[scarthgap][PATCH] improve_kernel_cve_report: fix crash on entries without detail

[scarthgap][PATCH] improve_kernel_cve_report: fix crash on entries without detail

[Hiago De Franco]

When the CNA reports Unpatched and the scan reports Patched, cve_update()
reads cve_data[cve]['detail'] unguarded. cve-check only writes 'detail'
for CVEs carrying a CVE_STATUS varflag, so an entry marked Patched by an
NVD version comparison has no such key and the script aborts with
KeyError: 'detail' on ordinary cve-check output. The unhandled-update
warning below makes the same assumption.

Use .get() in both places. A missing detail falls through to the CNA
verdict, and only an explicit CVE_STATUS = "backported-patch" outranks
it, which is what the guard was added for.

Tested by calling cve_update() with a Patched entry carrying no detail:
before it raises KeyError, after it takes the CNA's Unpatched verdict,
while an entry with detail = "backported-patch" stays Patched either way.

AI-Generated: Uses Claude (claude-opus-5)
Fixes: d317e2a52bd2 ("improve_kernel_cve_report: do not override backported-patch")
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
---
 scripts/contrib/improve_kernel_cve_report.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/contrib/improve_kernel_cve_report.py b/scripts/contrib/improve_kernel_cve_report.py
index 3a15b1ed26..dd59d93146 100755
--- a/scripts/contrib/improve_kernel_cve_report.py
+++ b/scripts/contrib/improve_kernel_cve_report.py
@@ -362,7 +362,7 @@ def cve_update(cve_data, cve, entry):
     if entry['status'] == "Unpatched" and cve_data[cve]['status'] == "Patched":
         # Backported-patch (e.g. vendor kernel repo with cherry-picked CVE patch)
         # has priority over unpatch from CNA
-        if cve_data[cve]['detail'] == "backported-patch":
+        if cve_data[cve].get('detail') == "backported-patch":
             return
         logging.warning("CVE entry %s update from Patched to Unpatched from the scan result", cve)
         cve_data[cve] = copy_data(cve_data[cve], entry)
@@ -381,7 +381,7 @@ def cve_update(cve_data, cve, entry):
         logging.debug("CVE entry %s updated from Unpatched to Ignored", cve)
         return
     logging.warning("Unhandled CVE entry update for %s %s from %s %s to %s",
-        cve, cve_data[cve]['status'], cve_data[cve]['detail'],  entry['status'], entry['detail'])
+        cve, cve_data[cve]['status'], cve_data[cve].get('detail'),  entry['status'], entry['detail'])
 
 def main():
     parser = argparse.ArgumentParser(

---
base-commit: 310eec2cb646d7d1a3ca99bad7e37495bb418a0d
change-id: 20260901-fix-kernel-cve-scarthgap-4b2042336e49

Best regards,
--  
Hiago

Re: [OE-core] [scarthgap][PATCH] improve_kernel_cve_report: fix crash on entries without detail

[Yoann Congal]

On Tue Sep 1, 2026 at 9:42 PM CEST, Hiago De Franco via lists.openembedded.org wrote:
> When the CNA reports Unpatched and the scan reports Patched, cve_update()
> reads cve_data[cve]['detail'] unguarded. cve-check only writes 'detail'
> for CVEs carrying a CVE_STATUS varflag, so an entry marked Patched by an
> NVD version comparison has no such key and the script aborts with
> KeyError: 'detail' on ordinary cve-check output. The unhandled-update
> warning below makes the same assumption.
>
> Use .get() in both places. A missing detail falls through to the CNA
> verdict, and only an explicit CVE_STATUS = "backported-patch" outranks
> it, which is what the guard was added for.
>
> Tested by calling cve_update() with a Patched entry carrying no detail:
> before it raises KeyError, after it takes the CNA's Unpatched verdict,
> while an entry with detail = "backported-patch" stays Patched either way.
>
> AI-Generated: Uses Claude (claude-opus-5)
> Fixes: d317e2a52bd2 ("improve_kernel_cve_report: do not override backported-patch")
> Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
> ---
>  scripts/contrib/improve_kernel_cve_report.py | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Hello,

If I'm not mistaken, this patch is the squash of 80ff4903ea1 and
f5da16b0d3c. I'd rather have 2 clean cherry-picks, this make tracking
which patch is needed or not easier.

Can you send the 2 cherry-picks as a series?

Thanks!
-- 
Yoann Congal
Smile ECS

Re: [OE-core] [scarthgap][PATCH] improve_kernel_cve_report: fix crash on entries without detail

[Hiago De Franco]

On Thu, Sep 10, 2026 at 05:39:31PM +0200, Yoann Congal wrote:
> On Tue Sep 1, 2026 at 9:42 PM CEST, Hiago De Franco via lists.openembedded.org wrote:
> > When the CNA reports Unpatched and the scan reports Patched, cve_update()
> > reads cve_data[cve]['detail'] unguarded. cve-check only writes 'detail'
> > for CVEs carrying a CVE_STATUS varflag, so an entry marked Patched by an
> > NVD version comparison has no such key and the script aborts with
> > KeyError: 'detail' on ordinary cve-check output. The unhandled-update
> > warning below makes the same assumption.
> >
> > Use .get() in both places. A missing detail falls through to the CNA
> > verdict, and only an explicit CVE_STATUS = "backported-patch" outranks
> > it, which is what the guard was added for.
> >
> > Tested by calling cve_update() with a Patched entry carrying no detail:
> > before it raises KeyError, after it takes the CNA's Unpatched verdict,
> > while an entry with detail = "backported-patch" stays Patched either way.
> >
> > AI-Generated: Uses Claude (claude-opus-5)
> > Fixes: d317e2a52bd2 ("improve_kernel_cve_report: do not override backported-patch")
> > Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
> > ---
> >  scripts/contrib/improve_kernel_cve_report.py | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> Hello,
> 
> If I'm not mistaken, this patch is the squash of 80ff4903ea1 and
> f5da16b0d3c. I'd rather have 2 clean cherry-picks, this make tracking
> which patch is needed or not easier.
> 
> Can you send the 2 cherry-picks as a series?

Correct. Sure, I just sent to the list. Thanks!

> 
> Thanks!
> -- 
> Yoann Congal
> Smile ECS
> 

-- 
Hiago