:15:0c:ee:48:66
++# SHA256 Fingerprint: bc:4d:80:9b:15:18:9d:78:db:3e:1d:8c:f4:f9:72:6a:79:5d:a1:64:3c:a5:f1:35:8e:1d:db:0e:dc:0d:7e:b3
++-----BEGIN CERTIFICATE-----
++MIICKzCCAbGgAwIBAgIKe3G2gla4EnycqDAKBggqhkjOPQQDAzBaMQswCQYDVQQG
++EwJVUzETMBEGA1UECxMKZW1TaWduIFBLSTEUMBIGA1UEChMLZU11ZGhyYSBJbmMx
++IDAeBgNVBAMTF2VtU2lnbiBFQ0MgUm9vdCBDQSAtIEMzMB4XDTE4MDIxODE4MzAw
++MFoXDTQzMDIxODE4MzAwMFowWjELMAkGA1UEBhMCVVMxEzARBgNVBAsTCmVtU2ln
++biBQS0kxFDASBgNVBAoTC2VNdWRocmEgSW5jMSAwHgYDVQQDExdlbVNpZ24gRUND
++IFJvb3QgQ0EgLSBDMzB2MBAGByqGSM49AgEGBSuBBAAiA2IABP2lYa57JhAd6bci
++MK4G9IGzsUJxlTm801Ljr6/58pc1kjZGDoeVjbk5Wum739D+yAdBPLtVb4Ojavti
++sIGJAnB9SMVK4+kiVCJNk7tCDK93nCOmfddhEc5lx/h//vXyqaNCMEAwHQYDVR0O
++BBYEFPtaSNCAIEDyqOkAB2kZd6fmw/TPMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMB
++Af8EBTADAQH/MAoGCCqGSM49BAMDA2gAMGUCMQC02C8Cif22TGK6Q04ThHK1rt0c
++3ta13FaPWEBaLd4gTCKDypOofu4SQMfWh0/434UCMBwUZOR8loMRnLDRWmFLpg9J
++0wD8ofzkpf9/rdcw0Md3f76BB1UwUCAU9Vc4CqgxUQ==
++-----END CERTIFICATE-----
++
+ # Issuer: CN=Hongkong Post Root CA 3 O=Hongkong Post
+ # Subject: CN=Hongkong Post Root CA 3 O=Hongkong Post
+ # Label: "Hongkong Post Root CA 3"
+--
+2.53.0
+
diff --git a/meta/recipes-devtools/python/python3-pip_26.0.1.bb b/meta/recipes-devtools/python/python3-pip_26.0.1.bb
index b6581575580..378fcd823ee 100644
--- a/meta/recipes-devtools/python/python3-pip_26.0.1.bb
+++ b/meta/recipes-devtools/python/python3-pip_26.0.1.bb
@@ -29,6 +29,8 @@ SRC_URI += "file://no_shebang_mangling.patch \
file://CVE-2026-8643.patch \
file://CVE-2026-8643-regression_p1.patch \
file://CVE-2026-8643-regression_p2.patch \
+ file://0001-Remove-emsign-437.patch;patchdir=src/pip/_vendor \
+ file://0002-Restore-unaffected-emSign-roots-439-440.patch;patchdir=src/pip/_vendor \
"
SRC_URI[sha256sum] = "c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 17/35] python3: upgrade 3.14.7 -> 3.14.9
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (15 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 16/35] python3-pip: patch the vendored python3-certifi Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 18/35] python3: upgrade 3.14.9 -> 3.14.10 Yoann Congal
` (18 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
The release notes are long[1] but the highlight is upgrading the bundled
pip wheel to 26.2.2, as pip bundles certifi which needed upgrading due
to the eMudhra intermediate CA compromise.
[1] https://docs.python.org/release/3.14.9/whatsnew/changelog.html
[2] https://emudhra.we-have-a-problem.com
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 526baf80188308bc1e65b09ccb41186772cd6336)
Dropped parts updating patches for openssl-4 or ptests.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../0001-Avoid-shebang-overflow-on-python-config.py.patch | 2 +-
...1-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch | 2 +-
...1-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch | 2 +-
meta/recipes-devtools/python/python3/makerace.patch | 2 +-
.../python/{python3_3.14.7.bb => python3_3.14.9.bb} | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.9.bb} (99%)
diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
index 7a605383647..7cacaf0ff37 100644
--- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
+++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
@@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index e946018..345ed29 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -2835,6 +2835,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh
+@@ -2839,6 +2839,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh
@ # Substitution happens here, as the completely-expanded BINDIR
@ # is not available in configure
sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py
diff --git a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch
index 60391e726bd..580d38a4031 100644
--- a/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch
+++ b/meta/recipes-devtools/python/python3/0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch
@@ -21,7 +21,7 @@ diff --git a/Lib/sysconfig/__init__.py b/Lib/sysconfig/__init__.py
index 0a8bcc0..a2341f2 100644
--- a/Lib/sysconfig/__init__.py
+++ b/Lib/sysconfig/__init__.py
-@@ -538,12 +538,12 @@ def _init_config_vars():
+@@ -539,12 +539,12 @@ def _init_config_vars():
_CONFIG_VARS['py_version'] = _PY_VERSION
_CONFIG_VARS['py_version_short'] = _PY_VERSION_SHORT
_CONFIG_VARS['py_version_nodot'] = _PY_VERSION_SHORT_NO_DOT
diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
index c7f14cad1e0..4e41b04a3bb 100644
--- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
+++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
@@ -18,7 +18,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index 526d500..a7e536d 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -861,8 +861,7 @@ profile-run-stamp:
+@@ -863,8 +863,7 @@ profile-run-stamp:
# enabled.
$(MAKE) profile-gen-stamp
# Next, run the profile task to generate the profile information.
diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch
index 248a521118c..b589dfb3460 100644
--- a/meta/recipes-devtools/python/python3/makerace.patch
+++ b/meta/recipes-devtools/python/python3/makerace.patch
@@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index a7e536d..e946018 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -2741,7 +2741,7 @@ COMPILEALL_OPTS=-j0
+@@ -2745,7 +2745,7 @@ COMPILEALL_OPTS=-j0
TEST_MODULES=@TEST_MODULES@
.PHONY: libinstall
diff --git a/meta/recipes-devtools/python/python3_3.14.7.bb b/meta/recipes-devtools/python/python3_3.14.9.bb
similarity index 99%
rename from meta/recipes-devtools/python/python3_3.14.7.bb
rename to meta/recipes-devtools/python/python3_3.14.9.bb
index e73dc8d7728..2a5279480b2 100644
--- a/meta/recipes-devtools/python/python3_3.14.7.bb
+++ b/meta/recipes-devtools/python/python3_3.14.9.bb
@@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \
file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
"
-SRC_URI[sha256sum] = "3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81"
+SRC_URI[sha256sum] = "e02d9ac21cebda6e46435369744a92c65cc7cd8669697694122cf97ffacd1e53"
# exclude pre-releases for both python 2.x and 3.x
UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 18/35] python3: upgrade 3.14.9 -> 3.14.10
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (16 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 17/35] python3: upgrade 3.14.7 -> 3.14.9 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 19/35] python3: skip test.test_readline.TestHistoryManipulation on musl Yoann Congal
` (17 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This is an expedited security release to address the compromised eMudhra
intermediate CA keys. These keys are now blocked by the ssl module as a
last resort against their use. Normal uses of pip, including to upgrade
pip itself, are now safe from attacks based on those compromised keys,
even if pip hasn't been updated yet.
Release information: [1]
Security content in this release
* CVE-2026-115557 gh-160040: Distrust compromised eMudhra intermediate CA keys
* CVE-2026-114583 gh-160097: Reject links replacing the destination in tarfile.tar_filter
* gh-160300: Reject cookies with a negative version in http.cookiejar
[1] https://www.python.org/downloads/release/python-31410/
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 4041f4a2e031f76e5a90207e855c735fd14259b1)
Dropped parts updating patches for openssl-4 or ptests.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../0001-Avoid-shebang-overflow-on-python-config.py.patch | 2 +-
...1-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch | 2 +-
.../0001-Update-test_sysconfig-for-posix_user-purelib.patch | 2 +-
meta/recipes-devtools/python/python3/makerace.patch | 2 +-
.../python/{python3_3.14.9.bb => python3_3.14.10.bb} | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
rename meta/recipes-devtools/python/{python3_3.14.9.bb => python3_3.14.10.bb} (99%)
diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
index 7cacaf0ff37..79fee9803fe 100644
--- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
+++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
@@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index e946018..345ed29 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -2839,6 +2839,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh
+@@ -2844,6 +2844,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh
@ # Substitution happens here, as the completely-expanded BINDIR
@ # is not available in configure
sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py
diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
index 4e41b04a3bb..d3f46c372a6 100644
--- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
+++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
@@ -18,7 +18,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index 526d500..a7e536d 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -863,8 +863,7 @@ profile-run-stamp:
+@@ -864,8 +864,7 @@ profile-run-stamp:
# enabled.
$(MAKE) profile-gen-stamp
# Next, run the profile task to generate the profile information.
diff --git a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch
index 5509b7475a9..0864f23926a 100644
--- a/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch
+++ b/meta/recipes-devtools/python/python3/0001-Update-test_sysconfig-for-posix_user-purelib.patch
@@ -25,7 +25,7 @@ diff --git a/Lib/test/test_sysconfig.py b/Lib/test/test_sysconfig.py
index 1fe4b68..383142a 100644
--- a/Lib/test/test_sysconfig.py
+++ b/Lib/test/test_sysconfig.py
-@@ -434,7 +434,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin):
+@@ -435,7 +435,7 @@ class TestSysConfig(unittest.TestCase, VirtualEnvironmentMixin):
expected = os.path.normpath(global_path.replace(base, user, 1))
# bpo-44860: platlib of posix_user doesn't use sys.platlibdir,
# whereas posix_prefix does.
diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch
index b589dfb3460..7167d5b4e82 100644
--- a/meta/recipes-devtools/python/python3/makerace.patch
+++ b/meta/recipes-devtools/python/python3/makerace.patch
@@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index a7e536d..e946018 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -2745,7 +2745,7 @@ COMPILEALL_OPTS=-j0
+@@ -2750,7 +2750,7 @@ COMPILEALL_OPTS=-j0
TEST_MODULES=@TEST_MODULES@
.PHONY: libinstall
diff --git a/meta/recipes-devtools/python/python3_3.14.9.bb b/meta/recipes-devtools/python/python3_3.14.10.bb
similarity index 99%
rename from meta/recipes-devtools/python/python3_3.14.9.bb
rename to meta/recipes-devtools/python/python3_3.14.10.bb
index 2a5279480b2..73d6e89854d 100644
--- a/meta/recipes-devtools/python/python3_3.14.9.bb
+++ b/meta/recipes-devtools/python/python3_3.14.10.bb
@@ -40,7 +40,7 @@ SRC_URI:append:class-native = " \
file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
"
-SRC_URI[sha256sum] = "e02d9ac21cebda6e46435369744a92c65cc7cd8669697694122cf97ffacd1e53"
+SRC_URI[sha256sum] = "de414a57119abef52784d8993e341d53aed635fc2b05c2607d9f98a2c5b72032"
# exclude pre-releases for both python 2.x and 3.x
UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 19/35] python3: skip test.test_readline.TestHistoryManipulation on musl
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (17 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 18/35] python3: upgrade 3.14.9 -> 3.14.10 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 20/35] piglit: fix build with Python 3.14.9 Yoann Congal
` (16 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
Fixes to the editline integration have sadly introduced regressions on
musl:
FAIL: test_append_limited_history (test.test_readline.TestHistoryManipulation.test_append_limited_history)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/usr/lib/python3.14/test/test_readline.py", line 208, in test_append_limited_history
self.assertEqual(readline.get_history_item(1), "second line")
~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: '_HiStOrY_V2_' != 'second line'
- _HiStOrY_V2_
+ second line
======================================================================
FAIL: test_write_read_append (test.test_readline.TestHistoryManipulation.test_write_read_append)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/usr/lib/python3.14/test/test_readline.py", line 101, in test_write_read_append
self.assertEqual(readline.get_current_history_length(), 3)
~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: 4 != 3
A ticket has been filed upstream so skip the tests for now.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7ba31b6a42f884964d2cff04235a930f757b9e4b)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3_3.14.10.bb | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/meta/recipes-devtools/python/python3_3.14.10.bb b/meta/recipes-devtools/python/python3_3.14.10.bb
index 73d6e89854d..a4cd0697d2a 100644
--- a/meta/recipes-devtools/python/python3_3.14.10.bb
+++ b/meta/recipes-devtools/python/python3_3.14.10.bb
@@ -274,6 +274,11 @@ SKIPPED_TESTS:append:class-target:libc-musl = " \
--ignore test.test_ctypes.test_dlerror.TestNullDlsym.test_null_dlsym \
"
+# https://github.com/python/cpython/issues/159424
+SKIPPED_TESTS:append:libc-musl = " \
+ --ignore test.test_readline.TestHistoryManipulation.test_append_limited_history \
+ --ignore test.test_readline.TestHistoryManipulation.test_write_read_append \
+"
do_install_ptest:append () {
sed -i -e "s|SKIPPED_TESTS=|SKIPPED_TESTS=\"${SKIPPED_TESTS}\"|" ${D}${PTEST_PATH}/run-ptest
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 20/35] piglit: fix build with Python 3.14.9
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (18 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 19/35] python3: skip test.test_readline.TestHistoryManipulation on musl Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 21/35] systemd: add iproute2-devlink runtime dependency to udev Yoann Congal
` (15 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
Python 3.14.9 added bounds checking to the mtime argument, so piglit
passing the mtime as a string causes runtime errors:
File "/usr/lib/python3.14/gzip.py", line 303, in _write_gzip_header
if not 0 <= mtime < 2**32:
TypeError: '<=' not supported between instances of 'int' and 'str'
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 66cf97860d9833b852298a6cd60334c372a18dc3)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
...-reproducible_mtime-should-be-an-int.patch | 33 +++++++++++++++++++
meta/recipes-graphics/piglit/piglit_git.bb | 1 +
2 files changed, 34 insertions(+)
create mode 100644 meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch
diff --git a/meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch b/meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch
new file mode 100644
index 00000000000..4578c296b0d
--- /dev/null
+++ b/meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch
@@ -0,0 +1,33 @@
+From 58a5bea55a5f7972462124e7a8f1b1971ad5483d Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Thu, 22 Oct 2026 14:09:08 +0100
+Subject: [PATCH] tests/serializer: reproducible_mtime should be an int
+X-ARM-No-Footer: NoDisclaimer
+
+The mtime argument is an integer not a string, so parse it with int().
+
+Passing a string breaks piglit with Python 3.14.9, which does integer
+bound checks on the specified mtime.
+
+Upstream-Status: Submitted [https://gitlab.freedesktop.org/mesa/piglit/-/merge_requests/1269]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+---
+ tests/serializer.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tests/serializer.py b/tests/serializer.py
+index 5ee9a1578..f7fdadf43 100644
+--- a/tests/serializer.py
++++ b/tests/serializer.py
+@@ -140,7 +140,7 @@ def serializer(name, profile, outfile):
+ tree = et.ElementTree(root)
+ reproducible_mtime = None
+ if 'SOURCE_DATE_EPOCH' in os.environ:
+- reproducible_mtime=os.environ['SOURCE_DATE_EPOCH']
++ reproducible_mtime=int(os.environ['SOURCE_DATE_EPOCH'])
+ with gzip.GzipFile(outfile, 'wb', mtime=reproducible_mtime) as f:
+ tree.write(f, encoding='utf-8', xml_declaration=True)
+
+--
+2.43.0
+
diff --git a/meta/recipes-graphics/piglit/piglit_git.bb b/meta/recipes-graphics/piglit/piglit_git.bb
index 76596350628..5d7cdafb070 100644
--- a/meta/recipes-graphics/piglit/piglit_git.bb
+++ b/meta/recipes-graphics/piglit/piglit_git.bb
@@ -14,6 +14,7 @@ SRC_URI = "git://gitlab.freedesktop.org/mesa/piglit.git;protocol=https;branch=ma
file://0001-tests-egl-spec-make-egl_ext_surface_compression-cond.patch \
file://0001-tests-no_error.py-modify-_command-and-not-command.patch \
file://0001-generated_tests-use-shape-in-place-of-newshape-on-nu.patch \
+ file://0001-tests-serializer-reproducible_mtime-should-be-an-int.patch \
"
UPSTREAM_CHECK_COMMITS = "1"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 21/35] systemd: add iproute2-devlink runtime dependency to udev
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (19 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 20/35] piglit: fix build with Python 3.14.9 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 22/35] bind: upgrade 9.20.29 -> 9.20.30 Yoann Congal
` (14 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Service file ${nonarch_libdir}/udev/rules.d/81-net-bridge.rules executes
/usr/sbin/devlink which causes errors seen in journal on systems which
don't install this package explicitly.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 69bf564780353d34cfd87bf73960cfadd8b2c6ac)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/systemd/systemd_259.5.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-core/systemd/systemd_259.5.bb b/meta/recipes-core/systemd/systemd_259.5.bb
index e924884bf95..3c747545322 100644
--- a/meta/recipes-core/systemd/systemd_259.5.bb
+++ b/meta/recipes-core/systemd/systemd_259.5.bb
@@ -760,6 +760,7 @@ FILES:libsystemd-shared = "${libdir}/systemd/libsystemd-shared*.so"
RPROVIDES:udev = "hotplug"
+RDEPENDS:udev += "iproute2-devlink"
RDEPENDS:udev-bash-completion += "bash-completion"
RDEPENDS:udev-hwdb += "udev"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 22/35] bind: upgrade 9.20.29 -> 9.20.30
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (20 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 21/35] systemd: add iproute2-devlink runtime dependency to udev Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 23/35] recipe_sanity: Drop rename overwrite detection Yoann Congal
` (13 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
ReleaseNotes: https://bind9.readthedocs.io/en/v9.20.30/notes.html#notes-for-bind-9-20-30
CVE fixes: CVE-2026-19630, CVE-2026-96888, CVE-2026-97313, CVE-2026-94300
- Other bug fixes are mentioned in ReleaseNotes.
- Refresh existing patches
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 3d52bad81bb24f84af630b9bbd3cadd7048ceec5)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../bind/bind/0001-avoid-start-failure-with-bind-user.patch | 2 +-
.../0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch | 2 +-
...0001-named-lwresd-V-and-start-log-hide-build-options.patch | 4 ++--
| 4 ++--
meta/recipes-connectivity/bind/bind/conf.patch | 2 +-
.../bind/bind/init.d-add-support-for-read-only-rootfs.patch | 2 +-
.../bind/bind/make-etc-initd-bind-stop-work.patch | 2 +-
.../bind/{bind_9.20.29.bb => bind_9.20.30.bb} | 2 +-
8 files changed, 10 insertions(+), 10 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%)
diff --git a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
index 15796a15fba..d302bc14810 100644
--- a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
+++ b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch
@@ -1,4 +1,4 @@
-From 95141cf9494292fc5645165ef3d5e9e2ed2208c6 Mon Sep 17 00:00:00 2001
+From 1c087c24e8162c7a042cf1f19ad313e0f3a21196 Mon Sep 17 00:00:00 2001
From: Chen Qi <Qi.Chen@windriver.com>
Date: Mon, 15 Oct 2018 16:55:09 +0800
Subject: [PATCH] avoid start failure with bind user
diff --git a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
index 99e781799da..eb0adcfabef 100644
--- a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
+++ b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
@@ -1,4 +1,4 @@
-From 06e9624eb7e474a08ed7e1a456bfe9759ba211da Mon Sep 17 00:00:00 2001
+From aa978a473328123575af0270dc1dd274050bdfc0 Mon Sep 17 00:00:00 2001
From: Khem Raj <khem.raj@oss.qualcomm.com>
Date: Fri, 10 Apr 2026 23:33:49 +0000
Subject: [PATCH] m4: Backport ax_prog_cc_for_build.m4 macros
diff --git a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
index 80a4f2abded..5871fb433cd 100644
--- a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
+++ b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch
@@ -1,4 +1,4 @@
-From f28920a59b658fcda24efde1c45322f785a0b0fe Mon Sep 17 00:00:00 2001
+From 525570781b873c3434df49ac753afca7c1bd9613 Mon Sep 17 00:00:00 2001
From: Hongxu Jia <hongxu.jia@windriver.com>
Date: Mon, 27 Aug 2018 21:24:20 +0800
Subject: [PATCH] `named/lwresd -V' and start log hide build options
@@ -20,7 +20,7 @@ Signed-off-by: Armin Kuster <akuster@mvista.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
-index 0bc3965..e1c2b12 100644
+index 4d02c6e..225f59c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -35,7 +35,7 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA], ["][bind_VERSION_EXTRA]["], [BIND 9 Extra par
--git a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
index 323985a4025..73300b46e87 100644
--- a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
+++ b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch
@@ -1,4 +1,4 @@
-From f003f396067e6cc1e2ec609b296bb642b8ddf47b Mon Sep 17 00:00:00 2001
+From 4388bec9a8ebd7d9dded4b1942a5670cdaec064f Mon Sep 17 00:00:00 2001
From: Paul Gortmaker <paul.gortmaker@windriver.com>
Date: Tue, 9 Jun 2015 11:22:00 -0400
Subject: [PATCH] bind: ensure searching for json headers searches sysroot
@@ -32,7 +32,7 @@ Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
-index 26c442a..0bc3965 100644
+index 75088e5..4d02c6e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -872,7 +872,7 @@ AS_CASE([$with_lmdb],
diff --git a/meta/recipes-connectivity/bind/bind/conf.patch b/meta/recipes-connectivity/bind/bind/conf.patch
index 28ee4ae74d3..f88f93951f1 100644
--- a/meta/recipes-connectivity/bind/bind/conf.patch
+++ b/meta/recipes-connectivity/bind/bind/conf.patch
@@ -1,4 +1,4 @@
-From 5fc3dfd3f994b5fd97e97837eee2ad808cd8af93 Mon Sep 17 00:00:00 2001
+From 65c90b60cc9f30c383b8e30b900abd04bc977bd1 Mon Sep 17 00:00:00 2001
From: Qing He <qing.he@intel.com>
Date: Tue, 30 Nov 2010 13:35:42 +0800
Subject: [PATCH] bind: add new recipe
diff --git a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
index b373251c47e..388335b2711 100644
--- a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
+++ b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch
@@ -1,4 +1,4 @@
-From 42c109317070d19fda70635b7043cbc6f9ec36ef Mon Sep 17 00:00:00 2001
+From c58e1309e80449ecc1fa1fa793630b53c08f958e Mon Sep 17 00:00:00 2001
From: Chen Qi <Qi.Chen@windriver.com>
Date: Thu, 27 Mar 2014 02:34:41 +0000
Subject: [PATCH] init.d: add support for read-only rootfs
diff --git a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
index 74cf947787a..bd6ada88228 100644
--- a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
+++ b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch
@@ -1,4 +1,4 @@
-From 2e1314f2e71be15704ba18756250185b36a5c0da Mon Sep 17 00:00:00 2001
+From ad9cb821a119f441f6131e01715d5e0eab368fc0 Mon Sep 17 00:00:00 2001
From: Roy Li <rongqing.li@windriver.com>
Date: Thu, 15 Nov 2012 02:27:54 +0000
Subject: [PATCH] bind: make "/etc/init.d/bind stop" work
diff --git a/meta/recipes-connectivity/bind/bind_9.20.29.bb b/meta/recipes-connectivity/bind/bind_9.20.30.bb
similarity index 97%
rename from meta/recipes-connectivity/bind/bind_9.20.29.bb
rename to meta/recipes-connectivity/bind/bind_9.20.30.bb
index 5ce94d597b4..bf51c48b601 100644
--- a/meta/recipes-connectivity/bind/bind_9.20.29.bb
+++ b/meta/recipes-connectivity/bind/bind_9.20.30.bb
@@ -21,7 +21,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch \
"
-SRC_URI[sha256sum] = "587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1"
+SRC_URI[sha256sum] = "9e1443a40a72a30272cbc3196d020a6b2e26937111c83e59e101e82e1e3b4fef"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# follow the ESV versions divisible by 2
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 23/35] recipe_sanity: Drop rename overwrite detection
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (21 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 22/35] bind: upgrade 9.20.29 -> 9.20.30 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 24/35] dropbear: add follow-up patches for CVE-2019-6111 Yoann Congal
` (12 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Bitbake itself checks for probelmatic renames now during key expansion so this
check shouldn't be needed anymore (it dates from pre 2011).
(https://git.openembedded.org/bitbake/tree/lib/bb/data.py#n96 in expandKeys())
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7944665886cb0bf881807a5d849ebdf42a33d1bf)
The corresponding bitbake change was merged in 2.18: 4986a548e (data: Fix
expandKeys recursion issue). Include this in wrynose as well so layers
using this class continue to work.
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes/recipe_sanity.bbclass | 21 ---------------------
1 file changed, 21 deletions(-)
diff --git a/meta/classes/recipe_sanity.bbclass b/meta/classes/recipe_sanity.bbclass
index a5cc4315fb8..3c763de1f20 100644
--- a/meta/classes/recipe_sanity.bbclass
+++ b/meta/classes/recipe_sanity.bbclass
@@ -34,13 +34,6 @@ def req_vars(cfgdata, d):
elif val == cfgval:
__note("%s should be defined to something other than default (%s)" % (var, cfgval), d)
-def var_renames_overwrite(cfgdata, d):
- renames = d.getVar("__recipe_sanity_renames", False)
- if renames:
- for (key, newkey, oldvalue, newvalue) in renames:
- if oldvalue != newvalue and oldvalue != cfgdata.get(newkey):
- __note("rename of variable '%s' to '%s' overwrote existing value '%s' with '%s'." % (key, newkey, oldvalue, newvalue), d)
-
def incorrect_nonempty_PACKAGES(cfgdata, d):
if bb.data.inherits_class("native", d) or \
bb.data.inherits_class("cross", d):
@@ -113,7 +106,6 @@ python do_recipe_sanity () {
__note(msg, d)
can_delete_others(p, cfgdata, d)
- var_renames_overwrite(cfgdata, d)
req_vars(cfgdata, d)
bad_runtime_vars(cfgdata, d)
}
@@ -137,19 +129,6 @@ python recipe_sanity_eh () {
d.setVar("__recipe_sanity_cfgdata", cfgdata)
#d.setVar("__recipe_sanity_cfgdata", d)
-
- # Sick, very sick..
- from bb.data_smart import DataSmart
- old = DataSmart.renameVar
- def myrename(self, key, newkey):
- oldvalue = self.getVar(newkey, 0)
- old(self, key, newkey)
- newvalue = self.getVar(newkey, 0)
- if oldvalue:
- renames = self.getVar("__recipe_sanity_renames", 0) or set()
- renames.add((key, newkey, oldvalue, newvalue))
- self.setVar("__recipe_sanity_renames", renames)
- DataSmart.renameVar = myrename
}
addhandler recipe_sanity_eh
recipe_sanity_eh[eventmask] = "bb.event.ConfigParsed"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 24/35] dropbear: add follow-up patches for CVE-2019-6111
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (22 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 23/35] recipe_sanity: Drop rename overwrite detection Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 25/35] dropbear: patch CVE-2026-35385 Yoann Congal
` (11 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick additional patches referencing this CVE from 2026.90 or 2026.91
releases.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: Note: this might change user-visible behavior:
a Remote to local "scp -r" into an existing directory will now
return an error.
]
---
.../dropbear/dropbear/CVE-2019-6111-01.patch | 364 ++++++++++++++++++
.../dropbear/dropbear/CVE-2019-6111-02.patch | 43 +++
.../dropbear/dropbear/CVE-2019-6111-03.patch | 34 ++
.../dropbear/dropbear/CVE-2019-6111-04.patch | 43 +++
.../recipes-core/dropbear/dropbear_2025.89.bb | 4 +
5 files changed, 488 insertions(+)
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch
diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch
new file mode 100644
index 00000000000..8e6da5fc23f
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch
@@ -0,0 +1,364 @@
+From 143291baca6ebb3407a0c25c85bd53bf041a6ab7 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Mon, 20 Apr 2026 20:57:11 +0800
+Subject: [PATCH] scp: more CVE-2019-6111 fix
+
+Cherrypicked from OpenSSH portable
+
+commit 3d896c157c722bc47adca51a58dca859225b5874
+djm Sun Feb 10 11:15:52 2019 +0000
+
+upstream: when checking that filenames sent by the server side
+
+match what the client requested, be prepared to handle shell-style brace
+alternations, e.g. "{foo,bar}".
+
+"looks good to me" millert@ + in snaps for the last week courtesy
+deraadt@
+
+CVE: CVE-2019-6111
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/143291baca6ebb3407a0c25c85bd53bf041a6ab7]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/scp.c | 281 +++++++++++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 269 insertions(+), 12 deletions(-)
+
+diff --git a/src/scp.c b/src/scp.c
+index bf98986c..d151587c 100644
+--- a/src/scp.c
++++ b/src/scp.c
+@@ -74,7 +74,6 @@
+ */
+
+ #include "includes.h"
+-/*RCSID("$OpenBSD: scp.c,v 1.130 2006/01/31 10:35:43 djm Exp $");*/
+
+ #include <fnmatch.h>
+
+@@ -600,6 +599,253 @@ tolocal(int argc, char **argv)
+ }
+ }
+
++/* Appends a string to an array; returns 0 on success, -1 on alloc failure */
++static int
++append(char *cp, char ***ap, size_t *np)
++{
++ char **tmp;
++
++ if ((tmp = reallocarray(*ap, *np + 1, sizeof(*tmp))) == NULL)
++ return -1;
++ tmp[(*np)] = cp;
++ (*np)++;
++ *ap = tmp;
++ return 0;
++}
++
++/*
++ * Finds the start and end of the first brace pair in the pattern.
++ * returns 0 on success or -1 for invalid patterns.
++ */
++static int
++find_brace(const char *pattern, int *startp, int *endp)
++{
++ int i;
++ int in_bracket, brace_level;
++
++ *startp = *endp = -1;
++ in_bracket = brace_level = 0;
++ for (i = 0; i < INT_MAX && *endp < 0 && pattern[i] != '\0'; i++) {
++ switch (pattern[i]) {
++ case '\\':
++ /* skip next character */
++ if (pattern[i + 1] != '\0')
++ i++;
++ break;
++ case '[':
++ in_bracket = 1;
++ break;
++ case ']':
++ in_bracket = 0;
++ break;
++ case '{':
++ if (in_bracket)
++ break;
++ if (pattern[i + 1] == '}') {
++ /* Protect a single {}, for find(1), like csh */
++ i++; /* skip */
++ break;
++ }
++ if (*startp == -1)
++ *startp = i;
++ brace_level++;
++ break;
++ case '}':
++ if (in_bracket)
++ break;
++ if (*startp < 0) {
++ /* Unbalanced brace */
++ return -1;
++ }
++ if (--brace_level <= 0)
++ *endp = i;
++ break;
++ }
++ }
++ /* unbalanced brackets/braces */
++ if (*endp < 0 && (*startp >= 0 || in_bracket))
++ return -1;
++ return 0;
++}
++
++/*
++ * Assembles and records a successfully-expanded pattern, returns -1 on
++ * alloc failure.
++ */
++static int
++emit_expansion(const char *pattern, int brace_start, int brace_end,
++ int sel_start, int sel_end, char ***patternsp, size_t *npatternsp)
++{
++ char *cp;
++ int o = 0, tail_len = strlen(pattern + brace_end + 1);
++
++ if ((cp = malloc(brace_start + (sel_end - sel_start) +
++ tail_len + 1)) == NULL)
++ return -1;
++
++ /* Pattern before initial brace */
++ if (brace_start > 0) {
++ memcpy(cp, pattern, brace_start);
++ o = brace_start;
++ }
++ /* Current braced selection */
++ if (sel_end - sel_start > 0) {
++ memcpy(cp + o, pattern + sel_start,
++ sel_end - sel_start);
++ o += sel_end - sel_start;
++ }
++ /* Remainder of pattern after closing brace */
++ if (tail_len > 0) {
++ memcpy(cp + o, pattern + brace_end + 1, tail_len);
++ o += tail_len;
++ }
++ cp[o] = '\0';
++ if (append(cp, patternsp, npatternsp) != 0) {
++ free(cp);
++ return -1;
++ }
++ return 0;
++}
++
++/*
++ * Expand the first encountered brace in pattern, appending the expanded
++ * patterns it yielded to the *patternsp array.
++ *
++ * Returns 0 on success or -1 on allocation failure.
++ *
++ * Signals whether expansion was performed via *expanded and whether
++ * pattern was invalid via *invalid.
++ */
++static int
++brace_expand_one(const char *pattern, char ***patternsp, size_t *npatternsp,
++ int *expanded, int *invalid)
++{
++ int i;
++ int in_bracket, brace_start, brace_end, brace_level;
++ int sel_start, sel_end;
++
++ *invalid = *expanded = 0;
++
++ if (find_brace(pattern, &brace_start, &brace_end) != 0) {
++ *invalid = 1;
++ return 0;
++ } else if (brace_start == -1)
++ return 0;
++
++ in_bracket = brace_level = 0;
++ for (i = sel_start = brace_start + 1; i < brace_end; i++) {
++ switch (pattern[i]) {
++ case '{':
++ if (in_bracket)
++ break;
++ brace_level++;
++ break;
++ case '}':
++ if (in_bracket)
++ break;
++ brace_level--;
++ break;
++ case '[':
++ in_bracket = 1;
++ break;
++ case ']':
++ in_bracket = 0;
++ break;
++ case '\\':
++ if (i < brace_end - 1)
++ i++; /* skip */
++ break;
++ }
++ if (pattern[i] == ',' || i == brace_end - 1) {
++ if (in_bracket || brace_level > 0)
++ continue;
++ /* End of a selection, emit an expanded pattern */
++
++ /* Adjust end index for last selection */
++ sel_end = (i == brace_end - 1) ? brace_end : i;
++ if (emit_expansion(pattern, brace_start, brace_end,
++ sel_start, sel_end, patternsp, npatternsp) != 0)
++ return -1;
++ /* move on to the next selection */
++ sel_start = i + 1;
++ continue;
++ }
++ }
++ if (in_bracket || brace_level > 0) {
++ *invalid = 1;
++ return 0;
++ }
++ /* success */
++ *expanded = 1;
++ return 0;
++}
++
++/* Expand braces from pattern. Returns 0 on success, -1 on failure */
++static int
++brace_expand(const char *pattern, char ***patternsp, size_t *npatternsp)
++{
++ char *cp, *cp2, **active = NULL, **done = NULL;
++ size_t i, nactive = 0, ndone = 0;
++ int ret = -1, invalid = 0, expanded = 0;
++
++ *patternsp = NULL;
++ *npatternsp = 0;
++
++ /* Start the worklist with the original pattern */
++ if ((cp = strdup(pattern)) == NULL)
++ return -1;
++ if (append(cp, &active, &nactive) != 0) {
++ free(cp);
++ return -1;
++ }
++ while (nactive > 0) {
++ cp = active[nactive - 1];
++ nactive--;
++ if (brace_expand_one(cp, &active, &nactive,
++ &expanded, &invalid) == -1) {
++ free(cp);
++ goto fail;
++ }
++ if (invalid)
++ fatal("%s: invalid brace pattern \"%s\"", __func__, cp);
++ if (expanded) {
++ /*
++ * Current entry expanded to new entries on the
++ * active list; discard the progenitor pattern.
++ */
++ free(cp);
++ continue;
++ }
++ /*
++ * Pattern did not expand; append the finename component to
++ * the completed list
++ */
++ if ((cp2 = strrchr(cp, '/')) != NULL)
++ *cp2++ = '\0';
++ else
++ cp2 = cp;
++ if (append(xstrdup(cp2), &done, &ndone) != 0) {
++ free(cp);
++ goto fail;
++ }
++ free(cp);
++ }
++ /* success */
++ *patternsp = done;
++ *npatternsp = ndone;
++ done = NULL;
++ ndone = 0;
++ ret = 0;
++ fail:
++ for (i = 0; i < nactive; i++)
++ free(active[i]);
++ free(active);
++ for (i = 0; i < ndone; i++)
++ free(done[i]);
++ free(done);
++ return ret;
++}
++
+ void
+ source(int argc, char **argv)
+ {
+@@ -841,7 +1087,8 @@ sink(int argc, char **argv, const char *src)
+ off_t size, statbytes;
+ int setimes, targisdir, wrerrno = 0;
+ char ch, *cp, *np, *targ, *why, *vect[1], buf[2048];
+- char *src_copy = NULL, *restrict_pattern = NULL;
++ char **patterns = NULL;
++ size_t n, npatterns = 0;
+ struct timeval tv[2];
+
+ #define atime tv[0]
+@@ -868,16 +1115,13 @@ sink(int argc, char **argv, const char *src)
+ * Prepare to try to restrict incoming filenames to match
+ * the requested destination file glob.
+ */
+- if ((src_copy = strdup(src)) == NULL)
+- fatal("strdup failed");
+- if ((restrict_pattern = strrchr(src_copy, '/')) != NULL) {
+- *restrict_pattern++ = '\0';
+- }
++ if (brace_expand(src, &patterns, &npatterns) != 0)
++ fatal("%s: could not expand pattern", __func__);
+ }
+ for (first = 1;; first = 0) {
+ cp = buf;
+ if (atomicio(read, remin, cp, 1) != 1)
+- return;
++ goto done;
+ if (*cp++ == '\n')
+ SCREWUP("unexpected <newline>");
+ do {
+@@ -900,7 +1144,7 @@ sink(int argc, char **argv, const char *src)
+ }
+ if (buf[0] == 'E') {
+ (void) atomicio(vwrite, remout, "", 1);
+- return;
++ goto done;
+ }
+ if (ch == '\n')
+ *--cp = 0;
+@@ -956,9 +1200,14 @@ sink(int argc, char **argv, const char *src)
+ run_err("error: unexpected filename: %s", cp);
+ exit(1);
+ }
+- if (restrict_pattern != NULL &&
+- fnmatch(restrict_pattern, cp, 0) != 0)
+- SCREWUP("filename does not match request");
++ if (npatterns > 0) {
++ for (n = 0; n < npatterns; n++) {
++ if (fnmatch(patterns[n], cp, 0) == 0)
++ break;
++ }
++ if (n >= npatterns)
++ SCREWUP("filename does not match request");
++ }
+ if (targisdir) {
+ static char *namebuf = NULL;
+ static size_t cursize = 0;
+@@ -1123,7 +1372,15 @@ bad: run_err("%s: %s", np, strerror(errno));
+ break;
+ }
+ }
++done:
++ for (n = 0; n < npatterns; n++)
++ free(patterns[n]);
++ free(patterns);
++ return;
+ screwup:
++ for (n = 0; n < npatterns; n++)
++ free(patterns[n]);
++ free(patterns);
+ run_err("protocol error: %s", why);
+ exit(1);
+ }
diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch
new file mode 100644
index 00000000000..99819b732ad
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch
@@ -0,0 +1,43 @@
+From 61bd0e3e6573277de17359763aa5827a189c8d7f Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Sat, 2 May 2026 08:43:26 +0800
+Subject: [PATCH] scp: Disallow -r to an existing directory
+
+Checks of received paths don't catch all cases in -r recursive mode, so
+disallow -r when the destination directory exists. This mitigates
+CVE-2019-6111, where unexpected files would be accepted from a malicious
+scp server.
+
+Alternatives like rsync could be used in that case.
+
+The new error message may be misleading if parent path components of the
+destination are also missing, though the command would have failed
+regardless.
+
+CVE: CVE-2019-6111
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/61bd0e3e6573277de17359763aa5827a189c8d7f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/scp.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/scp.c b/src/scp.c
+index d151587c..09297a5b 100644
+--- a/src/scp.c
++++ b/src/scp.c
+@@ -583,6 +583,15 @@ tolocal(int argc, char **argv)
+ if (*suser == '\0')
+ suser = NULL;
+ }
++
++ char *dest = *(argv + argc - 1);
++ if (!(access(dest, F_OK) == 0 && errno == ENOENT)) {
++ /* paths sent from the server in recursive mode aren't adequately
++ * checked that they match the requested files, so disallow this */
++ fprintf(stderr, "-r destination \"%s\" must not already exist\n", dest);
++ exit(1);
++ }
++
+ host = cleanhostname(host);
+ len = strlen(src) + CMDNEEDS + 20;
+ bp = xmalloc(len);
diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch
new file mode 100644
index 00000000000..c70bf4bb68c
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch
@@ -0,0 +1,34 @@
+From 0c5629a5d543ef5e4eff43345b1eedf2afef84ca Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Mon, 4 May 2026 21:35:57 +0800
+Subject: [PATCH] scp: don't use reallocarray
+
+reallocarray() isn't portable. An overflow check can be used instead.
+
+Fixes: 143291baca6e ("scp: more CVE-2019-6111 fix")
+
+CVE: CVE-2019-6111
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/0c5629a5d543ef5e4eff43345b1eedf2afef84ca]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/scp.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/scp.c b/src/scp.c
+index e5ce4e2f..2f7a6279 100644
+--- a/src/scp.c
++++ b/src/scp.c
+@@ -614,7 +614,12 @@ append(char *cp, char ***ap, size_t *np)
+ {
+ char **tmp;
+
+- if ((tmp = reallocarray(*ap, *np + 1, sizeof(*tmp))) == NULL)
++ if (*np + 1 > (SIZE_MAX / sizeof(*tmp))) {
++ /* overflow */
++ return -1;
++ }
++
++ if ((tmp = realloc(*ap, (*np + 1) * sizeof(*tmp))) == NULL)
+ return -1;
+ tmp[(*np)] = cp;
+ (*np)++;
diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch
new file mode 100644
index 00000000000..810e7e7963c
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch
@@ -0,0 +1,43 @@
+From 16ce059ed8e914e210af67e199041943ec747034 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Mon, 4 May 2026 21:36:41 +0800
+Subject: [PATCH] scp: fix recursive overwrite check
+
+Non-recursive transfers were incorrectly disallowed to an existing
+destination.
+
+In addition, the destination check logic was wrong.
+
+Fixes: 61bd0e3e6573 ("scp: Disallow -r to an existing directory")
+
+CVE: CVE-2019-6111
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/16ce059ed8e914e210af67e199041943ec747034]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/scp.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/src/scp.c b/src/scp.c
+index 2f7a6279..4b4990ea 100644
+--- a/src/scp.c
++++ b/src/scp.c
+@@ -585,11 +585,14 @@ tolocal(int argc, char **argv)
+ }
+
+ char *dest = *(argv + argc - 1);
+- if (!(access(dest, F_OK) == 0 && errno == ENOENT)) {
+- /* paths sent from the server in recursive mode aren't adequately
+- * checked that they match the requested files, so disallow this */
+- fprintf(stderr, "-r destination \"%s\" must not already exist\n", dest);
+- exit(1);
++ if (iamrecursive) {
++ /* Destination must not exist */
++ if (!(access(dest, F_OK) == -1 && errno == ENOENT)) {
++ /* paths sent from the server in recursive mode aren't adequately
++ * checked that they match the requested files, so disallow this */
++ fprintf(stderr, "-r destination \"%s\" must not already exist\n", dest);
++ exit(1);
++ }
+ }
+
+ host = cleanhostname(host);
diff --git a/meta/recipes-core/dropbear/dropbear_2025.89.bb b/meta/recipes-core/dropbear/dropbear_2025.89.bb
index 685ecf9a1b3..6cb520f68d9 100644
--- a/meta/recipes-core/dropbear/dropbear_2025.89.bb
+++ b/meta/recipes-core/dropbear/dropbear_2025.89.bb
@@ -25,6 +25,10 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
file://dropbear.socket \
file://dropbear.default \
${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
+ file://CVE-2019-6111-01.patch \
+ file://CVE-2019-6111-02.patch \
+ file://CVE-2019-6111-03.patch \
+ file://CVE-2019-6111-04.patch \
"
SRC_URI[sha256sum] = "0d1f7ca711cfc336dc8a85e672cab9cfd8223a02fe2da0a4a7aeb58c9e113634"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 25/35] dropbear: patch CVE-2026-35385
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (23 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 24/35] dropbear: add follow-up patches for CVE-2019-6111 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 26/35] python3-urllib3: Fix CVE-2026-44432 Yoann Congal
` (10 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2026.90 release.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../dropbear/dropbear/CVE-2026-35385.patch | 42 +++++++++++++++++++
.../recipes-core/dropbear/dropbear_2025.89.bb | 1 +
2 files changed, 43 insertions(+)
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch
diff --git a/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch
new file mode 100644
index 00000000000..6794acd57a0
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch
@@ -0,0 +1,42 @@
+From 443ccc1fd1b9a4e3747f6b5cd644b7af49064308 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Sat, 2 May 2026 08:17:25 +0800
+Subject: [PATCH] scp: clear setuid/setgid bits on received files
+
+From openssh-portable 487e8ac146f7d6616f65c125d5edb210519b833a
+Tracked as CVE-2026-35385
+
+upstream: when downloading files as root in legacy (-O) mode and
+
+without the -p (preserve modes) flag set, clear setuid/setgid bits from
+downloaded files as one might expect.
+
+AFAIK this bug dates back to the original Berkeley rcp program.
+
+Reported by Christos Papakonstantinou of Cantina and Spearbit.
+
+OpenBSD-Commit-ID: 49e902fca8dd933a92a9b547ab31f63e86729fa1
+
+CVE: CVE-2026-35385
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/443ccc1fd1b9a4e3747f6b5cd644b7af49064308]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/scp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/scp.c b/src/scp.c
+index 09297a5b..79b0a12d 100644
+--- a/src/scp.c
++++ b/src/scp.c
+@@ -1114,8 +1114,10 @@ sink(int argc, char **argv, const char *src)
+
+ setimes = targisdir = 0;
+ mask = umask(0);
+- if (!pflag)
++ if (!pflag) {
++ mask |= 07000;
+ (void) umask(mask);
++ }
+ if (argc != 1) {
+ run_err("ambiguous target");
+ exit(1);
diff --git a/meta/recipes-core/dropbear/dropbear_2025.89.bb b/meta/recipes-core/dropbear/dropbear_2025.89.bb
index 6cb520f68d9..9f04327bd1a 100644
--- a/meta/recipes-core/dropbear/dropbear_2025.89.bb
+++ b/meta/recipes-core/dropbear/dropbear_2025.89.bb
@@ -29,6 +29,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
file://CVE-2019-6111-02.patch \
file://CVE-2019-6111-03.patch \
file://CVE-2019-6111-04.patch \
+ file://CVE-2026-35385.patch \
"
SRC_URI[sha256sum] = "0d1f7ca711cfc336dc8a85e672cab9cfd8223a02fe2da0a4a7aeb58c9e113634"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 26/35] python3-urllib3: Fix CVE-2026-44432
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (24 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 25/35] dropbear: patch CVE-2026-35385 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 27/35] python3-urllib3: Fix CVE-2026-97687 Yoann Congal
` (9 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Yogita Urade <yurade@cisco.com>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a
[2] https://security-tracker.debian.org/tracker/CVE-2026-44432
Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python3-urllib3/CVE-2026-44432.patch | 157 ++++++++++++++++++
.../python/python3-urllib3_2.6.3.bb | 1 +
2 files changed, 158 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch
new file mode 100644
index 00000000000..2cccc0a9a10
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch
@@ -0,0 +1,157 @@
+From 2bdcc44d1e163fb5cc48a8662425e35e15adfe6a Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Thu, 7 May 2026 18:39:03 +0300
+Subject: [PATCH] Merge commit from fork
+
+* Avoid any decoding in `HTTPResponse.drain_conn`
+
+* Add a comment
+
+* Simplify `drain_conn`
+
+* Add tests
+
+* Add additional checks to the test
+
+* Fix full decompression on the 2nd small read from response using Brotli
+
+* Add a changelog entry
+
+* Inverse the order in the changelog entry
+
+* Mention `stream` call
+
+CVE: CVE-2026-44432
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a]
+
+Backport Changes:
+- Omitted changelog/GHSA-mf9v-mfxr-j63j.bugfix.rst because the OE recipe
+ backport applies the runtime fix and tests; the package does not ship it.
+
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/urllib3/response.py | 17 +++++++++++------
+ test/test_response.py | 24 +++++++++++++++++++++---
+ test/with_dummyserver/test_connection.py | 19 +++++++++++++++++++
+ 3 files changed, 51 insertions(+), 9 deletions(-)
+
+diff --git a/src/urllib3/response.py b/src/urllib3/response.py
+index 521c31b282..e9246b75e3 100644
+--- a/src/urllib3/response.py
++++ b/src/urllib3/response.py
+@@ -798,13 +798,14 @@ def drain_conn(self) -> None:
+ Unread data in the HTTPResponse connection blocks the connection from being released back to the pool.
+ """
+ try:
+- self.read(
+- # Do not spend resources decoding the content unless
+- # decoding has already been initiated.
+- decode_content=self._has_decoded_content,
+- )
++ self._raw_read()
+ except (HTTPError, OSError, BaseSSLError, HTTPException):
+ pass
++ if self._has_decoded_content:
++ # `_raw_read` skips decompression, so we should clean up the
++ # decoder to avoid keeping unnecessary data in memory.
++ self._decoded_buffer = BytesQueueBuffer()
++ self._decoder = None
+
+ @property
+ def data(self) -> bytes:
+@@ -1091,7 +1092,11 @@ def read(
+ elif amt is not None:
+ cache_content = False
+
+- if self._decoder and self._decoder.has_unconsumed_tail:
++ if (
++ self._decoder
++ and self._decoder.has_unconsumed_tail
++ and len(self._decoded_buffer) < amt
++ ):
+ decoded_data = self._decode(
+ b"",
+ decode_content,
+
+diff --git a/test/test_response.py b/test/test_response.py
+index c70262c04e..da521137bf 100644
+--- a/test/test_response.py
++++ b/test/test_response.py
+@@ -858,22 +858,33 @@ def test_memory_usage_decode_with_max_length(
+ pytest.skip(f"Proper {request.node.callspec.id} decoder is not available")
+
+ name, compressed_data = data
+- limit = 1024 * 1024 # 1 MiB
++ limit1 = 1024 * 1024 # 1 MiB
++ # We test with two read calls because the second call may be
++ # able to use the internal buffer filled by the first call, and
++ # we want to ensure that full decompression is never triggered
++ # by the second call. The limit for the second call is lowered
++ # to make sure that the internal buffer is used for the Brotli
++ # case specifically https://github.com/google/brotli/issues/1396
++ limit2 = 1024 # 1 KiB
+ if read_method in ("read_chunked", "stream"):
+ httplib_r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type]
++ httplib_r.chunked = True
++ httplib_r.chunk_left = 1
+ httplib_r.fp = MockChunkedEncodingResponse([compressed_data]) # type: ignore[assignment]
+ r = HTTPResponse(
+ httplib_r,
+ preload_content=False,
+ headers={"transfer-encoding": "chunked", "content-encoding": name},
+ )
+- next(getattr(r, read_method)(amt=limit, decode_content=True))
++ for limit in (limit1, limit2):
++ next(getattr(r, read_method)(amt=limit, decode_content=True))
+ else:
+ fp = BytesIO(compressed_data)
+ r = HTTPResponse(
+ fp, headers={"content-encoding": name}, preload_content=False
+ )
+- getattr(r, read_method)(amt=limit, decode_content=True)
++ for limit in (limit1, limit2):
++ getattr(r, read_method)(amt=limit, decode_content=True)
+
+ # Check that the internal decoded buffer is empty unless brotli
+ # is used.
+@@ -883,6 +894,13 @@ def test_memory_usage_decode_with_max_length(
+ if name != "br" or brotli.__name__ == "brotlicffi":
+ assert len(r._decoded_buffer) == 0
+
++ # Check that memory usage is still within the limit while the
++ # connection is being drained, meaning that the call does not
++ # decompress the whole content.
++ r.drain_conn()
++ assert r._decoder is None
++ assert len(r._decoded_buffer) == 0
++
+ def test_multi_decoding_deflate_deflate(self) -> None:
+ data = zlib.compress(zlib.compress(b"foo"))
+
+diff --git a/test/with_dummyserver/test_connection.py b/test/with_dummyserver/test_connection.py
+index b9c547c00f..940815dac2 100644
+--- a/test/with_dummyserver/test_connection.py
++++ b/test/with_dummyserver/test_connection.py
+@@ -138,3 +138,22 @@ def test_invalid_tunnel_scheme(pool: HTTPConnectionPool) -> None:
+ str(e.value)
+ == "Invalid proxy scheme for tunneling: 'socks', must be either 'http' or 'https'"
+ )
++
++
++def test_response_after_drain_conn(pool: HTTPConnectionPool) -> None:
++ """
++ Test that a connection can be reused after calling `drain_conn` on
++ an unread response.
++ """
++ conn = pool._get_conn()
++
++ conn.request("GET", "/", preload_content=False)
++ response = conn.getresponse()
++ assert response.status == 200
++ response.drain_conn()
++
++ conn.request("GET", "/", preload_content=False)
++ response = conn.getresponse()
++ assert response.status == 200
++
++ conn.close()
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
index 537a68cdabf..b9d9b5671e4 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
@@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=52d273a3054ced561275d4d15260ecda"
SRC_URI += "file://CVE-2026-44431.patch \
file://CVE-2026-97689.patch \
+ file://CVE-2026-44432.patch \
"
SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 27/35] python3-urllib3: Fix CVE-2026-97687
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (25 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 26/35] python3-urllib3: Fix CVE-2026-44432 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 28/35] python3-urllib3: Fix CVE-2026-97688 Yoann Congal
` (8 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Yogita Urade <yurade@cisco.com>
This patch applies the upstream fix as referenced in [3],
using the commit shown in [1] and [2].
[1] https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3
[2] https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465
[3] https://security-tracker.debian.org/tracker/CVE-2026-97687
Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python3-urllib3/CVE-2026-97687_p1.patch | 277 +++++++++++
.../python3-urllib3/CVE-2026-97687_p2.patch | 450 ++++++++++++++++++
.../python/python3-urllib3_2.6.3.bb | 2 +
3 files changed, 729 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch
new file mode 100644
index 00000000000..5bd1b8f2d71
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch
@@ -0,0 +1,277 @@
+From b6447295fff7b38fdffc67e0df9712d60cef3cc3 Mon Sep 17 00:00:00 2001
+From: Dustin Hoeppner <dhoepp@me.com>
+Date: Fri, 12 Jun 2026 08:27:08 -0500
+Subject: [PATCH] Fix `proxy_ssl_context` ignored for HTTPS forwarding proxies
+ (#3786)
+
+Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
+
+CVE: CVE-2026-97687
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3]
+
+Backport Changes:
+- Omitted changelog/2577.bugfix.rst because the OE recipe backport applies
+ the runtime fix and tests; the package does not ship it.
+
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/urllib3/connection.py | 16 ++
+ src/urllib3/poolmanager.py | 15 ++
+ test/with_dummyserver/test_proxy_poolmanager.py | 149 +++++++++++++++++++++--
+ 3 files changed, 163 insertions(+), 17 deletions(-)
+
+diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py
+index 84e1dab945..49d1c11ea7 100644
+--- a/src/urllib3/connection.py
++++ b/src/urllib3/connection.py
+@@ -793,6 +793,20 @@ def connect(self) -> None:
+ # Remove trailing '.' from fqdn hostnames to allow certificate validation
+ server_hostname_rm_dot = server_hostname.rstrip(".")
+
++ # Forwarding proxies should use proxy SSL context for
++ # wrapping since that's the connection being established,
++ # whereas tunneling proxies should use the connection's SSL
++ # context.
++ # However, for backwards compatibility reasons, if the proxy
++ # is forwarding but no proxy SSL context is provided, we
++ # fall back to using the connection's SSL context until
++ # urllib3 v3.0. Appropriate warning is emitted in
++ # ``ProxyManager.__init__``.
++ if self.proxy_is_forwarding and self.proxy_config is not None:
++ ssl_context = self.proxy_config.ssl_context
++ else:
++ ssl_context = self.ssl_context
++
+ sock_and_verified = _ssl_wrap_socket_and_match_hostname(
+ sock=sock,
+ cert_reqs=self.cert_reqs,
+@@ -806,7 +820,7 @@ def connect(self) -> None:
+ key_file=self.key_file,
+ key_password=self.key_password,
+ server_hostname=server_hostname_rm_dot,
+- ssl_context=self.ssl_context,
++ ssl_context=ssl_context,
+ tls_in_tls=tls_in_tls,
+ assert_hostname=self.assert_hostname,
+ assert_fingerprint=self.assert_fingerprint,
+
+diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py
+index 3914dec268..b7248d210d 100644
+--- a/src/urllib3/poolmanager.py
++++ b/src/urllib3/poolmanager.py
+@@ -581,6 +581,21 @@ def __init__(
+ if proxy.scheme not in ("http", "https"):
+ raise ProxySchemeUnknown(proxy.scheme)
+
++ if (
++ use_forwarding_for_https
++ and proxy.scheme == "https"
++ and connection_pool_kw.get("ssl_context") is not None
++ ):
++ warnings.warn(
++ "Passing ssl_context when use_forwarding_for_https=True is deprecated "
++ "and will raise an error in urllib3 v3.0. "
++ "Use proxy_ssl_context to configure the TLS connection to the proxy.",
++ FutureWarning,
++ stacklevel=2,
++ )
++ if proxy_ssl_context is None:
++ proxy_ssl_context = connection_pool_kw.get("ssl_context")
++
+ if not proxy.port:
+ port = port_by_scheme.get(proxy.scheme, 80)
+ proxy = proxy._replace(port=port)
+
+diff --git a/test/with_dummyserver/test_proxy_poolmanager.py b/test/with_dummyserver/test_proxy_poolmanager.py
+index 6921bc6d22..48f9704b9a 100644
+--- a/test/with_dummyserver/test_proxy_poolmanager.py
++++ b/test/with_dummyserver/test_proxy_poolmanager.py
+@@ -10,6 +10,7 @@
+ import socket
+ import ssl
+ import tempfile
++import typing
+ from test import LONG_TIMEOUT, SHORT_TIMEOUT, resolvesLocalhostFQDN, withPyOpenSSL
+ from test.conftest import ServerConfig
+
+@@ -24,7 +25,7 @@
+ )
+ from urllib3 import HTTPResponse
+ from urllib3._collections import HTTPHeaderDict
+-from urllib3.connection import VerifiedHTTPSConnection
++from urllib3.connection import HTTPSConnection, VerifiedHTTPSConnection
+ from urllib3.connectionpool import connection_from_url
+ from urllib3.exceptions import (
+ ConnectTimeoutError,
+@@ -166,6 +167,43 @@ def test_https_proxy_forwarding_for_https(self) -> None:
+ r = https.request("GET", f"{self.https_url}/")
+ assert r.status == 200
+
++ @requires_network()
++ @pytest.mark.parametrize(
++ "proxy_ssl_context_kw",
++ [
++ ("ssl_context",),
++ ("proxy_ssl_context",),
++ ("ssl_context", "proxy_ssl_context"),
++ ],
++ )
++ def test_https_proxy_forwarding_for_https_with_custom_context(
++ self, proxy_ssl_context_kw: tuple[str, ...]
++ ) -> None:
++ """
++ Test that an HTTP request succeeds when using a forwarding HTTPS
++ proxy with an SSL context provided via either
++ ``proxy_ssl_context``, ``ssl_context`` (fallback), or both.
++ """
++
++ proxy_ctx = ssl.create_default_context()
++ proxy_ctx.load_verify_locations(DEFAULT_CA)
++
++ warning_checker: contextlib.AbstractContextManager[typing.Any]
++ if "ssl_context" in proxy_ssl_context_kw:
++ warning_checker = pytest.warns(FutureWarning, match="ssl_context")
++ else:
++ warning_checker = contextlib.nullcontext()
++ with warning_checker:
++ proxy = proxy_from_url(
++ self.https_proxy_url,
++ **{kw: proxy_ctx for kw in proxy_ssl_context_kw},
++ use_forwarding_for_https=True,
++ )
++
++ with proxy:
++ resp = proxy.request("GET", self.https_url)
++ assert resp.status == 200
++
+ def test_nagle_proxy(self) -> None:
+ """Test that proxy connections do not have TCP_NODELAY turned on"""
+ with ProxyManager(self.proxy_url) as http:
+@@ -694,20 +732,8 @@ def test_https_proxy_tls_error(
+ assert isinstance(e.value.reason.original_error, SSLError)
+
+ @requires_network()
+- @pytest.mark.parametrize(
+- ["proxy_scheme", "use_forwarding_for_https"],
+- [
+- ("http", False),
+- ("https", False),
+- ("https", True),
+- ],
+- )
+- def test_proxy_https_target_tls_error(
+- self, proxy_scheme: str, use_forwarding_for_https: str
+- ) -> None:
+- if proxy_scheme == "https" and use_forwarding_for_https:
+- pytest.skip("Test is expected to fail due to urllib3/urllib3#2577")
+-
++ @pytest.mark.parametrize("proxy_scheme", ["http", "https"])
++ def test_proxy_https_target_tls_error(self, proxy_scheme: str) -> None:
+ proxy_url = self.https_proxy_url if proxy_scheme == "https" else self.proxy_url
+ proxy_ctx = ssl.create_default_context()
+ proxy_ctx.load_verify_locations(DEFAULT_CA)
+@@ -717,12 +743,103 @@ def test_proxy_https_target_tls_error(
+ proxy_url,
+ proxy_ssl_context=proxy_ctx,
+ ssl_context=ctx,
+- use_forwarding_for_https=use_forwarding_for_https,
+ ) as proxy:
+ with pytest.raises(MaxRetryError) as e:
+ proxy.request("GET", self.https_url)
+ assert isinstance(e.value.reason, SSLError)
+
++ @requires_network()
++ def test_forwarding_proxy_tls_error_with_fallback(self) -> None:
++ """
++ Test that when only ``ssl_context`` is passed to a forwarding
++ HTTPS proxy, a ``FutureWarning`` is emitted and if the TLS
++ handshake with the proxy fails using that context, the error is
++ a ``ProxyError`` wrapping the original TLS error.
++ """
++ ctx = ssl.create_default_context()
++
++ with pytest.warns(FutureWarning, match="ssl_context"):
++ proxy = proxy_from_url(
++ self.https_proxy_url,
++ ssl_context=ctx,
++ use_forwarding_for_https=True,
++ )
++
++ with proxy:
++ with pytest.raises(MaxRetryError) as e:
++ proxy.request("GET", self.https_url)
++ assert isinstance(e.value.reason, ProxyError)
++ assert isinstance(e.value.reason.original_error, SSLError)
++
++ @requires_network()
++ def test_forwarding_proxy_ssl_context_precedence(self) -> None:
++ """
++ Test that when both ``ssl_context`` and ``proxy_ssl_context``
++ are passed to a forwarding HTTPS proxy, ``proxy_ssl_context`` is
++ used for the proxy connection and ``ssl_context`` is ignored
++ (with a warning).
++ """
++ ssl_context = ssl.create_default_context(cafile=DEFAULT_CA)
++ proxy_ssl_context = ssl.create_default_context(cafile=DEFAULT_CA)
++
++ with pytest.warns(FutureWarning, match="ssl_context"):
++ proxy = proxy_from_url(
++ self.https_proxy_url,
++ proxy_ssl_context=proxy_ssl_context,
++ ssl_context=ssl_context,
++ use_forwarding_for_https=True,
++ )
++
++ with proxy:
++ pool = proxy.connection_from_url(self.https_url)
++ with contextlib.closing(pool._new_conn()) as conn:
++ conn = typing.cast(HTTPSConnection, conn)
++ conn.connect()
++ assert isinstance(conn.sock, ssl.SSLSocket)
++ assert conn.sock.context is proxy_ssl_context
++
++ @requires_network()
++ def test_forwarding_proxy_ssl_context_fallback(self) -> None:
++ """
++ Test that when only ``ssl_context`` is passed to a forwarding
++ HTTPS proxy, a ``FutureWarning`` is emitted and ``ssl_context``
++ is used as the proxy TLS context (fallback).
++ """
++ ssl_context = ssl.create_default_context(cafile=DEFAULT_CA)
++
++ with pytest.warns(FutureWarning, match="ssl_context"):
++ proxy = proxy_from_url(
++ self.https_proxy_url,
++ ssl_context=ssl_context,
++ use_forwarding_for_https=True,
++ )
++
++ with proxy:
++ pool = proxy.connection_from_url(self.https_url)
++ with contextlib.closing(pool._new_conn()) as conn:
++ conn = typing.cast(HTTPSConnection, conn)
++ conn.connect()
++ assert isinstance(conn.sock, ssl.SSLSocket)
++ assert conn.sock.context is ssl_context
++
++ @requires_network()
++ def test_forwarding_non_https_proxy_ssl_context_fallback(self) -> None:
++ """
++ Test that when only ``ssl_context`` is passed to a forwarding
++ non-HTTPS proxy, no warning or error is emitted.
++ """
++ ssl_context = ssl.create_default_context(cafile=DEFAULT_CA)
++ # No warning/error should be emitted even when ``ssl_context``
++ # is provided to a non-HTTPS proxy for some reason.
++ proxy = proxy_from_url(
++ self.proxy_url,
++ ssl_context=ssl_context,
++ use_forwarding_for_https=True,
++ )
++ with proxy:
++ resp = proxy.request("GET", self.https_url)
++ assert resp.status == 200
++
+ def test_scheme_host_case_insensitive(self) -> None:
+ """Assert that upper-case schemes and hosts are normalized."""
+ with proxy_from_url(self.proxy_url.upper(), ca_certs=DEFAULT_CA) as http:
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch
new file mode 100644
index 00000000000..8c2b26e89e0
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch
@@ -0,0 +1,450 @@
+From 07408cec79d1856d81bb42c74a904a24fdb9e465 Mon Sep 17 00:00:00 2001
+From: Andrey Petrov <andrey.petrov@shazow.net>
+Date: Wed, 29 Jul 2026 18:20:36 -0400
+Subject: [PATCH] Isolate HTTPS proxy TLS settings from target TLS (#5093)
+
+CVE: CVE-2026-97687
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465]
+
+Backport Changes:
+- Omitted changelog/5093.bugfix.rst because the OE recipe backport applies
+ the runtime fix and tests; the package does not ship it.
+
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/urllib3/connection.py | 93 +++++++++-----
+ src/urllib3/poolmanager.py | 8 +
+ test/with_dummyserver/test_proxy_poolmanager.py | 150 ++++++++++++++++++++++-
+ 3 files changed, 205 insertions(+), 46 deletions(-)
+
+diff --git a/src/urllib3/connection.py b/src/urllib3/connection.py
+index 8a89488d7c..443cb01be1 100644
+--- a/src/urllib3/connection.py
++++ b/src/urllib3/connection.py
+@@ -838,30 +838,30 @@ def connect(self) -> None:
+ # fall back to using the connection's SSL context until
+ # urllib3 v3.0. Appropriate warning is emitted in
+ # ``ProxyManager.__init__``.
++ wrapped_socket: ssl.SSLSocket | SSLTransport
+ if self.proxy_is_forwarding and self.proxy_config is not None:
+- ssl_context = self.proxy_config.ssl_context
++ wrapped_socket = self._connect_tls_proxy(self.host, sock)
++ is_verified = self.proxy_is_verified is True
+ else:
+- ssl_context = self.ssl_context
+-
+- sock_and_verified = _ssl_wrap_socket_and_match_hostname(
+- sock=sock,
+- cert_reqs=self.cert_reqs,
+- ssl_version=self.ssl_version,
+- ssl_minimum_version=self.ssl_minimum_version,
+- ssl_maximum_version=self.ssl_maximum_version,
+- ca_certs=self.ca_certs,
+- ca_cert_dir=self.ca_cert_dir,
+- ca_cert_data=self.ca_cert_data,
+- cert_file=self.cert_file,
+- key_file=self.key_file,
+- key_password=self.key_password,
+- server_hostname=server_hostname_rm_dot,
+- ssl_context=ssl_context,
+- tls_in_tls=tls_in_tls,
+- assert_hostname=self.assert_hostname,
+- assert_fingerprint=self.assert_fingerprint,
+- )
+- self.sock = sock_and_verified.socket
++ wrapped_socket, is_verified = _ssl_wrap_socket_and_match_hostname(
++ sock=sock,
++ cert_reqs=self.cert_reqs,
++ ssl_version=self.ssl_version,
++ ssl_minimum_version=self.ssl_minimum_version,
++ ssl_maximum_version=self.ssl_maximum_version,
++ ca_certs=self.ca_certs,
++ ca_cert_dir=self.ca_cert_dir,
++ ca_cert_data=self.ca_cert_data,
++ cert_file=self.cert_file,
++ key_file=self.key_file,
++ key_password=self.key_password,
++ server_hostname=server_hostname_rm_dot,
++ ssl_context=self.ssl_context,
++ tls_in_tls=tls_in_tls,
++ assert_hostname=self.assert_hostname,
++ assert_fingerprint=self.assert_fingerprint,
++ )
++ self.sock = wrapped_socket
+
+ # If an error occurs during connection/handshake we may need to release
+ # our lock so another connection can probe the origin.
+@@ -882,7 +882,7 @@ def connect(self) -> None:
+ # If this connection doesn't know if the origin supports HTTP/2
+ # we report back to the HTTP/2 probe our result.
+ if target_supports_http2 is None:
+- supports_http2 = sock_and_verified.socket.selected_alpn_protocol() == "h2"
++ supports_http2 = wrapped_socket.selected_alpn_protocol() == "h2"
+ http2_probe.set_and_release(
+ host=probe_http2_host,
+ port=probe_http2_port,
+@@ -896,7 +896,7 @@ def connect(self) -> None:
+ if self.proxy_is_forwarding:
+ self.is_verified = False
+ else:
+- self.is_verified = sock_and_verified.is_verified
++ self.is_verified = is_verified
+
+ # If there's a proxy to be connected to we are fully connected.
+ # This is set twice (once above and here) due to forwarding proxies
+@@ -906,24 +906,47 @@ def connect(self) -> None:
+ # Set `self.proxy_is_verified` unless it's already set while
+ # establishing a tunnel.
+ if self._has_connected_to_proxy and self.proxy_is_verified is None:
+- self.proxy_is_verified = sock_and_verified.is_verified
++ self.proxy_is_verified = is_verified
+
+ def _connect_tls_proxy(self, hostname: str, sock: socket.socket) -> ssl.SSLSocket:
+ """
+- Establish a TLS connection to the proxy using the provided SSL context.
++ Establish a TLS connection to the proxy using proxy-specific policy.
+ """
+- # `_connect_tls_proxy` is called when self._tunnel_host is truthy.
+ proxy_config = typing.cast(ProxyConfig, self.proxy_config)
+- ssl_context = proxy_config.ssl_context
++ proxy_ssl_context = proxy_config.ssl_context
++
++ ssl_context: ssl.SSLContext | None
++ cert_reqs: int | str | None
++ if proxy_ssl_context is not None:
++ # Prefer the proxy's cert policy for the proxy connection
++ ssl_context = proxy_ssl_context
++ cert_reqs = proxy_ssl_context.verify_mode
++ ca_certs = None
++ ca_cert_dir = None
++ ca_cert_data = None
++ ssl_version = None
++ ssl_minimum_version = None
++ ssl_maximum_version = None
++ else:
++ # Otherwise we inherit the pool's cert policies
++ ssl_context = self.ssl_context if self.proxy_is_forwarding else None
++ cert_reqs = self.cert_reqs
++ ca_certs = self.ca_certs
++ ca_cert_dir = self.ca_cert_dir
++ ca_cert_data = self.ca_cert_data
++ ssl_version = self.ssl_version
++ ssl_minimum_version = self.ssl_minimum_version
++ ssl_maximum_version = self.ssl_maximum_version
++
+ sock_and_verified = _ssl_wrap_socket_and_match_hostname(
+ sock,
+- cert_reqs=self.cert_reqs,
+- ssl_version=self.ssl_version,
+- ssl_minimum_version=self.ssl_minimum_version,
+- ssl_maximum_version=self.ssl_maximum_version,
+- ca_certs=self.ca_certs,
+- ca_cert_dir=self.ca_cert_dir,
+- ca_cert_data=self.ca_cert_data,
++ cert_reqs=cert_reqs,
++ ssl_version=ssl_version,
++ ssl_minimum_version=ssl_minimum_version,
++ ssl_maximum_version=ssl_maximum_version,
++ ca_certs=ca_certs,
++ ca_cert_dir=ca_cert_dir,
++ ca_cert_data=ca_cert_data,
+ server_hostname=hostname,
+ ssl_context=ssl_context,
+ assert_hostname=proxy_config.assert_hostname,
+
+diff --git a/src/urllib3/poolmanager.py b/src/urllib3/poolmanager.py
+index c10e5d53cf..c1eb131290 100644
+--- a/src/urllib3/poolmanager.py
++++ b/src/urllib3/poolmanager.py
+@@ -583,6 +583,9 @@ def __init__(
+ if proxy.scheme not in ("http", "https"):
+ raise ProxySchemeUnknown(proxy.scheme)
+
++ # Keep the deprecated ssl_context fallback on the manager for
++ # compatibility, while passing only explicit proxy policy to connections.
++ self.proxy_ssl_context = proxy_ssl_context
+ if (
+ use_forwarding_for_https
+ and proxy.scheme == "https"
+@@ -595,8 +598,8 @@ def __init__(
+ FutureWarning,
+ stacklevel=2,
+ )
+- if proxy_ssl_context is None:
+- proxy_ssl_context = connection_pool_kw.get("ssl_context")
++ if self.proxy_ssl_context is None:
++ self.proxy_ssl_context = connection_pool_kw.get("ssl_context")
+
+ if not proxy.port:
+ port = port_by_scheme.get(proxy.scheme, 80)
+@@ -604,7 +607,6 @@ def __init__(
+
+ self.proxy = proxy
+ self.proxy_headers = proxy_headers or {}
+- self.proxy_ssl_context = proxy_ssl_context
+ self.proxy_config = ProxyConfig(
+ proxy_ssl_context,
+ use_forwarding_for_https,
+
+diff --git a/test/with_dummyserver/test_proxy_poolmanager.py b/test/with_dummyserver/test_proxy_poolmanager.py
+index 48f9704b9a..0991f93a19 100644
+--- a/test/with_dummyserver/test_proxy_poolmanager.py
++++ b/test/with_dummyserver/test_proxy_poolmanager.py
+@@ -114,6 +114,13 @@ def test_is_verified_https_proxy_to_http_target(self) -> None:
+ assert r.status == 200
+ assert_is_verified(https, proxy=True, target=False)
+
++ def test_is_verified_https_proxy_to_http_target_without_proxy_config(self) -> None:
++ with proxy_from_url(self.https_proxy_url, ca_certs=DEFAULT_CA) as https:
++ https.connection_pool_kw["_proxy_config"] = None
++ r = https.request("GET", f"{self.http_url}/")
++ assert r.status == 200
++ assert_is_verified(https, proxy=True, target=False)
++
+ def test_is_verified_https_proxy_to_https_target(self) -> None:
+ with proxy_from_url(self.https_proxy_url, ca_certs=DEFAULT_CA) as https:
+ r = https.request("GET", f"{self.https_url}/")
+@@ -144,6 +151,18 @@ def test_https_proxy_with_proxy_ssl_context(self) -> None:
+ r = https.request("GET", f"{self.http_url}/")
+ assert r.status == 200
+
++ @withPyOpenSSL
++ def test_https_proxy_with_proxy_ssl_context_pyopenssl(self) -> None:
++ proxy_ssl_context = create_urllib3_context()
++ proxy_ssl_context.load_verify_locations(DEFAULT_CA)
++
++ with proxy_from_url(
++ self.https_proxy_url,
++ proxy_ssl_context=proxy_ssl_context,
++ ) as https:
++ response = https.request("GET", f"{self.http_url}/")
++ assert response.status == 200
++
+ @withPyOpenSSL
+ def test_https_proxy_pyopenssl_not_supported(self) -> None:
+ with proxy_from_url(self.https_proxy_url, ca_certs=DEFAULT_CA) as https:
+@@ -779,8 +798,8 @@ def test_forwarding_proxy_ssl_context_precedence(self) -> None:
+ used for the proxy connection and ``ssl_context`` is ignored
+ (with a warning).
+ """
+- ssl_context = ssl.create_default_context(cafile=DEFAULT_CA)
+- proxy_ssl_context = ssl.create_default_context(cafile=DEFAULT_CA)
++ ssl_context = create_urllib3_context(cert_reqs=ssl.CERT_REQUIRED)
++ proxy_ssl_context = create_urllib3_context(cert_reqs=ssl.CERT_NONE)
+
+ with pytest.warns(FutureWarning, match="ssl_context"):
+ proxy = proxy_from_url(
+@@ -797,6 +816,7 @@ def test_forwarding_proxy_ssl_context_precedence(self) -> None:
+ conn.connect()
+ assert isinstance(conn.sock, ssl.SSLSocket)
+ assert conn.sock.context is proxy_ssl_context
++ assert proxy_ssl_context.verify_mode == ssl.CERT_NONE
+
+ @requires_network()
+ def test_forwarding_proxy_ssl_context_fallback(self) -> None:
+@@ -805,15 +825,21 @@ def test_forwarding_proxy_ssl_context_fallback(self) -> None:
+ HTTPS proxy, a ``FutureWarning`` is emitted and ``ssl_context``
+ is used as the proxy TLS context (fallback).
+ """
+- ssl_context = ssl.create_default_context(cafile=DEFAULT_CA)
++ ssl_context = create_urllib3_context(cert_reqs=ssl.CERT_NONE)
+
+ with pytest.warns(FutureWarning, match="ssl_context"):
+ proxy = proxy_from_url(
+ self.https_proxy_url,
+ ssl_context=ssl_context,
++ cert_reqs=ssl.CERT_REQUIRED,
++ ca_certs=DEFAULT_CA,
+ use_forwarding_for_https=True,
+ )
+
++ assert proxy.proxy_ssl_context is ssl_context
++ assert proxy.proxy_config is not None
++ assert proxy.proxy_config.ssl_context is None
++
+ with proxy:
+ pool = proxy.connection_from_url(self.https_url)
+ with contextlib.closing(pool._new_conn()) as conn:
+@@ -821,6 +847,23 @@ def test_forwarding_proxy_ssl_context_fallback(self) -> None:
+ conn.connect()
+ assert isinstance(conn.sock, ssl.SSLSocket)
+ assert conn.sock.context is ssl_context
++ assert ssl_context.verify_mode == ssl.CERT_REQUIRED
++
++ @requires_network()
++ def test_https_proxy_to_http_target_ssl_context_fallback(self) -> None:
++ ssl_context = create_urllib3_context()
++ ssl_context.load_verify_locations(DEFAULT_CA)
++
++ with proxy_from_url(
++ self.https_proxy_url,
++ ssl_context=ssl_context,
++ ) as proxy:
++ pool = proxy.connection_from_url(self.http_url)
++ with contextlib.closing(pool._new_conn()) as conn:
++ conn = typing.cast(HTTPSConnection, conn)
++ conn.connect()
++ assert isinstance(conn.sock, ssl.SSLSocket)
++ assert conn.sock.context is ssl_context
+
+ @requires_network()
+ def test_forwarding_non_https_proxy_ssl_context_fallback(self) -> None:
+@@ -921,32 +964,38 @@ def test_https_proxy_assert_fingerprint_md5(
+ destination_url = f"https://{server.host}:{server.port}"
+
+ proxy_ctx = urllib3.util.ssl_.create_urllib3_context(verify_flags=0)
++ proxy_ctx.load_verify_locations(proxy.ca_certs)
+ proxy_fingerprint = self._get_proxy_fingerprint_md5(proxy.ca_certs)
+ with proxy_from_url(
+ proxy_url,
+- ca_certs=proxy.ca_certs,
++ ca_certs=server.ca_certs,
+ proxy_ssl_context=proxy_ctx,
+ proxy_assert_fingerprint=proxy_fingerprint,
+ ) as https:
+ https.request("GET", destination_url)
+
++ @pytest.mark.parametrize("use_forwarding_for_https", [False, True])
+ def test_https_proxy_assert_fingerprint_md5_non_matching(
+- self, no_san_proxy_with_server: tuple[ServerConfig, ServerConfig]
++ self,
++ no_san_proxy_with_server: tuple[ServerConfig, ServerConfig],
++ use_forwarding_for_https: bool,
+ ) -> None:
+ proxy, server = no_san_proxy_with_server
+ proxy_url = f"https://{proxy.host}:{proxy.port}"
+ destination_url = f"https://{server.host}:{server.port}"
+
+ proxy_ctx = urllib3.util.ssl_.create_urllib3_context(verify_flags=0)
++ proxy_ctx.load_verify_locations(proxy.ca_certs)
+ proxy_fingerprint = self._get_proxy_fingerprint_md5(proxy.ca_certs)
+ new_char = "b" if proxy_fingerprint[5] == "a" else "a"
+ proxy_fingerprint = proxy_fingerprint[:5] + new_char + proxy_fingerprint[6:]
+
+ with proxy_from_url(
+ proxy_url,
+- ca_certs=proxy.ca_certs,
++ ca_certs=server.ca_certs,
+ proxy_ssl_context=proxy_ctx,
+ proxy_assert_fingerprint=proxy_fingerprint,
++ use_forwarding_for_https=use_forwarding_for_https,
+ ) as https:
+ with pytest.raises(MaxRetryError) as e:
+ https.request("GET", destination_url)
+@@ -964,8 +1013,11 @@ def test_https_proxy_assert_hostname(
+ ) as https:
+ https.request("GET", destination_url)
+
++ @pytest.mark.parametrize("use_forwarding_for_https", [False, True])
+ def test_https_proxy_assert_hostname_non_matching(
+- self, san_proxy_with_server: tuple[ServerConfig, ServerConfig]
++ self,
++ san_proxy_with_server: tuple[ServerConfig, ServerConfig],
++ use_forwarding_for_https: bool,
+ ) -> None:
+ proxy, server = san_proxy_with_server
+ destination_url = f"https://{server.host}:{server.port}"
+@@ -975,6 +1027,7 @@ def test_https_proxy_assert_hostname_non_matching(
+ proxy.base_url,
+ ca_certs=proxy.ca_certs,
+ proxy_assert_hostname=proxy_hostname,
++ use_forwarding_for_https=use_forwarding_for_https,
+ ) as https:
+ with pytest.raises(MaxRetryError) as e:
+ https.request("GET", destination_url)
+@@ -1064,6 +1117,7 @@ def test_https_proxy_no_san_hostname_checks_common_name(
+ destination_url = f"https://{server.host}:{server.port}"
+
+ proxy_ctx = urllib3.util.ssl_.create_urllib3_context(verify_flags=0)
++ proxy_ctx.load_verify_locations(proxy.ca_certs)
+ try:
+ proxy_ctx.hostname_checks_common_name = True
+ # PyPy doesn't like us setting 'hostname_checks_common_name'
+@@ -1074,6 +1128,86 @@ def test_https_proxy_no_san_hostname_checks_common_name(
+ pytest.skip("Test requires 'SSLContext.hostname_checks_common_name=True'")
+
+ with proxy_from_url(
+- proxy_url, ca_certs=proxy.ca_certs, proxy_ssl_context=proxy_ctx
++ proxy_url, ca_certs=server.ca_certs, proxy_ssl_context=proxy_ctx
+ ) as https:
+ https.request("GET", destination_url)
++
++ @pytest.mark.parametrize(
++ "target_tls_kwargs",
++ [
++ pytest.param({"server_hostname": "example.com"}, id="server-hostname"),
++ pytest.param({"assert_hostname": "example.com"}, id="assert-hostname"),
++ pytest.param({"assert_fingerprint": "00" * 32}, id="assert-fingerprint"),
++ ],
++ )
++ def test_https_proxy_forwarding_ignores_target_identity_settings(
++ self,
++ san_proxy_with_server: tuple[ServerConfig, ServerConfig],
++ target_tls_kwargs: dict[str, typing.Any],
++ ) -> None:
++ proxy, server = san_proxy_with_server
++ proxy_ctx = create_urllib3_context()
++ proxy_ctx.load_verify_locations(proxy.ca_certs)
++
++ with proxy_from_url(
++ proxy.base_url,
++ proxy_ssl_context=proxy_ctx,
++ proxy_assert_hostname=proxy.host,
++ use_forwarding_for_https=True,
++ **target_tls_kwargs,
++ ) as https:
++ pool = https.connection_from_url(server.base_url)
++ with contextlib.closing(pool._new_conn()) as conn:
++ conn = typing.cast(HTTPSConnection, conn)
++ conn.connect()
++ assert isinstance(conn.sock, ssl.SSLSocket)
++ assert conn.sock.context is proxy_ctx
++
++ def test_https_proxy_forwarding_ignores_target_client_certificate(
++ self,
++ san_proxy_with_server: tuple[ServerConfig, ServerConfig],
++ ) -> None:
++ proxy, server = san_proxy_with_server
++ proxy_ctx = create_urllib3_context()
++ proxy_ctx.load_verify_locations(proxy.ca_certs)
++ missing_cert = str(pathlib.Path(proxy.ca_certs).with_name("missing-cert.pem"))
++
++ with proxy_from_url(
++ proxy.base_url,
++ proxy_ssl_context=proxy_ctx,
++ cert_file=missing_cert,
++ use_forwarding_for_https=True,
++ ) as https:
++ pool = https.connection_from_url(server.base_url)
++ with contextlib.closing(pool._new_conn()) as conn:
++ conn = typing.cast(HTTPSConnection, conn)
++ conn.connect()
++ assert isinstance(conn.sock, ssl.SSLSocket)
++ assert conn.sock.context is proxy_ctx
++
++ def test_https_proxy_forwarding_ignores_target_tls_policy(
++ self,
++ san_proxy_with_server: tuple[ServerConfig, ServerConfig],
++ ) -> None:
++ proxy, server = san_proxy_with_server
++ proxy_ctx = create_urllib3_context(cert_reqs=ssl.CERT_REQUIRED)
++ proxy_ctx.load_verify_locations(proxy.ca_certs)
++ proxy_cert_store_stats = proxy_ctx.cert_store_stats()
++
++ with proxy_from_url(
++ proxy.base_url,
++ proxy_ssl_context=proxy_ctx,
++ cert_reqs=ssl.CERT_NONE,
++ ca_certs=DEFAULT_CA,
++ use_forwarding_for_https=True,
++ ) as https:
++ for target_url in (server.base_url, "https://example.com/"):
++ pool = https.connection_from_url(target_url)
++ with contextlib.closing(pool._new_conn()) as conn:
++ conn = typing.cast(HTTPSConnection, conn)
++ conn.connect()
++ assert isinstance(conn.sock, ssl.SSLSocket)
++ assert conn.sock.context is proxy_ctx
++
++ assert proxy_ctx.verify_mode == ssl.CERT_REQUIRED
++ assert proxy_ctx.cert_store_stats() == proxy_cert_store_stats
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
index b9d9b5671e4..ad5dd190d8d 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
@@ -6,6 +6,8 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=52d273a3054ced561275d4d15260ecda"
SRC_URI += "file://CVE-2026-44431.patch \
file://CVE-2026-97689.patch \
file://CVE-2026-44432.patch \
+ file://CVE-2026-97687_p1.patch \
+ file://CVE-2026-97687_p2.patch \
"
SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 28/35] python3-urllib3: Fix CVE-2026-97688
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (26 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 27/35] python3-urllib3: Fix CVE-2026-97687 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 29/35] gnupg: Fix CVE-2026-105712 Yoann Congal
` (7 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Yogita Urade <yurade@cisco.com>
This patch applies the upstream fix as referenced in [3],
using the commit shown in [1] and regression commit from [2].
Regression test-only follow-up skips the Brotli case when urllib3 uses
brotlicffi, because that trailing-data case is unsupported by that
backend. The skip is limited to Brotli; the Deflate regression case
remains covered.
[1] https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f
[2] https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e
[3] https://security-tracker.debian.org/tracker/CVE-2026-97688
[4] https://github.com/urllib3/urllib3/pull/5258
Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../CVE-2026-97688-regression.patch | 29 +++++
.../python3-urllib3/CVE-2026-97688.patch | 107 ++++++++++++++++++
.../python/python3-urllib3_2.6.3.bb | 2 +
3 files changed, 138 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
new file mode 100644
index 00000000000..220b024e1e8
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
@@ -0,0 +1,29 @@
+From 9016d7e8afc68185496ef07f3c3a4a743d04922e Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Tue, 15 Sep 2026 22:04:41 +0300
+Subject: [PATCH] Skip `test_read_chunked_with_trailing_data_does_not_hang` for
+ brotlicffi (#5258)
+
+CVE: CVE-2026-97688
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e]
+
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ test/test_response.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/test/test_response.py b/test/test_response.py
+index 5ecdbd9..24118f6 100644
+--- a/test/test_response.py
++++ b/test/test_response.py
+@@ -831,6 +831,8 @@ class TestResponse:
+ # while trailing data remains in the decoder's input buffer.
+ original_data = b"A" * 100
+ content_encoding, compress_func = data
++ if content_encoding == "br" and brotli.__name__ == "brotlicffi":
++ pytest.skip("This case is not supported by brotlicffi")
+ compressed_data = compress_func(original_data) + b"tail"
+ httplib_r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type]
+ httplib_r.fp = MockChunkedEncodingResponse([compressed_data]) # type: ignore[assignment]
+--
+2.35.6
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
new file mode 100644
index 00000000000..4fcdce68fc2
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
@@ -0,0 +1,107 @@
+From ea2ad7b21a80da3632f80016526a18864586077f Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Tue, 15 Sep 2026 21:32:04 +0300
+Subject: [PATCH] Merge commit from fork
+
+* Prevent an infinite loop when decoding Deflate responses
+
+* Move the new test to a better place
+
+* Add a changelog entry
+
+CVE: CVE-2026-97688
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f]
+
+Backport Changes:
+- Omitted changelog/GHSA-gh4c-6fx4-qh6g.bugfix.rst because the OE recipe
+ backport applies the runtime fix and tests; the package does not ship it.
+
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ src/urllib3/response.py | 8 +++++++-
+ test/test_response.py | 38 +++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 44 insertions(+), 2 deletions(-)
+
+diff --git a/src/urllib3/response.py b/src/urllib3/response.py
+index e9e0cee75e..dccdb12936 100644
+--- a/src/urllib3/response.py
++++ b/src/urllib3/response.py
+@@ -76,6 +76,10 @@ def __init__(self) -> None:
+ def decompress(self, data: bytes, max_length: int = -1) -> bytes:
+ data = self._unfed_data + data
+ self._unfed_data = b""
++ # Data received after EOF cannot produce more output from this
++ # Deflate stream.
++ if self._obj.eof:
++ return b""
+ if not data and not self._obj.unconsumed_tail:
+ return data
+ original_max_length = max_length
+@@ -118,7 +122,9 @@ def decompress(self, data: bytes, max_length: int = -1) -> bytes:
+ @property
+ def has_unconsumed_tail(self) -> bool:
+ return bool(self._unfed_data) or (
+- bool(self._obj.unconsumed_tail) and not self._first_try
++ bool(self._obj.unconsumed_tail)
++ and not self._first_try
++ and not self._obj.eof
+ )
+
+ def flush(self) -> bytes:
+
+diff --git a/test/test_response.py b/test/test_response.py
+index 799325b58c..4675646232 100644
+--- a/test/test_response.py
++++ b/test/test_response.py
+@@ -11,7 +11,7 @@
+ from base64 import b64decode
+ from http.client import IncompleteRead as httplib_IncompleteRead
+ from io import BufferedReader, BytesIO, TextIOWrapper
+-from test import onlyBrotli, onlyZstd
++from test import LONG_TIMEOUT, onlyBrotli, onlyZstd
+ from unittest import mock
+
+ import pytest
+@@ -813,6 +813,42 @@ def test_read_chunked_with_all_data_already_in_decompressor(
+ assert len(result[-1]) == len(original_data) % 10240
+ assert b"".join(result) == original_data
+
++ @pytest.mark.timeout(LONG_TIMEOUT)
++ @pytest.mark.parametrize(
++ "data",
++ [d[1] for d in _test_compressor_params],
++ ids=[d[0] for d in _test_compressor_params],
++ )
++ def test_read_chunked_with_trailing_data_does_not_hang(
++ self,
++ request: pytest.FixtureRequest,
++ data: tuple[str, typing.Callable[[bytes], bytes]] | None,
++ ) -> None:
++ if data is None:
++ pytest.skip(f"Proper {request.node.callspec.id} decoder is not available")
++ # The decoded body must fill multiple bounded reads so EOF is reached
++ # while trailing data remains in the decoder's input buffer.
++ original_data = b"A" * 100
++ content_encoding, compress_func = data
++ compressed_data = compress_func(original_data) + b"tail"
++ httplib_r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type]
++ httplib_r.fp = MockChunkedEncodingResponse([compressed_data]) # type: ignore[assignment]
++ r = HTTPResponse(
++ httplib_r,
++ preload_content=False,
++ headers={
++ "transfer-encoding": "chunked",
++ "content-encoding": content_encoding,
++ },
++ )
++
++ stream = r.stream(len(original_data) // 2, decode_content=True)
++ if content_encoding in ("br", "zstd"):
++ with pytest.raises(DecodeError):
++ list(stream)
++ else:
++ assert b"".join(stream) == original_data
++
+ @pytest.mark.parametrize(
+ "delta",
+ (
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
index ad5dd190d8d..73bfd369747 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.6.3.bb
@@ -8,6 +8,8 @@ SRC_URI += "file://CVE-2026-44431.patch \
file://CVE-2026-44432.patch \
file://CVE-2026-97687_p1.patch \
file://CVE-2026-97687_p2.patch \
+ file://CVE-2026-97688.patch \
+ file://CVE-2026-97688-regression.patch \
"
SRC_URI[sha256sum] = "1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 29/35] gnupg: Fix CVE-2026-105712
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (27 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 28/35] python3-urllib3: Fix CVE-2026-97688 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 30/35] linux-yocto/6.18: aufs: refresh to upstream aufs6.18 Yoann Congal
` (6 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch backports the upstream gpgtar security fix and its
follow-up to GnuPG 2.5.17. The security fix, directory handling
follow-up, and public CVE advisory are referenced in [1], [2],
and [3]. The follow-up includes a regression check for dry-run
extraction with a non-existing -C directory.
[1] https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88
[2] https://github.com/gpg/gnupg/commit/1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-105712
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gnupg/CVE-2026-105712-regression.patch | 39 ++++
.../gnupg/gnupg/CVE-2026-105712.patch | 194 ++++++++++++++++++
meta/recipes-support/gnupg/gnupg_2.5.17.bb | 2 +
3 files changed, 235 insertions(+)
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch
diff --git a/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch
new file mode 100644
index 00000000000..6097da38c30
--- /dev/null
+++ b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch
@@ -0,0 +1,39 @@
+From 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Tue, 14 Apr 2026 04:32:00 +0000
+Subject: [PATCH] tools:gpgtar: Fix for a case of non existing dir with -C.
+
+* tools/gpgtar-extract.c (gpgtar_extract): Call the
+check_output_directory function only when DIRNAME exists.
+
+--
+GnuPG-bug-id: 8159
+
+CVE: CVE-2026-105712
+Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5]
+
+Backport Changes:
+- Used gnupg_access() for the existence check because 2.5.17 does not
+ have the upstream COMPAT_NO_DIR_CHECK compatibility flag.
+
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+(cherry picked from commit 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ tools/gpgtar-extract.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c
+index 5ca80cb..a5a925c 100644
+--- a/tools/gpgtar-extract.c
++++ b/tools/gpgtar-extract.c
+@@ -504,7 +504,8 @@ gpgtar_extract (const char *filename, int decrypt)
+ goto leave;
+ }
+
+- if (!check_output_directory (dirname))
++ if (gnupg_access (dirname, F_OK) == 0
++ && !check_output_directory (dirname))
+ {
+ err = gpg_error (GPG_ERR_INV_ARG);
+ goto leave;
diff --git a/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch
new file mode 100644
index 00000000000..9b0bc1ca663
--- /dev/null
+++ b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch
@@ -0,0 +1,194 @@
+From 8df56dd913f3c910c9b265691efaac6c36a007a1 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 20 Mar 2026 13:33:00 +0900
+Subject: [PATCH] tool:gpgtar: Check the output directory with --directory.
+
+* doc/tools.texi (gpgtar): Clarify about the --directory option.
+* tools/gpgtar-extract.c (check_output_directory): New.
+(gpgtar_extract): Call check_output_directory.
+
+--
+
+GnuPG-bug-id: 8159
+
+CVE: CVE-2026-105712
+Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88]
+
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+(cherry picked from commit 7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ doc/tools.texi | 11 ++--
+ tools/gpgtar-extract.c | 123 ++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 128 insertions(+), 6 deletions(-)
+
+diff --git a/doc/tools.texi b/doc/tools.texi
+index 45f3e897d..691b7dc9c 100644
+--- a/doc/tools.texi
++++ b/doc/tools.texi
+@@ -2024,11 +2024,12 @@ Do not actually output the extracted files.
+ @item --directory @var{dir}
+ @itemx -C @var{dir}
+ @opindex directory
+-Extract the files into the directory @var{dir}. The default is to
+-take the directory name from the input filename. If no input filename
+-is known a directory named @file{GPGARCH} is used. For tarball
+-creation, switch to directory @var{dir} before performing any
+-operations.
++Extract the files into the directory @var{dir}. It raises an error
++when @var{dir} is not empty, or @var{dir} is a symlink to other
++directory. When this option is not given, the default is to take the
++directory name from the input filename. If no input filename is known
++a directory, named @file{GPGARCH} is used. For tarball creation,
++switch to directory @var{dir} before performing any operations.
+
+ @item --files-from @var{file}
+ @itemx -T @var{file}
+diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c
+index d23ccc579..5ca80cb89 100644
+--- a/tools/gpgtar-extract.c
++++ b/tools/gpgtar-extract.c
+@@ -24,6 +24,8 @@
+ #include <errno.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <dirent.h>
++#include <fcntl.h>
+ #include <string.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+@@ -369,6 +371,112 @@ create_directory (const char *dirprefix)
+ }
+
+
++/* Check the output directory DIRNAME if it's not symlink and empty.
++ Return 1 if good, 0 otherwise. */
++static int
++check_output_directory (const char *dirname)
++{
++#ifdef HAVE_W32_SYSTEM
++#define dirent _wdirent
++#define DIR _WDIR
++#define readdir _wreaddir
++#define closedir _wclosedir
++#endif
++ DIR *d;
++ struct dirent *dent;
++ int count = 0;
++
++#ifdef HAVE_W32_SYSTEM
++ wchar_t *wdirname;
++ DWORD attr;
++
++ wdirname = utf8_to_wchar (dirname);
++ if (!wdirname)
++ return 0;
++
++ attr = GetFileAttributesW (wdirname);
++
++ if (attr == INVALID_FILE_ATTRIBUTES)
++ {
++ log_error ("error getting attributes '%s': %s\n", dirname, w32_strerror (-1));
++ xfree (wdirname);
++ return 0;
++ }
++ else if ((attr & FILE_ATTRIBUTE_REPARSE_POINT))
++ {
++ /* It's reparse point (possibly symlink), not good. */
++ log_error ("Not a regular directory (may be symlink): %s\n", dirname);
++ xfree (wdirname);
++ return 0;
++ }
++
++ d = _wopendir (wdirname);
++ xfree (wdirname);
++#else
++# if O_NOFOLLOW == 0
++ struct stat sbuf;
++
++ if (lstat (dirname, &sbuf))
++ return 0;
++
++ if (S_ISLNK (sbuf.st_mode))
++ {
++ /* It's symlink, not good. */
++ log_error ("It's symbolic link: %s\n", dirname);
++ return 0;
++ }
++
++ d = opendir (dirname);
++# else
++ int fd;
++
++ /* With O_NOFOLLOW, make sure it's not symlink. */
++ fd = open (dirname, (O_RDONLY | O_NOFOLLOW));
++ if (fd < 0)
++ {
++ log_error ("Can't open (symlink?): %s\n", dirname);
++ return 0;
++ }
++
++ d = fdopendir (fd);
++# endif
++#endif
++
++ if (d == NULL)
++ return 0;
++
++ while ((dent = readdir (d)) != NULL)
++ {
++ if (dent->d_name[0] == '.' && dent->d_name[1] == 0)
++ continue;
++
++ if (dent->d_name[0] == '.' && dent->d_name[1] == '.'
++ && dent->d_name[2] == 0)
++ continue;
++
++ count++;
++ }
++
++ /* In case of fdopendir, FD is released by closedir. */
++ closedir (d);
++
++ if (count)
++ {
++ /* It's not empty, not good. */
++ log_error ("Directory not empty: %s\n", dirname);
++ return 0;
++ }
++
++ /* Good. */
++ return 1;
++}
++
++#ifdef HAVE_W32_SYSTEM
++#undef dirent
++#undef DIR
++#undef readdir
++#undef closedir
++#endif
+ \f
+ gpg_error_t
+ gpgtar_extract (const char *filename, int decrypt)
+@@ -388,7 +496,20 @@ gpgtar_extract (const char *filename, int decrypt)
+ memset (&tarinfo_buffer, 0, sizeof tarinfo_buffer);
+
+ if (opt.directory)
+- dirname = xtrystrdup (opt.directory);
++ {
++ dirname = xtrystrdup (opt.directory);
++ if (!dirname)
++ {
++ err = gpg_error_from_syserror ();
++ goto leave;
++ }
++
++ if (!check_output_directory (dirname))
++ {
++ err = gpg_error (GPG_ERR_INV_ARG);
++ goto leave;
++ }
++ }
+ else
+ {
+ if (opt.filename)
diff --git a/meta/recipes-support/gnupg/gnupg_2.5.17.bb b/meta/recipes-support/gnupg/gnupg_2.5.17.bb
index 6b2af1c96c9..04666ee8d77 100644
--- a/meta/recipes-support/gnupg/gnupg_2.5.17.bb
+++ b/meta/recipes-support/gnupg/gnupg_2.5.17.bb
@@ -20,6 +20,8 @@ SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \
file://0002-use-pkgconfig-instead-of-npth-config.patch \
file://0001-Woverride-init-is-not-needed-with-gcc-9.patch \
file://CVE-2026-57062.patch \
+ file://CVE-2026-105712.patch \
+ file://CVE-2026-105712-regression.patch \
"
SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \
file://relocate.patch"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 30/35] linux-yocto/6.18: aufs: refresh to upstream aufs6.18
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (28 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 29/35] gnupg: Fix CVE-2026-105712 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 31/35] linux-yocto/6.18: update to v6.18.57 Yoann Congal
` (5 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Integrating the following commit(s) to linux-yocto/6.18:
1/2 [
Author: Bruce Ashfield
Email: bruce.ashfield@gmail.com
Subject: aufs: update to upstream aufs6.18 (latest)
Date: Sat, 3 Oct 2026 22:06:19 -0400
Refresh the in-tree aufs to the current upstream aufs-standalone aufs6.18
snapshot (f8b3fda5). Brings in accumulated upstream aufs bugfixes plus the
x86 CONFIG_PREEMPT_RT support, superseding the standalone backport posted
to the linux-yocto list.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
2/2 [
Author: Bruce Ashfield
Email: bruce.ashfield@gmail.com
Subject: fs/aufs: route the FUSE mnt-ns check back through is_current_mnt_ns
Date: Sat, 3 Oct 2026 23:54:11 -0400
The aufs6.18 refresh moved fs/aufs to the native upstream snapshot, whose
vfsub.c calls our_mnt() directly. Upstream exports our_mnt() via its own
standalone integration patch; our integration instead exports a small
is_current_mnt_ns() wrapper. The refresh delta reverted that carried
adaptation, leaving the aufs module with an unexported our_mnt() reference
that fails to link whenever aufs is compiled.
Restore the adaptation: route the CONFIG_AUFS_BR_FUSE mnt-ns check back
through is_current_mnt_ns(). Unlike v7.x, 6.18 does not need the
open-coded rename-lock helpers -- lock_rename()/unlock_rename() are still
exported in the 6.18 kernel (the unexport landed upstream in v7.1), so the
native vfsub.c rename-locking links as-is here.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4f2e85e25ddf35220fe8b12fa1f1f354930ef563)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.18.bb | 4 ++--
.../linux/linux-yocto-tiny_6.18.bb | 4 ++--
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 20 +++++++++----------
3 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 5db966af1e7..ac97f340da1 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,8 +15,8 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "f892d97a3d660b9e7f4dc0618e0737f6e23906a7"
-SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf"
+SRCREV_machine ?= "64ebedd888ed53620df352f568a8b55c5620d169"
+SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index ef90b3db194..4cbcfc0084c 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
-SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf"
+SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 8bf35579cda..95cae43557d 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,18 +17,18 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "16672075f0d625c2a7186a00a0d47b34f8ac1e36"
-SRCREV_machine:qemuarm64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
-SRCREV_machine:qemuloongarch64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
+SRCREV_machine:qemuarm ?= "f271f5b5cce5f2c67c00ccb5b4bf60502d4ddc0b"
+SRCREV_machine:qemuarm64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_machine:qemuloongarch64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
-SRCREV_machine:qemuriscv64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
-SRCREV_machine:qemuriscv32 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
-SRCREV_machine:qemux86 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
-SRCREV_machine:qemux86-64 ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
+SRCREV_machine:qemuppc ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_machine:qemuriscv64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_machine:qemuriscv32 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_machine:qemux86 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_machine:qemux86-64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "8372c22a7d24c8fa15b62e13c1b5524a94caf9dc"
-SRCREV_meta ?= "366edfd67e22da481a7e6beb6386e1f7d19e71cf"
+SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 31/35] linux-yocto/6.18: update to v6.18.57
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (29 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 30/35] linux-yocto/6.18: aufs: refresh to upstream aufs6.18 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:29 ` Patchtest results for " patchtest
2026-11-11 9:02 ` [OE-core][wrynose 32/35] linux-yocto/6.18: update to v6.18.59 Yoann Congal
` (4 subsequent siblings)
35 siblings, 1 reply; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
2ff600d29ee47 Linux 6.18.57
d1e095c75d127 HID: steam: Clean up locking
cf71a6ee1d4e3 HID: steam: Refactor registration
86724f4bcf604 HID: steam: Rearrange teardown sequence
05d39902539a3 HID: steam: Fully unregister controller when hidraw is opened
3142648c952d6 sched_ext: Generate qseq from a per-task counter
f94a12ddd3184 drm/amd/display: Don't replace a sink mode that shares the native totals
82ac8c4939bdb regulator: of: fill in supply names in of_regulator_bulk_get_all()
32642616a8d73 SUNRPC: Add Kconfig dependency on CRYPTO_KRB5
69bf8d145ee1b can: fix unique skb identifier regression under RPS
cf32eb20dfacf xfs: fix exchange-range-to-eof file size exchange
7d3b9b2c9dc57 xfs: stop exchanging reflink flags when exchanging mappings
87655adb5ddb1 xfs: remove duplicate INO1_WRITTEN check
30e08c92118cc ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons
d0813c7c09dfa ACPI: scan: Do not mark button ACPI devices as wakeup-capable
5e9c814ee4da9 workqueue: Annotate alloc_workqueue_va() with __printf(1, 0)
2d2c32b1b9e32 accel/amdxdna: Fix crash when destroying a suspended hardware context
a82142af837f6 accel/amdxdna: Fix race condition when checking rpm_on
27f52d4089ade accel/amdxdna: Resume power for creating and destroying hardware context
44e61f1834831 s390/zcrypt: Pad trailing CCA or EP11 message with zeros
00a44ff06bcff s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
f463f474773aa s390/zcrypt: Improve EP11 CPRB length and overflow checks
584400144020f s390/zcrypt: Improve CCA CPRB length and overflow checks
7673661a8adc0 workqueue: fix devm_alloc_workqueue() va_list misuse
5c03da7451714 netfs: Fix missing alloc tagging of direct mempool allocations
22adb6751bcf9 net: fix backlog_unlock_irq_restore() vs CONFIG_PREEMPT_RT
07861e84b766c media: verisilicon: Fix kernel panic due to __initconst misuse
a582e7391fe35 netfs, afs: Fix symlink reading
4719852d14db2 cifs: consolidate time_last_write stamp into _cifsFileInfo_put()
8f7285d608ed0 btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
fdee3570b282a drm/panthor: validate userspace queue count against initialized firmware slot count
e3e6779f77ab6 x86/CPU/AMD: Fix AMD TLBI Erratum #1718
bf0f3412d5a0d drm/vc4: Fix binner slot allocation failing on an idle GPU
4835dbcde5cc3 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
2594795fd832f net: openvswitch: validate transport header presence in set_ipv6_addr
0849ecf1c65e8 ptp: ocp: fix PCIe delay estimation calculation
3938430f0237c mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
5b1fb3b105ff6 net/mlx5e: Order ICOSQ cc update after CQ doorbell
e241465838e26 veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
9caa2eca5cc83 drm/imagination: Fix reference and vm_bo handling in remap()
cc18eb0e99411 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
cb0d55754b4f9 bnxt_en: Re-write the BARs following any type of PCIe errors
fd6a2b055dbc8 bnxt_en: Drop pci_save_state() after pci_restore_state()
5026c5070b825 bnxt_en: Delay for 5 seconds after AER DPC for all chips
f41becbee8fc6 bnxt_en: Fix driver init in kdump kernel
8ef2b3ce6d142 bnxt_en: Add bnxt_clear_bars() helper
b18a649649549 pfcp: make sure the SEID is linear before reading it
75e7f850cabd5 net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET
e378bd8705659 Revert "net/mlx5: E-Switch, preserve max tx speed on vport state modification"
972b9285ae530 net/sched: cls_route: reject change with no routing attribute
8de57bfec3825 devlink: fix devlink_rel reference leak when notify work is pending
27748588c9310 net: sparx5: start the TOD counters on non-PTP lan969x variants
9993e6a0ac1b5 flow_dissector: avoid u16 truncation of skb->len when computing thoff
0bcebf2c4305c cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()
1194fd4c6dd1d spi: sg2044-nor: Honor SPI clock limits
f3e80f5132dc4 spi: sg2044-nor: Return transfer errors
64bb35079dcbc ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
ef15a51966ee1 ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
47c0c7a051b70 ASoC: adau1372: allow sleepy powerdown GPIOs
1bee950630df0 Revert "wifi: ath12k: add panic handler"
e3f7cc4ef04d1 wifi: mt76: mt792x: pick the SAR table layout from the table itself
83ec70a640fe1 wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
7fb2d37329c62 wifi: mt76: mt7925: don't put the band auto marker in TGID
0f9afe238eeb7 wifi: mt76: mt7915: disable rx napi when removing device
f240282165821 wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
0ed29ec00eb33 wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
69aae4146191f wifi: mt76: use ALTX queue for packets to disassociated stations
a18f68c1e72c8 wifi: mt76: route nullfunc frames to PSD/ALTX queue
9f28f50465086 wifi: mt76: account non-AQL frames per peer rather than per link
65b080310077c wifi: mt76: add PS buffering support for HW-managed TIM drivers
12b467683be5f wifi: mac80211: add ieee80211_txq_aql_pending()
09c6284b21f2e wifi: mac80211: add AQL support for multicast packets
aafd1724f65ef wifi: mt76: don't return TXQ when exceeding max non-AQL packets
0cf84535c031a riscv: vector: Fix output operands in context save
b56f9e11ac9f1 riscv: vector: Fix data pointer constraints in context save/restore
2c77af8bb5dc1 net: make dev_xdp_sb_prog_count() see programs attached through a link
63bc3cf8d7dd9 drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximums
36d7e2da7a873 btrfs: fix lost error return value in btrfs_listxattr()
a97114b9b00ed btrfs: fix xattr replace when multiple xattrs are packed in the same item
2797eb38773a9 btrfs: unlock inode and extent in caller when io_uring read extent fails
7a3addbdc5ad1 btrfs: free iov when btrfs_uring_read_extent() fails
033dda5b321f0 btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
77de9adf46f5b zloop: zero out only the unread tail of short reads
7057b683922fc arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
ce79a6c5cc1b8 nvmet: use the local P2P device on metadata allocation failure
e76979e27f0c5 nvmet: return Invalid Field for invalid NSIDs feature 82h
b7725acf9c574 ice: Restore Ordered MMIO Writes for Tx Doorbells
cbab667ef8b5d tee: optee: ffa: support shared memory offsets on large-page kernels
c83bf3973da6f tee: optee: fix kernel-doc warnings
7110c7f70c59e cxgb4/ch_ktls: disable softirqs around tid_list erases
181cb48c1e9af amt: send the relay's General Query directly from the receive path
85e5512369d4f net/sched: em_text: reject unterminated algo before autoload
bea10b84e22ef drm/vc4: Free the BO cache size list on teardown
742619c8637b9 drm/aspeed: Balance the display clock enable on teardown
01318927a9055 gpio: exar: initialize the ID before registering its cleanup
5b26dbb27c0cb drm/dp: don't mark the AUX backlight enabled when enabling failed
73e8503fac49c Bluetooth: btintel_pcie: Add shared HW reset for clean start
39ab048cce70d Bluetooth: btintel_pcie: fix TX descriptor bounds check
62a167e7e6d8c fs: don't let a migrating task hide its reference from do_umount()
6850385e26bf2 fs: move mntput_no_expire() slowpath into a dedicated routine
7505f139d8995 mount: refuse MOVE_MOUNT_SET_GROUP on an unbindable mount
cc21cda4cac5d arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
5a673697e4a3e arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
ab0f32981ce39 arm64: dts: lx2160a: fix incorrect pinmux
fea9c705bbc61 smb/server: fix tree connection leak in smb2_tree_connect()
46a431c0a25a8 ksmbd: convert tree_conns_lock to rw_semaphore
0af43b52fe4b1 printk: Don't WARN on kthread_run failure.
9bf96b4347f54 bpf: check_cond_jmp_op(): properly infer if register is null
8a3257f142ae5 net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
afca229b39acc ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
45462e5ba345a ipv6: mcast: annotate data-races around mca_users
a0cd9e22f8fae bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
3a39bc9707fbd bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
65f636322ac40 bpf: Mark syscall helpers as sleepable
364a31052aa9e ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
5b40198a0c69e ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer
6bb6ae5ab1bef bpf: zero extend the result of an arena 32-bit cmpxchg
c4d3bdb3ab211 bpf: don't rewrite bpf_fastcall patterns entered by a jump
65bea674f43c0 bpf: Don't infer non-NULL from a pointer with an unbounded offset
8d19e2cdfba9b bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
bb667eb575c90 bpf: Mark NULL kptr stores precise
08b534bafdd9d bpf: Preserve inner map identity in callback frames
3f30b2cd4eba4 tracing: Fix subbuf resize races with trace_pipe_raw readers
b1fe6379e401b bpf: mark a NULL call argument precise
787405e9e7bdc iommu/riscv: Serialize command queue publishing
3e6400e3b8b85 virtio_ring: fix stale descriptor flags after a failed packed add
831dab9b9bcc1 vduse: validate virtqueue alignment
7f8ee0b8f6324 vhost: invalidate vring access on IOTLB transitions
d9232a90c6f7d tracing: Take trace_array reference when opening a tracer options file
30dacb56f0728 drm/amdgpu: skip the VMID 0 flush for VRAM
6ac7a29691558 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
2be31f252ade7 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
28289d880e6d1 ksmbd: fix maximum allowed access checks
eb2e3bb27e78c ksmbd: remove redundant DACL check in smb_check_perm_dacl
2e7e39bb81913 remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
5c9ab0c9cede9 powerpc/xive: propagate IPI init errors to prevent use-after-free
e3388edec1fff powerpc/xive: add error return value to xive_smp_probe()
ebdd932dc24c1 ACPI: bus: Introduce acpi_bus_get_primary_device()
041cce629a08d drm/xe: don't WARN on kernel job timeout when device already wedged
40bab0da844c1 nfsd: convert nfsd_net boolean flags to unsigned long flags word
65aa0a4c4c1bf nfsd: use workqueue enable/disable APIs for v4_end_grace sync
96d4b275281b4 dm-pcache: validate seg_id fields from persistent memory
3d8391d3149a1 drm/amd/display: Fix dangling pointer in plane reset function
3a03827bb3cda drm/amd/display: Fix dangling pointer in CRTC reset function
f786e7b3adbf3 dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
7abc9b49ad01a uprobes/x86: Move optimized uprobe from nop5 to nop10
cf08ff2255de9 bpf: Reject MEM_ALLOC BTF accesses past object bounds
644cf4e77c277 bpf: Reject writes through untrusted BTF pointers
16a82add1918d platform/x86: dell-wmi-base: Fix handling of ultra performance key
93a20b14f8627 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
0203146ad4509 usb: gadget: uac: validate rate list length before storing
8410cd2690d46 platform/x86: asus-wmi: fix resource leaks on probe failure
1ad6456898f6e esp: do not unref managed frag pages in esp_ssg_unref()
80968b42d1308 RDMA/rvt: Return NULL after port allocation failure
6a2e023429a41 fs/resctrl: Fix UAF from worker threads when domains are removed
c6492e1741204 cxl/features: Serialize multi-part Get/Set Feature transfers
a60bc2df2d323 firmware: arm_scmi: Fix SCMI device destroy lifetimes
f85333284fcb6 firmware: arm_scmi: Fix OF node reference handling
21bc07293ec4f firmware: arm_scmi: Clear SystemPower flag on create failure
074d062040197 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
094f0a895cf97 bpf: Fix WARNING in bpf_tracing_link_release
01b5fcdc30c0a pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
f3480c59f4ce9 scsi: ufs: core: Validate string descriptors
9d39f6dda00f6 scsi: ufs: core: Convert string descriptor format macros to enum
268cbe3a36ae5 iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
c36816feff47f PCI: Fix UAF when probe runs concurrent to dyn ID removal
5e81d109f2e24 PCI: Fix dyn_id add TOCTOU
0787e34b894bd PCI: Make pci_match_one_device() match on ID instead of device
2fcd26f468014 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
ffd56ada81f97 nvmet: fix return status of RMI log page on allocation failure
f2be47fa8e225 drm/panthor: Add vm_bind region with kbo range overlap check
23bed4ef132c5 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
ffcc9ea4e4d12 md: remove REQ_NOWAIT support from raid1/10/456
7a1b971b799ea wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
2aa3d3b9fac91 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
aca0cd273b486 wifi: mt76: cancel reset and rc work on device unregister
9a9e902bd0556 bpf: Reject >8 byte return values on return-reading trampoline paths
e512823aabbdc wifi: mt76: mt7996: clear stale link state on full reset
e9e2854fcff57 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
0ec1d14cf302a wifi: nl80211: clean up color-change beacon data on errors
f334b26b884df wifi: brcmfmac: fix P2P action frame handling without device vif
9260a92ce90e6 serial: core: do fallible allocations before the console can be registered
ddf51d74ee9f9 serial: core: clear freed pointers on uart_register_driver() failure
2af4c46b42990 tty: skip cdev_del() when no cdev is registered
2fd9c8112907c HID: logitech-hidpp: Fix FF device cleanup on init failure
8397942b67128 ublk: validate auto buf reg before taking uring_cmd
f81972b235f3e bpf: Invalidate RCU pointers after final spin unlock
3556caa31a2bf PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers
9b405b3e7e131 thermal: hwmon: Remove hwmon class device along with its parent
9d44822ba34d6 ocfs2: o2hb: quiesce negotiate handlers and timeout work
bf4bd72020f33 ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
1f0f61573ba4c bpf: Clear buf on error in __bpf_get_task_stack
35ef785b25ee2 bpf: Remove trace_in argument from __bpf_get_stack
63669625833c4 bpf: Factor callchain_finalize function from __bpf_get_stack
8c30d9fd61ebf bpf: Factor callchain_store function from __bpf_get_stack
562d24ac214ba drm/amd/display: Resize MST HDCP per-connector arrays to 32
b5896fc269e9f drm/amd/display: disable replay when crc source is enabled
d5f3dae82705d coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
e90f746f4ca38 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
fcee001f57bdb scsi: sd: Move the sd_config_discard() function definition
ce8103676f4d4 btrfs: check if root is readonly when setting posix acl
172f349f2c59b btrfs: apply the AUTO_K(V)FREE macros throughout the code
58b0ab0340ce0 btrfs: zoned: flush active metadata block group at btree_writepages() start
243bf1e45e40b iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
11dfe2896ea23 iommu: Pass in old domain to attach_dev callback functions
6822ba1ae9b6d NFS: Return a delegation the client fails to record
e4ab436d5ba61 bpf: Compare iterator types during state pruning
a25ea67a913f9 clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
6e6f8e3bfc66d nvmet: fix max_qid race between configfs and controller allocation
5c6593422eb3c blk-iolatency: clear delay state when freeing policy data
b399a88eb8b16 blk-iocost: clear delay state when freeing policy data
f4ca62414f4fb blk-cgroup: delay freeing policy data after rcu grace period
d4ba9d888ac0a bpf: Check pointer type for all atomic RMW paths
272c05a51285f ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
dc1e34f78dfab ksmbd: serialize oplock close with pending break ownership
ff6870cf3b7ec ksmbd: defer publishing granted locks to prevent UAF/double-free race
52b91bc5253bb ksmbd: safely discard unregistered deferred locks
f77d2accafca5 ksmbd: detach blocked lock requests before freeing
1ff0e41afbe73 ksmbd: scope session state changes to bound connections
d39da3ff8d39c dpll: fix NULL deref in dpll_device_ops() during teardown race
5235abdb760bb virtio_net: Fix resize of the RX ring
0887d41abf766 irqchip/gic-v5: Clear per-CPU IRS data on teardown
f57b0fd1c62e1 ip6mr: do not clone dst in ip6mr_cache_report()
884cbf15ccd39 net: bridge: arp/nd proxy: fix reading neigh ha
f43ef9a3f9c12 vxlan: fix reading neigh ha
f4d23937e1c41 NFSv4.1: zero referring call lists before decoding
68fb30607169c net/sched: account classifier filter allocations to memcg
1ca1df82d9248 fuse: Fix the condition to enable over-io-uring
8460dc49c9756 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
8a8585e421d06 Bluetooth: do not leak an hci_conn when a second LE connect is rejected
7b3e08eea1e8c net: mana: Cap MSI-X vectors to the device MSI-X table size
c08314f917829 octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()
c6b56b8d549a0 netfilter: nf_tables: skip double clone set expressions on element insert
ef4dee4640c6a KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
506f03b5f869c LoongArch: KVM: Validate MSI data before routing it to EIOINTC
34a2a7134fd66 LoongArch: KVM: Get VM PMU capability from HW GCFG register
56c2c5ad35614 media: chips-media: wave5: Resume device before setting EOS flag
c26cbd5c33cd7 drm/amdgpu: force complete the KIQ ring fences on reset
7d722821e2f62 drm/amdgpu: force complete the MES ring fences on reset
ef073edd7cfd3 zram: fix out-of-bounds access in writeback_store()
836ce2b99bcce lockd, nfsd: RCU-protect nlmsvc_ops dispatch
df5500ab85df6 nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths
9646dfee88073 ceph: fix UAF in check_new_map() on session freed during unlock
e1f692b6da3e6 cifs: call pagecache_isize_extended() in cifs_setsize() when extending
5481766125041 ext2: Fix lost inode updates for IS_SYNC inodes
0692a8fdf0222 kho: fix size calculation in kho_preserved_memory_reserve()
996dd15f60121 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
5909f8f04e9b7 SUNRPC: Switch MIC token verification to crypto/krb5
ffb0423b4f4b0 SUNRPC: Switch MIC token generation to crypto/krb5
1e9125bb7948c SUNRPC: Switch wrap token decryption to crypto/krb5
5ec781a29eed1 SUNRPC: Switch wrap token encryption to crypto/krb5
6b4d0c9cf2b10 SUNRPC: Prepare crypto/krb5 encryption and checksum handles
5cf04fdbbf30e SUNRPC: Add errno-to-GSS status conversion helper
08efba8d62560 SUNRPC: Add crypto/krb5 enctype lookup to krb5_ctx
65f0f82f20334 svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
35d5dd0c2fd1e svcrdma: wake sq waiters when the transport closes
f35cf68b14422 svcrdma: Add Write chunk WRs to the RPC's Send WR chain
ddbd71a378094 RISC-V: KVM: Fix PMU event info array size overflow
0d4316e30efc8 KVM: riscv: Fix Spectre-v1 in PMU counter access
0f035333e1994 ntb: Store original DMA address for future release
b8cd3b632a0ce NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
6a01c4d3a3ae1 NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
7672973957e3e tipc: avoid busy looping in tipc_exit_net()
ed7e9715849ab fbdev: Wrap user-invoked calls to fb_set_var() in helper
69164d6bdad5d drm/amdkfd: Add bounds check for CRAT subtype length
39841db9322cd drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
22c2169770ad3 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
bea1f73ad69ee drm/amd/display: check if dml21_add_phantom_plane() is successful
63844dc03960b dmaengine: idxd: fix double free of wq, engine, and group structs
e299b7d1334eb idpf: bound interrupt-vector register fill to the allocated array
a4de6fc95b2f3 Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
e124f7b170337 soc: xilinx: Fix race condition in event registration
afef4b0de4f3c drivers: firmware: xilinx: Switch to new family code in zynqmp_pm_get_family_info()
a19c48d9f5a73 drivers: firmware: xilinx: Add unique family code for all platforms
547ea9f567498 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
be7fb59512ffc btrfs: lzo: reject compressed segment that overflows the compressed input
0977a6f234396 optee: ffa: Add NULL check in optee_ffa_lend_protmem
fdc93f4a80107 scsi: core: pair EH runtime PM get and put
5cea365559449 ovpn: defer key slot crypto freeing to workqueue
eb81c8e758f49 ipvs: revalidate ihl to prevent out-of-bounds access
d10e73572cda4 eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
21f5381a57a5f eth: bnxt: decrease indent in bnxt_request_irq()
bf3f37c2d40b5 gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
868c478abce85 soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
056876c9db1e9 btrfs: lzo: reject inline extents without valid headers
618fc8dc219c1 accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()
b3d05a335cbd3 accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()
4af94462c0ca2 bpf: Fix netns reference imbalance in conntrack kfuncs
b57164cdddb46 vhost_iotlb: bound map allocation in add_range
2b80707b9e276 eventfs: Use children field for rcu head and add memory barriers
969a96479add6 btrfs: skip global block reserve accounting for rescue mounts
f5427cab06564 btrfs: warn about extent buffer that can not be released
23b0f4117e970 btrfs: only invalidate btree inode pages after all ebs are released
a6f972c50552e btrfs: split btrfs_fs_closing() and change return type to bool
f8e5715a37378 KVM: arm64: vgic: Fix race between LPI release and re-registration
4b296d176580a nexthop: take nh->lock for f6i_list walks in replace check and notify
f97fae992155b nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
2c0a8cc97a9d9 xsk: reclaim invalid Tx descriptors in ZC batch path
1ff789fdfa231 xsk: provide sufficient space in pool->tx_descs
9990cac513e8b net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
15ed8a9b7c63e netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
ff5625d27415a Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
ff926f3ef6c80 Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs
946dc5835c8fb net: Convert proto_ops bind() callbacks to use sockaddr_unsized
f1b4c6aaf7655 hdlc_ppp: fix potential null pointer in ppp_cp_event logging
68ffe4265775e Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
a76243488740a octeontx2-af: Block VFs from clobbering special CGX PKIND state
59adeedebf02a s390/zcrypt: Close speculative mem read possibility
20b0b0159390f s390/zcrypt: Rework domain processing within zcrypt device driver
2a25ddf0bf6dd s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code
23a541c31b45f drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
029b363c9b690 md/raid1,raid10: fix error-path detection with md_cloned_bio()
bcf30e14d2bd5 md/raid1,raid10: fix bio accounting for split md cloned bios
ea2d1d2ebf60b md/raid1,raid10: fix deadlock in read error recovery path
e4a59511e1abd md: replace wait loop with wait_event() in md_handle_request()
55c6f05b66772 wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
c09314b8b4c62 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
d94bf50756d7f ocfs2: validate fast symlink target during inode read
b4059a1f57eff bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
68cf46755894d wifi: mac80211: bound S1G TIM PVB walk to the TIM element
0901d2c894426 wifi: ieee80211: split S1G definitions out
f488b83a38103 ixgbe: do not configure xps for XDP queues
29e07ec352f0a ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
0bc97a4110e87 ext4: add mext_check_validity() to do basic check
6166cb1344f16 iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path
98c7e206af48b cxl/region: Block region delete during region creation
53fb46cf933dc netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
fcacd948b10a3 netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
7d5a0dc8eaab4 netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding
33aed3ba04aa5 RDMA/bnxt_re: Free CQ toggle page after firmware teardown
2106c337905d7 RDMA/bnxt_re: Add a max slot check for SQ
b422e3eff0edf net: serialize netif_running() check in enqueue_to_backlog()
9a6916a934277 net: fully inline backlog_unlock_irq_restore()
459536b3acf13 net: optimize enqueue_to_backlog() for the fast path
580896e330038 fs/ntfs3: call _ntfs_bad_inode() when failing to rename
da6675b393516 fs/ntfs3: Reformat code and update terminology
308d7951ca221 i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()
7a45046068791 md/raid1: fix writes_pending and barrier reference leaks on write failures
c642583adc136 md/raid10: fix writes_pending leak on write request failures
453f4f1e90de5 bpf: Guard conntrack opts error writes
644b4c05bd1a4 bpf: net: netfilter: drop dead NULL checks
3827ff67f9fbe tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
9de9e8f279de0 drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
bc8f2d1c6f7cf xen/pvcalls: bound backend response req_id before indexing rsp[]
177d22d31a4eb iomap: release pages on atomic dio size mismatch
0be672071d6e8 net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
31cc289d5b179 Bluetooth: 6lowpan: avoid untracked enable work
3dd12422653ad accel/amdxdna: Fix VMA access race
33819cca7b76d accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval
bf63433873a06 accel/amdxdna: Fill invalid payload for failed command
08ff33dce6f91 net/liquidio: drop cached VF pci_dev LUT
241cf3b7455be accel/amdxdna: reject user command submission without a command BO
0a2c89d538fd4 ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
4739b1b833cf2 ata: libata-core: Disable LPM on Silicon Motion MD619{H,G}XCLDE3TC
1c3d9c6bd5b79 wifi: mac80211: validate extension-frame layout before RX
9cbad9c8125f5 net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
c59a693fbd213 drm/amd/display: use kvzalloc to allocate struct dc
c2ddd180bbee7 wifi: cfg80211: use wiphy work for socket owner autodisconnect
01f8a354497ba bpf: Fix UAF in sock clone early bailouts
0b2c44363432a bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
88c38ff74f834 drm/xe/guc: Keep scheduler timeline name alive
81f70f130eff9 drm/xe/guc: Hold device ref until queue teardown completes
8549ac21ab503 bnxt_en: Handle partially initialized auxiliary devices
e611403f30928 fwctl/bnxt_en: Refactor aux bus functions to be more generic
5d3cea7d41dc7 tipc: serialize udp bearer replicast list updates
6089f561e2c31 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
984ce52ea0e01 cifs: prevent readdir from changing file size due to stale directory metadata
0c07e046e6391 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
16656c3d73469 LoongArch: BPF: Zero-extend signed ALU32 div/mod results
08fffd2881e28 idpf: fix max_vport related crash on allocation error during init
c174969f6af6c drm/i915/gt: Fix NULL deref on sched_engine alloc failure
f7e744bac9a72 drm/amdgpu: Fix kernel panic during driver load failure
cfb5a56c21888 ksmbd: prevent path traversal bypass by restricting caseless retry
3eaec47518e12 smb/client: fix chown/chgrp with SMB3 POSIX Extensions
d16713c060066 wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon
3f9c0fdefa043 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values
5afc2d9b86bed netfs: Fix zeropoint update where i_size > remote_i_size
b76568c672184 drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
fcb23bb31508b erofs: fix metabuf leak in inode xattr initialization
48d09dea506de net: hsr: defer node table free until after RCU readers
a2650f8461cd8 wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
3899d6f924925 wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
f669571a2bf50 netfilter: x_tables: allocate hook ops while under mutex
a014668cbd95b netfilter: x_tables: allow initial table replace without emitting audit log message
f048f297d93fd netfs: Fix missing barriers when accessing stream->subrequests locklessly
93531bca46707 afs: Fix the locking used by afs_get_link()
86f4c1586418d cachefiles: Fix error return when vfs_mkdir() fails
b9390aa62fdca nvme-pci: fix dma_vecs leak on p2p memory
fba32257979dd nvme-pci: fix dma mapping leak on data setup error
c85f325d9ec31 ACPI: button: Fix ACPI GPE handler leak during removal
78677084cd090 ACPI: button: Tweak acpi_button_remove()
38c79dacc8063 ACPI: button: Convert the driver to a platform one
bad88022f8949 ACPI: button: Adjust event notification routines
4ec3a8ca97394 net/sched: fix packet loop on netem when duplicate is on
b050fd0c2063b net: Introduce skb tc depth field to track packet loops
2090c1a236833 KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor
fa34d3e14cb76 drm/amdgpu: fix amdgpu_hmm_range_get_pages
768daa9f4276b netfilter: nf_tables: add hook transactions for device deletions
7e4ab3907f44d f2fs: read COW data with the original inode during atomic write
8363c219d88e7 fbdev: omap2: fix use-after-free in omapfb_mmap
48ac6bab9999b fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
4338663dfd21b power: supply: max77705: Free allocated workqueue and fix removal order
4e1af66d855f5 power: supply: max77705: Drop duplicated IRQ error message
fa4be2054a3e2 workqueue: devres: Add device-managed allocate workqueue
5459933a799aa net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
a8c1480bb066c drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
afe815a67ec8f wifi: cfg80211: enforce HE/EHT cap/oper consistency
daacc9d1430b6 ptp: ocp: fix resource freeing order
9446167bef89b ptp: ocp: Make ptp_ocp_unregister_ext() NULL-aware
de05e37d02f3f ublk: reset per-IO canceled flag on each fetch
09207dc57ab4c powerpc/64s: Fix unmap race with PMD migration entries
e72ffe59e48a7 greybus: raw: fix use-after-free on cdev close
cb06a07d835ba f2fs: fix data loss caused by incorrect use of nat_entry flag
910e498613d5b ice: fix double-free of tx_buf skb
c789649d4334a ice: fix potential NULL pointer deref in error path of ice_set_ringparam()
e98cea6d5562f ice: fix race condition in TX timestamp ring cleanup
cbfbc9d446d98 ice: reshuffle and group Rx and Tx queue fields by cachelines
349499a65b6b5 ceph: put folios not suitable for writeback
5df268406ef38 libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
d0ce7b07dafe4 drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure
060f8f3020516 drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure
dc24e03be0e4b Revert "net/smc: Introduce TCP ULP support"
2da62dbb4169e drm/amdgpu/userq: fix access to stale wptr mapping
b33d6f5da16e0 pseries/papr-hvpipe: Fix race with interrupt handler
51a321dec76f7 papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
1d15503e454bf drm/amd/display: Fix dc_link NULL handling in HPD init
96889fcdb0988 media: iris: fix use-after-free of fmt_src during MBPF check
46edfdcf95d2b media: iris: turn platform caps into constants
b0eb0a8959ac2 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
73df74544b552 udf: fix partition descriptor append bookkeeping
4456be93464a5 gfs2: fix memory leaks in gfs2_fill_super error path
370154a83a835 gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn
1b6a9f81c4715 gfs2: Get rid of delayed withdraws
dfd14e14772c6 gfs2: Asynchronous withdraw
604dca7c20a15 gfs2: Add clean argument to lm_unmount hook
74b981f0d3b90 gfs2: Clean up quotad timeout handling
9e0652e243ef4 gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit
e0e31a7ed1191 ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
4097a2afe8acc scsi: qla2xxx: Completely fix fcport double free
57a79c5df057d soc/tegra: pmc: Fix unsafe generic_handle_irq() call
5133ef7c893c2 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
6c5d98f24f995 media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
6ad4caadc6343 btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
6311ee6daa9cc btrfs: remove 'reserved' argument from btrfs_pin_extent()
81e1ae665004b btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
559f856b109c4 hfs: Replace BUG_ON with error handling for CNID count checks
3a409a64b2d61 ASoC: qcom: q6asm: drop DSP responses for closed data streams
d9bf525dff80b ASoC: qcom: q6asm: handle the responses after closing
02b033e18e08a drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
203a9241a7384 drm/amd/display: Rename FAMS2 global control lock to DMUB HW control lock
28768bc7ea0b1 srcu: Use irq_work to start GP in tiny SRCU
37419fa1b0bc2 irqwork: Move data struct to a types header
d14847cb7f65d mshv: Fix error handling in mshv_region_pin
f33de03b47c14 mshv: Move region management to mshv_regions.c
06c0ce18055a5 mshv: Centralize guest memory region destruction
93ed80634288d mshv: Refactor and rename memory region handling functions
a40a75df33267 static_call: allow using STATIC_CALL_TRAMP_STR() from assembly
5cfa4f537a056 Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
971854e7b6ddd ALSA: ctxfi: Check the error for index mapping
88cc09bb70651 ALSA: ctxfi: Refactor resource alloc for sparse mappings
1422b94887c5c ALSA: ctxfi: Use explicit output flag for DAIO resources
c0904c424f7da ALSA: ctxfi: Add hw parameter to daio_mgr_dao_init()
dbc8b8d33c9e1 Bluetooth: hci_event: move wake reason storage into validated event handlers
c516c2e06fe58 net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path
2352d719cccfc net: ti: icssg-prueth: Make emac_run_xdp function independent of page
2157742f5c32f net: ti: icssg-prueth: Add functions to create and destroy Rx/Tx queues
41f3fa0d14bb8 ti: icssg: convert to ndo_hwtstamp API
6e5c3ddf17a2c blktrace: fix __this_cpu_read/write in preemptible context
6b3546e3a8c66 accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
2f62f8be57882 PCI: endpoint: Add missing NULL check for alloc_workqueue()
b0d908230b3d8 PCI: Add WQ_PERCPU to alloc_workqueue() users
b569ff8a1bc1b accel/amdxdna: Fix potential NULL pointer dereference in context cleanup
09ed30edcfa1f accel/amdxdna: Add hardware specific attributes
3bdd26582d026 accel/amdxdna: Enhance runtime power management
5a7d0e2810891 ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands
e01c79761c7b3 namespace: handle mount locking for automounts correctly
6b8dc3713a763 namespace: never expire a locked mount
494c57572d2d5 namespace: refuse an automount below a mount that is in no namespace
fa75dae156df1 fcntl: refuse F_SET_RW_HINT on an immutable inode
5f97df8ca7fad namei: don't reveal overmounted entries in refwalk
d29cd99db3db7 namespace: unhash a dentry before detaching the mounts on it
7e1c466011ba9 namespace: don't let a pseudo dentry become the root of a mount
390ddcea2a8ac dcache: don't put a mountpoint on a dentry that's being removed
e3aba6900483f namespace: check the mounts before reading their parents in pivot_root()
888363d74c3b5 namespace: remove the fsnotify marks of a mount namespace in process context
b9c40553f6ceb namespace: look at the topmost mount for a mount namespace file
a0ba48256f5df namespace: check a recursive bind mount for mount namespace loops
d73f04e92c1aa namespace: check a submount for references right before unmounting it
acbe9e4418e2e namespace: queue a mount only once for mount notifications
33b4344f69013 namespace: check the target before walking it in do_mount_setattr()
c44f5c30f0a97 fs: refuse fspick() on internal superblocks
b47b40c4f0584 namespace: don't copy an unmounted mount tree
eecc9cd0fc07d namespace: don't inherit MNT_UMOUNT in clone_mnt()
5e0a1f2c753a7 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
bf2c8dec26fb7 fs: don't silently unmount busy mounts
9bd1181b36f2d mount: keep a copied mount unbindable
c6307228af65a drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
d9da2f7bbbffb drm/amdgpu/userq: return the memdup_user() error for the user MQD
112dbe2b10d6d drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
21aee7fc9310d drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
1a5c03198ae86 drm/amdgpu: make Mac FB workaround generic
8d6f773d74790 drm/amdgpu: serialize vblank counter reads against GPU reset
3d4890b4ab04f drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
f009879ed9906 drm/amdkfd: align SDMA doorbell base for shader doorbell writes
3a11adcfd9a2d drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
993c952e6832a drm/xe: Fix shrinker accounting double-subtraction on nested external pins
76e5ddd7d9822 drm/vmwgfx: validate pitch coming from userspace
ea22f8a5d11a4 drm/vc4: Fix firmware reference leak in vc4_drm_bind()
e61465d3e0292 drm/vc4: drain the hangcheck timer and works on V3D unbind
f9b215b3e37a5 drm/imagination: Size page table preallocation by device address
0b4a0fb98b9ff drm/i915/gt: Unmask interrupts only when ACTIVE is true
152fb5083b933 drm/i915/gem: Prevent overstepping exec array boundary
cd7bec509c180 drm/gud: don't keep a connector without a CRTC as connector_state
4e7b508c7c60d drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
a661f401f83b8 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
4f46de658ce61 Bluetooth: RFCOMM: free the skb when the DLC has no owner
b108ea7ebba14 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
ec227cddd13cd Bluetooth: MGMT: Fix status of pending commands flushed on power off
c6489a3a0ac8c Bluetooth: ISO: Serialize concurrent connect calls
90b744066ca52 Bluetooth: ISO: Reject concurrent BIS listener setup
7db33b36213a3 Bluetooth: hci_sync: Fix command skb lifetime during scan setup
c3d2799877906 Bluetooth: hci_sock: Serialize dead-device detachment
c9c20d334cd5e Bluetooth: btintel_pcie: use managed IRQ teardown
71beae6f2e8bc riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
2e5c80bbc062a riscv: futex: untag the user pointer before the atomic access
b86e88a3dc6e1 riscv: fix load_unaligned_zeropad() fixup for RV32
fa465a7819ecb riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
7d1367a53137e riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
8bfcbd5022818 scsi: qedi: Initialize callback state before registration
ce2eee635fd3e pmdomain: rockchip: propagate subdomain add errors
1072890e6c1af pmdomain: rockchip: fix clock leak on domain probe failure
5874c0e2bd030 pmdomain: rockchip: don't ignore clock lookup errors on attach
28606d4d4dbe8 pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
f6fbe9c6b3996 regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
199a62d70314d regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
681adbc9c7a82 optee: register TEE devices only once fully initialized
55f12552b00a3 openvswitch: fix soft lockup in the netlink flow dump
558a189ca357d nvme: fix swapped ZRASF zone state values for full and read only
961563117626f net: team: free skb when broadcast has no txable port
0c0568c9d35c4 net: team: stop reusing skb after queue override
5b144f83f2179 net: usb: ax88179_178a: fix rx frame length for non-last packets
cc7cc5955d22e net: sparx5: free the matchall entry on destroy
5551399751e2c net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
d7fea7141036f net: dsa: microchip: fix KSZ8765 fiber detection
d109141ba1465 net: bridge: avoid recursive multicast port cleanup
6a1833f0d7dc0 net/smc: protect clcsock lifetime in smc_getname
3efe0e0944157 net/packet: guard the ll header push in packet_rcv_spkt()
3a1caa886d41d mmc: sdhci-sprd: disable runtime PM on remove
46e75703ca3f0 mmc: mtk-sd: Cancel request timeout work on remove
9ac3fd9dc917d mmc: cavium-thunderx: destroy slot platform devices on remove
8668f432a9bf7 mmc: cavium-octeon: destroy slot platform devices on remove
e3bf232c913b7 dm: fix reading free memory in do_resume
c86f80cd246c0 dm-snap: reject the transient exception store for snapshot-merge
4f0ee735dc68e dm-integrity: fix buffer overflow in inline mode with large tag size
a1a875614dae4 dm-crypt: reject the lmk IV mode with AEAD ciphers
7a25ca170c12a mm: don't schedule deferred kernel page table freeing while booting
d7e811c3a49cd memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
f2795c50144d5 memstick: core: wait for request completion before freeing card
11516a0c402a6 KEYS: Fix add_key() race with keyring restriction
955b1f75c4001 keys: finalize persistent keyring timeout after link attempt
beb05f484a1e4 ice: fix metadata_dst refcount handling on representor teardown
ca8a6285b11d0 ice: fix use-after-free in dynamic port cleanup
bb8f6b89587d0 ibmveth: fix TX LTB and filter unwind on open-fail
a065bd31ec462 ibmveth: h_free logical LAN on open-fail after register
06656aaa7e43a gve: fix XSK buffer leak on error descriptor
506f9de069d07 gve: fix XSK buffer leak when rings are stopped
42935a6100192 gve: fix napi_disable deadlock when attempting to disable XSK pools
a027e0d7765d1 gpio: xilinx: fix runtime PM leak on request error path
76390ac0bca7e gpio: mpsse: fix race when arming the IRQ poll worker
1eb70d10bbb8a EDAC/amd64: Mask UMC chip select to the four implemented selects
2d79ddc9a0cc0 sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
5509d498e1b9e selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
5a41bcc5057dc selinux: fix data race on AVC latest_notif
215c29f7f4606 Revert "wifi: libertas: reject short monitor TX frames"
1428c5f1d346a tipc: hold a reference to nodes found by link name
0af8780bdfdfc tipc: destroy topsrv workqueues before closing connections
1c7463ac0e99c tcp: reject net_iov in zerocopy receive mapping hints
3d555c31b0d27 swiotlb: fix default_swiotlb_limit() for non-growable default pool
d2b5f637b9b67 strparser: make sure __strp_recv isn't running before tearing down the parser
65cb86860a80f tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
086944c1c2cbb xen/netfront: don't leak the skb when xennet_fill_frags() fails
b12a25fb2b9d5 workqueue: Fix NULL current_pwq deref in chained work check
4d64a3d6e96aa wireguard: noise: reject response consumption after intermediate initiation
38da24fd5c9d0 wireguard: queueing: preserve tstamp_type when encapsulating packet
d730b466496ce wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
dd117d17e8aa2 wifi: mt76: mt7603: initialize global station WCID
eef16a74ff8ed wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
38bad3930b118 vsock/virtio: account only unread bytes in read_skb()
6139c710d8bee usb: f81604: fix struct f81604_int_data size mismatch
5680b6fb30546 dm ioctl: don't let data_start run past the buffer
2200fe1d6148b cipso: adjust cached option offsets when removing CIPSO
8d88d3221204f cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
12ba7d8b9cd45 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
a768b88cd157b ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
13bbcfe755d46 arm64: irq: exclude the softirq stack switch from KCOV
1ea7241101753 ALSA: hda/tas2781: Accept V1 calibration data without CRC
f7dc71c1ce885 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
0b0278e760d7b Input: xpad - add support for Corsair Novablade Pro
2e4f80c023119 Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox
d738e51bf2c21 Input: ati_remote2 - fix type confusion in device attribute handlers
4ac7d92a4698e ipv6: do not warn on route notification size race
7dfa7ca97f3ac ipv4: do not warn on route notification size race
c1f48d1c2d5e9 ipv4: stop route notification sizing when nexthop group shrinks
21cba134c30c1 ipv4: stop exception dump when nexthop group shrinks
c6d670ac656ba ipv4: stop PMTU walk when nexthop group shrinks
71cbad138969e rust_binder: reschedule node refcount update on thread exit
f3e835af6226f ipv4: validate checksum_start before completing checksum
fa1bceba169b1 ipv6: Fix redirect exception creation for UDP/RAW sockets
61a32face36f7 crypto: drbg - Fix ineffective sanity check
af98611ad109e net: dsa: mt7530: fix .get_stats64 sleeping in atomic context
4d8ed219b1921 f2fs: fix to reset all pinned status during fggc
b2cf17d39dd2c f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
3f63f071bf82b accel/amdxdna: Bound the sync_bo flush range to the BO size
d7b9770a487e1 ynl: fix schema check errors
3a49853272bd3 doc/netlink: netlink-raw: Add max check
56760e83aa4e8 netfs: zero the tail of a short DIO/unbuffered read
61519a5a1d70f net: mana: Skip WQ object destruction for uninitialized RXQ
b5aa7f1773f80 net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
867119b4b5880 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
639522e5056ca net/mlx5e: Prevent stale XSK buffer release on refill retry
50cff3f112d64 fs: Free any excess xarray nodes in clear_inode()
fbd977e513971 bnxt_en: fix DMA mapping length for padded small packets
17ad2612c11a7 Linux 6.18.56
a47406c769f72 ipv4: free inet_opt and ireq_opt after an RCU grace period
b473ee29aa0d3 iio: adc: adi-axi-adc: Initialize state mutex
bb29dd90885b4 iio: adc: adi-axi-adc: Make use of dev_err_probe()
e05c55de819b4 iio: buffer-dmaengine: fix sg entry iteration when building dma_vecs
845c959178cca net: mana: Sync page pool RX frags for CPU
55aa2774323e7 net: mana: remove double CQ cleanup in mana_create_rxq error path
72d2f54367895 xen/netfront: drop RX packets with a short Ethernet header
626deff23b544 net: usb: qmi_wwan: add Quectel EG120K-EA
525694a6021ec KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
81d7875515906 KVM: x86: Add static calls for nested virtualization ops
69f1d46341c28 KVM: x86: Reject nested CAP enablement if nested virtualization is disabled
9a4605ac9045d KVM: move TSS constants from kvm_host.h to tss.h
318ef696fa3c7 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
267c586a090a4 KVM: arm64: Use stage-1 leaf size for VM_PFNMAP
1113374a17d7f KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
e4f086a7d7074 KVM: arm64: Always populate FGT masks at boot time
a014b1a377e45 KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.h
cf0654248c87f arm64: errata: Add Cortex-A725 erratum 3821522 workaround
424e851050f47 arm64: errata: Factor out broken AMU const counter cap
277c4d8eac0ba arm64: mm: Fix the break-before-make flush range for erratum 2645198
e506333d1b9f4 perf: Require kernel access for text poke events
2581b43e162cf perf/core: Check kernel access when kernel callchains are requested
a16986dac7be5 perf: Replace perf_event_header__init_id with full header init
624370942abd3 unwind: Shorten lines
08bf919f041af tty: fix saved termios reset race
9e8595cbd31db usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
100f92cc90149 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2
ba927133b3018 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
9b995b757a87d drm/amd/display: Fix fast updates on DCE 8.1
6f36088234647 drm/amdgpu: reset VI ASIC on MacBookPro14,3
d12b62677fb48 drm/amdgpu: reset VI ASIC on MacBookPro15,1
0e0fd96b26263 drm/amd/display: Preserve eDP mode on initial ASSR failure
8786c5bc77375 drm/amd/display: Mark DCE 6.4 as not APU
6b0cc4e32599f iio: adc: ad4030: fix invalid oversampling_ratio validation
23222e50948a2 iio: adc: ad4030: Use BIT macro to improve code readability
9c8158ef4ccce units: Add HZ_PER_GHZ
a0a1929d66d6b smb: client: only require read lease for size-extending preallocate
aec958676fb75 iio: adc: aspeed: propagate reset deassert errors
49c97ba1a3a3f iio: adc: aspeed: Simplify with dev_err_probe
74d723eee7296 smb: client: distinguish real EOF from a stale remote_i_size on read
cecf4114069fc smb: client: flush dirty data before zeroing a range
405a969c0b335 thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
9cedbfde14500 wifi: mac80211: set info->band for 802.3 encap offload frames
cbdcf80683f53 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
03525b632908b wifi: mac80211: count only matching reservations in reserved switch
80e8b0ea73ba2 mtd: spinand: fix NULL pointer dereference with no ECC engine
2d86abd280714 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
d3d6d7efdacc0 nvmet: copy the hostid into the ctrl before creating PR pc_refs
dd053fc01eefa nvmet-tcp: Don't error if TLS is enabed on a reset
889c61e3d0f10 Bluetooth: Serialize SMP remote OOB data access
e887e43bd5aa7 fsverity: add dependency on 64K or smaller pages
b4c0c41b952c2 fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
2efdeec99ca09 fs,fsverity: reject size changes on fsverity files in setattr_prepare
8f317daa50fe1 rust: irq: pass RegistrationInner as cookie to request_irq
333fa4bb5dbbe rust: devres: ensure revocation is complete before device finishes unbinding
e7930d857cc79 rust: devres: fix race between concurrent revokers
5017fdcb5ad73 rust: devres: add 'static bound to Devres<T>
8ae7e5dec4f34 rust: devres: fix race condition due to nesting
946ae2e1669b6 mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc
60f3b22d501dd mm/vma: rename __mmap_prepare() function to avoid confusion
98f6a4589e0f5 netfs: clear post-EOF pagecache when extending a file via write
4b8ce1686dea1 pfcp: fix socket lifetime on netdevice registration failure
8bed333470a1b mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
0a6c9b3801903 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
e68380710fc97 svcrdma: Use svc_xprt_put to free listener on create failure
d1d9694ae47da mptcp: fix msk->timer_ival reset
e64703280ce7a iio: trigger: cancel reenable_work before freeing trigger
e113bac1d5e72 iio: proximity: vl53l0x-i2c: claim direct mode for raw reads
28e76a775c304 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
a70d84d2f6c32 iio: proximity: sx9324: Correct proximity channel resolution
20ebd7f4e35c0 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
58237debc18dd iio: proximity: isl29501: Fix return type of isl29501_register_write
6501b032be217 iio: proximity: aw96103: validate firmware data length
493e743ea1b59 iio: pressure: rohm-bm1390: Return error when read fails
4fd5a61e61d68 iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
10a958e76c737 iio: light: rohm-bu27034: Fix infinite delay on error
cc71400bc965c iio: light: gp2ap020a00f: drain irq_work after free_irq
ce308ce18dedc iio: imu: adis16480: fix unprotected debugfs reads
50e8d70ba0743 iio: imu: adis16400: fix unprotected debugfs reads
60699102827fd iio: health: max30102: fix NULL dereference in interrupt handler
b53dc6e15aead iio: gyro: adis16136: fix unprotected debugfs reads
786f0162fe6d2 iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
d6a83a5015071 iio: cdc: ad7150: fix OF matching and publish module aliases
b134ef820610b iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
b466db9e68b47 iio: buffer: serialize buffer teardown with mode claims
8aef1e8bdd86d iio: admv1013: initialize callback mutex before registering notifier
a5fe2d1b55fab iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
f44e2ac2fb114 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
d74c2489acc5f iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
6dd3bf785d030 iio: adc: stm32-adc: fix possible division by zero in processed channel
2754d336af34b iio: adc: stm32-adc: fix check on internal channel availability
56e8e9d9992b4 iio: adc: rohm-bd79124: Fix rising alarm
2a3fd11fd0e19 iio: adc: rohm-bd79124: Fix GPIO mask check
02a9e6a95a3bf iio: adc: rohm-bd79124: Fix channel initialization
1d8beaae5a745 iio: adc: rohm-bd79124: Catch regmap errors at measurement start/stop
2eb7f097e15dc iio: adc: pac1934: check ACPI label duplication
fe0ceff995d91 iio: adc: max1363: sign-extend bipolar differential channel reads
f87d392bb4ebf iio: adc: axp288: Add TS bias override for Haier HV103H
ed1a6230155fd iio: adc: ade9000: request interrupts after powering the device
f73b94acc7ec8 iio: adc: ade9000: handle Phase C dip events in IRQ1 handler
fddb6cc28134b iio: adc: ade9000: fix overlapping scan_index for current and voltage channels
d2400175228fb iio: adc: ade9000: fix NULL pointer dereference in clkout registration
f20b94a7dc1ff iio: adc: ad_sigma_delta: fix use-after-free on unbind
0633f83c4caa9 iio: adc: ad7173: Fix digital filter configuration
d2261795797bc iio: accel: sca3000: fix frequency divider condition check
3365209e758c8 iio: accel: kxcjk-1013: reject duplicate event disable
5c7ca8fe72064 iio: accel: kionix-kx022a: Prevent memory leak and fix state
4165641d06ef4 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
f82242fe3109a smb: client: flush and commit data before querying allocated ranges
dce9bca8afcbd smb: client: discard post-EOF pagecache when extending a file via copy range
b75dadb50a25e smb: client: discard post-EOF pagecache when extending a file via zero range
2f97f929dad9e thunderbolt: Reject oversized XDomain properties responses
58cb2aa1d29f7 thunderbolt: Disable CL states for the Anker Prime TB5 dock
2f5893172fc61 thunderbolt: Fix domain reference leak when DPRX read is canceled
34a6e27c954e5 thunderbolt: Tear down inactive DP tunnels when the domain is stopped
e09cbad4db58a thunderbolt: Mark discovered tunnels as active
c444d2c17dc23 thunderbolt: Hold a router reference for each allocated HopID
f18faa3d3b810 thunderbolt: Fix KASAN reported use-after-free when request is canceled
29664699216c6 USB: serial: option: add Compal EXC-T1 support
af4224809ea1b USB: serial: option: add Quectel RG660QB
3ef1b5c9a7194 USB: serial: option: add Compal EXM-G1x support
8b495843267b9 USB: serial: option: add Quectel EG060W
02e1112182d8a USB: serial: option: add support for SIMCom SIM8260C
4597ddd6168ae USB: serial: fix ioctl hangup race
a1aa474768f69 USB: serial: fix driver deregistration order
4d6da6867b4ac USB: serial: fix dynamic id driver deregistration race
02fc7a87f0291 USB: serial: ssu100: fix baud rate overflow
4e18c175cea26 USB: serial: quatech2: fix baud rate overflow
25a5f7239a43a USB: serial: cp210x: add Corsair AX1500i Power Supply
452f1c9b76f7a wifi: mac80211: handle empty FILS association request payload
128e800a41270 wifi: mac80211: fix mesh fast xmit path deletion UAF
a613c891906b5 wifi: mac80211: release mesh path quota on failed additions
1892e71aa2e5e wifi: mac80211: reject invalid 320 MHz CSA bandwidth
42aa9feb27b60 wifi: mac80211: minstrel_ht: validate fixed rate index
d0183cd1f6a2d wifi: mac80211: keep fallback association elements alive
3b75831ceee76 wifi: mac80211: account proxy paths against the mesh path limit
772bd89304ecf wifi: mac80211: drain PS delivery work during station teardown
481f9230284c2 wifi: mac80211: shut down RX BA session timer on teardown
1c82d0c5d5091 wifi: mac80211: keep paired old chanctx alive
cd8f8f45d81aa wifi: iwlegacy: 3945: free EEPROM data on remove
b0e97bd40e0c2 wifi: cw1200: fix TX padding OOB read leaking heap data to device
4c9a32a808104 wifi: cfg80211: fix RTS threshold setting for single-radio PHY
98abf374e5096 KVM: arm64: vgic-its: Fix MOVALL handling of source redistributor
b37ae6e65a1dc KVM: arm64: Clear HCR_EL2.RW for 32-bit non-protected vCPUs
97c1dcce17ef2 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
8b7d4f68fef96 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
b1de3ebf59507 KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
f6189e26d0237 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
1a62eb293f60a mtd: spinand: Do not update the QE bit on devices without one
b28120197cc15 mtd: spinand: fix zero oobavail when no ECC engine is used
23cef33571b19 mtd: spinand: Enable QE on all dies
2bbaa3f8df83f mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()
875c57f2df09f mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
1ed0ccd564915 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
cadf42f22438f mtd: mtd_intel_dg: reset poll counter for each erase
a991c28066e7b mtd: block2mtd: Fix divide error when erase_size is zero
2423a05dd0f21 nvmet: pci-epf: reject too-short SGL segments
7fd3c363eba4f nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
21ffcae171d11 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
49e8a3224c91f nvme-multipath: fix underflow in ANA log bounds checks
e30a2406408d2 tpm: fix off-by-four bounds check in tpm2_get_random()
aa480f05aed7a net: extend IPv6 exthdr detection of tunneled packets
6316d17324bd4 ipvs: bound LBLCR and LBLC cache growth
891bd8335a0de io_uring: fix task_work add use-after-free with SQPOLL
a85d0f00671b4 fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
bdbc8e78aa96d tracing: fprobe: fix suspicious rcu usage in fprobe_entry
b0f76d4cb9be5 mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
d3c2d2692bdf4 x86/mm: Drop unnecessary PMD page copy when freeing
fe23680e6f1d5 x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
84df222de86ea Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
c3b5e6da4ba64 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
c42ce5373405c Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
708cdd203d0bb Bluetooth: hci_core: Serialize fragmented ISO packet queueing
1681f97afdf92 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
86e9708f9d19a Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
dd4db9f808ac2 Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
cabd58d9bb66d Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
333257e6e4a7b Bluetooth: hci_sync: Fix inquiry cache use-after-free
0a554901bd227 Bluetooth: RFCOMM: Fix initial port reference race
4230d65032fcf i2c: xiic: don't clobber msg->len to signal block-read completion
51e1125ff7d63 i2c: xiic: preserve PEC byte length in SMBus block read setup
ba0632683728e EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup
865f3bdebbc9b EDAC/altera: Fix use-after-free in error paths
74eeb95c0478b EDAC/altera: Fix memory leak on dci allocation failure
9846b85c2eb8b EDAC/altera: Drop __init from ECC setup paths for re-probe safety
0c03cb91b5698 EDAC/altera: Do not allow driver unbinding
9d2d3b3dfe897 EDAC/versalnet: Drop remote processor handle refcount on driver removal
e561c2740b628 ALSA: hda/realtek: Fix silent speaker on Higole F9B
d8986de05cc6c ALSA: hda/realtek: Fix square wave output on ASUS Strix G615LR
eb0c7fda59cf6 ALSA: ua101: reject mismatched capture/playback packet sizes
fc5c52848e405 ALSA: seq: Serialize compat port-info ioctls
9590d16791625 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
69d2b7a4c1151 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
d195c8c763fdd ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
7df8c39a50f36 ASoC: codecs: max98363: fix uninitialized stream_config->type
2bce6f006cfe0 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
1c17db14f2c23 serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
8f9103651d6ab serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
48e09369839fb serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
f895ed664cb7a serial: tegra: don't clear the Tx FIFO on an Rx-only reset
d8233d6b391b4 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
7019a84c23c1f serial: fix TIOCMIWAIT race
3f151c2e86f5d serial: revert guards in uart_wait_modem_status()
c3ba14c29d55b serial: 8250_omap: fix wake irq cleared during suspend
e32440fa536af serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
2c8614981d3e6 tty: serial: max3100: shut down timer before freeing port
94af6cd832e9b tty: abort break signalling on hangup
c110c6eed54fb tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
6b7be3b9b8579 tty: port: fix tty_port_tty_vhangup() race
7021acc84c2e0 tty: tty_port: restore TTY_IO_ERROR on activation failure
821050631750e tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
4335278d0e753 tty: vcc: zero-initialize control packet in vcc_send_ctl()
3551bdf843a1f tty: amiserial: fix broken TIOCMIWAIT
e8615dfe80cf5 tty: vt: fix memory leak in vc_allocate()
d16046f1ace26 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
95160fe606e68 usb: cdns3: fix use-after-free in cdns3_gadget_exit()
072535f26dc5c usb: typec: ucsi: displayport: Current CAM OOB index fixup
f5ed186d0cf38 usb: typec: ucsi: Get the connector fwnode based on reg value
41934f92e7a54 usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
75dc6cb377efd usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
282be6ae8be79 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
30dbaf3c6696b usb: typec: tipd: don't send GAID when probe fails in APP mode
b2ed8643face2 usb: typec: tcpm: recover after failure to start the frs ams
4333174ea52c8 USB: dwc2: shut down wakeup timer before freeing HCD state
1da16c46b8d71 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
bd89c4f42f564 usb: chipidea: tegra: disable runtime PM on resume failure
7811d8e26c77f usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
5298c96bf0068 USB: gadget: dummy-hcd: Fix wait for outstanding request completions
474e9e1852fb5 usb: gadget: aspeed-vhub: cancel wake work on device removal
9f0321e8e9afb usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
7b5ed2d30ccc6 usb: typec: port-mapper: Only match USB4 port if host interface is available
50a92c02551c1 usb: typec: anx7411 - stop the IRQ before destroying the workqueue
8c611876c002d usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
87f2185423e01 usb: gadget: midi2: Fix the jack descriptor array sizes
772149e7badba usb: ohci-st: disable controller wakeup on removal
ec69932b45585 usb: ohci-spear: disable controller wakeup on removal
dc1b196ad5956 usb: ohci-s3c2410: disable controller wakeup on removal
83e8bd42bd17b usb: ohci-da8xx: disable controller wakeup on cleanup
a12e803d22551 usb: octeon-hcd: fix the FIFO-flush timeout computation
e9545dd8bc625 usb: hub: use shorter 120ms post resume hold for SS root hubs
e2d62928f2666 usb: storage: sierra_ms: reject short SWoC info transfers
5e8980a81af19 USB: serial: fix port tear down use-after-free
a0ed07b5bbb2d USB: cdc-acm: skip URB restart in port_shutdown if disconnected
108af6f585ddc USB: cdc-acm: fix racy TIOCMIWAIT implementation
9b5b83ca2a668 soc: qcom: geni-se: Correct QUP Core ICC vote constants
d54df2de22f9a rust_binder: cancel deferred work items in thread exit
f7fb6c2835ede nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
c5504e179135d Input: synaptics - limit T440p InterTouch quirk to LEN0036
fc92d4499f3fa Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
95e8d0a7b22fa Input: s6sy761 - fix resume ordering and restore sensing
d79caaf07875c Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
bcfd26841471a Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
0278c68c59b94 kgdboc: Fix tty driver reference leak in configure_kgdboc()
1299cb3fb0615 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
86cdcc87d4ba6 binder: fix is_failure flag for superseded transaction cleanup
5b113e8ee3268 drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU
587469076e4ff drm/amdgpu: fix ACP MFD device leak on init failure
7ca44cb14d024 drm/amdgpu: fix IP instance memory leak on kobject add failure
b84f1386d84b3 drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
629458b7e4955 drm/mediatek: Fix ovl adaptor platform device leak
88f8a92dcb0cb drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
4d12b763c2c55 drm/radeon: Read the VRAM VBIOS signature with readb()
652f631e2e3a8 drm/amdgpu/gfx6: fix firmware leak on teardown
36fa4159d0054 drm/amd/pm/si: Fix updating clock limits on AC/DC
e67aef159f430 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
197946faa1b79 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
f3db2853e2a28 PCI: Accept AtomicOps already enabled by the hypervisor
f3eaf31910087 spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260
d5a81039adc6a ALSA: ice1712: Fix the error handling via auto-cleanup at probe
fc34dd95d3baa ALSA: core: Define auto-cleanup for snd_card_free()
524063fea29f8 perf: Fix race between perf_event_exit_task() and perf_pending_task()
7648757145aa9 i2c: at91: release DMA channels when probe defers
efd0d161b0cb7 net: mvneta: clear XDP pfmemalloc flag between frames
53b21bc2df6e8 ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
f81d40e2eb695 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
9a76ae59fd637 net: sparx5: make ports inherit the switch base mac address type
e3630ff89b777 of: Put coreboot node after compatibility check
47c5ac61e6fb6 net: microchip: vcap: stop scanning after deleting key field
4033e1a9262c5 netfilter: flowtable: generalize pending status bit
f6143ae109df5 netfilter: bpf: reject invalid NAT manipulation types
55d033324f67a ipvs: filter some flags received in the backup server
7151f14d59155 ipvs: do not create invisible templates
60e9a6e2ba718 ipvs: fix missing counter decrement in lblc
e5633d81b2daf tcp: refresh TS.Recent for accepted old ACKs
35c706d6eb196 net: sparx5: skip ptp deinit if init was skipped
297769d75dc67 net: sparx5: move PTP IRQ handling out of sparx5_start()
728138dcfc92f net: sparx5: move stats initialization and add deinit function
387478e9e9861 net: sparx5: move MAC table initialization and add deinit function
a0a8687eb7878 net: sparx5: move VCAP initialization to probe
ebb164ae76ad9 net: sparx5: move netdev and notifier block registration to probe
a01c71ab74ea4 net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values
82be3d08de9e1 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
2f581814e4e3e net: cap skb->queue_mapping when the tx queue is picked
2294b62eaec6f net: bcmgenet: fix NULL dereference in set_coalesce before first open
507c895019a81 net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence
a4b63808f99a5 virtio_blk: set the zone write granularity
ac4827cf96532 net/sched: sch_codel: match the no-drop threshold to the packet size
ab6842a1c7bdd net/sched: fq_codel: match the no-drop threshold to the packet size
e94970076d293 gve: DQO: accept TSO packets with non-protocol gso_type bits
5069ce898148b net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
358d5ac5a5d57 net: stmmac: fix rx Scatter-Gather support
5847b60561a31 net: stmmac: convert priv->sph* to boolean and rename
f78d45d5f1ac4 net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
f74f100e49588 tipc: prevent GCM nonce reuse on peer key changes
adad3ff80e50c octeontx2-af: mcs: Fix SC resource cleanup loop
3a6e67ff267af net/mlx5: Fix slab-out-of-bounds when handling team device events
8438b4f65a179 net: systemport: Fix RUNT MIB counter register offset calculation
96d8b26be5bc4 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
7f16443a30f4e Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
70d2afb554015 netfilter: ipset: do not update comments from kernel-side adds
e50eaba0b34be ipv6: fix prefix route expiry in modify_prefix_route()
6598215a1d8e2 net: bcmgenet: allocate RX buffers as page fragments
ebc9611ab154c net/sched: cls_api: reclaim an empty proto on the error path
63120572edde8 net/mctp: publish the mctp_dev only after it is initialised
380acb097059c ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer
a85823b074f9f arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz
b0fce76873a5e Bluetooth: btintel: validate DDC record lengths
8ba754621f105 Bluetooth: hci_core: free the HCI ID if naming fails
790730e4d95de blk-mq: set RQF_USE_SCHED when the operation is known
2e8f3fdb0825c blk-mq: factor out a helper blk_mq_limit_depth()
c97ef13ad96be block: reject polled dio with user integrity metadata
ed389554fe22c ASoC: codecs: rt274: Fix format setting for 44100 rate
eb04ba7d97809 ASoC: codecs: rt286: Revert delay value for jack setup
88e96d902efee wifi: mac80211: prevent AP VLAN tx from other interfaces
227ebe48704be wifi: mac80211: Add 802.3 multicast encapsulation offload support
9f4e5abe6bf72 wifi: mac80211: Add multicast to unicast support for 802.3 path
dd7973a4130b0 wifi: cfg80211: preserve hidden-group beacon IE ownership
cfd70c9b19846 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
9cff19ddd7f90 rtc: ac100: Fix clock provider use-after-free on probe failure
00dc50cede967 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
345ce265cf604 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
e0c21130c1c77 wifi: ath9k: reject short WMI command responses
9a9467f7cc633 wifi: ath11k: reset ar->num_stations on hardware start
9338b2dea74cb wifi: mac80211: drop oversized fragments to avoid extra_len overflow
f9d075fa9fba9 wifi: mac80211: remove RX_DROP
f41735133943b ASoC: tegra: Fix ASRC Stream6 input threshold control
71d140099165d wifi: wfx: validate MIB read length before copying to caller
9091199beced3 ASoC: wm8903: Move the DRC QR threshold to the register that holds it
b8cbeda043e47 of/overlay: don't create "//" paths for fragments targeting the root
7a46f1917b320 of/overlay: don't leak fragment references when changeset init fails
2222a8b7dfeb3 random: fix vgetrandom_opaque_params kernel-doc
541d61d59f19a nvmet: preserve device path on allocation failure
f971f1c63cf71 mtd: core: call _get_device() with the master MTD
4c73c1859fa64 iio: accel: kionix-kx022a: Fix array boundary check
489e51034910f iio: light: rohm-bu27034: Fix error return
09a9a2a9548f2 iio: dac: rohm-bd79703: Do not allow writing SCALE
7899d0530b411 mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
122b8541f511d random: vDSO: avoid call to memset() when zeroing reserved parameter
3f75da1e4ee69 ALSA: line6: reject oversized playback packets
84727facd8506 ALSA: caiaq: unregister the input device when probe fails
9cec23424c598 wifi: wlcore: Fix runtime PM leak in wlcore_remove()
ad06f7312d3f6 vt: skip screen update for DEC alignment test on backgroup consoles
037d7e3ca5c59 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
233a2e190b128 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
90c29158159e4 net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
7d2ff870f0cf1 rds_tcp: close NULL deref window in rds_tcp_set_callbacks
dc87b56b43c91 mm/huge_memory: initialise workingset state before folio split
9ebb974773bfa mm: shmem: ignore sysfs configs for shmem forced collapse
7a1e8daeaa466 virt: vmgenid: set driver_data before registering notification handlers
0af47cb2575d4 virt: vmgenid: remap memory as decrypted
258310d59a82e module: fix lost error code from codetag_load_module()
512eaf01ffabf netfs: zero gaps in read-gaps folio to avoid writing back stale data
96c46c75b0d47 tpm: Disable TPM on null key name mismatch
e701345d886e8 sctp: check RCV_SHUTDOWN after the sendmsg connect wait
e0cabda9b6f4d rtc: spear: initialize IRQ state before requesting alarm IRQ
160619b387072 rtc: ac100: Assign .num before accessing .hws
37286a49cc744 r8169: disable EEE on RTL8168h/8111h
69ca64bbb5288 net/packet: prevent TX_RING byte count overflow
c5f91098edee9 netfilter: nft_flow_offload: drop flowtable reference on init error path
ba56d6f9f1a8d net: phy: aquantia: fix system interface type not updated in forced mode
ed997f875d03d net: fix checksum offsets in skb_splice_from_iter()
0d1525fdcd335 of/overlay: only treat a positive changeset id as registered
7dc6a769153c0 of/overlay: put property on deadprops only after changeset add succeeds
42f6d682e0ab5 of/irq: Fix remaining refcount leaks in of_irq_init()
f7ea1916e8a80 octeontx2-pf: Fix RSS indirection table size
6745fa65f4115 kprobes: Skip disarmed probes when checking optkprobe overlap
c2733ea2c15a1 kasan: unpoison task stack below watermark only in generic mode
2ebeba4f9e815 io_uring/zcrx: requeue multishot receives stopped by a local resource
4e9e016c4f498 io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full
0c19a6c1d25fd HID: multitouch: stop the release timer from being rearmed on remove
97be6396817bd HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
308db93de666a crypto: x86/aes-gcm - fix always true check for last AAD segment
88633025f20ba audit: fix exe mark UAF in kill_rules()
745e83328dd69 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
224b56b7c02b2 smb: client: close completed creates on compound wait errors
78e718c5aa146 cifs: Remove the RFC1002 header from smb_hdr
f09875ff901e9 smb: client: close handle after create-context parsing failure
080573f419506 smb/client: pass cifs_open_info_data to SMB2_open()
7bdc4b7d99a82 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
605ef5bd74d02 cifs: on replayable errors back-off before replay, not after
178820984f2cd Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
60ba99f910b76 ASoC: sdw_utils: Set snd_soc_dai_link_ch_map.codec_ch_mask for capture
f44d5d3b7e344 neighbour: Annotate access to neigh_parms fields.
3b91cdacb16b7 neighbour: Use RCU list helpers for neigh_parms.list writers.
df057d89e0cc2 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr()
b15c79fca2806 xfs: don't let memory failures leak blocks and kill repairs
70a7918fda54a smb: client: use finish_no_open() for non-regular inodes
677aeec9783c8 mm/execmem: make the populate and alloc atomic
7ad8b185dd7e9 selftests/mm: hugetlb-mremap: add setup of HugeTLB pages
22e82acec93a6 KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
81e3f065a6485 KVM: arm64: nv: Fix life cycle of the nested_mmus array
e18b8236c57fc btrfs: initialize inode mapping flags for cached inodes
725bd2f3c81d5 Linux 6.18.55
fa047f2a02500 bpf: Reject key-less BTF for hash maps
98fd50aaaeb2a rose: don't warn on stray CALL_ACCEPTED/CLEAR_CONFIRMATION in state 3
5454ea6e22e7d rose: use timer_shutdown_sync() for t0timer teardown
bcf4c43f797ce rose: guard rose_transmit_link() against a NULL neighbour
7d10439345e2b rose: keep the route needed for routing loop detection
6c401ae426e20 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
d3c8fb7094c53 hfsplus: avoid double unload_nls() on mount failure
500c9259f5a66 mm/damon/core: fix unconditionally skip last region
f6660e9a3e1e6 rust: net: phy: fix off-by-one bit positions in device status accessors
d50418db3b862 Revert "rust: net: phy: fix off-by-one bit positions in device status accessors"
c525772c304c9 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
5fdc644a4fea4 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
4a04ed9157581 net/sched: act_ct: avoid modifying shared unconfirmed ct entry
812c16a255e77 net/sched: act_ct: fix helper UAF due to extensions realloc
9ba16ce8f3faa x86/sev: Make vTPM SVSM calls preemption-safe
e43d42bd711e7 x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()
524becfebcd0f x86/sev: Carve out the SVSM code into a separate compilation unit
b2a9d6ff593b5 x86/sev: Add internal header guards
1cad4f235e150 x86/sev: Move the internal header
99607d955be3b perf/x86/intel: Remove incorrect LionCove PEBS data-source constraints
7ba97aa16778e perf/x86/intel: Update event constraints and cache_extra_regsfor LNL
edc0309282aab perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
51199c793bc05 perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
24e79508b237d net: ipconfig: bound DHCP option construction
8fbfa861dfd4f net: ipconfig: Remove outdated comment and indent code block
bda487567d0b7 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
aa4845a710ae9 HID: alps: unregister DualPoint Stick input device on remove
48c5c02bf6fde HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
d0f6244f4af44 PCI: Fix BAR resize for devices on a root bus
85b1112945f21 super: make iterate_supers_type() deletion-safe
ccf96a4b8626a mm/hugetlb: do not dissolve gigantic pages without runtime support
2ab4b6815d10e mm/hugetlb: create hstate_is_gigantic_no_runtime helper
4cef512a955e4 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
a56e5bcc43310 mm/rmap: allocate anon_vma_chain objects unlocked when possible
fcbedba553a9c drm/client: fix restore of partially initialized client
933145e2bbb4c drm/client: Pass force parameter to client restore
0589706ace3bd drm/client: Remove holds_console_lock parameter from suspend/resume
817dd706ee616 drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
13f299763f6c0 drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1
97e40aa29c10c drm/i915/psr: Disable PSR2 on Xiaomi Book Pro 14 2026 as a quirk
66f814e8af462 drm/i915/psr: Fixes for Dell XPS DA14260 quirk
782b5210e89e7 drm/i915/psr: Disable Panel Replay on Dell XPS 14 DA14260 as a quirk
5815329988acf i2c: qcom-geni: Fix hardcoded clock index in SE_GENI_CLK_SEL
f42562dd027dc vlan: require the MAC header to be present in __vlan_insert_inner_tag()
241e67b60308c cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
d186e0171c8a4 cgroup/cpuset: Ensure domain isolated CPUs stay in root or isolated partition
8a64ac9f03fc9 cgroup/cpuset: Move up prstate_housekeeping_conflict() helper
438bf73ca9775 net: tls: fix silent data drop under pipe back-pressure
66a2179d02668 xfs: fix cursor and pointer handling when recovering iunlink buckets
86b17699bd0c2 xfs: fix blockgc group quota scanning when usrquota isn't enforced
930a9c1c321ef xfs: don't let hidden_space go negative in xfs_metafile_resv_init
09ebf777ad4e2 xfs: call xfs_dquot_set_prealloc_limits if we installed default rtb limits
d46492fb8018d xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
543bc5fd7d8ec xfs: fix rtgroup repair estimations
6aabf4f351cd8 xfs: check di_forkoff correctly in scrub
f99c672471797 xfs: use the correct reservations for rtrmap/refcount recovery
adb80d620dabe xfs: don't call xfs_exchange_range_finish for a dry run
770d21b52c91b xfs: check padding field in xfs_ioc_commit_range
09b7a63e11c7c xfs: use correct jiffies comparison function in xchk_maybe_relax
6a65a68097a19 xfs: release orphanage dir inode if chown fails
ac76f8df55980 xfs: fix attr fork block count checks in xrep_inode_blockcounts
ef7a56c6630ff xfs: don't assert when XFS_SCRUB_TYPE_HEALTHY scans return corruption
c2ac475ddd737 smb: client: validate POSIX create context length
31107f79ad33b smb: client: preserve create-context parsing errors
abab661eed00f smb: client: clean up failed cached directory opens
05a7fd80024ff smb: client: fix create context out-of-bounds reads
8f5b30cc12c40 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
416546cd6a54e Bluetooth: mgmt: fix race in read_unconf_index_list()
c6a288e6001bc Bluetooth: L2CAP: validate frame length before control and FCS access
ed4c026cc4094 Bluetooth: ISO: release unused CIS holds after channel attach
4e49206d9574a Bluetooth: ISO: balance the parent hold in hci_bind_bis()
173457fa3e99e Bluetooth: hci_sock: reject out-of-range OCF values
f894f6292d512 Bluetooth: hci_sock: validate event length before filtering
3ff5a8d949e3a Bluetooth: hci_conn: fix CIS hold ownership on reuse
57ccaa818307b RISC-V: KVM: Fix HSM hart status error propagation
5567ce11304db RISC-V: KVM: Propagate interrupted G-stage faults
ea91f05a55b80 RISC-V: KVM: Synchronize hrtimer callback during teardown
e5dd2a91a7ae3 KVM: arm64: Transfer the hyp stack pages out of the host stage-2
970de111c0874 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
c23ed110d27ba KVM: arm64: Fix spurious warning for benign stage 2 teardown race
8530a05b304d3 KVM: arm64: Fix AArch32 DBGBXVR<n> handling
37dfb676fafd1 KVM: SEV: Do cache maintenance on the source VM during intra-host migration
6aef7cf800098 KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
066a53a0bc19e KVM: Don't treat reserved xarray entries as having memory attributes
7dcaf0107523f KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg
cf441a0db681d s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
af295f0eab683 s390/pci: Don't report recovery success on skipped recovery
eef5c8e1cca6f s390/pci: Report SCLP status on error events when no pdev is associated
743a8458978d1 s390/pci: Fix missing device lock in zpci_report_status()
dd5ed64dadb07 s390/pci: Fix leak of struct pci_dev reference in zpci_report_status()
748ec2f7f5df9 s390/cmf: Fix virtual vs physical address confusion
c3bbcb32deecc s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
02664a8d8d592 pinctrl: sunxi: keep a shadow copy of the data register output latches
1deeeca89ea12 pinctrl: single: free the IRQ on domain creation failure
a23f9f9b56b79 perf/core: Run sched_task() for PMUs with only CPU-wide events
249a2bd87a0e5 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
5023c70853ad9 parisc: Increase kernel stack size to 32kb
ee56b5e18f566 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
cc444e4ad4346 nfc: trf7970a: power down on startup RX gain failure
14b1467cfc663 nfc: port100: reject frames whose declared length exceeds the received data
810f204ef8f61 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
841af260ff477 nfc: fix use-after-free in nfc_get_local_general_bytes
12cf803edfffe netfilter: nf_tables: skip expired catchall elements on insert and delete
191239b093969 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
eafe081ea77d2 netfilter: ip6t_rpfilter: reject routes without inet6_dev
8a611f33216f4 net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
7d2377868feb7 net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
43ff11501ea6a net: txgbe: fix FDIR filter restore for VF rules
9447ddd8b9242 net: phy: micrel: Advance register data pointer in write loop
30ff01b4c7e41 net: ena: fix MMIO read buffer leak on probe failure
e8a2f48bbff1f net: ena: fix PHC cleanup on probe failure
ab3c4a4c85f2e net: bridge: mdb: restart port group walk after deletion
4b7161804d8f3 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
586847400b116 net: atl1c: fix soft lockup on out-of-range tpd_cons read
5f23080a625dd net: openvswitch: conntrack: fix helper UAF due to extensions realloc
caefcd433ecb2 net: openvswitch: conntrack: remove 'add_helper' dead code
e2829ae5459dd net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
729737267e7c1 net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
0f573b0576252 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
ba664d8363864 net: arp: terminate device name before lookup
aca91d8fa0ecb net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
968550a439f64 net/sched: reject IDR error pointers when deleting actions
3803dc8477f08 net/mlx5e: fix swapped IPv6 IPsec policy masks
0c336ecabaf9d net/mlx5e: advertise MACsec offload only when supported
99d8dc5166374 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
c3129e6f26e18 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
5695ec5339d4d HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
925da1d2a2478 HID: alps: fix use-after-free on input2 registration failure
eda9bcb721f15 packet: use ubuf_info completion for TX_RING packets
879c911f77b8a PCI: of_property: Omit bus properties without a subordinate bus
e59cb7eda7c06 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
850cc4a84b36a mm/hugetlb: preserve mremap address delta when skipping page tables
b1db1ec5c8941 gpio: tps65219: Fix TPS65214 GPIO direction programming
ac3c7eb6a44ba gpio: tps65219: Use the variant-specific direction callback
fabe897e61e45 gpio: tps65219: Fix GPIO input value reads
f2f1683955b95 drm/virtio: fix NULL pointer dereference on fence allocation failure
8fa78900fd242 drm/virtio: fix memory leak of fence event on execbuffer failure
c2d4689c3ea92 drm/xe: Keep walking on SVM eviction failure
c306b6419fd00 drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
2bcbfc5e7bfa9 drm/xe: harden adjust_idledly() against divide-by-zero and overflow
ba678c2b02e0d drm/xe/vm: nuke PTs only after unlinking contested VMAs
19f5a5839b308 drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
35151e9a82741 drm/nouveau: RCU-free the scheduler-containing nouveau_sched
59aa1f8c95941 drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
030e93fc91d55 drm/nouveau: Fix gem reference leak in validate_init()
109a8d2d5b7d2 drm/nouveau: fix double-free in nvif_vmm_dtor
6d497216c10af drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
9132215d2c90e drm/nouveau: fix autosuspend cleanup during teardown
0d29bf51f8ddd drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
c83261854e19a drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
c28e74395ab09 drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
0bfb0419a1480 drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
d197b15d4beb9 drm/amd/display: Bump frame warning limit for clang builds of dml
89a11c7efe387 drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
fe933dda0bb18 drm/i915/dp_mst: Fix configuring TUs for a disconnected stream
369f4e3264374 drm/i915/dp_mst: Fix configuring FEC for a disconnected stream
cc890d3f1b15b drm/i915: fix incorrect RCU teardown order
bbef7450e2b42 drm/imagination: Fix page count for page table for map() interface
afe5b4d66d45b drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
e2ee061626008 rds: ib: Clear the sg list when mapping an MR fails
e35cb500dd148 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
e06f8b6e27cc6 llc: reserve device headroom for allocated frames
58a417a19d801 gpio: zynq: fix runtime PM leak on request error path
cf3d043582e10 gpio: cdev: fix kernel stack leak to user-space in error path
a9f738487c11f gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
6fcfc362344ed ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
1d42828565889 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
599d0498a3931 ipe: protect the dm-verity root hash with RCU
48f7d0233c3cc ipe: fix use-after-free when auditing a newly loaded policy
c2a5e59185862 fsl/fman: Fix clk reference leak in read_dts_node()
fd3bf32279df9 writeback: report a Tasks-RCU quiescent state per cgwb drain pass
1dccf5dc2f8fe workqueue: Fix NULL current_pwq deref in flush dependency check
dd4b920672387 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
37ec7353f4ac4 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
b1229b210ef5a fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
2f7042429a8e9 cgroup/pids: Restore pids.events notifications in local mode
caf8b2d9b30c3 crypto: s390/hmac - Generate intermediate CV for API partial block handling
7504b677c4370 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
4d97a141e85a0 bna: prevent IOC timer rearm during teardown
1603abb0c5042 ata: libata-scsi: bound the ATA passthru sense descriptor writes
cdccb760be1f1 arm64: errata: match the target implementation CPU's own MIDR
071f51188a5d8 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
6279211e7d245 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
ec23855274a73 sctp: discard the rest of the packet on a stale-cookie error
7ba87509c54cd tcp: prevent collapsing skbs across boundary in rtx queue
12cc3a1eac5a2 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
ca40f4df4ab2f virtio_net: copy zerocopy frags in start_xmit without NAPI
33da1ff56f955 x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
f50d2e8cc1f1d x86/mce: Fix hardware debug register corruption on task migration
a557816c6e38e netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
7b32eba3fad84 rculist: add list_splice_rcu() for private lists
162bf5f73f1b4 mptcp: return sk_wait_data() errors from recvmsg()
9fe317b999aa8 sched/core: Account PSI IRQ time to the execution context, not the scheduling context
23250517cd475 perf/core: Fix a refcount leak in attach_perf_ctx_data()
654fc8445ca8d perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()
0688289753450 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
8cb5a01cb5f12 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
c205e3fc9962c perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
4bcb371019097 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
c7ee4bea64f55 vlan: ensure sufficient headroom in vlan_dev_hard_header()
7f8b56c82919c net/sched: sch_teql: fix shadowed err in __teql_resolve()
15d00994a1bd2 bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
41dcae82bece9 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
2dc3ae3942e15 gve: DQO: reject TSO packets with an out of range MSS
089e04db44754 gve: fix TX drop when GSO MSS is too small for hw
feab3880a72b4 gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
2f855c52a2e1d gve: add support for UDP GSO for DQO format
6d4a5ce75b6e3 gve: Enable hw-gro by default if device supported
adbfc707ff6b9 gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO
6c7937db1d561 gve: Allow ethtool to configure rx_buf_len
bcaedb514a5d2 gve: Use extack to log xdp config verification errors
a0d644b8ff883 gve: Consolidate and persist ethtool ring changes
5f86408eba31b net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
d990b786abfd6 tipc: Fix a data race on mon->peer_cnt in mon_timeout()
3d65a2eb4449f net/smc: fix UAF on lgr list traversal in smcr_port_err()
8468d05aa08dc nfp: hold IPsec RX state under the XArray lock
4e7a4af364c20 net: phylink: record the PHY only once bringup cannot fail
631aa4cb45099 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
2357c682f6eaf net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
62c0e38b2e503 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
2b42adf3b8ee9 macsec: initialize SecY before registering the netdevice
dc106fe25e9a8 bonding: crypto offload enabled, non-offload slave failover, rekey failed
e0560db0ea6e1 drm/imagination: clamp freelist reconstruction requests
2cc1c3977acbf net: xps: reject an out of range traffic class
a3c5eb6e382dd vxlan: use one headroom snapshot for neighbour replies
bdd41b96e8143 ip_gre: Reject enabling collect metadata through changelink
c3fab2f1d8a6e net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
d68899b50caf8 net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
b3ebe8983d86f net: bcmgenet: do not skip WoL power up on GENET V1
21a0de4858779 net: bcmgenet: initialize u64 stats seq counter for all queues
aefa837c26674 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
501baaeca7d12 net: stmmac: clear stale buf->page after recycling on skb build failure
0f7ed27586acf tg3: use random MAC address when tg3_get_device_address fails
e40990861074a bpf: Fix BSWAP 32 and 16 on MIPS64
876ef04c75c27 bpf: Fix immediate JMP JEQ/JNE on MIPS32
6d76ddce4f1ba vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
cfa643f2ca36c net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
25bb7c3622522 veth: manage XDP program pointers during channel resize
63bcc2fee6419 net: bcmgenet: stop Tx NAPI before disabling the queues
284166f34b8fb net/sched: act_gate: budget the per-entry list in get_fill_size
e72cbedc4596e nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
8978dff632519 nfc: llcp: fix slab-out-of-bounds reads when logging service names
f234197f3bda3 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
2386d107df6d2 nfc: llcp: fix -ENOMEM on connect with zero-length service name
fdd95e819d828 nfc: st21nfca: validate ISO15693 inventory length
cbde7f5d32617 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
0b32dcc8a3f94 nfc: virtual_ncidev: Add missing ioctl compat handler
27cf04ba4e7ef selftests/nci: Fix out-of-bounds store on thread join
f9cbe5c68d93a selftests: nci: Fix uninitialized family ID on missing attribute
da8a077573836 nfc: llcp: Fix race condition in accept_queue lifecycle
3316903fdc3a3 selftests: nci: Correct pthread_create return value check
b94cf09720543 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
57919d0662d88 nfc: st21nfca: validate received frame size
ed2e00bb22c73 nfc: nfcmrvl: validate helper command length before pull
940b626854de2 bpf: Reject dev-bound-only programs on other devices
9923e1c537f91 net/sched: fix potential stack infoleak in em_text_dump()
92c9f2ea634d9 eth: fbnic: Avoid rounding zero ring sizes
3ea177bdba25f net: stmmac: selftests: Account for alignment shift on dwmac1000 for Jumbo test
b17959fb4d55f net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
4c4217aaa5e4b net: stmmac: selftests: Capture all packets for vlan checks
e7a8bbb6149b4 net: stmmac: selftests: Check the dev->features for S-TAG offload testing
74da0c1cede8a net: stmmac: selftests: Support running selftests on DSA conduits
d18cb8fd1b6ba sctp: hold asoc or transport before mod_timer() in timer handlers
650dcd938e563 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
cdeca5de4e186 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
cea597519b9ca bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
d95dd5a6c6cd0 bpf: Fix bpf_sock context code generation
1196903a27cac bpf: Fix bounds check for skb-backed dynptrs
fb1e2df8e2e28 thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds
0f5d8953cb63a net: pcs: xpcs: fix clock reference leak on xpcs_init_clks failure
54e98316ce5c1 genetlink: report the real command id for dump-only ops in policy dumps
41e444535c60f net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
ca9986cc824f2 net: spacemit: clear TX descriptor on fragment mapping failure
9c6af88fbefbe s390/debug: Fix NULL pointer dereference in debug_info_copy()
36831afe8eba0 s390/debug: Do not register views for failed static debug areas
8b661a045082c drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disable
6515c41503eef tg3: clean up PHYLIB resources on probe failure
c21daf37d5ce9 udp: remove a disconnected socket from the 4-tuple hash table
7a0bbe5654ecb udp: relocate a connected socket in the 4-tuple hash table on re-connect
ed902d5546fb9 ipv6: Fix dst leak for uncached routes.
6ab6c9d120b30 net: usb: sr9700: include receive overhead in the length check
e3c21e8b53906 dpll: use exact lookup for reference sync pin id
649ffc76ed548 ipv6: Prevent rt6_insert_exception() for dying fib6_info.
ff8cff3aff673 octeontx2-af: Fix memory scaling limitation in SR-IOV mode
be00deee60044 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
8ec5838a35b03 Bluetooth: btintel_pcie: validate device-supplied DMA indices
8f31031326994 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
a8f3a829f3a53 ovpn: reject invalid peer VPN addresses
7efbc134253c1 ovpn: reject multipeer peers without VPN addresses
daab972893aec ovpn: reject duplicate peer VPN addresses
12ee72319805a ovpn: always unhash old VPN addresses before rehashing
c44a04722f7da ovpn: replace bind when clearing stale local source
21dbc9f4d0bdd ovpn: replace bind when learning local endpoint
324ebbde06cd5 ovpn: validate peer state before caching UDP dst
db97cfe9a5070 ovpn: track UDP socket route key for peer dst cache
ba3877bdcc9aa ovpn: skip UDP source validation for unspecified addresses
8c1d7994a18ec ovpn: preserve IPv6 scope id for netlink peer endpoints
ebffd70e4877b drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
d6b59a9fece4d drm/virtio: sync shmem backing on guest-bound transfers
e7df00bb036e0 Revert "drm/virtio: Allow importing prime buffers when 3D is enabled"
5c2cb3dd14477 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
81c6769e069d7 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
b516446a25bf3 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
a93dce15dfef2 drm/virtio: fix object leak when drm_gem_handle_create() fails
0fa25ba50a382 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
cd12d3e086202 bpf: Check params size before reading reserved fields
dd9c6f8f05170 net: usb: catc: bound the RX packet length in catc_rx_done()
9c11e543fec32 bpf: Bound ownership depth through local kptrs and graph roots
c9338057df102 sctp: avoid livelock while updating retransmit path
c7a254c16c6fb eth: fbnic: Handle FW mailbox completions flagged with an error
a85a019b3011a eth fbnic: Add debugfs hooks for firmware mailbox
6a112552d3055 eth: fbnic: Reuse RX mailbox pages
8a052cd4b2cae eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
c5b5aee41b9f5 eth: fbnic: reset num_napi when the napi vectors are freed
6c903188b6761 eth: fbnic: Handle maximum standalone channels
8dc5667770912 ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
7254b702e5561 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
40aeafbcbc7bc net: gue: reject invalid REMCSUM offsets
00734f3684fce net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
ca29834c8c146 drm/nouveau/disp: don't reject HDMI config on cards without SCDC
40afa1f7a5c77 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
0d096a7f7d792 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
f2e9005aadb67 ocfs2: make ocfs2_calc_xattr_init() return void
b17aa4955e3a6 arm64: io: Reject non-user protection in ioremap_prot()
0994c3e3b4e3e netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
f100578039b31 ipvs: revalidate ihl before icmp_send
302477c9ffefa netfilter: nft_synproxy: use the family-aware checksum helper
07a3ec8fdc5a1 netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
b0ef9450e93f2 netfilter: flowtable: publish HW_DEAD after worker is done
1363c71be27a7 ipv4: fib: fix data-race and stale genid check around nh->nh_saddr
5be5ccd3a5563 libbpf: Reject truncated ldimm64 CO-RE relocations
2d7d04357c41a bpf: Restrict CO-RE poisoning to relocatable instructions
2fe1569e32ddf net/mlx5: devcom, Base component size on linked devices
8ebfd34fef750 octeontx2-af: use seq_file for rsrc_alloc debugfs
6127164efa94e net: pcs: rzn1-miic: Fix config array initialization
f6696481eedfd net/sched: cls_u32: fix manual hash table handle IDR aliasing
f4277b19edbc6 eth: fbnic: Fix payload page pool error cleanup
6e271f093d15d bpf: Skip unsettled links in link iterator
b5c0cff0c5331 xsk: Use a 32-bit compare in xsk_map_gen_lookup
e4f3e476cd406 fs: avoid repeated scans in evict_inodes()
22225cd612b26 s390/cio: Guard PMCW field accesses with dnv check
5eae708cca8f4 s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
591ba131193ee s390/cio: Fix cio_update_schib() to not cache invalid schib
8bd9905dfbd97 s390/pci/docs: Fix sriov_numvfs attribute name
e163f1dccede7 docs: s390/pci: Improve and update PCI documentation
6675f801b0d60 scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
0117e731435bd selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode
2189a219397d8 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
8a36598050cd1 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
6fdabd654578e Bluetooth: SMP: reject Security Request over BR/EDR
9c051b12ca106 pinctrl: sunxi: A523: fix voltage withstand encoding
0af16d8be3ec7 scsi: sd_zbc: Reject disks with too many zones
0cb85377daaef squashfs: Add dictionary size range check to prevent shift-out-of-bounds
5d54693bc457c KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP
cb68b5589318f KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
4efda20408714 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
f126952167146 KVM: arm64: Include VM type when checking VM capabilities in pKVM
bbcd7e851d57d KVM: arm64: Fix MTE flag initialization for protected VMs
c142034ad3a84 KVM: arm64: vgic-v3: Fix GICv3 trapping in protected mode
bd46b41f412fb KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
faf66e55e8749 KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
65bffaf100df8 KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save
80a6b712dc193 KVM: arm64: vgic-its: Free the caches when GITS_BASER changes
c2230cd149507 RISC-V: KVM: Fix perf-backed counter accounting across stop and read
f6f1d27e0c893 RISC-V: KVM: Report snapshot write failure to the guest
f4363eede3e74 RISC-V: KVM: Preserve firmware counter value across stop/start
d6de766d8d26d KVM: riscv: Fix NACL hfence entry update order
5c221f33a5183 HID: bpf: fix __hid_bpf_hw_check_params report length
5f9e2ecb725ad HID: amd_sfh: Validate PCI BAR size before mapping
905d1a40f34f7 pinctrl: meson: Fix typo in s4 group name
b67b4c763f211 bpf, arm64: set up the frame pointer for the exception callback
ae1ffd04e98be bpf, sockmap: Fix self-redirect copied_seq double-counting
1d6581b544a88 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
51a17f0ce19c4 bpf: Register dtor for freeing special fields
6785313d4fac9 bpf: Fix out-of-bounds read of rtt_min in sock_ops
44f9bcb5ab2b2 bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
5ad116c23f149 KVM: x86/pmu: Move Intel PMU global MSRs to intel_is_valid_msr()
08a4d55b26724 HID: elecom: fix bus type for M-XGL20DLBK
49688a0d1ac69 HID: multitouch: Add report ID mismatch quirk for ASUS ROG Z13 Folio
55bbebf2829c3 tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
91a482a81eabd bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
8eb4cd72daad3 bpf: Fix divide-by-zero in btf_struct_walk()
5334c609bf927 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
37b18688cd18f bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
69fe51a3bd78d bpf: Fix bpf_skb_change_tail wrt csum partial skbs
04bb5b2eb9f1d s390/uv: Prevent potential out-of-bounds read
018e137ac1da2 s390/uv: Fix loop condition in uv_find_secrets
a379ac504fcb8 KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
7c7a6ba6128f2 remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
50d844aead62c ALSA: hda/realtek: Add StarFighter HDA SSID
56b321df2863d ALSA: hda/realtek: Limit Star Labs internal mic boost
2945d3eb73d61 drm/amd/display: Atomize IRQ register read/modify/write ops
d1079deec828d erofs: fix large folio race in erofs_fscache_req_complete
14ae74db795ab xfs: don't stash removename operations with unknown ftype
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e5e96e09fcd99cd92fa30d57545eb986daf3d953)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index ac97f340da1..9690d312b8b 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "64ebedd888ed53620df352f568a8b55c5620d169"
-SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341"
+SRCREV_machine ?= "f87ce4ad0a7f6290a8fd961a63fd1653c7308a14"
+SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.54"
+LINUX_VERSION ?= "6.18.57"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index 4cbcfc0084c..939ca9c5b83 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.54"
+LINUX_VERSION ?= "6.18.57"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
-SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341"
+SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 95cae43557d..ce4878d0f27 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "f271f5b5cce5f2c67c00ccb5b4bf60502d4ddc0b"
-SRCREV_machine:qemuarm64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
-SRCREV_machine:qemuloongarch64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_machine:qemuarm ?= "3881e81dea81f6aea84ea28b22899708f3fef903"
+SRCREV_machine:qemuarm64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_machine:qemuloongarch64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
-SRCREV_machine:qemuriscv64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
-SRCREV_machine:qemuriscv32 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
-SRCREV_machine:qemux86 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
-SRCREV_machine:qemux86-64 ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
+SRCREV_machine:qemuppc ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_machine:qemuriscv64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_machine:qemuriscv32 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_machine:qemux86 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_machine:qemux86-64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "aa6a6669031c1e6a30eaa9d8abf4d25ce447acb9"
-SRCREV_meta ?= "b505aeae4f62715ec4801e292b32ad68593b3341"
+SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "1b357ecb321392158d507b04672ffee57bfa071d"
+SRCREV_machine:class-devupstream ?= "2ff600d29ee478d0a8d46ef8a58afb5e038fe692"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.54"
+LINUX_VERSION ?= "6.18.57"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 32/35] linux-yocto/6.18: update to v6.18.59
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (30 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 31/35] linux-yocto/6.18: update to v6.18.57 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 33/35] groff: build less in groff-native Yoann Congal
` (3 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
1253a6aa5d104 Linux 6.18.59
9a5d65b06dc33 smb: client: drain outstanding I/O before truncating on O_TRUNC open
a4c584ea79d95 ice: fix crash in ethtool offline loopback test
9f158a9b10e1e ice: fix broken Rx on VFs
f4a25618c3683 ice: switch to Page Pool
0026267561bc6 ice: drop page splitting and recycling
c8bd04221f6a8 ice: remove legacy Rx and construct SKB
4d143608a0445 smb: client: fix data corruption with concurrent writes and O_TRUNC
c027f8b429dbb vsock/vmci: validate packet source for connected sockets
ecd7ead4bf05e ipv4: udp: Create exceptions before socket matching
6cd829de69efd vsock/virtio: validate packet source for connected sockets
569c34a35fbc9 virtio: set skb owner of virtio_transport_reset_no_sock() reply
f320b85c90fe5 workqueue: Fix unbound pool lifetime for pending pwqs
299912bbc6455 workqueue: release pwq pools by pool type
94d13387b96e5 io_uring/cancel: don't spin on local work the task can't run
7123c79206e49 io_uring/cancel: move cancelation code from io_uring.c to cancel.c
76cb14d6f1433 io_uring/cancel: move __io_uring_cancel() into cancel.c
755e88e78beaf io_uring/cancel: move request/task cancelation logic into cancel.c
de477667b890b cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
242c7b3a71ddf smb/client: refresh allocation size after duplicate extents
8d891c218016b sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
6ac46ae5ac561 drm/amdgpu: free the userptr ranges when a CS fails after parser_bos
2058a1fe791bb tracing: Keep the predicate limit separate from program capacity
07180a910e9d0 tracing: Fix ignored return value of resize_buffer_duplicate_size()
a425e1c687595 sched_ext: idle: Respect task affinity in restricted CPU selection
dfcfe2874e7c1 drm/i915/dmc: Harden DMC firmware payload parsing
c8b1a48404679 ntfs3: free the sbi after a grace period
d977b979081ef fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()
129b0a64fe9ac ntfs3: fix double free of sbi->options->nls and clarify ownership of fc->fs_private
e0ab437276575 ntfs3: fix use-after-free of sbi->options in cmp_fnames
a1647b653549f scsi: st: Fix use-after-free race between st_remove() and st_open()
d2f591e6c7304 smb: client: fix multiuser mount with krb5
d96f3365ce61c smb: client: fix heap overflow in cifs_do_set_acl()
45e60747a9db2 net/sched: cls_flower: validate mask pointer after nla_next()
898cb4f2e12a5 ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
d8c450ad0d089 ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
beba2ef6f66a7 ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
a9f14ea73e82d net: psp: do not inherit the Rx association on clone
8243d587a081e net: bridge: mcast: don't truncate the port group walk on teardown
80d5db1686b05 ext4: free the sbi after a grace period
cad63a7798d6a ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
c17cc2027773e futex: Fix mm reuse handling for FUT_OFF_MMSHARED
dce8f7f03a47b drm/amdgpu: keep the eviction fence until the last handle is closed
0caeefed99b37 KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
7786dde1b5001 KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
dc29c0478b856 netfilter: nft_byteorder: remove multi-register support
61f376654fb9d drm/amdgpu: Fix VCE 3 ring align_mask
d49fa454c2869 KVM: SVM: Stop toggling virtual VMSAVE/VMLOAD on intercept recalc
5dac5c7ba8f5f ipv4: avoid divide by zero in fib_rebalance
ba5001db9bb23 s390/pci: Fix leak of uninitialized kernel data in SCLP report
34fa3607b7604 s390/ctcm: Prevent XID null dereference
813a72beaa5d3 page_pool: keep frag_offset aligned for odd-sized requests
40507f59f230d sctp: validate chunk length in the inqueue parser
b8b7d28dc2b74 tipc: protect node reset trace dump with node lock
f7e82f72b90ce workqueue: Annotate cb_lock nesting when draining a dead BH pool
6b26b3d39904c workqueue: Use raise_softirq() to trigger softirq in irq_work handler
b6a0e5faf0dca netlink: specs: add missing mask attributes for conntrack dump
62ed32a1d4499 netlink: specs: fix the conntrack filter type
e20e6b14e3b5c xfs: fix zoned write iomap flags assignments
19a1a22029ad3 xfs: fix capability check in xfs
e5456dec79c71 xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
8f2efa742f4cf net/iucv: fix the recvmsg window update
3cdd8b1abddeb mac802154: fix data race and NULL deref on local->assoc_dev
c8922e7afb058 dm-integrity: require stable writes for internal hash modes
fc512700f1413 dm-integrity: fix infinite loop on discard with large tag size
40791f07bad61 dm-ebs: fix incorrect device offset check in ebs_ctr()
ac5d887ab9359 dm-crypt: fix a tiny race condition in crypt_dec_pending
73df2ff409f3d dm cache: fix issue with background work locking
de9e8e587c07b dm cache: fix demotion stats in passthrough mode
04d020b3d0b58 cifs: don't update i_size in cifs_do_truncate without a cached handle
2f9dd8214d421 cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
86814e5370068 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
c1804ef016392 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
f641066b0ddcd wifi: p54: validate firmware record lengths
09c7cce2e59e6 tracing: Fix hist trigger timestamps for buffered events
813e18881c647 tracing: Do not initialize tracefs work if tracing is disabled
a866a8a753922 tracing: Check operator stack capacity before pushing
7c0c6d88a232a tracing: Take trace_types_lock when dropping the buffer_meta reference
c4918c28b1baf tracing: Fix the shift out of bounds in the log2 histogram modifier
3a3c4503ba1b4 drm/xe: Bump LRU for external objects on exec and rebind
ef82b4d5cb4a3 drm/i915/dmc: Add sanity check for DMC load address
22fd3f760845f drm/i915/cx0_phy: Fix ARL-S host bridge detection
96d9996e5dbcf drm/exec: don't immediately add prelocked obj to array of locked objs
07002a326c7cc drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES
652b1f26125fe drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
05507b9b19f95 drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
6cfc4a25d4f02 drm/amd/pm: add zero fan stop temperature support on smu 14.0.2
55a65ef61e277 scsi: libiscsi: Validate the task named by a management response
7215a69b6456f scsi: libiscsi: Validate the ITT reflected in a Reject PDU
6cadfa6f1f589 scsi: libiscsi: Reject a negative task index from parse_pdu_itt
1d91ec793d6c8 scsi: xen/scsifront: Check for a NULL shadow entry on a backend response
2effbe746452c scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
029770f5baded ring-buffer: Fix false warning in ring_buffer_map_get_reader()
2f1248b728b56 ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
8512d0312cc0e ring-buffer: Do not show buffer_meta for CPUs without a buffer
29469305a9390 perf: Update cgroup time when rotating multiplexed events
b67fb3955b07d perf: Track the perf mlock gift separately
5d476bb76b7d7 i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe()
d2cb4d7451491 i2c: qcom-cci: Fix HALT_ACK reset request being dropped
1f36e4ddd05d5 tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
13735c2cf4849 tools: gpio: fix building from the top level with O=
77a63d1b813b0 sctp: revalidate output stream after association connect wait
6232e93c3036c pinctrl: amd: Clear S4 wake bits when firmware has _AEI
5f23e4e3a31da net: rds: fix uninitialized trans dereference in CM event handler
2465d27ef90de net/sched: fix use-after-free in __tcf_action_put()
568323cddd54f lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()
ae6584eaaa4f1 lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state
492c10662177f namei: test for a negative dentry the way traverse_mounts() does
4586ef24ce390 eventfs: Free the eventfs_inode after an rcu grace period too
2e10b8a74f55b pid_namespace: make zap_pid_ns_processes() freezable
952501bfc6e5e fsnotify: prevent mark additions during connector teardown
d00d5f534a823 KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
b77e9622bbade x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
811fb6d0b0760 watch_queue: Fix note pool publication race in watch_queue_set_size()
2b54d3c971a1e unicode: free the map after a grace period
d518fc5cced10 bootconfig: give the footer size static_assert a message
1a177064f501e autofs: ignore notification errors from a replaced pipe
debb0f36bfe3d afs: free the super info after a grace period
5078c91f5c84b accel/rocket: search every core slot when a core is removed
7249a442ab261 PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
7595bacee48bc printk: Postpone kthread startup
3eb08f09bfb36 perf: Fix perf_pmu_migrate_context() leaving events behind
d0ffb0dc01166 gpio: mxc: fix race between gpiochip registration and IRQ domain setup
238f93bd1d063 gpio: mxc: fix wakeup_pads bit operations
dab5c228a8468 gpio: mxc: use BIT() macro
911f606dd05d7 gpio: mxc: fix both_edges bit operations
261802c14e1a3 gpio: mxc: fix race between chained IRQ handler install and probe completion
78189c0e35abb gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
1c9fcfca51e3c calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
e221a7d6f7c91 net/ipv6: Introduce payload_len helpers
40c04abcbc34e net: bcmgenet: unshare the skb before writing the control block
bdd55b8a8acbf netlink: avoid hashing the network namespace pointer
c9fb89246d992 scsi: libsas: Fix SMP IO deadlock during HA resume
fbb5a6f0b06fb tracing: probes: error if BTF is required but unavailable
4c42ce499ce4b pipe: preserve existing fasync readers on writer setup failure
7780f9e828da0 samples: pidfd: fix userprogs typo
04d4571c00db6 ocfs2/dlm: Protect the recovery list during debugfs reads
de3923caf0772 drm/panthor: fix immortalis condition
9b07828b133b3 scsi: target: iscsi: Fix race in discovery auth updates
71e12d43ef37e scsi: st: Save the visited block for the partition the drive is in
e3bf250a2fda6 nios2: fix __wsum type degradation in csum_fold()
e4d45c651d19f spi: tegra114: assert CS GPIO for every transfer in a message
21f41b6daf0db drm/xe/oa: Zero OA buffer at allocation
6046bb9cb2859 drm/xe: skip eviction of a BO with no resource
8d15821aa2de1 ASoC: amd: yc: disable MSI on resume
efe1393e783f2 net/mlx5: HWS, fix flow meter offset within its bulk
a3516f0704b96 net/mlx5: HWS, release L2 to L3 tunnel reformats to their own pool
79071b67182e1 accel/rocket: clear rdev on device init failure
06791594274f8 netlink: reset skb headers before unicast and multicast filtering
4a9fb8122a19d regmap: Drop map lock during cache init and exit
bae057687f615 regcache: Do not overwrite error code when finalizing cache after error
b498b70a8174b regcache: Add ->populate() callback to separate from ->init()
0a9a172d4cbfc ASoC: nau8822: Fix the 128x oversampling switch bits
9a87917b8f3d5 ASoC: wm8978: Fix the 128x oversampling switch bits
9b1a72628f125 ASoC: max98371: Fix the Speaker DHT Min Volume bits
384e00dd8908b ASoC: pcm3168a: Fix the DAC zero flag polarity bit
db3a7a70cc214 ASoC: cs42l52: Fix the NG Type Switch bit
856ecf3c600af ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
4528f8d38d893 ASoC: stm32: spdifrx: fix synchronization state check
d3239b8f4fc46 ASoC: Intel: avs: Reset the stream unless it is already prepared
a7c7d0ff87637 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
c2c5359ef2c33 vsock: treat TCP_CLOSING as once-established
fb5fb74fb4fff gpio: nct6694: Mark the GPIO controller as sleeping
6b03e354526f6 drm/vc4: hdmi: Move packet RAM enable to PM runtime
47b725c17dcb2 pinctrl: sunxi: dt: do not accumulate npins across probe attempts
9d0508bcf6743 pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12
2ac0256a28e15 power: supply: core: prevent unregistering a power supply while a callback runs
dda0df37aabd8 power: supply: generic-adc-battery: Fix temperature IIO channel conversion
06e3e6dc2688f tools/power turbostat: Fix add_counter issue if > 24 counters.
f573d257aad5a tools/power turbostat: Fix PMT error path fd handling
b2af180dbc5f5 tools/power turbostat: Fix CWF PMT off-by-one
e2c86984ccc0b tools/power turbostat: Fix fd_perf leak on reset
e76e6284de2ba pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13
54e54a690bf13 pinctrl: qcom: qcs8300: Fix intr_target_width
f47ce27af80b8 Drivers: hv: Don't reset VMBus connection state on error/exit paths
2b561786c9076 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
7141331f2d245 Drivers: hv: Avoid infinite retry loop in init_vp_index()
c3e5854b2e8b6 power: supply: ds2780: Fix ds2780_get_capacity() returning raw value
7de3a5a49410a power: supply: Fix maintenance charge table kernel-doc
ea9c08c33d57c ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition
0992d03e55e5a soc/tegra: fuse: Add missing newline to APBMISC error message
07fa8baa78d64 kho: free phys_bits bitmaps using free_page() in __kho_abort()
96d2abaa2e328 i2c: qcom-geni: Restore the source-clock selection policy
cd3c05651d04b rose: purge rose_neigh->queue on final teardown
6b450cf6dd419 ax25: bound REJ-driven fast retransmits with the existing N2 counter
c7bdc88b27cc6 ALSA: ctxfi: Use correct DAIO type for da_desc
fb5e2dd6565a9 ALSA: ctxfi: Rename SPDIFI1 to SPDIFI_BAY
7fca3600e79e9 ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization
b48ebe399b4e7 drm/ttm: fix swapped-out resources never leaving their bulk_move range
2926d88bb7fc4 Linux 6.18.58
2566780c684c9 KVM: x86: Use active memslots for the per-vCPU MMIO cache
517404e157395 ksmbd: fix heap out-of-bounds write in krb5_authenticate()
88c7c3aa8d0ff wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
5c0940abe76c9 bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
8b7748e9904f8 kho: free chunks using free_page() instead of kfree()
a6d84b420a848 io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
e46794d1936ca io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK
314b72d5e8273 rose: hold a reference on incoming sockets queued for accept()
30ec3025b7715 USB: iowarrior: fix use-after-free on disconnect race
e8ed9a1dfc74f usb: iowarrior: remove inherent race with minor number
c24d2e190b955 selinux: allow multiple opens of /sys/fs/selinux/policy
93a7f297362de mm/damon/core: fix damos_walk() vs kdamond_fn() exit race
7e54ed8a780c8 mm/damon/core: cancel damos_walk() before damon_ctx->kdamond reset
7ea3850b9ce00 xfs: close crash window in attr dabtree inactivation
4b963fddf470f xfs: factor out xfs_attr3_leaf_init
50144efd23ad9 xfs: factor out xfs_attr3_node_entry_remove
0f39d936a3493 ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()
265ca3f6524be ima: Access decompressed kernel module to verify appended signature
7d6fd50746482 fat: stop reading directory entries past the end-of-directory marker
f6c1e709a4f91 cifs: fix time_last_write stamp placement in setattr/truncate paths
2efa187fd4c9b drm/xe/i2c: cancel the client work on remove
97e736000731f scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
ee01d48f0f086 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()
e36bac5923a3b scsi: ufs: core: Add debug log for MCQ command timeout
d12c834b97c36 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
a34a230ccea1b scsi: ch: Do not keep references to data transfer element devices
8176ec7e36987 scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
9e8fc7972b398 riscv: patch: fix handling of bpf-jit execmem addresses
420bf39a22a73 riscv: patch: Avoid early phys_to_page()
08275dcfbfc3b net: mana: reserve RX buffer headroom to fix forwarding performance
eececf7c3a679 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
cc7732b8549ec Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
638ee6bca1975 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
454b67fcc28c1 dm-integrity: validate the superblock on resume
2e25842f0e442 dm-integrity: fix NULL pointer dereference when the 'R' flag is used
0c9d4f9c66ca7 wifi: mt76: connac: tolerate inactive BSS deactivation
22732b0f290ac nfsd: fix all-zero stateid in CB_OFFLOAD for async COPY
0c5595cba7224 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
5720bf6b91295 mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
fdf4f011c6004 iavf: send MAC change request synchronously
5aa9efb559174 iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test
b030fde644501 drm/amd: Create a device link between APU display and XHCI devices
2d06cb25a497d ip6_gre: remove obsolete ERSPAN PMTU update
903a2ab8325a2 PCI: dwc: Return -EIO from dw_pcie_wait_for_link() if device is not active
adc0d81b4d415 PCI: dwc: Return -ENODEV from dw_pcie_wait_for_link() if device is not found
e32aa1d85126e RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
3c03f6f7c6f2d usb: gadget: f_hid: Add missing error code
7820bca8cb207 spi: mpc52xx: clean up interrupt handling
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5d1656b394fb5c06269ff9251e1dd0b4a93b7821)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 9690d312b8b..cf6ed368c53 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "f87ce4ad0a7f6290a8fd961a63fd1653c7308a14"
-SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3"
+SRCREV_machine ?= "582762f4ac66e79c16b088b3fbb5a67a57a15d88"
+SRCREV_meta ?= "cf1eb35154969907fb08e980fe6d1881c97d6a97"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.57"
+LINUX_VERSION ?= "6.18.59"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index 939ca9c5b83..d117eb8a205 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.57"
+LINUX_VERSION ?= "6.18.59"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
-SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3"
+SRCREV_machine ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
+SRCREV_meta ?= "cf1eb35154969907fb08e980fe6d1881c97d6a97"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index ce4878d0f27..f579bacf7ac 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "3881e81dea81f6aea84ea28b22899708f3fef903"
-SRCREV_machine:qemuarm64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
-SRCREV_machine:qemuloongarch64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_machine:qemuarm ?= "5d45ccb59e84ed3f8071c55eeba225af3d8ff987"
+SRCREV_machine:qemuarm64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
+SRCREV_machine:qemuloongarch64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
-SRCREV_machine:qemuriscv64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
-SRCREV_machine:qemuriscv32 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
-SRCREV_machine:qemux86 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
-SRCREV_machine:qemux86-64 ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
+SRCREV_machine:qemuppc ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
+SRCREV_machine:qemuriscv64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
+SRCREV_machine:qemuriscv32 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
+SRCREV_machine:qemux86 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
+SRCREV_machine:qemux86-64 ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "cbba43337e083c0ace9a6cf998850eb1d3f4a0b0"
-SRCREV_meta ?= "5978c5f530b91cfb62213506ee6f157897432ba3"
+SRCREV_machine ?= "0aa9c16e54e9a318d97bae25e0082d7807186232"
+SRCREV_meta ?= "cf1eb35154969907fb08e980fe6d1881c97d6a97"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "2ff600d29ee478d0a8d46ef8a58afb5e038fe692"
+SRCREV_machine:class-devupstream ?= "1253a6aa5d104312bf0992afacc15220ae35bdf9"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.57"
+LINUX_VERSION ?= "6.18.59"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 33/35] groff: build less in groff-native
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (31 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 32/35] linux-yocto/6.18: update to v6.18.59 Yoann Congal
@ 2026-11-11 9:02 ` Yoann Congal
2026-11-11 9:29 ` Patchtest results for " patchtest
2026-11-11 9:03 ` [OE-core][wrynose 34/35] scripts/install-buildtools: Update to 6.0.4 Yoann Congal
` (2 subsequent siblings)
35 siblings, 1 reply; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:02 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
When building groff-native we only really need enough of groff to build
manpages, and don't need documentation or extra tools.
Patch the Makefile to stop building the doc and contrib directories,
which both take time and have incomplete build dependencies that cause
intermittent failures[1][2].
This makes groff-native faster to build:
groff-native do_compile -30.6s -33.7% 90.9s -> 60.3s
And some tools are removed, which I don't believe are needed by anything
we build:
/usr/bin/chem was removed
/usr/bin/eqn2graph was removed
/usr/bin/gdiffmk was removed
/usr/bin/gperl was removed
/usr/bin/gpinyin was removed
/usr/bin/mmroff was removed
/usr/bin/pic2graph was removed
/usr/share/groff/1.24.1/tmac/chem.pic was removed
/usr/share/groff/1.24.1/tmac/hdmisc.tmac was removed
/usr/share/groff/1.24.1/tmac/hdtbl.tmac was removed
/usr/share/groff/1.24.1/tmac/mm was removed
/usr/share/groff/1.24.1/tmac/mm/0.MT was removed
/usr/share/groff/1.24.1/tmac/mm/4.MT was removed
/usr/share/groff/1.24.1/tmac/mm/5.MT was removed
/usr/share/groff/1.24.1/tmac/mm/ms.cov was removed
/usr/share/groff/1.24.1/tmac/mm/se_ms.cov was removed
/usr/share/groff/1.24.1/tmac/mmse.tmac was removed
/usr/share/groff/1.24.1/tmac/mm.tmac was removed
/usr/share/groff/1.24.1/tmac/mom.tmac was removed
/usr/share/groff/1.24.1/tmac/mse.tmac was removed
/usr/share/groff/1.24.1/tmac/m.tmac was removed
/usr/share/groff/1.24.1/tmac/om.tmac was removed
/usr/share/groff/1.24.1/tmac/refer-mm.tmac was removed
/usr/share/groff/1.24.1/tmac/rfc1345.tmac was removed
/usr/share/groff/1.24.1/tmac/sboxes.tmac was removed
[1] oe-core d1a02bdd242 ("groff: Fix occasional build race failure")
[2] https://bugzilla.yoctoproject.org/show_bug.cgi?id=16279
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9deeb7474b2586eb031e4f00a644aed9ccf8cb19)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: For [YOCTO #16279] ]
---
.../groff/files/build-less.patch | 24 +++++++++++++++++++
meta/recipes-extended/groff/groff_1.24.1.bb | 8 +++++--
2 files changed, 30 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-extended/groff/files/build-less.patch
diff --git a/meta/recipes-extended/groff/files/build-less.patch b/meta/recipes-extended/groff/files/build-less.patch
new file mode 100644
index 00000000000..dc560fbb309
--- /dev/null
+++ b/meta/recipes-extended/groff/files/build-less.patch
@@ -0,0 +1,24 @@
+Build less bits of groff to save time and reduce random build
+failures from missing dependencies in this logic.
+
+Upstream-Status: Inappropriate
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+--- a/Makefile.am~ 2026-05-15 13:23:08.000000000 +0100
++++ b/Makefile.am 2026-05-15 13:29:17.053867035 +0100
+@@ -556,15 +556,0 @@
+-include $(top_srcdir)/contrib/chem/chem.am
+-include $(top_srcdir)/contrib/eqn2graph/eqn2graph.am
+-include $(top_srcdir)/contrib/gdiffmk/gdiffmk.am
+-include $(top_srcdir)/contrib/glilypond/glilypond.am
+-include $(top_srcdir)/contrib/gperl/gperl.am
+-include $(top_srcdir)/contrib/gpinyin/gpinyin.am
+-include $(top_srcdir)/contrib/grap2graph/grap2graph.am
+-include $(top_srcdir)/contrib/hdtbl/hdtbl.am
+-include $(top_srcdir)/contrib/install-font/install-font.am
+-include $(top_srcdir)/contrib/mm/mm.am
+-include $(top_srcdir)/contrib/mom/mom.am
+-include $(top_srcdir)/contrib/pic2graph/pic2graph.am
+-include $(top_srcdir)/contrib/rfc1345/rfc1345.am
+-include $(top_srcdir)/contrib/sboxes/sboxes.am
+-include $(top_srcdir)/doc/doc.am
diff --git a/meta/recipes-extended/groff/groff_1.24.1.bb b/meta/recipes-extended/groff/groff_1.24.1.bb
index 24b8146a727..dd5ebee3df2 100644
--- a/meta/recipes-extended/groff/groff_1.24.1.bb
+++ b/meta/recipes-extended/groff/groff_1.24.1.bb
@@ -15,6 +15,8 @@ SRC_URI = "${GNU_MIRROR}/groff/groff-${PV}.tar.gz \
file://builddep.patch \
"
+SRC_URI:append:class-native = "file://build-less.patch"
+
SRC_URI[sha256sum] = "74e2819795b6aff431aeac983d63a9c8968eeaba2a2eba7df8ba4c7b41e7cfd8"
DEPENDS = "bison-native groff-native"
@@ -65,8 +67,10 @@ do_install:append() {
rm -rf ${D}${bindir}/grap2graph
rm -rf ${D}${mandir}/man1/grap2graph*
- # strip hosttool path out of generated files
- sed -i -e 's:${HOSTTOOLS_DIR}/::g' ${D}${docdir}/${BP}/examples/hdtbl/*.roff
+ # strip hosttool path out of generated files
+ if [ -d ${D}${docdir}/${BP}/examples/hdtbl/ ]; then
+ sed -i -e 's:${HOSTTOOLS_DIR}/::g' ${D}${docdir}/${BP}/examples/hdtbl/*.roff
+ fi
}
do_install:append:class-native() {
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 34/35] scripts/install-buildtools: Update to 6.0.4
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (32 preceding siblings ...)
2026-11-11 9:02 ` [OE-core][wrynose 33/35] groff: build less in groff-native Yoann Congal
@ 2026-11-11 9:03 ` Yoann Congal
2026-11-11 9:03 ` [OE-core][wrynose 35/35] populate_sdk_ext: Fix locale error handling in SDK Yoann Congal
2026-11-11 9:13 ` [OE-core][wrynose 00/35] Patch review Yoann Congal
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:03 UTC (permalink / raw)
To: openembedded-core
From: Yoann Congal <yoann.congal@smile.fr>
Update to the 6.0.4 release of the 6.0 series for buildtools
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
scripts/install-buildtools | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/install-buildtools b/scripts/install-buildtools
index e1af05fca33..bc044f9b308 100755
--- a/scripts/install-buildtools
+++ b/scripts/install-buildtools
@@ -57,8 +57,8 @@ logger = scriptutils.logger_create(PROGNAME, stream=sys.stdout)
DEFAULT_INSTALL_DIR = os.path.join(os.path.split(scripts_path)[0],'buildtools')
DEFAULT_BASE_URL = 'https://downloads.yoctoproject.org/releases/yocto'
-DEFAULT_RELEASE = 'yocto-6.0.3'
-DEFAULT_INSTALLER_VERSION = '6.0.3'
+DEFAULT_RELEASE = 'yocto-6.0.4'
+DEFAULT_INSTALLER_VERSION = '6.0.4'
DEFAULT_BUILDDATE = '202110XX'
# Python version sanity check
^ permalink raw reply related [flat|nested] 39+ messages in thread
* [OE-core][wrynose 35/35] populate_sdk_ext: Fix locale error handling in SDK
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (33 preceding siblings ...)
2026-11-11 9:03 ` [OE-core][wrynose 34/35] scripts/install-buildtools: Update to 6.0.4 Yoann Congal
@ 2026-11-11 9:03 ` Yoann Congal
2026-11-11 9:13 ` [OE-core][wrynose 00/35] Patch review Yoann Congal
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:03 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
During automated testing we occasionally we see the error:
"ERROR: the installer requires the en_US.UTF-8 locale to be installed (but not selected), please install it first"
This is puzzling as the locale *is* installed. The use of -q with grep in
a pipeline is potentially problematic as grep can exit early and cause a
pipefail/SIGPIPE.
Tweak the code to avoid it and a few other issues (add quoting, handle the
"." correctly, match a whole line).
[YOCTO #16198]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f290e76eef3bd175f71414b7f78aafd0af5e0ce2)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes-recipe/populate_sdk_ext.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes-recipe/populate_sdk_ext.bbclass b/meta/classes-recipe/populate_sdk_ext.bbclass
index 071cf959e7e..990113d1798 100644
--- a/meta/classes-recipe/populate_sdk_ext.bbclass
+++ b/meta/classes-recipe/populate_sdk_ext.bbclass
@@ -678,7 +678,7 @@ sdk_ext_preinst() {
fi
# Check setting of LC_ALL set above
canonicalised_locale=`echo $LC_ALL | sed 's/UTF-8/utf8/'`
- if ! locale -a | grep -q $canonicalised_locale ; then
+ if ! locale -a | grep -Fx "$canonicalised_locale" > /dev/null ; then
echo "ERROR: the installer requires the $LC_ALL locale to be installed (but not selected), please install it first"
exit 1
fi
^ permalink raw reply related [flat|nested] 39+ messages in thread
* Re: [OE-core][wrynose 00/35] Patch review
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
` (34 preceding siblings ...)
2026-11-11 9:03 ` [OE-core][wrynose 35/35] populate_sdk_ext: Fix locale error handling in SDK Yoann Congal
@ 2026-11-11 9:13 ` Yoann Congal
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-11-11 9:13 UTC (permalink / raw)
To: Yoann Congal, openembedded-core
On Wed Nov 11, 2026 at 10:02 AM CET, Yoann Congal wrote:
> Please review this set of changes for wrynose and have comments back by
> end of day Thursday, November 12.
>
> Passed a-full on autobuilder:
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/5102
> * qemuarm64-musl-ptest failed with 15814 – qemuarm64 musl ptest failures
> retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/109/builds/1543
>
> The following changes since commit 2285da08068a6d1b4a64c9a52d85a58be50e4679:
>
> openssh: fix CVE-2026-123158 (aka "sshhole") (2026-11-06 17:15:59 +0100)
>
> are available in the Git repository at:
>
> https://git.openembedded.org/openembedded-core-contrib stable/wrynose-review
> https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review
>
> for you to fetch changes up to 33a6bd6cc8a9a976902081642414bd67adc74879:
>
> populate_sdk_ext: Fix locale error handling in SDK (2026-11-11 00:22:27 +0100)
I forgot to highlight 2 patches:
* "dropbear: add follow-up patches for CVE-2019-6111"
I think this is a worthy fix but it has user-visible consequences:
`scp -r host:dir <existing dir>` now exits 1 instead of overwriting
files (which is the vulnerability being fixed).
* "python3-urllib3: Fix CVE-2026-97687"
May throw a new warning in a unsecure configuration (related to TLS
and proxies) that will be dropped in futur version. User code fix might
be needed to avoid the warning (but the code will still work).
> ----------------------------------------------------------------
>
> Adrian Freihofer (1):
> kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps
>
> Benjamin Robin (4):
> spdx_common: simplify get_patched_src() implementation
> spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
> spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
> package: no longer modify paths in save_debugsources_info()
>
> Bruce Ashfield (3):
> linux-yocto/6.18: aufs: refresh to upstream aufs6.18
> linux-yocto/6.18: update to v6.18.57
> linux-yocto/6.18: update to v6.18.59
>
> Deepak Rathore (1):
> gnupg: Fix CVE-2026-105712
>
> Jaipaul Cheernam (1):
> bind: upgrade 9.20.29 -> 9.20.30
>
> Jeroen Hofstee (1):
> python3-pip: patch the vendored python3-certifi
>
> Jinwang Li (5):
> bluez5: Fix error handling for AVDTP_OPEN cmd
> bluez5: Fix GET_CONFIGURATION cmd
> bluez5: Return correct error when SEP is inuse
> bluez5: Fix ABORT response being discarded
> bluez5: Fix u128_to_string skipping data[4]
>
> Peter Marko (7):
> boost: patch CVE-2023-34399
> go: upgrade 1.26.9 -> 1.26.10
> glib-2.0: patch CVE-2026-16118
> python3: upgrade 3.14.9 -> 3.14.10
> systemd: add iproute2-devlink runtime dependency to udev
> dropbear: add follow-up patches for CVE-2019-6111
> dropbear: patch CVE-2026-35385
>
> Richard Purdie (2):
> recipe_sanity: Drop rename overwrite detection
> populate_sdk_ext: Fix locale error handling in SDK
>
> Ross Burton (4):
> python3: upgrade 3.14.7 -> 3.14.9
> python3: skip test.test_readline.TestHistoryManipulation on musl
> piglit: fix build with Python 3.14.9
> groff: build less in groff-native
>
> Shantanu Majumdar (1):
> gstreamer1.0-plugins-bad: use gtk+3 dependency name
>
> Theo Gaige (Schneider Electric) (1):
> python3-pyelftools: add missing runtime dependencies
>
> Yoann Congal (1):
> scripts/install-buildtools: Update to 6.0.4
>
> Yogita Urade (3):
> python3-urllib3: Fix CVE-2026-44432
> python3-urllib3: Fix CVE-2026-97687
> python3-urllib3: Fix CVE-2026-97688
>
> meta/classes-recipe/kernel-fit-image.bbclass | 14 +-
> meta/classes-recipe/populate_sdk_ext.bbclass | 2 +-
> meta/classes/recipe_sanity.bbclass | 21 -
> meta/lib/oe/package.py | 54 +--
> meta/lib/oe/spdx30_tasks.py | 1 -
> meta/lib/oe/spdx_common.py | 125 +++--
> ...1-avoid-start-failure-with-bind-user.patch | 2 +-
> ...kport-ax_prog_cc_for_build.m4-macros.patch | 2 +-
> ...d-V-and-start-log-hide-build-options.patch | 4 +-
> ...ching-for-json-headers-searches-sysr.patch | 4 +-
> .../recipes-connectivity/bind/bind/conf.patch | 2 +-
> ...t.d-add-support-for-read-only-rootfs.patch | 2 +-
> .../bind/make-etc-initd-bind-stop-work.patch | 2 +-
> .../bind/{bind_9.20.29.bb => bind_9.20.30.bb} | 2 +-
> meta/recipes-connectivity/bluez5/bluez5.inc | 5 +
> ...0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch | 36 ++
> ...ix-error-handling-for-AVDTP_OPEN-cmd.patch | 48 ++
> ...turn-correct-error-when-SEP-is-inuse.patch | 32 ++
> ...x-Fix-ABORT-response-being-discarded.patch | 44 ++
> ...p-Fix-u128_to_string-skipping-data-4.patch | 33 ++
> .../dropbear/dropbear/CVE-2019-6111-01.patch | 364 ++++++++++++++
> .../dropbear/dropbear/CVE-2019-6111-02.patch | 43 ++
> .../dropbear/dropbear/CVE-2019-6111-03.patch | 34 ++
> .../dropbear/dropbear/CVE-2019-6111-04.patch | 43 ++
> .../dropbear/dropbear/CVE-2026-35385.patch | 42 ++
> .../recipes-core/dropbear/dropbear_2025.89.bb | 5 +
> .../glib-2.0/files/CVE-2026-16118.patch | 48 ++
> meta/recipes-core/glib-2.0/glib.inc | 1 +
> meta/recipes-core/systemd/systemd_259.5.bb | 1 +
> .../go/{go-1.26.9.inc => go-1.26.10.inc} | 2 +-
> ..._1.26.9.bb => go-binary-native_1.26.10.bb} | 6 +-
> ...1.26.9.bb => go-cross-canadian_1.26.10.bb} | 0
> ...go-cross_1.26.9.bb => go-cross_1.26.10.bb} | 0
> ...sssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} | 0
> ...untime_1.26.9.bb => go-runtime_1.26.10.bb} | 0
> .../go/{go_1.26.9.bb => go_1.26.10.bb} | 0
> .../python3-pip/0001-Remove-emsign-437.patch | 142 ++++++
> ...tore-unaffected-emSign-roots-439-440.patch | 108 +++++
> .../python/python3-pip_26.0.1.bb | 2 +
> .../python/python3-pyelftools_0.32.bb | 8 +-
> .../python3-urllib3/CVE-2026-44432.patch | 157 ++++++
> .../python3-urllib3/CVE-2026-97687_p1.patch | 277 +++++++++++
> .../python3-urllib3/CVE-2026-97687_p2.patch | 450 ++++++++++++++++++
> .../CVE-2026-97688-regression.patch | 29 ++
> .../python3-urllib3/CVE-2026-97688.patch | 107 +++++
> .../python/python3-urllib3_2.6.3.bb | 5 +
> ...shebang-overflow-on-python-config.py.patch | 2 +-
> ...-use-prefix-value-from-build-configu.patch | 2 +-
> ...-qemu-wrapper-when-gathering-profile.patch | 2 +-
> ...est_sysconfig-for-posix_user-purelib.patch | 2 +-
> .../python/python3/makerace.patch | 2 +-
> .../{python3_3.14.7.bb => python3_3.14.10.bb} | 7 +-
> .../groff/files/build-less.patch | 24 +
> meta/recipes-extended/groff/groff_1.24.1.bb | 8 +-
> ...-reproducible_mtime-should-be-an-int.patch | 33 ++
> meta/recipes-graphics/piglit/piglit_git.bb | 1 +
> .../linux/linux-yocto-rt_6.18.bb | 6 +-
> .../linux/linux-yocto-tiny_6.18.bb | 6 +-
> meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +-
> .../gstreamer1.0-plugins-bad_1.28.5.bb | 2 +-
> .../boost/boost/CVE-2023-34399.patch | 35 ++
> meta/recipes-support/boost/boost_1.90.0.bb | 1 +
> .../gnupg/CVE-2026-105712-regression.patch | 39 ++
> .../gnupg/gnupg/CVE-2026-105712.patch | 194 ++++++++
> meta/recipes-support/gnupg/gnupg_2.5.17.bb | 2 +
> scripts/install-buildtools | 4 +-
> 66 files changed, 2554 insertions(+), 151 deletions(-)
> rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%)
> create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch
> create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch
> create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch
> create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch
> create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch
> create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch
> create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch
> create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch
> create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch
> create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch
> create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch
> rename meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} (90%)
> rename meta/recipes-devtools/go/{go-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} (80%)
> rename meta/recipes-devtools/go/{go-cross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} (100%)
> rename meta/recipes-devtools/go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} (100%)
> rename meta/recipes-devtools/go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} (100%)
> rename meta/recipes-devtools/go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} (100%)
> rename meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} (100%)
> create mode 100644 meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch
> create mode 100644 meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch
> create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch
> create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch
> create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch
> create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch
> create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch
> rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.10.bb} (98%)
> create mode 100644 meta/recipes-extended/groff/files/build-less.patch
> create mode 100644 meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch
> create mode 100644 meta/recipes-support/boost/boost/CVE-2023-34399.patch
> create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch
> create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 39+ messages in thread
* Patchtest results for [OE-core][wrynose 31/35] linux-yocto/6.18: update to v6.18.57
2026-11-11 9:02 ` [OE-core][wrynose 31/35] linux-yocto/6.18: update to v6.18.57 Yoann Congal
@ 2026-11-11 9:29 ` patchtest
0 siblings, 0 replies; 39+ messages in thread
From: patchtest @ 2026-11-11 9:29 UTC (permalink / raw)
To: Yoann Congal; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 3210 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/wrynose-31-35-linux-yocto-6.18-update-to-v6.18.57.patch
FAIL: test commit message user tags: Mbox includes one or more GitHub-style username tags. Ensure that any "@" symbols are stripped out of usernames (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test CVE tag format: No new source patches introduced (test_patch.TestPatch.test_cve_tag_format)
SKIP: test Signed-off-by presence: No new source patches introduced (test_patch.TestPatch.test_signed_off_by_presence)
SKIP: test Upstream-Status presence: No new source patches introduced (test_patch.TestPatch.test_upstream_status_presence_format)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply [flat|nested] 39+ messages in thread
* Patchtest results for [OE-core][wrynose 33/35] groff: build less in groff-native
2026-11-11 9:02 ` [OE-core][wrynose 33/35] groff: build less in groff-native Yoann Congal
@ 2026-11-11 9:29 ` patchtest
0 siblings, 0 replies; 39+ messages in thread
From: patchtest @ 2026-11-11 9:29 UTC (permalink / raw)
To: Yoann Congal; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 3054 bytes --]
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch /home/patchtest/share/mboxes/wrynose-33-35-groff-build-less-in-groff-native.patch
FAIL: test Upstream-Status presence: Upstream-Status is Inappropriate, but no reason was provided (test_patch.TestPatch.test_upstream_status_presence_format)
PASS: test CVE check ignore (test_metadata.TestMetadata.test_cve_check_ignore)
PASS: test CVE tag format (test_patch.TestPatch.test_cve_tag_format)
PASS: test Signed-off-by presence (test_mbox.TestMbox.test_signed_off_by_presence)
PASS: test Signed-off-by presence (test_patch.TestPatch.test_signed_off_by_presence)
PASS: test auh changelog truncation notice (test_mbox.TestMbox.test_auh_changelog_truncation_notice)
PASS: test author valid (test_mbox.TestMbox.test_author_valid)
PASS: test commit message presence (test_mbox.TestMbox.test_commit_message_presence)
PASS: test commit message user tags (test_mbox.TestMbox.test_commit_message_user_tags)
PASS: test lic files chksum modified not mentioned (test_metadata.TestMetadata.test_lic_files_chksum_modified_not_mentioned)
PASS: test max line length (test_metadata.TestMetadata.test_max_line_length)
PASS: test mbox format (test_mbox.TestMbox.test_mbox_format)
PASS: test non-AUH upgrade (test_mbox.TestMbox.test_non_auh_upgrade)
PASS: test shortlog format (test_mbox.TestMbox.test_shortlog_format)
PASS: test shortlog length (test_mbox.TestMbox.test_shortlog_length)
PASS: test target mailing list (test_mbox.TestMbox.test_target_mailing_list)
SKIP: pretest pylint: No python related patches, skipping test (test_python_pylint.PyLint.pretest_pylint)
SKIP: pretest src uri left files: Patch cannot be merged (test_metadata.TestMetadata.pretest_src_uri_left_files)
SKIP: test bugzilla entry format: No bug ID found (test_mbox.TestMbox.test_bugzilla_entry_format)
SKIP: test lic files chksum presence: No added recipes, skipping test (test_metadata.TestMetadata.test_lic_files_chksum_presence)
SKIP: test license presence: No added recipes, skipping test (test_metadata.TestMetadata.test_license_presence)
SKIP: test pylint: No python related patches, skipping test (test_python_pylint.PyLint.test_pylint)
SKIP: test series merge on head: Merge test is disabled for now (test_mbox.TestMbox.test_series_merge_on_head)
SKIP: test src uri left files: Patch cannot be merged (test_metadata.TestMetadata.test_src_uri_left_files)
SKIP: test summary presence: No added recipes, skipping test (test_metadata.TestMetadata.test_summary_presence)
---
Please address the issues identified and
submit a new revision of the patch, or alternatively, reply to this
email with an explanation of why the patch should be accepted. If you
believe these results are due to an error in patchtest, please submit a
bug at https://bugzilla.yoctoproject.org/ (use the 'Patchtest' category
under 'Yocto Project Subprojects'). For more information on specific
failures, see: https://wiki.yoctoproject.org/wiki/Patchtest. Thank
you!
^ permalink raw reply [flat|nested] 39+ messages in thread
end of thread, other threads:[~2026-11-11 9:29 UTC | newest]
Thread overview: 39+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-11 9:02 [OE-core][wrynose 00/35] Patch review Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 01/35] bluez5: Fix error handling for AVDTP_OPEN cmd Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 02/35] bluez5: Fix GET_CONFIGURATION cmd Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 03/35] bluez5: Return correct error when SEP is inuse Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 04/35] bluez5: Fix ABORT response being discarded Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 05/35] bluez5: Fix u128_to_string skipping data[4] Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 06/35] gstreamer1.0-plugins-bad: use gtk+3 dependency name Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 07/35] spdx_common: simplify get_patched_src() implementation Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 08/35] spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src() Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 09/35] spdx_common: In get_patched_src() ensure kernel dir name to be ${BP} Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 10/35] package: no longer modify paths in save_debugsources_info() Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 11/35] python3-pyelftools: add missing runtime dependencies Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 12/35] kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 13/35] boost: patch CVE-2023-34399 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 14/35] go: upgrade 1.26.9 -> 1.26.10 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 15/35] glib-2.0: patch CVE-2026-16118 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 16/35] python3-pip: patch the vendored python3-certifi Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 17/35] python3: upgrade 3.14.7 -> 3.14.9 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 18/35] python3: upgrade 3.14.9 -> 3.14.10 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 19/35] python3: skip test.test_readline.TestHistoryManipulation on musl Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 20/35] piglit: fix build with Python 3.14.9 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 21/35] systemd: add iproute2-devlink runtime dependency to udev Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 22/35] bind: upgrade 9.20.29 -> 9.20.30 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 23/35] recipe_sanity: Drop rename overwrite detection Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 24/35] dropbear: add follow-up patches for CVE-2019-6111 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 25/35] dropbear: patch CVE-2026-35385 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 26/35] python3-urllib3: Fix CVE-2026-44432 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 27/35] python3-urllib3: Fix CVE-2026-97687 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 28/35] python3-urllib3: Fix CVE-2026-97688 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 29/35] gnupg: Fix CVE-2026-105712 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 30/35] linux-yocto/6.18: aufs: refresh to upstream aufs6.18 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 31/35] linux-yocto/6.18: update to v6.18.57 Yoann Congal
2026-11-11 9:29 ` Patchtest results for " patchtest
2026-11-11 9:02 ` [OE-core][wrynose 32/35] linux-yocto/6.18: update to v6.18.59 Yoann Congal
2026-11-11 9:02 ` [OE-core][wrynose 33/35] groff: build less in groff-native Yoann Congal
2026-11-11 9:29 ` Patchtest results for " patchtest
2026-11-11 9:03 ` [OE-core][wrynose 34/35] scripts/install-buildtools: Update to 6.0.4 Yoann Congal
2026-11-11 9:03 ` [OE-core][wrynose 35/35] populate_sdk_ext: Fix locale error handling in SDK Yoann Congal
2026-11-11 9:13 ` [OE-core][wrynose 00/35] Patch review Yoann Congal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox