Re: [OE-core] [scarthgap][PATCH] improve_kernel_cve_report: fix crash on entries without detail

[Hiago De Franco <hfranco@baylibre.com>]

On Thu, Sep 10, 2026 at 05:39:31PM +0200, Yoann Congal wrote:
> On Tue Sep 1, 2026 at 9:42 PM CEST, Hiago De Franco via lists.openembedded.org wrote:
> > When the CNA reports Unpatched and the scan reports Patched, cve_update()
> > reads cve_data[cve]['detail'] unguarded. cve-check only writes 'detail'
> > for CVEs carrying a CVE_STATUS varflag, so an entry marked Patched by an
> > NVD version comparison has no such key and the script aborts with
> > KeyError: 'detail' on ordinary cve-check output. The unhandled-update
> > warning below makes the same assumption.
> >
> > Use .get() in both places. A missing detail falls through to the CNA
> > verdict, and only an explicit CVE_STATUS = "backported-patch" outranks
> > it, which is what the guard was added for.
> >
> > Tested by calling cve_update() with a Patched entry carrying no detail:
> > before it raises KeyError, after it takes the CNA's Unpatched verdict,
> > while an entry with detail = "backported-patch" stays Patched either way.
> >
> > AI-Generated: Uses Claude (claude-opus-5)
> > Fixes: d317e2a52bd2 ("improve_kernel_cve_report: do not override backported-patch")
> > Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
> > ---
> >  scripts/contrib/improve_kernel_cve_report.py | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> Hello,
> 
> If I'm not mistaken, this patch is the squash of 80ff4903ea1 and
> f5da16b0d3c. I'd rather have 2 clean cherry-picks, this make tracking
> which patch is needed or not easier.
> 
> Can you send the 2 cherry-picks as a series?

Correct. Sure, I just sent to the list. Thanks!

> 
> Thanks!
> -- 
> Yoann Congal
> Smile ECS
> 

-- 
Hiago