* [OE-core][wrynose 01/36] curl: fix CVE-2026-7168
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 02/36] gawk: Fix CVE-2026-40467 Yoann Congal
` (34 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for proxy Digest state reuse across proxy
switches described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507
[2] https://curl.se/docs/CVE-2026-7168.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-7168
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../curl/curl/CVE-2026-7168.patch | 376 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 377 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-7168.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-7168.patch b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
new file mode 100644
index 00000000000..d547c849266
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-7168.patch
@@ -0,0 +1,376 @@
+From c1cfdf59acbaf9504c4578d4cf56cdd7c8594507 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 27 Apr 2026 09:14:51 +0200
+Subject: [PATCH] setopt: clear proxy auth properties when switching
+
+Verify with test 1588
+
+Closes #21453
+
+CVE: CVE-2026-7168
+Upstream-Status: Backport [https://github.com/curl/curl/commit/c1cfdf59acbaf9504c4578d4cf56cdd7c8594507]
+
+Backport Changes:
+- Adapted setproxy() insertion and test-list placement to the curl 8.19.0 wrynose layout.
+
+(cherry picked from commit c1cfdf59acbaf9504c4578d4cf56cdd7c8594507)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/setopt.c | 17 ++++-
+ lib/vauth/vauth.h | 1 +
+ tests/data/Makefile.am | 2 +-
+ tests/data/test1588 | 106 ++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc | 2 +-
+ tests/libtest/lib1588.c | 150 +++++++++++++++++++++++++++++++++++++
+ 6 files changed, 275 insertions(+), 3 deletions(-)
+ create mode 100644 tests/data/test1588
+ create mode 100644 tests/libtest/lib1588.c
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 84f3e02..d12ffb6 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -49,6 +49,7 @@
+ #include "curlx/strdup.h"
+ #include "escape.h"
+ #include "bufref.h"
++#include "vauth/vauth.h"
+
+ static CURLcode setopt_set_timeout_sec(timediff_t *ptimeout_ms, long secs)
+ {
+@@ -1664,6 +1665,20 @@ static CURLcode cookiefile(struct Curl_easy *data, const char *ptr)
+ #endif
+
+ #ifndef CURL_DISABLE_PROXY
++
++static CURLcode setproxy(struct Curl_easy *data, const char *proxy)
++{
++ if((data->set.str[STRING_PROXY] && proxy) &&
++ /* there was one set, is this a new one? */
++ !strcmp(data->set.str[STRING_PROXY], proxy))
++ return CURLE_OK; /* same one as before */
++
++ Curl_auth_digest_cleanup(&data->state.proxydigest);
++ memset(&data->state.authproxy, 0, sizeof(data->state.authproxy));
++ return Curl_setstropt(&data->set.str[STRING_PROXY], proxy);
++}
++
++
+ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
+ const char *ptr)
+ {
+@@ -1759,7 +1771,7 @@ static CURLcode setopt_cptr_proxy(struct Curl_easy *data, CURLoption option,
+ * Setting it to NULL, means no proxy but allows the environment variables
+ * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
+ */
+- return Curl_setstropt(&s->str[STRING_PROXY], ptr);
++ return setproxy(data, ptr);
+ case CURLOPT_PRE_PROXY:
+ /*
+ * Set proxy server:port to use as SOCKS proxy.
+diff --git a/lib/vauth/vauth.h b/lib/vauth/vauth.h
+index 3e66c89..20ee51e 100644
+--- a/lib/vauth/vauth.h
++++ b/lib/vauth/vauth.h
+@@ -117,6 +117,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
+ /* This is used to clean up the digest specific data */
+ void Curl_auth_digest_cleanup(struct digestdata *digest);
+ #else
++#define Curl_auth_digest_cleanup(x)
+ #define Curl_auth_is_digest_supported() FALSE
+ #endif /* !CURL_DISABLE_DIGEST_AUTH */
+
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 1b76b01..1e84b26 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -208,7 +208,7 @@ test1548 test1549 test1550 test1551 test1552 test1553 test1554 test1555 \
+ test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \
+ test1564 test1565 test1566 test1567 test1568 test1569 test1570 test1571 \
+ test1572 test1573 test1574 test1575 test1576 test1577 test1578 test1579 \
+-test1580 test1581 test1582 test1583 test1584 test1585 \
++test1580 test1581 test1582 test1583 test1584 test1585 test1588 \
+ \
+ test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
+ test1598 test1599 test1600 test1601 test1602 test1603 test1604 test1605 \
+diff --git a/tests/data/test1588 b/tests/data/test1588
+new file mode 100644
+index 0000000..753e98c
+--- /dev/null
++++ b/tests/data/test1588
+@@ -0,0 +1,106 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000 crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<datacheck crlf="headers">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</datacheck>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++digest
++</features>
++<name>
++HTTP proxy auth Digest, then change proxy and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER %HOSTIP %HTTPPORT silly:person custom.set.host.name
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/1588 HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="silly", realm="weirdorealm", nonce="12345", uri="/path/1588", response="d0b2f000c7e3fca24452b5810713404a"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 2f77c16..96b82bc 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -97,7 +97,7 @@ TESTS_C = \
+ lib1559.c lib1560.c lib1564.c lib1565.c \
+ lib1567.c lib1568.c lib1569.c lib1571.c \
+ lib1576.c \
+- lib1582.c \
++ lib1582.c lib1588.c \
+ lib1591.c lib1592.c lib1593.c lib1594.c lib1597.c \
+ lib1598.c lib1599.c \
+ lib1662.c \
+diff --git a/tests/libtest/lib1588.c b/tests/libtest/lib1588.c
+new file mode 100644
+index 0000000..9b12f36
+--- /dev/null
++++ b/tests/libtest/lib1588.c
+@@ -0,0 +1,150 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = URL
++ * argv2 = proxy host
++ * argv3 = proxy port
++ * argv4 = proxyuser:password
++ */
++
++#include "first.h"
++
++static CURLcode init1588(CURL *curl, const char *url,
++ const char *userpwd, const char *proxy)
++{
++ CURLcode result = CURLE_OK;
++
++ res_easy_setopt(curl, CURLOPT_URL, url);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY, proxy);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++ if(result)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++ if(result)
++ goto init_failed;
++#if 0
++ res_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1L);
++ if(result)
++ goto init_failed;
++#endif
++
++ res_easy_setopt(curl, CURLOPT_HEADER, 1L);
++ if(result)
++ goto init_failed;
++
++ return CURLE_OK; /* success */
++
++init_failed:
++ return result; /* failure */
++}
++
++static CURLcode run1588(CURL *curl, const char *url, const char *userpwd,
++ const char *proxy)
++{
++ CURLcode result = CURLE_OK;
++
++ result = init1588(curl, url, userpwd, proxy);
++ if(result)
++ return result;
++
++ return curl_easy_perform(curl);
++}
++
++static CURLcode test_lib1588(const char *URL)
++{
++ CURLcode result = CURLE_OK;
++ CURL *curl = NULL;
++ const char *proxyuserpws = libtest_arg4;
++ struct curl_slist *host = NULL;
++ struct curl_slist *host2 = NULL;
++ char proxy1_resolve[128];
++ char proxy2_resolve[128];
++ char proxy1_connect[128];
++ char proxy2_connect[128];
++
++ if(test_argc < 3)
++ return TEST_ERR_MAJOR_BAD;
++
++ curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
++ "firstproxy:%s:%s", libtest_arg3, libtest_arg2);
++ curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
++ "secondproxy:%s:%s", libtest_arg3, libtest_arg2);
++
++ /* we connect to the fake host name but the right port number */
++ curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
++ "firstproxy:%s", libtest_arg3);
++ curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
++ "secondproxy:%s", libtest_arg3);
++
++ res_global_init(CURL_GLOBAL_ALL);
++ if(result)
++ return result;
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ host = curl_slist_append(NULL, proxy1_resolve);
++ if(!host)
++ goto test_cleanup;
++ host2 = curl_slist_append(host, proxy2_resolve);
++ if(!host2)
++ goto test_cleanup;
++ host = host2;
++
++ start_test_timing();
++
++ easy_setopt(curl, CURLOPT_RESOLVE, host);
++
++ result = run1588(curl, URL, proxyuserpws, proxy1_connect);
++ if(result)
++ goto test_cleanup;
++
++ curl_mfprintf(stderr, "lib1588: now we do the request again\n");
++
++ result = run1588(curl, URL, proxyuserpws, proxy2_connect);
++
++test_cleanup:
++
++ /* proper cleanup sequence - type PB */
++
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++ curl_slist_free_all(host);
++ return result;
++}
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 6ad0daa59d4..bdd6e730199 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -21,6 +21,7 @@ SRC_URI = " \
file://CVE-2026-6253.patch \
file://CVE-2026-6429-dependent.patch \
file://CVE-2026-6429.patch \
+ file://CVE-2026-7168.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 02/36] gawk: Fix CVE-2026-40467
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 01/36] curl: fix CVE-2026-7168 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 03/36] gawk: Fix CVE-2026-40468 Yoann Congal
` (33 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40467
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gawk/gawk/CVE-2026-40467.patch | 62 +++++++++++++++++++
meta/recipes-extended/gawk/gawk_5.4.0.bb | 1 +
2 files changed, 63 insertions(+)
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch
diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch
new file mode 100644
index 00000000000..772172c3737
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40467.patch
@@ -0,0 +1,62 @@
+From 194a2884f21a6fc02c446ca4e2dc9107298832db Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Fri, 3 Apr 2026 12:02:11 +0300
+Subject: [PATCH] Small memory management fix in io.c.
+
+CVE: CVE-2026-40467
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8]
+
+(cherry picked from commit a2d18c74109e41bec29a23098eba2e00057286d8)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ChangeLog | 6 ++++++
+ io.c | 5 ++++-
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index a714ca1a..517aba91 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,9 @@
++2026-04-03 Arnold D. Robbins <arnold@skeeve.com>
++
++ * io.c (do_getline_redir): Don't DEREF redir_exp too early.
++ Thanks to Michał Majchrowicz <mmajchrowicz@afine.com>
++ for the report.
++
+ 2026-02-22 Arnold D. Robbins <arnold@skeeve.com>
+
+ * 5.4.0: Release tar ball made.
+diff --git a/io.c b/io.c
+index a3b877c4..7a547aa1 100644
+--- a/io.c
++++ b/io.c
+@@ -2853,21 +2853,24 @@ do_getline_redir(int into_variable, enum redirval redirtype)
+ redir_exp = TOP();
+ redir_exp = elem_new_to_scalar(redir_exp);
+ rp = redirect(redir_exp, redirtype, & redir_error, false);
+- DEREF(redir_exp);
+ decr_sp();
+ if (rp == NULL) {
+ if (redir_error) { /* failed redirect */
+ update_ERRNO_int(redir_error);
+ }
++ DEREF(redir_exp);
+ return make_number((AWKNUM) -1.0);
+ } else if ((rp->flag & RED_TWOWAY) != 0 && rp->iop == NULL) {
+ if (is_non_fatal_redirect(redir_exp->stptr, redir_exp->stlen)) {
+ update_ERRNO_int(EBADF);
++ DEREF(redir_exp);
+ return make_number((AWKNUM) -1.0);
+ }
+ (void) close_rp(rp, CLOSE_ALL);
++ DEREF(redir_exp); // we're about to die, but what the heck, release it anyway
+ fatal(_("getline: attempt to read from closed read end of two-way pipe"));
+ }
++ DEREF(redir_exp);
+ iop = rp->iop;
+ if (iop == NULL) /* end of input */
+ return make_number((AWKNUM) 0.0);
+--
+2.53.0
+
diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb
index d7211f28f33..59c4cb2536f 100644
--- a/meta/recipes-extended/gawk/gawk_5.4.0.bb
+++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb
@@ -28,6 +28,7 @@ PACKAGECONFIG[pma-if-64bit] = "--enable-pma,--disable-pma, "
SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \
file://run-ptest \
file://0001-configure.ac-re-enable-disabled-printf-features.patch \
+ file://CVE-2026-40467.patch \
"
SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 03/36] gawk: Fix CVE-2026-40468
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 01/36] curl: fix CVE-2026-7168 Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 02/36] gawk: Fix CVE-2026-40467 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 04/36] gawk: Fix CVE-2026-40469 Yoann Congal
` (32 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40468
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gawk/gawk/CVE-2026-40468.patch | 61 +++++++++++++++++++
meta/recipes-extended/gawk/gawk_5.4.0.bb | 1 +
2 files changed, 62 insertions(+)
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch
diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch
new file mode 100644
index 00000000000..6b767c3bead
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40468.patch
@@ -0,0 +1,61 @@
+From 1e0b3ebeb4a39680dcd9c8eeadd8e3bf1c7c6200 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Sat, 4 Apr 2026 21:45:58 +0300
+Subject: [PATCH] Minor integer overflow fixes.
+
+CVE: CVE-2026-40468
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7]
+
+(cherry picked from commit 062f2f2581b991362c046f7f2e238ffa34e6f8c7)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ChangeLog | 8 ++++++++
+ builtin.c | 2 +-
+ node.c | 2 +-
+ 3 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 517aba91..8cdf90f6 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,11 @@
++2026-04-04 Arnold D. Robbins <arnold@skeeve.com>
++
++ * builtin.c (do_sub): Make `sofar' be size_t to avoid
++ integer overflows. Thanks to Michał Majchrowicz
++ <mmajchrowicz@afine.com> for the report.
++ * node.c (parse_escape): Change `i' to int64_t to avoid
++ overflows. Thanks to ASan with gcc -m32.
++
+ 2026-04-03 Arnold D. Robbins <arnold@skeeve.com>
+
+ * io.c (do_getline_redir): Don't DEREF redir_exp too early.
+diff --git a/builtin.c b/builtin.c
+index 6305b541..d0e083da 100644
+--- a/builtin.c
++++ b/builtin.c
+@@ -1806,7 +1806,7 @@ do_sub(int nargs, unsigned int flags)
+ char *repl;
+ char *replend;
+ size_t repllen;
+- int sofar;
++ size_t sofar;
+ int ampersands;
+ int matches = 0;
+ Regexp *rp;
+diff --git a/node.c b/node.c
+index 0e2bfb0f..f1e14dff 100644
+--- a/node.c
++++ b/node.c
+@@ -584,7 +584,7 @@ parse_escape(const char **string_ptr, const char **result, size_t *nbytes)
+ static char buf[MB_LEN_MAX];
+ enum escape_results retval = ESCAPE_OK;
+ int c = *(*string_ptr)++;
+- long i;
++ int64_t i;
+ int count;
+ int j;
+ const char *start;
+--
+2.53.0
+
diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb
index 59c4cb2536f..345103a7f0a 100644
--- a/meta/recipes-extended/gawk/gawk_5.4.0.bb
+++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb
@@ -29,6 +29,7 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \
file://run-ptest \
file://0001-configure.ac-re-enable-disabled-printf-features.patch \
file://CVE-2026-40467.patch \
+ file://CVE-2026-40468.patch \
"
SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 04/36] gawk: Fix CVE-2026-40469
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (2 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 03/36] gawk: Fix CVE-2026-40468 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 05/36] gawk: Fix CVE-2026-40553 Yoann Congal
` (31 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Darsh Kelaiya <dkelaiya@cisco.com>
NVD [3] identifies upstream merge commit [2] as the fix. The
CVE-specific change is its second parent [1], which adds 32-bit
overflow checking in do_sub().
[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=aa7272a6e1184cdd21ab8f89200219abd8053eda
[2] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40469
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gawk/gawk/CVE-2026-40469.patch | 90 +++++++++++++++++++
meta/recipes-extended/gawk/gawk_5.4.0.bb | 1 +
2 files changed, 91 insertions(+)
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch
diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch
new file mode 100644
index 00000000000..73cda824a73
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40469.patch
@@ -0,0 +1,90 @@
+From 436584a4302b1c6da55080c0a0408a98e551ea7e Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Mon, 6 Apr 2026 10:56:38 +0300
+Subject: [PATCH] Add overflow checking in do_sub for 32 bit systems.
+
+CVE: CVE-2026-40469
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=aa7272a6e1184cdd21ab8f89200219abd8053eda]
+
+(cherry picked from commit aa7272a6e1184cdd21ab8f89200219abd8053eda)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ ChangeLog | 9 +++++++++
+ builtin.c | 25 ++++++++++++++++++++-----
+ 2 files changed, 29 insertions(+), 5 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index 8cdf90f6..c1b2e7f4 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,12 @@
++2026-04-06 Arnold D. Robbins <arnold@skeeve.com>
++
++ * builtin.c (do_sub): Check for overflow in calculation of size
++ of result buffer by doing the math in 64 bits. This provides
++ a fatal message on 32 bit systems if overflow happens instead
++ of letting dynamic memory get corrupted and likely causing
++ a core dump. Thanks to Michał Majchrowicz <mmajchrowicz@afine.com>
++ for the report and fix.
++
+ 2026-04-04 Arnold D. Robbins <arnold@skeeve.com>
+
+ * builtin.c (do_sub): Make `sofar' be size_t to avoid
+diff --git a/builtin.c b/builtin.c
+index d0e083da..3906d507 100644
+--- a/builtin.c
++++ b/builtin.c
+@@ -1820,11 +1820,13 @@ do_sub(int nargs, unsigned int flags)
+ bool lastmatchnonzero;
+ char *mb_indices = NULL;
+ int searchflags = RE_NEED_START;
++ const char *fname = NULL; // for fatal message, below
+
+ if ((flags & GENSUB) != 0) {
+ double d;
+ NODE *glob_flag;
+
++ fname = "gensub";
+ check_exact_args(nargs, "gensub", 4);
+
+ tmp = PEEK(3);
+@@ -1856,11 +1858,9 @@ do_sub(int nargs, unsigned int flags)
+ DEREF(glob_flag);
+ searchflags |= RE_NEED_SUB;
+ } else {
+- if ((flags & GSUB) != 0) {
+- check_exact_args(nargs, "gsub", 3);
+- } else {
+- check_exact_args(nargs, "sub", 3);
+- }
++ fname = ((flags & GSUB) != 0) ? "gsub" : "sub";
++
++ check_exact_args(nargs, fname, 3);
+
+ /* take care of regexp early, in case re_update is fatal */
+
+@@ -1976,6 +1976,21 @@ do_sub(int nargs, unsigned int flags)
+ * vary since ampersand is actual text of regexp match.
+ */
+
++ // 4/2026: This overflow check simply provides a fatal
++ // message instead of letting realloc() die later after
++ // a buffer overrun. It simply makes the user experience better,
++ // but does not prevent gawk from dying miserably. I suppose
++ // it's worth the trouble, but just barely.
++
++ /* uint64_t so the product is 64-bit even on 32-bit ILP32 builds */
++ uint64_t repl_contribution =
++ (uint64_t)(unsigned int)ampersands
++ * (uint64_t)(uintptr_t)(matchend - matchstart);
++ if (repl_contribution > (uint64_t)SIZE_MAX
++ || repl_contribution > (uint64_t)SIZE_MAX - (size_t)(matchend - text)
++ - repllen - 1)
++ fatal(_("%s: replacement expansion too large"), fname);
++
+ /*
+ * add 1 to len to handle "empty" case where
+ * matchend == matchstart and we force a match on a single
+--
+2.53.0
+
diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb
index 345103a7f0a..a7c88224ddf 100644
--- a/meta/recipes-extended/gawk/gawk_5.4.0.bb
+++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb
@@ -30,6 +30,7 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \
file://0001-configure.ac-re-enable-disabled-printf-features.patch \
file://CVE-2026-40467.patch \
file://CVE-2026-40468.patch \
+ file://CVE-2026-40469.patch \
"
SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 05/36] gawk: Fix CVE-2026-40553
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (3 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 04/36] gawk: Fix CVE-2026-40469 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 06/36] rsync: Fix CVE-2026-29518 Yoann Congal
` (30 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix as referenced in [3], using the
commit shown in [1]. It also applies the corrective follow-up [2],
which fixes the snprintf() truncation boundary check. Both commits
are included in gawk 5.4.1, identified as the fixed release in [4].
[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843
[2] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=bfa2e4b890a44100a99d26b54af385479528b12e
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40553
[4] https://cert.pl/en/posts/2026/07/CVE-2026-40467/
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gawk/gawk/CVE-2026-40553_p1.patch | 50 +++++++++++++++++++
.../gawk/gawk/CVE-2026-40553_p2.patch | 44 ++++++++++++++++
meta/recipes-extended/gawk/gawk_5.4.0.bb | 2 +
3 files changed, 96 insertions(+)
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch
diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch
new file mode 100644
index 00000000000..81e2efd6b96
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p1.patch
@@ -0,0 +1,50 @@
+From 6e7695c994aa45c0f7e9f8b80aa6f99717bbaf60 Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Wed, 15 Apr 2026 09:39:02 +0300
+Subject: [PATCH] Avoid buffer overflow in extension/readdir.c.
+
+CVE: CVE-2026-40553
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843]
+
+(cherry picked from commit cca0366144336b49aaa7d5d949966ce8e2c70843)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ extension/ChangeLog | 6 ++++++
+ extension/readdir.c | 6 +++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/extension/ChangeLog b/extension/ChangeLog
+index b11e83ac..6f88eb19 100644
+--- a/extension/ChangeLog
++++ b/extension/ChangeLog
+@@ -1,3 +1,9 @@
++2026-04-15 Arnold D. Robbins <arnold@skeeve.com>
++
++ * readdir.c (ftype): Use snprintf() to check for buffer
++ overflow in the file name before calling stat(). Thanks to
++ Marcin Wyczechowski <mwyczechowski@afine.com> for the report.
++
+ 2026-02-22 Arnold D. Robbins <arnold@skeeve.com>
+
+ * 5.4.0: Release tar ball made.
+diff --git a/extension/readdir.c b/extension/readdir.c
+index f876e168..5bbee261 100644
+--- a/extension/readdir.c
++++ b/extension/readdir.c
+@@ -118,8 +118,12 @@ ftype(struct dirent *entry, const char *dirname)
+ #endif
+ char fname[PATH_MAX];
+ struct stat sbuf;
++ int count;
++
++ count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name);
++ if (count > sizeof(fname))
++ return "u"; // buffer overflow. skip stat() call.
+
+- sprintf(fname, "%s/%s", dirname, entry->d_name);
+ if (stat(fname, &sbuf) == 0) {
+ if (S_ISBLK(sbuf.st_mode))
+ return "b";
+--
+2.53.0
+
diff --git a/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch
new file mode 100644
index 00000000000..84bfdc54187
--- /dev/null
+++ b/meta/recipes-extended/gawk/gawk/CVE-2026-40553_p2.patch
@@ -0,0 +1,44 @@
+From a98440e83cb19b042958a179293bd637c400a35b Mon Sep 17 00:00:00 2001
+From: "Arnold D. Robbins" <arnold@skeeve.com>
+Date: Fri, 17 Apr 2026 11:48:19 +0300
+Subject: [PATCH] Small fix in extension/readdir.c.
+
+CVE: CVE-2026-40553
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=bfa2e4b890a44100a99d26b54af385479528b12e]
+
+(cherry picked from commit bfa2e4b890a44100a99d26b54af385479528b12e)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ extension/ChangeLog | 5 +++++
+ extension/readdir.c | 2 +-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/extension/ChangeLog b/extension/ChangeLog
+index 6f88eb19..9fe216e6 100644
+--- a/extension/ChangeLog
++++ b/extension/ChangeLog
+@@ -1,3 +1,8 @@
++2026-04-15 Arnold D. Robbins <arnold@skeeve.com>
++
++ * readdir.c (ftype): Use >= in check of snprintf() return
++ value. Thanks to Andrew Schorr <aschorr@telemetry-investments.com>.
++
+ 2026-04-15 Arnold D. Robbins <arnold@skeeve.com>
+
+ * readdir.c (ftype): Use snprintf() to check for buffer
+diff --git a/extension/readdir.c b/extension/readdir.c
+index 5bbee261..3cb31834 100644
+--- a/extension/readdir.c
++++ b/extension/readdir.c
+@@ -121,7 +121,7 @@ ftype(struct dirent *entry, const char *dirname)
+ int count;
+
+ count = snprintf(fname, sizeof(fname), "%s/%s", dirname, entry->d_name);
+- if (count > sizeof(fname))
++ if (count >= sizeof(fname))
+ return "u"; // buffer overflow. skip stat() call.
+
+ if (stat(fname, &sbuf) == 0) {
+--
+2.53.0
+
diff --git a/meta/recipes-extended/gawk/gawk_5.4.0.bb b/meta/recipes-extended/gawk/gawk_5.4.0.bb
index a7c88224ddf..f44d82b37c5 100644
--- a/meta/recipes-extended/gawk/gawk_5.4.0.bb
+++ b/meta/recipes-extended/gawk/gawk_5.4.0.bb
@@ -31,6 +31,8 @@ SRC_URI = "${GNU_MIRROR}/gawk/gawk-${PV}.tar.xz \
file://CVE-2026-40467.patch \
file://CVE-2026-40468.patch \
file://CVE-2026-40469.patch \
+ file://CVE-2026-40553_p1.patch \
+ file://CVE-2026-40553_p2.patch \
"
SRC_URI[sha256sum] = "3dd430f0cd3b4428c6c3f6afc021b9cd3c1f8c93f7a688dc268ca428a90b4ac1"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 06/36] rsync: Fix CVE-2026-29518
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (4 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 05/36] gawk: Fix CVE-2026-40553 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 07/36] rsync: Fix CVE-2026-43619 Yoann Congal
` (29 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Ashishkumar Parmar <asparmar@cisco.com>
This patch backports the upstream rsync v3.4.3 security fix train for
CVE-2026-29518. The direct CVE fixes are [3] and [4]:
- [3] enables secure_relative_open() for daemon modules running with
"use chroot = no", closing the receiver-side basis-file TOCTOU.
- [4] routes the sender read path through secure_relative_open() from
the trusted module root, closing the matching sender-side TOCTOU.
This patch also carries [1] and [2] from the same upstream v3.4.3
security/update train. These are supporting secure_relative_open()
changes, not standalone direct CVE fixes: [1] uses Linux
openat2(RESOLVE_BENEATH) to preserve the same confinement while allowing
legitimate in-tree symlinks, fixing upstream issue #715; [2] adds the
equivalent FreeBSD/macOS O_RESOLVE_BENEATH path. Debian's
rsync 3.4.1+ds1-5+deb13u3 security update also carries these commits
before the direct CVE-2026-29518 commits.
The upstream fixed release is referenced in [5], and the public CVE
record is referenced in [6]. Individual backported commit links are
also recorded in the embedded patch headers.
[1] https://github.com/RsyncProject/rsync/commit/4fa7156ccdb2ad34b034d18fe2fd6cd79adef8a1
[2] https://github.com/RsyncProject/rsync/commit/7f60ec001a0be63b770707ec8b829524c3809a43
[3] https://github.com/RsyncProject/rsync/commit/f1c24ab03bc85cb2638a569faa60216582fb6c5d
[4] https://github.com/RsyncProject/rsync/commit/859d44fa4f1420775e4ba050337ef32092f2894c
[5] https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
[6] https://www.cve.org/CVERecord?id=CVE-2026-29518
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../rsync/files/CVE-2026-29518_p1.patch | 392 ++++++++++++++++++
.../rsync/files/CVE-2026-29518_p2.patch | 98 +++++
.../rsync/files/CVE-2026-29518_p3.patch | 328 +++++++++++++++
.../rsync/files/CVE-2026-29518_p4.patch | 71 ++++
meta/recipes-devtools/rsync/rsync_3.4.1.bb | 4 +
5 files changed, 893 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch
new file mode 100644
index 00000000000..fcb7b777fe1
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p1.patch
@@ -0,0 +1,392 @@
+From e7b575413b962ac042079a55530577b20c7eee44 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Thu, 30 Apr 2026 08:39:22 +1000
+Subject: [PATCH] syscall: use openat2(RESOLVE_BENEATH) on Linux for
+ secure_relative_open
+
+The CVE fix in commit c35e283 made secure_relative_open() walk every
+component of relpath with O_NOFOLLOW. That blocks every symlink in the
+path, which is stricter than the threat model required: legitimate
+directory symlinks within the destination tree (e.g. when using -K /
+--copy-dirlinks) are also rejected, breaking delta transfers with
+"failed verification -- update discarded". See issue #715.
+
+On Linux 5.6+, openat2(RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS) gives
+us exactly what we want: the kernel rejects any resolution that would
+escape the starting directory (via "..", absolute paths, or symlinks
+pointing outside dirfd) while still following symlinks that resolve
+within it. /proc magic-links are blocked too.
+
+Use openat2 first; fall back to the existing per-component O_NOFOLLOW
+walk on ENOSYS (kernel < 5.6). The lexical "../" checks at the head
+of the function are kept as defense in depth. The Linux gate is
+plain #ifdef __linux__: the runtime ENOSYS fallback covers the only
+case that actually matters (header present + old kernel), and any
+Linux build environment without linux/openat2.h will fail with a
+clear "no such file" error rather than silently disabling the
+protection.
+
+Verified manually that openat2(RESOLVE_BENEATH) blocks all four
+escape patterns (absolute symlink, ../ symlink, lexical .., absolute
+path) while allowing direct and within-tree symlinks. The new
+testsuite/symlink-dirlink-basis.test (taken from PR #864 by Samuel
+Henrique) exercises the issue #715 regression and passes; full
+make check passes 47/47.
+
+Test: testsuite/symlink-dirlink-basis.test (8 scenarios)
+Fixes: https://github.com/RsyncProject/rsync/issues/715
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-29518
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/4fa7156ccdb2ad34b034d18fe2fd6cd79adef8a1]
+
+(cherry picked from commit 4fa7156ccdb2ad34b034d18fe2fd6cd79adef8a1)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ syscall.c | 62 ++++++-
+ testsuite/symlink-dirlink-basis.test | 247 +++++++++++++++++++++++++++
+ 2 files changed, 304 insertions(+), 5 deletions(-)
+ create mode 100755 testsuite/symlink-dirlink-basis.test
+
+diff --git a/syscall.c b/syscall.c
+index 34a9bba0..d66c9fdd 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -33,6 +33,11 @@
+ #include <sys/syscall.h>
+ #endif
+
++#ifdef __linux__
++#include <sys/syscall.h>
++#include <linux/openat2.h>
++#endif
++
+ #include "ifuncs.h"
+
+ extern int dry_run;
+@@ -715,12 +720,49 @@ int do_open_nofollow(const char *pathname, int flags)
+ /*
+ open a file relative to a base directory. The basedir can be NULL,
+ in which case the current working directory is used. The relpath
+- must be a relative path, and the relpath must not contain any
+- elements in the path which follow symlinks (ie. like O_NOFOLLOW, but
+- applies to all path components, not just the last component)
+-
+- The relpath must also not contain any ../ elements in the path
++ must be a relative path. The kernel must guarantee that resolution
++ cannot escape basedir (or the cwd, when basedir is NULL): no ".."
++ jumps above the start, no symlinks pointing outside, no absolute
++ paths, no /proc magic-link tricks.
++
++ Symlinks *within* basedir are followed normally — earlier rsync
++ versions rejected every symlink with O_NOFOLLOW on each component,
++ which broke legitimate directory symlinks on the receiver side
++ (https://github.com/RsyncProject/rsync/issues/715). The escape
++ prevention is handled by the kernel via openat2(RESOLVE_BENEATH)
++ on Linux 5.6+; older systems fall back to the per-component
++ O_NOFOLLOW walk below.
++
++ The relpath must also not contain any ../ elements in the path.
+ */
++
++#ifdef __linux__
++static int secure_relative_open_linux(const char *basedir, const char *relpath, int flags, mode_t mode)
++{
++ struct open_how how;
++ int dirfd, retfd;
++
++ memset(&how, 0, sizeof how);
++ how.flags = flags;
++ how.mode = mode;
++ how.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS;
++
++ if (basedir == NULL) {
++ dirfd = AT_FDCWD;
++ } else {
++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
++ if (dirfd == -1)
++ return -1;
++ }
++
++ retfd = syscall(SYS_openat2, dirfd, relpath, &how, sizeof how);
++
++ if (dirfd != AT_FDCWD)
++ close(dirfd);
++ return retfd;
++}
++#endif
++
+ int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
+ {
+ if (!relpath || relpath[0] == '/') {
+@@ -734,6 +776,16 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ return -1;
+ }
+
++#ifdef __linux__
++ {
++ int fd = secure_relative_open_linux(basedir, relpath, flags, mode);
++ /* ENOSYS = kernel < 5.6 doesn't have the syscall even though
++ * glibc/kernel-headers do; fall through to the portable path. */
++ if (fd != -1 || errno != ENOSYS)
++ return fd;
++ }
++#endif
++
+ #if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY) || !defined(AT_FDCWD)
+ // really old system, all we can do is live with the risks
+ if (!basedir) {
+diff --git a/testsuite/symlink-dirlink-basis.test b/testsuite/symlink-dirlink-basis.test
+new file mode 100755
+index 00000000..9065dd81
+--- /dev/null
++++ b/testsuite/symlink-dirlink-basis.test
+@@ -0,0 +1,247 @@
++#!/bin/sh
++
++# Test that updating a file through a directory symlink works when using
++# -K (--copy-dirlinks). This is a regression test for:
++# https://github.com/RsyncProject/rsync/issues/715
++#
++# The CVE fix in commit c35e283 introduced secure_relative_open() which
++# uses O_NOFOLLOW on all path components, breaking legitimate directory
++# symlinks on the receiver side. The fix splits the path into basedir
++# (dirname, symlinks followed) and basename (O_NOFOLLOW) so that
++# directory symlinks are traversed while the final file component is
++# still protected.
++#
++# The regression only manifests when delta matching is triggered (i.e.,
++# the sender finds matching blocks in the old file). Small files with
++# completely different content are transferred in full and don't trigger
++# the bug. We use a large file with a small modification to ensure
++# delta transfer is used.
++#
++# In addition to the original regression, this test covers edge cases
++# in the fix itself:
++# - --backup with directory symlinks (finish_transfer pointer identity)
++# - --partial-dir with protocol < 29 (fnamecmp != partialptr guard)
++# - --inplace with directory symlinks (updating_basis_or_equiv check)
++# - Files without a dirname (top-level files, no split needed)
++
++. "$suitedir/rsync.fns"
++
++RSYNC_RSH="$scratchdir/src/support/lsh.sh"
++export RSYNC_RSH
++
++# $HOME is set to $scratchdir by rsync.fns
++# localhost: destination will cd to $HOME (i.e., $scratchdir)
++
++# Helper: create a large file suitable for delta transfers.
++# ~32KB is large enough for rsync's block matching to find matches.
++make_testfile() {
++ dd if=/dev/urandom of="$1" bs=1024 count=32 2>/dev/null \
++ || test_fail "failed to create test file $1"
++}
++
++# Set up source tree
++srcbase="$tmpdir/src"
++
++######################################################################
++# Test 1: Basic directory symlink update (the original issue #715)
++######################################################################
++
++mkdir -p "$HOME/real-dir"
++ln -s real-dir "$HOME/dir"
++
++mkdir -p "$srcbase/dir"
++make_testfile "$srcbase/dir/file"
++
++# First transfer (initial): should create the file through the symlink
++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 1: initial transfer failed"
++
++if [ ! -f "$HOME/real-dir/file" ]; then
++ test_fail "test 1: initial transfer did not create file through symlink"
++fi
++
++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \
++ || test_fail "test 1: initial transfer content mismatch"
++
++# Small modification to trigger delta transfer
++echo "appended update" >> "$srcbase/dir/file"
++sleep 1
++touch "$srcbase/dir/file"
++
++# Second transfer (update): was failing with "failed verification"
++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 1: update through directory symlink failed"
++
++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \
++ || test_fail "test 1: update transfer content mismatch"
++
++######################################################################
++# Test 2: Compression (-z) as in the original reproducer
++######################################################################
++
++echo "another line" >> "$srcbase/dir/file"
++sleep 1
++touch "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptzv --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 2: compressed update through directory symlink failed"
++
++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \
++ || test_fail "test 2: compressed update content mismatch"
++
++######################################################################
++# Test 3: Nested directory symlinks (nested/sub/data.txt where
++# "nested" is a symlink to "nested_real")
++######################################################################
++
++mkdir -p "$HOME/nested_real/sub"
++ln -s nested_real "$HOME/nested"
++
++mkdir -p "$srcbase/nested/sub"
++make_testfile "$srcbase/nested/sub/data.txt"
++
++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" nested/sub/data.txt localhost:) \
++ || test_fail "test 3: initial nested transfer failed"
++
++echo "appended nested" >> "$srcbase/nested/sub/data.txt"
++sleep 1
++touch "$srcbase/nested/sub/data.txt"
++
++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" nested/sub/data.txt localhost:) \
++ || test_fail "test 3: update through nested directory symlink failed"
++
++diff "$srcbase/nested/sub/data.txt" "$HOME/nested_real/sub/data.txt" >/dev/null \
++ || test_fail "test 3: nested update content mismatch"
++
++######################################################################
++# Test 4: --backup with directory symlinks
++#
++# Exercises the finish_transfer() "fnamecmp == fname" pointer
++# comparison that determines whether to update fnamecmp to the
++# backup name. If broken, --backup would reference a renamed file
++# for xattr handling.
++######################################################################
++
++# Reset destination
++rm -f "$HOME/real-dir/file" "$HOME/real-dir/file~"
++
++make_testfile "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 4: initial transfer for backup test failed"
++
++echo "backup update" >> "$srcbase/dir/file"
++sleep 1
++touch "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --backup --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 4: update with --backup through directory symlink failed"
++
++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \
++ || test_fail "test 4: backup update content mismatch"
++
++if [ ! -f "$HOME/real-dir/file~" ]; then
++ test_fail "test 4: backup file was not created"
++fi
++
++######################################################################
++# Test 5: --inplace with directory symlinks
++#
++# Exercises the updating_basis_or_equiv check which uses
++# "fnamecmp == fname". With --inplace, rsync writes directly to
++# the destination file instead of a temp file.
++######################################################################
++
++rm -f "$HOME/real-dir/file" "$HOME/real-dir/file~"
++
++make_testfile "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --inplace --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 5: initial inplace transfer failed"
++
++echo "inplace update" >> "$srcbase/dir/file"
++sleep 1
++touch "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --inplace --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 5: inplace update through directory symlink failed"
++
++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \
++ || test_fail "test 5: inplace update content mismatch"
++
++######################################################################
++# Test 6: Top-level file (no dirname, no split needed)
++#
++# Ensures the dirname/basename split is not attempted for files
++# at the top level (file->dirname is NULL).
++######################################################################
++
++make_testfile "$srcbase/topfile"
++mkdir -p "$HOME"
++
++(cd "$srcbase" && $RSYNC -Rlptv --rsync-path="$RSYNC" topfile localhost:) \
++ || test_fail "test 6: initial top-level transfer failed"
++
++echo "toplevel update" >> "$srcbase/topfile"
++sleep 1
++touch "$srcbase/topfile"
++
++(cd "$srcbase" && $RSYNC -Rlptv --rsync-path="$RSYNC" topfile localhost:) \
++ || test_fail "test 6: top-level update failed"
++
++diff "$srcbase/topfile" "$HOME/topfile" >/dev/null \
++ || test_fail "test 6: top-level update content mismatch"
++
++######################################################################
++# Test 7: --partial-dir with protocol < 29
++#
++# For protocol < 29, fnamecmp_type stays FNAMECMP_FNAME even when
++# fnamecmp is set to partialptr. The dirname/basename split must
++# NOT trigger in this case (guarded by "fnamecmp == fname").
++######################################################################
++
++rm -f "$HOME/real-dir/file"
++make_testfile "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 --partial-dir=.rsync-partial \
++ --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 7: initial proto28 partial-dir transfer failed"
++
++echo "partial-dir update" >> "$srcbase/dir/file"
++sleep 1
++touch "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 --partial-dir=.rsync-partial \
++ --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 7: proto28 partial-dir update through dirlink failed"
++
++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \
++ || test_fail "test 7: proto28 partial-dir update content mismatch"
++
++######################################################################
++# Test 8: Protocol < 29 basic directory symlink update
++#
++# Exercises the protocol < 29 code path and its fallback logic
++# (clearing basedir on retry).
++######################################################################
++
++rm -f "$HOME/real-dir/file"
++make_testfile "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 \
++ --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 8: initial proto28 transfer failed"
++
++echo "proto28 update" >> "$srcbase/dir/file"
++sleep 1
++touch "$srcbase/dir/file"
++
++(cd "$srcbase" && $RSYNC -KRlptv --protocol=28 \
++ --rsync-path="$RSYNC" dir/file localhost:) \
++ || test_fail "test 8: proto28 update through directory symlink failed"
++
++diff "$srcbase/dir/file" "$HOME/real-dir/file" >/dev/null \
++ || test_fail "test 8: proto28 update content mismatch"
++
++# The script would have aborted on error, so getting here means we've won.
++exit 0
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch
new file mode 100644
index 00000000000..661f23db765
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p2.patch
@@ -0,0 +1,98 @@
+From 0675997f170b6463dd20306ee97e346e79196335 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Thu, 30 Apr 2026 08:44:11 +1000
+Subject: [PATCH] syscall: also use O_RESOLVE_BENEATH on FreeBSD and MacOS
+
+FreeBSD and MacOS have O_RESOLVE_BENEATH as an openat() flag with the same
+"must not escape dirfd" semantics as Linux's RESOLVE_BENEATH. The
+kernel rejects ".." escapes, absolute symlinks, and symlinks whose
+target lies outside dirfd, while still following symlinks that
+resolve within it -- the same trade-off that fixes issue #715 on
+Linux.
+
+Add a parallel BSD path in secure_relative_open(), gated on
+declared. Unlike Linux, BSD doesn't have the header/runtime split
+where the symbol can exist without kernel support, so no runtime
+fallback is needed: if the flag compiles in, the kernel honours it.
+
+OpenBSD and NetBSD have no equivalent kernel primitive and continue
+to use the existing per-component O_NOFOLLOW walk; issue #715
+remains visible on those platforms (a userland resolver or
+unveil(2)-based fence would be follow-up work).
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-29518
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/7f60ec001a0be63b770707ec8b829524c3809a43]
+
+(cherry picked from commit 7f60ec001a0be63b770707ec8b829524c3809a43)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ syscall.c | 40 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 37 insertions(+), 3 deletions(-)
+
+diff --git a/syscall.c b/syscall.c
+index d66c9fdd..9033196f 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -729,9 +729,13 @@ int do_open_nofollow(const char *pathname, int flags)
+ versions rejected every symlink with O_NOFOLLOW on each component,
+ which broke legitimate directory symlinks on the receiver side
+ (https://github.com/RsyncProject/rsync/issues/715). The escape
+- prevention is handled by the kernel via openat2(RESOLVE_BENEATH)
+- on Linux 5.6+; older systems fall back to the per-component
+- O_NOFOLLOW walk below.
++ prevention is handled by:
++ Linux 5.6+: openat2(RESOLVE_BENEATH)
++ FreeBSD 13+: openat() with O_RESOLVE_BENEATH
++ macOS 15+ / iOS 18+: openat() with O_RESOLVE_BENEATH (same
++ flag name, picked up by the same #ifdef;
++ flag value differs from FreeBSD)
++ Other systems fall back to the per-component O_NOFOLLOW walk below.
+
+ The relpath must also not contain any ../ elements in the path.
+ */
+@@ -763,6 +767,32 @@ static int secure_relative_open_linux(const char *basedir, const char *relpath,
+ }
+ #endif
+
++#ifdef O_RESOLVE_BENEATH
++/* FreeBSD 13+ and macOS 15+ (Sequoia) / iOS 18+: O_RESOLVE_BENEATH is
++ * an openat() flag with the same "must not escape dirfd" semantics as
++ * Linux's RESOLVE_BENEATH. The kernel rejects ".." escapes, absolute
++ * symlinks, and symlinks whose target lies outside dirfd. (FreeBSD and
++ * Apple use different flag bit values, but the same symbolic name.) */
++static int secure_relative_open_resolve_beneath(const char *basedir, const char *relpath, int flags, mode_t mode)
++{
++ int dirfd, retfd;
++
++ if (basedir == NULL) {
++ dirfd = AT_FDCWD;
++ } else {
++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
++ if (dirfd == -1)
++ return -1;
++ }
++
++ retfd = openat(dirfd, relpath, flags | O_RESOLVE_BENEATH, mode);
++
++ if (dirfd != AT_FDCWD)
++ close(dirfd);
++ return retfd;
++}
++#endif
++
+ int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
+ {
+ if (!relpath || relpath[0] == '/') {
+@@ -786,6 +816,10 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ }
+ #endif
+
++#ifdef O_RESOLVE_BENEATH
++ return secure_relative_open_resolve_beneath(basedir, relpath, flags, mode);
++#endif
++
+ #if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY) || !defined(AT_FDCWD)
+ // really old system, all we can do is live with the risks
+ if (!basedir) {
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch
new file mode 100644
index 00000000000..9c138b5437e
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p3.patch
@@ -0,0 +1,328 @@
+From edfd5b913c9afdb0f340cf8135544399206f6e62 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Wed, 31 Dec 2025 10:01:23 +1100
+Subject: [PATCH] syscall+clientserver: am_chrooted and use_secure_symlinks for
+ daemon-no-chroot (CVE-2026-29518)
+
+CVE-2026-29518: an rsync daemon configured with "use chroot = no"
+is exposed to a TOCTOU race on parent path components. A local
+attacker with write access to a module can replace a parent
+directory component with a symlink between the receiver's check
+and its open(), redirecting reads (basis-file disclosure) and
+writes (file overwrite) outside the module. Under elevated daemon
+privilege this allows privilege escalation. Default
+"use chroot = yes" is not exposed.
+
+Add secure_relative_open() in syscall.c. It walks the parent
+components under RESOLVE_BENEATH (Linux 5.6+) /
+O_RESOLVE_BENEATH (FreeBSD 13+, macOS 15+) / per-component
+O_NOFOLLOW elsewhere, anchored at a trusted dirfd, so a parent-
+symlink swap is rejected by the kernel. Route the receiver's
+basis-file open in receiver.c through it when use_secure_symlinks
+is set in clientserver.c rsync_module().
+
+Reporters: Nullx3D (Batuhan SANCAK); Damien Neil; Michael Stapelberg.
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-29518
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/f1c24ab03bc85cb2638a569faa60216582fb6c5d]
+
+(cherry picked from commit f1c24ab03bc85cb2638a569faa60216582fb6c5d)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ clientserver.c | 25 +++++++++
+ options.c | 9 ++++
+ receiver.c | 22 ++++++--
+ syscall.c | 139 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 192 insertions(+), 3 deletions(-)
+
+diff --git a/clientserver.c b/clientserver.c
+index 7c897abc..b6eba098 100644
+--- a/clientserver.c
++++ b/clientserver.c
+@@ -30,6 +30,7 @@ extern int list_only;
+ extern int am_sender;
+ extern int am_server;
+ extern int am_daemon;
++extern int am_chrooted;
+ extern int am_root;
+ extern int msgs2stderr;
+ extern int rsync_port;
+@@ -38,6 +39,7 @@ extern int ignore_errors;
+ extern int preserve_xattrs;
+ extern int kluge_around_eof;
+ extern int munge_symlinks;
++extern int use_secure_symlinks;
+ extern int open_noatime;
+ extern int sanitize_paths;
+ extern int numeric_ids;
+@@ -981,6 +983,7 @@ static int rsync_module(int f_in, int f_out, int i, const char *addr, const char
+ io_printf(f_out, "@ERROR: chroot failed\n");
+ return -1;
+ }
++ am_chrooted = 1;
+ module_chdir = module_dir;
+ }
+
+@@ -1003,6 +1006,15 @@ static int rsync_module(int f_in, int f_out, int i, const char *addr, const char
+ }
+ }
+
++ /* Enable secure symlink handling for any non-chrooted daemon module.
++ * This prevents TOCTOU race attacks where an attacker could switch a
++ * directory to a symlink between path validation and file open.
++ * Match the gate used by the do_*_at() wrappers in syscall.c
++ * (am_daemon && !am_chrooted) -- the protection has nothing to do
++ * with symlink munging, so a module configured with
++ * "munge symlinks = false" must still get the secure-open path. */
++ use_secure_symlinks = am_daemon && !am_chrooted;
++
+ if (gid_list.count) {
+ gid_t *gid_array = gid_list.items;
+ if (setgid(gid_array[0])) {
+@@ -1305,6 +1317,19 @@ int start_daemon(int f_in, int f_out)
+ rsyserr(FLOG, errno, "daemon chroot(\"%s\") failed", p);
+ return -1;
+ }
++ /* Deliberately do NOT set am_chrooted here. am_chrooted
++ * gates the per-module symlink-race defenses
++ * (secure_relative_open() and the do_*_at() wrappers in
++ * syscall.c) and means "the kernel is enforcing path
++ * confinement at the module boundary". The daemon chroot
++ * confines path resolution to the daemon-chroot directory,
++ * not to any individual module path -- modules sharing the
++ * daemon chroot are still distinguishable filesystem
++ * subtrees and a sender-controlled symlink in module A
++ * could redirect a syscall to module B (or to other files
++ * inside the daemon chroot) without the per-module
++ * defenses. Leave am_chrooted=0 here so secure_relative_open()
++ * still fires for "use chroot = no" modules. */
+ if (chdir("/") < 0) {
+ rsyserr(FLOG, errno, "daemon chdir(\"/\") failed");
+ return -1;
+diff --git a/options.c b/options.c
+index 578507c6..87c91376 100644
+--- a/options.c
++++ b/options.c
+@@ -113,11 +113,20 @@ int mkpath_dest_arg = 0;
+ int allow_inc_recurse = 1;
+ int xfer_dirs = -1;
+ int am_daemon = 0;
++/* Set after a successful per-module chroot ("use chroot = yes") in
++ * clientserver.c. NOT set for the daemon-level "daemon chroot = /X"
++ * chroot: that confines path resolution to /X, but module paths
++ * /X/modA, /X/modB, etc. are not chroot boundaries, so the per-module
++ * symlink-race defenses (secure_relative_open() / do_*_at() in
++ * syscall.c, gated by `am_daemon && !am_chrooted`) must still fire
++ * even when the daemon is inside a daemon chroot. */
++int am_chrooted = 0;
+ int connect_timeout = 0;
+ int keep_partial = 0;
+ int safe_symlinks = 0;
+ int copy_unsafe_links = 0;
+ int munge_symlinks = 0;
++int use_secure_symlinks = 0;
+ int size_only = 0;
+ int daemon_bwlimit = 0;
+ int bwlimit = 0;
+diff --git a/receiver.c b/receiver.c
+index edfbb210..5a2c8c5a 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -70,6 +70,7 @@ extern int fuzzy_basis;
+
+ extern struct name_num_item *xfer_sum_nni;
+ extern int xfer_sum_len;
++extern int use_secure_symlinks;
+
+ static struct bitbag *delayed_bits = NULL;
+ static int phase = 0, redoing = 0;
+@@ -214,7 +215,12 @@ int open_tmpfile(char *fnametmp, const char *fname, struct file_struct *file)
+ * access to ensure that there is no race condition. They will be
+ * correctly updated after the right owner and group info is set.
+ * (Thanks to snabb@epipe.fi for pointing this out.) */
+- fd = do_mkstemp(fnametmp, (file->mode|added_perms) & INITACCESSPERMS);
++ /* When use_secure_symlinks is on (non-chroot daemon with munge_symlinks),
++ * use secure_mkstemp to prevent symlink race attacks on parent directories. */
++ if (use_secure_symlinks)
++ fd = secure_mkstemp(fnametmp, (file->mode|added_perms) & INITACCESSPERMS);
++ else
++ fd = do_mkstemp(fnametmp, (file->mode|added_perms) & INITACCESSPERMS);
+
+ #if 0
+ /* In most cases parent directories will already exist because their
+@@ -854,11 +860,21 @@ int recv_files(int f_in, int f_out, char *local_name)
+ /* We now check to see if we are writing the file "inplace" */
+ if (inplace || one_inplace) {
+ fnametmp = one_inplace ? partialptr : fname;
+- fd2 = do_open(fnametmp, O_WRONLY|O_CREAT, 0600);
++ /* When use_secure_symlinks is on (non-chroot daemon),
++ * use secure open to prevent symlink race attacks where an
++ * attacker could switch a directory to a symlink between
++ * path validation and file open. */
++ if (use_secure_symlinks)
++ fd2 = secure_relative_open(NULL, fnametmp, O_WRONLY|O_CREAT, 0600);
++ else
++ fd2 = do_open(fnametmp, O_WRONLY|O_CREAT, 0600);
+ #ifdef linux
+ if (fd2 == -1 && errno == EACCES) {
+ /* Maybe the error was due to protected_regular setting? */
+- fd2 = do_open(fname, O_WRONLY, 0600);
++ if (use_secure_symlinks)
++ fd2 = secure_relative_open(NULL, fname, O_WRONLY, 0600);
++ else
++ fd2 = do_open(fname, O_WRONLY, 0600);
+ }
+ #endif
+ if (fd2 == -1) {
+diff --git a/syscall.c b/syscall.c
+index 9033196f..dcecda1a 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -877,6 +877,145 @@ cleanup:
+ #endif // O_NOFOLLOW, O_DIRECTORY
+ }
+
++/* Fill buf with len random bytes. Prefers /dev/urandom for cryptographic
++ * quality; falls back to rand() if /dev/urandom cannot be opened or read
++ * (e.g. inside a chroot or container without /dev populated). */
++static void rand_bytes(unsigned char *buf, size_t len)
++{
++#ifndef O_CLOEXEC
++#define O_CLOEXEC 0
++#endif
++ int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
++ if (fd >= 0) {
++ ssize_t n = read(fd, buf, len);
++ close(fd);
++ if (n == (ssize_t)len) {
++ return;
++ }
++ }
++ for (size_t i = 0; i < len; i++) {
++ buf[i] = (unsigned char)rand();
++ }
++}
++
++/*
++ Secure version of mkstemp that prevents symlink attacks on parent directories.
++ Like secure_relative_open(), this walks the path checking each component
++ with O_NOFOLLOW to prevent TOCTOU race conditions.
++
++ The template may be relative or absolute, but must not contain ../ components.
++ Returns fd on success, -1 on error.
++*/
++int secure_mkstemp(char *template, mode_t perms)
++{
++#if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY) || !defined(AT_FDCWD)
++ /* Fall back to regular mkstemp on old systems */
++ return do_mkstemp(template, perms);
++#else
++ char *lastslash;
++ int dirfd = AT_FDCWD;
++ int fd = -1;
++
++ if (!template) {
++ errno = EINVAL;
++ return -1;
++ }
++ if (strncmp(template, "../", 3) == 0 || strstr(template, "/../")) {
++ errno = EINVAL;
++ return -1;
++ }
++
++ /* For absolute paths, start the secure walk from "/" rather than CWD. */
++ if (template[0] == '/') {
++ dirfd = open("/", O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
++ if (dirfd < 0)
++ return -1;
++ }
++
++ /* Find the last slash to separate directory from filename */
++ lastslash = strrchr(template, '/');
++ if (lastslash) {
++ char *path_copy = my_strdup(template, __FILE__, __LINE__);
++ if (!path_copy)
++ return -1;
++
++ /* Null-terminate at the last slash to get directory part */
++ path_copy[lastslash - template] = '\0';
++
++ /* Walk the directory path securely */
++ for (const char *part = strtok(path_copy, "/");
++ part != NULL;
++ part = strtok(NULL, "/"))
++ {
++ int next_fd = openat(dirfd, part, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
++ if (next_fd == -1) {
++ int save_errno = errno;
++ free(path_copy);
++ if (dirfd != AT_FDCWD) close(dirfd);
++ errno = (save_errno == ELOOP) ? ELOOP : save_errno;
++ return -1;
++ }
++ if (dirfd != AT_FDCWD) close(dirfd);
++ dirfd = next_fd;
++ }
++ free(path_copy);
++ }
++
++ /* Now create the temp file in the securely-opened directory */
++ perms |= S_IWUSR;
++
++ /* Generate unique filename - we need to modify the template in place */
++ char *filename = lastslash ? lastslash + 1 : template;
++ size_t filename_len = strlen(filename);
++
++ if (filename_len < 6) {
++ if (dirfd != AT_FDCWD) close(dirfd);
++ errno = EINVAL;
++ return -1;
++ }
++ char *suffix = filename + filename_len - 6; /* Points to XXXXXX */
++ if (strcmp(suffix, "XXXXXX") != 0) {
++ if (dirfd != AT_FDCWD) close(dirfd);
++ errno = EINVAL;
++ return -1;
++ }
++
++ /* Try random suffixes until we find one that works */
++ static const char letters[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
++ for (int tries = 0; tries < 100; tries++) {
++ unsigned char rbytes[6];
++ rand_bytes(rbytes, sizeof(rbytes));
++ for (int i = 0; i < 6; i++)
++ suffix[i] = letters[rbytes[i] % (sizeof(letters) - 1)];
++
++ fd = openat(dirfd, filename, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, perms);
++ if (fd >= 0)
++ break;
++ if (errno != EEXIST) {
++ if (dirfd != AT_FDCWD) close(dirfd);
++ return -1;
++ }
++ }
++
++ if (fd >= 0) {
++ if (fchmod(fd, perms) != 0 && preserve_perms) {
++ int errno_save = errno;
++ close(fd);
++ unlinkat(dirfd, filename, 0);
++ if (dirfd != AT_FDCWD) close(dirfd);
++ errno = errno_save;
++ return -1;
++ }
++#if defined HAVE_SETMODE && O_BINARY
++ setmode(fd, O_BINARY);
++#endif
++ }
++
++ if (dirfd != AT_FDCWD) close(dirfd);
++ return fd;
++#endif
++}
++
+ /*
+ varient of do_open/do_open_nofollow which does do_open() if the
+ copy_links or copy_unsafe_links options are set and does
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch
new file mode 100644
index 00000000000..ba9ef808b4e
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-29518_p4.patch
@@ -0,0 +1,71 @@
+From 302e3116633ed953e0c1cc2d6878d7a22b6bf9b8 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sun, 1 Mar 2026 09:28:40 +1100
+Subject: [PATCH] sender: fix read-path TOCTOU by opening from module root
+ (CVE-2026-29518)
+
+The sender's file open was vulnerable to the same TOCTOU symlink
+race as the receiver-side basis-file open. change_pathname() calls
+chdir() into subdirectories, which follows symlinks; an attacker
+could race to swap a directory for a symlink between the chdir and
+the file open, allowing reads of privileged files through the
+daemon.
+
+Reconstruct the full relative path (F_PATHNAME + fname) and open
+via secure_relative_open() from the trusted module_dir, which
+walks each path component without following symlinks. This is
+independent of CWD, so the chdir race is neutralised.
+
+CVE-2026-29518.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+
+CVE: CVE-2026-29518
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/859d44fa4f1420775e4ba050337ef32092f2894c]
+
+(cherry picked from commit 859d44fa4f1420775e4ba050337ef32092f2894c)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ sender.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/sender.c b/sender.c
+index b1588b70..99f431fe 100644
+--- a/sender.c
++++ b/sender.c
+@@ -48,6 +48,8 @@ extern int make_backups;
+ extern int inplace;
+ extern int inplace_partial;
+ extern int batch_fd;
++extern int use_secure_symlinks;
++extern char *module_dir;
+ extern int write_batch;
+ extern int file_old_total;
+ extern BOOL want_progress_now;
+@@ -352,7 +354,25 @@ void send_files(int f_in, int f_out)
+ exit_cleanup(RERR_PROTOCOL);
+ }
+
+- fd = do_open_checklinks(fname);
++ if (use_secure_symlinks) {
++ /* Open from module root to prevent TOCTOU race where
++ * change_pathname's chdir follows a directory symlink.
++ * Reconstruct the full path relative to module_dir
++ * from F_PATHNAME (path) and f_name (fname). */
++ char secure_path[MAXPATHLEN];
++ int slen = snprintf(secure_path, sizeof secure_path, "%s%s%s", path, slash, fname);
++ if (slen >= (int)sizeof secure_path) {
++ io_error |= IOERR_GENERAL;
++ rprintf(FERROR_XFER, "path too long: %s%s%s\n", path, slash, fname);
++ free_sums(s);
++ if (protocol_version >= 30)
++ send_msg_int(MSG_NO_SEND, ndx);
++ continue;
++ }
++ fd = secure_relative_open(module_dir, secure_path, O_RDONLY, 0);
++ } else {
++ fd = do_open_checklinks(fname);
++ }
+ if (fd == -1) {
+ if (errno == ENOENT) {
+ enum logcode c = am_daemon && protocol_version < 28 ? FERROR : FWARNING;
diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
index 509be486b87..e2fe0128d53 100644
--- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
@@ -16,6 +16,10 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://determism.patch \
file://0001-Add-missing-prototypes-to-function-declarations.patch \
file://CVE-2025-10158.patch \
+ file://CVE-2026-29518_p1.patch \
+ file://CVE-2026-29518_p2.patch \
+ file://CVE-2026-29518_p3.patch \
+ file://CVE-2026-29518_p4.patch \
"
SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 07/36] rsync: Fix CVE-2026-43619
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (5 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 06/36] rsync: Fix CVE-2026-29518 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 08/36] rsync: Fix CVE-2026-43618 Yoann Congal
` (28 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Ashishkumar Parmar <asparmar@cisco.com>
This patch backports the upstream rsync v3.4.3 symlink-race fix chain
for CVE-2026-43619. The upstream NEWS entry describes this CVE as
symlink races on path-based system calls in "use chroot = no" daemon
mode, generalizing CVE-2026-29518 beyond the receiver's open() path.
The backported commits form the following linear upstream chain:
- [1] closes the receiver-side do_chmod() path.
- [2] closes the daemon-no-chroot change_dir() escape.
- [3] adds the remaining symlink-race-safe do_*_at() wrappers and
migrates the affected path-based syscall users.
- [4] closes adjacent bare-path copy/open surfaces. Upstream titles this
commit "defence-in-depth", but it is in the same linear v3.4.3
symlink-race fix chain and Debian's rsync 3.4.1+ds1-5+deb13u3
security update carries it as part of the CVE-2026-43619 patch train.
The v3.4.3 security train also has portability and functional follow-ups
that were released in v3.4.4, so this CVE-scoped backport includes them
under CVE-2026-43619:
- [5] adds the mknodat()/mkfifoat() configure fallback used by the new
do_mknod_at() path.
- [6] gates <linux/openat2.h> and openat2() use behind configure/runtime
checks so systems without the header or usable syscall fall back safely.
The upstream fixed security release is referenced in [7], the v3.4.4
follow-up release is referenced in [8], and the public advisory is
referenced in [9]. The Debian tracker entry is referenced in [10].
Individual backported commit links are also recorded in the embedded
patch headers.
[1] https://github.com/RsyncProject/rsync/commit/862fe4eeaf82178324c66e504bf2c6c2e4038f99
[2] https://github.com/RsyncProject/rsync/commit/15d296425609a997f56eb8f9017ff73922f99b20
[3] https://github.com/RsyncProject/rsync/commit/30656c5e358b1c6033f4caf24f3e11b29d25c9f4
[4] https://github.com/RsyncProject/rsync/commit/3cc6a9e8cdcffb637ecdd41dae47833096dca317
[5] https://github.com/RsyncProject/rsync/commit/f3757a470ad3defdb2c4c6ad334e3839f3c7f1ae
[6] https://github.com/RsyncProject/rsync/commit/c14e2258b59a3f16a99c6e83a28660ba438a73e9
[7] https://github.com/RsyncProject/rsync/releases/tag/v3.4.3
[8] https://github.com/RsyncProject/rsync/releases/tag/v3.4.4
[9] https://github.com/RsyncProject/rsync/security/advisories/GHSA-4h9m-w5ff-j735
[10] https://security-tracker.debian.org/tracker/CVE-2026-43619
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../rsync/files/CVE-2026-43619_p1.patch | 471 +++++
.../rsync/files/CVE-2026-43619_p2.patch | 205 ++
.../rsync/files/CVE-2026-43619_p3.patch | 1783 +++++++++++++++++
.../rsync/files/CVE-2026-43619_p4.patch | 568 ++++++
.../rsync/files/CVE-2026-43619_p5.patch | 69 +
.../rsync/files/CVE-2026-43619_p6.patch | 258 +++
meta/recipes-devtools/rsync/rsync_3.4.1.bb | 6 +
7 files changed, 3360 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch
new file mode 100644
index 00000000000..b1556e51fa4
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p1.patch
@@ -0,0 +1,471 @@
+From e406eb555ea1fadb7c0dd8ddef3fde1b92771aa7 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Mon, 4 May 2026 21:53:14 +1000
+Subject: [PATCH] syscall+receiver: secure receiver-side do_chmod against
+ symlink-race TOCTOU
+
+CVE-2026-29518's fix routed the receiver's open() through
+secure_relative_open(), but every other path-based syscall the
+receiver runs on sender-controllable paths is vulnerable to the
+same TOCTOU primitive. This commit closes the chmod variant.
+
+Add do_chmod_at() that opens the parent of fname under
+secure_relative_open() and uses fchmodat() against the resulting
+dirfd. Gate the secure path on am_daemon && !am_chrooted (the same
+gate use_secure_symlinks already uses for the receiver basis-file
+open), so non-daemon callers and chrooted daemons keep the original
+do_chmod() fast path.
+
+Migrate the receiver-side do_chmod() call sites in delete.c,
+generator.c, rsync.c, and xattrs.c.
+
+Adds testsuite/chmod-symlink-race.test (with t_chmod_secure helper)
+as regression coverage.
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-43619
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/862fe4eeaf82178324c66e504bf2c6c2e4038f99]
+
+Backport Changes:
+- Upstream also updates runtests.py and a newer Makefile.in test
+ helper list that includes simdtest. Wrynose 3.4.1 does not carry
+ runtests.py and its CHECK_PROGS list has no simdtest entry, so
+ those test-runner hunks were not applicable.
+
+(cherry picked from commit 862fe4eeaf82178324c66e504bf2c6c2e4038f99)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ Makefile.in | 9 ++-
+ delete.c | 4 +-
+ generator.c | 4 +-
+ rsync.c | 2 +-
+ syscall.c | 80 ++++++++++++++++++++
+ t_chmod_secure.c | 117 ++++++++++++++++++++++++++++++
+ t_stub.c | 2 +
+ testsuite/chmod-symlink-race.test | 68 +++++++++++++++++
+ xattrs.c | 6 +-
+ 9 files changed, 282 insertions(+), 10 deletions(-)
+ create mode 100644 t_chmod_secure.c
+ create mode 100755 testsuite/chmod-symlink-race.test
+
+diff --git a/Makefile.in b/Makefile.in
+index 2c5cf996..c30b8876 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -62,12 +62,13 @@ TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/perms
+
+ # Programs we must have to run the test cases
+ CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \
+- testrun$(EXEEXT) trimslash$(EXEEXT) t_unsafe$(EXEEXT) wildtest$(EXEEXT)
++ testrun$(EXEEXT) trimslash$(EXEEXT) t_unsafe$(EXEEXT) t_chmod_secure$(EXEEXT) \
++ wildtest$(EXEEXT)
+
+ CHECK_SYMLINKS = testsuite/chown-fake.test testsuite/devices-fake.test testsuite/xattrs-hlink.test
+
+ # Objects for CHECK_PROGS to clean
+-CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o trimslash.o wildtest.o
++CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o trimslash.o wildtest.o
+
+ # note that the -I. is needed to handle config.h when using VPATH
+ .c.o:
+@@ -183,6 +184,10 @@ T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/sn
+ t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_UNSAFE_OBJ) $(LIBS)
+
++T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
++t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ)
++ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS)
++
+ .PHONY: conf
+ conf: configure.sh config.h.in
+
+diff --git a/delete.c b/delete.c
+index 89c1f8d6..ded0ab2a 100644
+--- a/delete.c
++++ b/delete.c
+@@ -98,7 +98,7 @@ static enum delret delete_dir_contents(char *fname, uint16 flags)
+
+ strlcpy(p, fp->basename, remainder);
+ if (!(fp->mode & S_IWUSR) && !am_root && fp->flags & FLAG_OWNED_BY_US)
+- do_chmod(fname, fp->mode | S_IWUSR);
++ do_chmod_at(fname, fp->mode | S_IWUSR);
+ /* Save stack by recursing to ourself directly. */
+ if (S_ISDIR(fp->mode)) {
+ if (delete_dir_contents(fname, flags | DEL_RECURSE) != DR_SUCCESS)
+@@ -139,7 +139,7 @@ enum delret delete_item(char *fbuf, uint16 mode, uint16 flags)
+ }
+
+ if (flags & DEL_NO_UID_WRITE)
+- do_chmod(fbuf, mode | S_IWUSR);
++ do_chmod_at(fbuf, mode | S_IWUSR);
+
+ if (S_ISDIR(mode) && !(flags & DEL_DIR_IS_EMPTY)) {
+ /* This only happens on the first call to delete_item() since
+diff --git a/generator.c b/generator.c
+index b56fa569..e5aff654 100644
+--- a/generator.c
++++ b/generator.c
+@@ -1499,7 +1499,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ #ifdef HAVE_CHMOD
+ if (!am_root && (file->mode & S_IRWXU) != S_IRWXU && dir_tweaking) {
+ mode_t mode = file->mode | S_IRWXU;
+- if (do_chmod(fname, mode) < 0) {
++ if (do_chmod_at(fname, mode) < 0) {
+ rsyserr(FERROR_XFER, errno,
+ "failed to modify permissions on %s",
+ full_fname(fname));
+@@ -2111,7 +2111,7 @@ static void touch_up_dirs(struct file_list *flist, int ndx)
+ continue;
+ fname = f_name(file, NULL);
+ if (fix_dir_perms)
+- do_chmod(fname, file->mode);
++ do_chmod_at(fname, file->mode);
+ if (need_retouch_dir_times) {
+ STRUCT_STAT st;
+ if (link_stat(fname, &st, 0) == 0 && mtime_differs(&st, file)) {
+diff --git a/rsync.c b/rsync.c
+index b130aba5..cc46a2f9 100644
+--- a/rsync.c
++++ b/rsync.c
+@@ -657,7 +657,7 @@ int set_file_attrs(const char *fname, struct file_struct *file, stat_x *sxp,
+
+ #ifdef HAVE_CHMOD
+ if (!BITS_EQUAL(sxp->st.st_mode, new_mode, CHMOD_BITS)) {
+- int ret = am_root < 0 ? 0 : do_chmod(fname, new_mode);
++ int ret = am_root < 0 ? 0 : do_chmod_at(fname, new_mode);
+ if (ret < 0) {
+ rsyserr(FERROR_XFER, errno,
+ "failed to set permissions on %s",
+diff --git a/syscall.c b/syscall.c
+index dcecda1a..06d5ed3f 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -281,6 +281,86 @@ int do_chmod(const char *path, mode_t mode)
+ return code;
+ return 0;
+ }
++
++/*
++ Symlink-race-safe variant of do_chmod() for receiver-side use.
++
++ Threat model: on a daemon running with "use chroot = no" (the prerequisite
++ for CVE-2026-29518), a local attacker can race a symlink swap of one of
++ the parent directory components of a path the receiver is about to chmod.
++ Because chmod() resolves symlinks at every component, the swap redirects
++ the chmod outside the receiver's confinement.
++
++ Defence: open the *parent* directory of fname under secure_relative_open()
++ (which uses openat2(RESOLVE_BENEATH) on Linux 5.6+, openat() with
++ O_RESOLVE_BENEATH on FreeBSD 13+ and macOS 15+ (Sequoia), or a per-component
++ O_NOFOLLOW walk elsewhere) and do fchmodat() against that dirfd. A symlink
++ substituted into one of the parent components is then either followed
++ within the tree (legitimate dir-symlinks still work) or rejected by the
++ kernel (escape attempts fail).
++
++ Final-component handling matches do_chmod(): fchmodat() with flag 0
++ follows a symlink at the final component, which is the same behaviour as
++ chmod() and matches every current call site (the file being chmod'd is
++ one the receiver itself just created or transferred). For the rare case
++ where the caller wants to chmod a symlink-as-an-object (S_ISLNK in the
++ mode bits), we fall through to do_chmod() which has portability code for
++ that case.
++
++ Falls back to do_chmod() for absolute paths and for paths with no parent
++ component, where there is nothing to protect against.
++*/
++int do_chmod_at(const char *fname, mode_t mode)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ /* Only the daemon-without-chroot case is exposed to the symlink-
++ * race attack: a chroot already confines the receiver, and a
++ * non-daemon rsync runs with the user's own authority so a
++ * symlink they planted can only redirect to files they could
++ * already access. Everywhere else, fall through to plain
++ * do_chmod() to avoid the dirfd-open overhead on every call. */
++ if (!am_daemon || am_chrooted)
++ return do_chmod(fname, mode);
++
++ if (!fname || !*fname || *fname == '/' || S_ISLNK(mode))
++ return do_chmod(fname, mode);
++
++ slash = strrchr(fname, '/');
++ if (!slash)
++ return do_chmod(fname, mode);
++
++ dlen = slash - fname;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, fname, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = fchmodat(dfd, bname, mode, 0);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_chmod(fname, mode);
++#endif
++}
+ #endif
+
+ int do_rename(const char *old_path, const char *new_path)
+diff --git a/t_chmod_secure.c b/t_chmod_secure.c
+new file mode 100644
+index 00000000..114dfb2d
+--- /dev/null
++++ b/t_chmod_secure.c
+@@ -0,0 +1,117 @@
++/*
++ * Test harness for do_chmod_at(). Confirms the symlink-TOCTOU
++ * primitive used by CVE-2026-29518 (and its incomplete-fix follow-up
++ * for chmod) is closed by do_chmod_at(): a parent directory component
++ * being a symlink that escapes the receiver's confinement must be
++ * rejected, while a parent symlink that resolves *within* the tree
++ * must still work (so legitimate dir-symlinks are not regressed).
++ *
++ * Not linked into rsync itself.
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#include "rsync.h"
++
++#include <sys/stat.h>
++
++int dry_run = 0;
++int am_root = 0;
++int am_sender = 0;
++int read_only = 0;
++int list_only = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
++extern int am_daemon, am_chrooted;
++
++short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG];
++
++static int errs = 0;
++
++static void check(const char *label, int actual_rc, int expect_ok,
++ const char *path, mode_t expected_mode)
++{
++ struct stat st;
++ int got_ok = (actual_rc == 0);
++ if (got_ok != expect_ok) {
++ fprintf(stderr, "FAIL [%s]: rc=%d errno=%d (%s), expected %s\n",
++ label, actual_rc, errno, strerror(errno),
++ expect_ok ? "success" : "rejection");
++ errs++;
++ return;
++ }
++ if (path && stat(path, &st) < 0) {
++ fprintf(stderr, "FAIL [%s]: stat(%s) failed: %s\n",
++ label, path, strerror(errno));
++ errs++;
++ return;
++ }
++ if (path && (st.st_mode & 07777) != expected_mode) {
++ fprintf(stderr,
++ "FAIL [%s]: %s mode is 0%o, expected 0%o\n",
++ label, path, st.st_mode & 07777, expected_mode);
++ errs++;
++ return;
++ }
++ fprintf(stderr, "OK [%s]\n", label);
++}
++
++int main(int argc, char **argv)
++{
++ if (argc != 2) {
++ fprintf(stderr, "usage: %s <module-dir>\n", argv[0]);
++ return 2;
++ }
++ if (chdir(argv[1]) < 0) {
++ perror("chdir");
++ return 2;
++ }
++
++ /* Simulate the daemon-without-chroot deployment that do_chmod_at()
++ * defends. With am_daemon=0 or am_chrooted=1 the wrapper falls
++ * through to plain do_chmod() and the symlink-race test would be
++ * meaningless. */
++ am_daemon = 1;
++ am_chrooted = 0;
++
++ /* Test layout (all inside the directory we just chdir'd to):
++ *
++ * ./realdir/sentinel -- regular target file
++ * ./inside_link -> realdir -- legitimate dir-symlink within the tree
++ * ./escape_link -> ../trap -- attacker swap, target outside tree
++ * ../trap/sentinel -- the file the attacker wants to alter
++ *
++ * The shell wrapper that calls this helper has set both sentinel
++ * files to mode 0600 so we have a clean baseline to compare.
++ */
++
++ /* Scenario A: legitimate parent dir-symlink, chmod must succeed. */
++ int rc = do_chmod_at("inside_link/sentinel", 0640);
++ check("A: legit dir-symlink within tree",
++ rc, 1, "realdir/sentinel", 0640);
++
++ /* Scenario B: parent symlink escapes the tree -- chmod must be
++ * rejected and the outside file's mode must be unchanged. */
++ rc = do_chmod_at("escape_link/sentinel", 0666);
++ check("B: parent symlink escapes tree (the attack)",
++ rc, 0, "../trap/sentinel", 0600);
++
++ /* Scenario C: plain relative path with no symlink components,
++ * regression check that the safe wrapper doesn't break the
++ * normal case. */
++ rc = do_chmod_at("realdir/sentinel", 0644);
++ check("C: plain relative path (regression check)",
++ rc, 1, "realdir/sentinel", 0644);
++
++ /* Scenario D: top-level file, no parent directory component.
++ * Falls back to do_chmod(); should succeed. */
++ rc = do_chmod_at("topfile", 0640);
++ check("D: top-level file, no parent component",
++ rc, 1, "topfile", 0640);
++
++ if (errs)
++ fprintf(stderr, "%d failure(s)\n", errs);
++ return errs ? 1 : 0;
++}
+diff --git a/t_stub.c b/t_stub.c
+index eee92729..63bc144c 100644
+--- a/t_stub.c
++++ b/t_stub.c
+@@ -23,6 +23,8 @@
+
+ int do_fsync = 0;
+ int inplace = 0;
++int am_daemon = 0;
++int am_chrooted = 0;
+ int modify_window = 0;
+ int preallocate_files = 0;
+ int protect_args = 0;
+diff --git a/testsuite/chmod-symlink-race.test b/testsuite/chmod-symlink-race.test
+new file mode 100755
+index 00000000..48bbfbb4
+--- /dev/null
++++ b/testsuite/chmod-symlink-race.test
+@@ -0,0 +1,68 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for the symlink-TOCTOU class of bug applied to
++# chmod() on the receiver side. The CVE-2026-29518 fix used
++# secure_relative_open() for the basis-file open, but every other
++# path-based syscall the receiver runs on sender-controllable paths
++# is vulnerable to the same primitive: a local attacker swaps a
++# symlink into one of the parent directory components between the
++# receiver's check and its act, and the syscall escapes the module.
++#
++# This test exercises the new do_chmod_at() wrapper via the
++# t_chmod_secure helper. The helper sets up two scenarios:
++# - a parent dir-symlink that resolves WITHIN the module tree
++# (legitimate -K-style use, must continue to work)
++# - a parent dir-symlink that escapes the module tree (the
++# attack, must be rejected)
++# plus two regression scenarios (plain relative path, top-level
++# file) that just confirm the safe wrapper doesn't break the
++# normal case.
++#
++# The kernel-enforced "stay below dirfd" path resolution is
++# only available on Linux 5.6+, FreeBSD 13+, and macOS 15+.
++# Skip on platforms that fall back to per-component O_NOFOLLOW
++# (Solaris, OpenBSD, NetBSD, Cygwin); the per-component fallback
++# would also reject the attack but the legitimate dir-symlink
++# scenario would fail there.
++
++. "$suitedir/rsync.fns"
++
++case "$(uname -s)" in
++ SunOS|OpenBSD|NetBSD|CYGWIN*)
++ test_skipped "do_chmod_at relies on RESOLVE_BENEATH-equivalent kernel support not available on $(uname -s)"
++ ;;
++esac
++
++mod="$scratchdir/module"
++trap_outside="$scratchdir/trap"
++rm -rf "$mod" "$trap_outside"
++mkdir -p "$mod/realdir" "$trap_outside"
++
++# Set up the four file-system objects the helper expects:
++echo bystander > "$mod/realdir/sentinel"
++chmod 0600 "$mod/realdir/sentinel"
++echo target > "$trap_outside/sentinel"
++chmod 0600 "$trap_outside/sentinel"
++ln -s realdir "$mod/inside_link"
++ln -s ../trap "$mod/escape_link"
++echo top > "$mod/topfile"
++chmod 0600 "$mod/topfile"
++
++"$TOOLDIR/t_chmod_secure" "$mod" || \
++ test_fail "t_chmod_secure reported failures (see stderr above)"
++
++# Sanity-check from the shell side too: the outside file's mode must
++# still be 0600 -- the helper checked this, but a second look from
++# the shell guards against a helper-internal stat() bug.
++mode=$(stat -c '%a' "$trap_outside/sentinel" 2>/dev/null \
++ || stat -f '%Lp' "$trap_outside/sentinel" 2>/dev/null)
++if [ "$mode" != "600" ]; then
++ test_fail "outside sentinel mode changed from 600 to $mode -- chmod escaped the module"
++fi
++
++exit 0
+diff --git a/xattrs.c b/xattrs.c
+index 26e50a6f..4462d63b 100644
+--- a/xattrs.c
++++ b/xattrs.c
+@@ -1086,7 +1086,7 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna
+ && !S_ISLNK(sxp->st.st_mode)
+ #endif
+ && access(fname, W_OK) < 0
+- && do_chmod(fname, (sxp->st.st_mode & CHMOD_BITS) | S_IWUSR) == 0)
++ && do_chmod_at(fname, (sxp->st.st_mode & CHMOD_BITS) | S_IWUSR) == 0)
+ added_write_perm = 1;
+
+ ndx = F_XATTR(file);
+@@ -1094,7 +1094,7 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna
+ lst = &glst->xa_items;
+ int return_value = rsync_xal_set(fname, lst, fnamecmp, sxp);
+ if (added_write_perm) /* remove the temporary write permission */
+- do_chmod(fname, sxp->st.st_mode);
++ do_chmod_at(fname, sxp->st.st_mode);
+ return return_value;
+ }
+
+@@ -1211,7 +1211,7 @@ int set_stat_xattr(const char *fname, struct file_struct *file, mode_t new_mode)
+ mode = (fst.st_mode & _S_IFMT) | (fmode & ACCESSPERMS)
+ | (S_ISDIR(fst.st_mode) ? 0700 : 0600);
+ if (fst.st_mode != mode)
+- do_chmod(fname, mode);
++ do_chmod_at(fname, mode);
+ if (!IS_DEVICE(fst.st_mode))
+ fst.st_rdev = 0; /* just in case */
+
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch
new file mode 100644
index 00000000000..9decc585456
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p2.patch
@@ -0,0 +1,205 @@
+From a2269dd38ddc83bbc8738d8b0897400e8088c1a8 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 5 May 2026 14:34:33 +1000
+Subject: [PATCH] util1: secure change_dir() against symlink-race chdir-escape
+
+The receiver's chdir(2) into a destination subdirectory followed
+attacker-planted symlinks at every path component. Once CWD
+escaped the module, every subsequent path-relative syscall (open,
+chmod, lchown, ...) inherited the escape -- defeating
+secure_relative_open's RESOLVE_BENEATH anchor against AT_FDCWD,
+since the anchor itself was now outside the module.
+
+Route change_dir's relative target through secure_relative_open()
+and fchdir() to the resulting dirfd in am_daemon && !am_chrooted
+mode, so the chdir step itself can no longer follow a parent-
+symlink. Same treatment applied to the CD_SKIP_CHDIR /
+set_path_only path so it also can't follow attacker symlinks
+during path tracking.
+
+Adds testsuite/sender-flist-symlink-leak.test covering the
+sender-side flist resolution variant of the same primitive.
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-43619
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/15d296425609a997f56eb8f9017ff73922f99b20]
+
+(cherry picked from commit 15d296425609a997f56eb8f9017ff73922f99b20)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ testsuite/sender-flist-symlink-leak.test | 90 ++++++++++++++++++++++++
+ util1.c | 56 +++++++++++++--
+ 2 files changed, 142 insertions(+), 4 deletions(-)
+ create mode 100755 testsuite/sender-flist-symlink-leak.test
+
+diff --git a/testsuite/sender-flist-symlink-leak.test b/testsuite/sender-flist-symlink-leak.test
+new file mode 100755
+index 00000000..011d93d0
+--- /dev/null
++++ b/testsuite/sender-flist-symlink-leak.test
+@@ -0,0 +1,90 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for codex re-check finding: the sender-side file-
++# list generator can still follow an attacker-planted symlink out of
++# the module via change_pathname() -> change_dir(...,CD_SKIP_CHDIR)
++# followed by change_dir(...,CD_NORMAL). The CD_SKIP_CHDIR sets
++# skipped_chdir=1, and the next CD_NORMAL call's secure-branch in
++# util1.c is gated on `!skipped_chdir`, so the secure path is
++# bypassed and a raw chdir(curr_dir) follows attacker-controlled
++# symlinks during flist generation.
++#
++# Reach: rsync daemon module with `use chroot = no`. A local
++# attacker plants module/cd -> /outside. A client (innocent or
++# malicious) pulls rsync://<daemon>/<module>/cd/. The daemon, as
++# sender, enumerates files in /outside and ships their metadata
++# (names, sizes, modes, mtimes) to the client. The actual content
++# transfer fails later at the secure_relative_open step with EXDEV,
++# but by then the metadata has already leaked.
++#
++# We detect by running a dry-run pull of the symlinked subdir and
++# checking whether the client's --list-only output mentions any
++# file from /outside. With the bug, /outside/secret.txt appears in
++# the list with its size; with the fix, the daemon's chdir into
++# the symlinked subdir is rejected and no /outside file is listed.
++
++. "$suitedir/rsync.fns"
++
++case "$(uname -s)" in
++ SunOS|OpenBSD|NetBSD|CYGWIN*)
++ test_skipped "secure change_dir relies on RESOLVE_BENEATH-equivalent kernel support not available on $(uname -s)"
++ ;;
++esac
++
++mod="$scratchdir/module"
++outside="$scratchdir/outside"
++listfile="$scratchdir/listed.txt"
++conf="$scratchdir/test-rsyncd.conf"
++
++rm -rf "$mod" "$outside"
++mkdir -p "$mod" "$outside"
++
++# Outside-the-module file the daemon should NOT enumerate to clients.
++# A distinctive name + non-trivial size makes the leak easy to spot.
++echo "OUTSIDE_PROTECTED_FILE_USED_AS_LEAK_DETECTOR" > "$outside/leak_marker.txt"
++chmod 0644 "$outside/leak_marker.txt"
++
++# The symlink trap planted by the local attacker.
++ln -s "$outside" "$mod/cd"
++
++my_uid=`get_testuid`
++root_uid=`get_rootuid`
++root_gid=`get_rootgid`
++uid_setting="uid = $root_uid"
++gid_setting="gid = $root_gid"
++if test x"$my_uid" != x"$root_uid"; then
++ uid_setting="#$uid_setting"
++ gid_setting="#$gid_setting"
++fi
++
++cat > "$conf" <<EOF
++use chroot = no
++$uid_setting
++$gid_setting
++log file = $scratchdir/rsyncd.log
++[upload]
++ path = $mod
++ use chroot = no
++ read only = no
++EOF
++
++# Pull recursively into the symlinked subdir with dry-run + verbose,
++# capturing the daemon's flist (file list) on stdout. If the daemon
++# enumerates /outside, leak_marker.txt will appear in the listing.
++RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon" \
++ $RSYNC -nrv rsync://localhost/upload/cd/ "$scratchdir/dst/" \
++ > "$listfile" 2>&1 || true
++
++if grep -q "leak_marker\.txt" "$listfile"; then
++ echo "----- leaked listing follows" >&2
++ sed 's/^/ /' "$listfile" >&2
++ echo "----- leaked listing ends" >&2
++ test_fail "sender flist leak: outside/leak_marker.txt was enumerated to the client (daemon's chdir followed the cd symlink during flist generation)"
++fi
++
++exit 0
+diff --git a/util1.c b/util1.c
+index d84bc414..6e457d4f 100644
+--- a/util1.c
++++ b/util1.c
+@@ -1112,6 +1112,7 @@ char *sanitize_path(char *dest, const char *p, const char *rootdir, int depth, i
+ * Also cleans the path using the clean_fname() function. */
+ int change_dir(const char *dir, int set_path_only)
+ {
++ extern int am_daemon, am_chrooted;
+ static int initialised, skipped_chdir;
+ unsigned int len;
+
+@@ -1150,10 +1151,57 @@ int change_dir(const char *dir, int set_path_only)
+ curr_dir[curr_dir_len++] = '/';
+ memcpy(curr_dir + curr_dir_len, dir, len + 1);
+
+- if (!set_path_only && chdir(curr_dir)) {
+- curr_dir_len = save_dir_len;
+- curr_dir[curr_dir_len] = '\0';
+- return 0;
++ if (!set_path_only) {
++ int chdir_failed;
++ /* In the daemon-without-chroot deployment we must not
++ * follow a symlink in any component of the chdir
++ * target -- otherwise CWD escapes the module and
++ * every subsequent path-relative syscall (open,
++ * chmod, lchown, ...) inherits the escape, which
++ * defeats secure_relative_open's RESOLVE_BENEATH
++ * anchor and re-opens the CVE-2026-29518 class of
++ * symlink TOCTOU attacks. Use the secure resolver
++ * to get a confined dirfd, then fchdir() to it.
++ *
++ * If skipped_chdir is set, a previous CD_SKIP_CHDIR
++ * call buffered an absolute prefix in curr_dir
++ * (e.g. change_pathname's CD_SKIP_CHDIR to orig_dir)
++ * without syncing the kernel's CWD. Resolve `dir`
++ * relative to that prefix as basedir so the secure
++ * branch still anchors at the operator-trusted
++ * directory rather than wherever the kernel CWD
++ * happens to be. */
++ if (am_daemon && !am_chrooted) {
++ const char *basedir = NULL;
++ char prefix[MAXPATHLEN];
++ int dfd;
++ if (skipped_chdir) {
++ if (save_dir_len >= sizeof prefix) {
++ errno = ENAMETOOLONG;
++ chdir_failed = 1;
++ goto chdir_cleanup;
++ }
++ memcpy(prefix, curr_dir, save_dir_len);
++ prefix[save_dir_len] = '\0';
++ basedir = prefix;
++ }
++ dfd = secure_relative_open(basedir, dir,
++ O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0) {
++ chdir_failed = 1;
++ } else {
++ chdir_failed = fchdir(dfd) != 0;
++ close(dfd);
++ }
++ } else {
++ chdir_failed = chdir(curr_dir) != 0;
++ }
++ chdir_cleanup:
++ if (chdir_failed) {
++ curr_dir_len = save_dir_len;
++ curr_dir[curr_dir_len] = '\0';
++ return 0;
++ }
+ }
+ skipped_chdir = set_path_only;
+ }
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch
new file mode 100644
index 00000000000..fac413f3ea8
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p3.patch
@@ -0,0 +1,1783 @@
+From a55d00c0f37fd811b0fddc1eaeb7f420215b1e05 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 5 May 2026 15:02:48 +1000
+Subject: [PATCH] syscall: add symlink-race-safe do_*_at() wrappers and harden
+ secure_relative_open
+
+Add the rest of the path-based syscall wrappers and migrate every
+receiver-side caller:
+ - do_lchown_at, do_rename_at, do_mkdir_at, do_symlink_at,
+ do_mknod_at, do_link_at, do_unlink_at, do_rmdir_at,
+ do_utimensat_at, do_stat_at, do_lstat_at
+
+Same shape as do_chmod_at: open each parent under
+secure_relative_open(), call the *at() variant against the dirfd,
+fall through to the bare path-based syscall in non-daemon /
+chrooted / absolute-path / no-parent cases. macOS's
+setattrlist-based set_times tier is also routed through the
+utimensat_at path on daemon-no-chroot.
+
+Hardenings to secure_relative_open() itself:
+ - confine basedir resolution under the same kernel mechanism
+ used for relpath (basedirs from --copy-dest / --link-dest are
+ sender-controllable in daemon mode)
+ - reject any '..' component (bare '..', 'foo/..', 'subdir/..')
+ so the per-component O_NOFOLLOW fallback can't escape
+ - return the dirfd we built up from the per-component fallback
+ when the caller passed O_DIRECTORY (otherwise every do_*_at
+ failed with EINVAL on platforms without RESOLVE_BENEATH)
+
+Adds testsuite/alt-dest-symlink-race.test and
+testsuite/secure-relpath-validation.test (with t_secure_relpath
+helper) as regression coverage for the new hardenings.
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-43619
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/30656c5e358b1c6033f4caf24f3e11b29d25c9f4]
+
+Backport Changes:
+- Upstream also updates runtests.py and a newer Makefile.in test
+ helper list that includes simdtest. Wrynose 3.4.1 does not carry
+ runtests.py and its CHECK_PROGS list has no simdtest entry, so
+ those test-runner hunks were not applicable.
+
+(cherry picked from commit 30656c5e358b1c6033f4caf24f3e11b29d25c9f4)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ Makefile.in | 8 +-
+ backup.c | 14 +-
+ cleanup.c | 2 +-
+ delete.c | 2 +-
+ generator.c | 22 +-
+ hlink.c | 2 +-
+ receiver.c | 8 +-
+ rsync.c | 6 +-
+ syscall.c | 841 ++++++++++++++++++++++-
+ t_secure_relpath.c | 151 ++++
+ testsuite/alt-dest-symlink-race.test | 96 +++
+ testsuite/secure-relpath-validation.test | 34 +
+ util1.c | 20 +-
+ xattrs.c | 9 +-
+ 14 files changed, 1164 insertions(+), 51 deletions(-)
+ create mode 100644 t_secure_relpath.c
+ create mode 100755 testsuite/alt-dest-symlink-race.test
+ create mode 100755 testsuite/secure-relpath-validation.test
+
+diff --git a/Makefile.in b/Makefile.in
+index c30b8876..c0cc7a06 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -63,12 +63,12 @@ TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/perms
+ # Programs we must have to run the test cases
+ CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \
+ testrun$(EXEEXT) trimslash$(EXEEXT) t_unsafe$(EXEEXT) t_chmod_secure$(EXEEXT) \
+- wildtest$(EXEEXT)
++ t_secure_relpath$(EXEEXT) wildtest$(EXEEXT)
+
+ CHECK_SYMLINKS = testsuite/chown-fake.test testsuite/devices-fake.test testsuite/xattrs-hlink.test
+
+ # Objects for CHECK_PROGS to clean
+-CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o trimslash.o wildtest.o
++CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o t_secure_relpath.o trimslash.o wildtest.o
+
+ # note that the -I. is needed to handle config.h when using VPATH
+ .c.o:
+@@ -188,6 +188,10 @@ T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/com
+ t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS)
+
++T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
++t_secure_relpath$(EXEEXT): $(T_SECURE_RELPATH_OBJ)
++ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SECURE_RELPATH_OBJ) $(LIBS)
++
+ .PHONY: conf
+ conf: configure.sh config.h.in
+
+diff --git a/backup.c b/backup.c
+index 686cb297..ae8cb49e 100644
+--- a/backup.c
++++ b/backup.c
+@@ -39,7 +39,7 @@ static int validate_backup_dir(void)
+ {
+ STRUCT_STAT st;
+
+- if (do_lstat(backup_dir_buf, &st) < 0) {
++ if (do_lstat_at(backup_dir_buf, &st) < 0) {
+ if (errno == ENOENT)
+ return 0;
+ rsyserr(FERROR, errno, "backup lstat %s failed", backup_dir_buf);
+@@ -98,7 +98,7 @@ static BOOL copy_valid_path(const char *fname)
+ for ( ; b; name = b + 1, b = strchr(name, '/')) {
+ *b = '\0';
+
+- while (do_mkdir(backup_dir_buf, ACCESSPERMS) < 0) {
++ while (do_mkdir_at(backup_dir_buf, ACCESSPERMS) < 0) {
+ if (errno == EEXIST) {
+ val = validate_backup_dir();
+ if (val > 0)
+@@ -197,7 +197,7 @@ static inline int link_or_rename(const char *from, const char *to,
+ if (IS_SPECIAL(stp->st_mode) || IS_DEVICE(stp->st_mode))
+ return 0; /* Use copy code. */
+ #endif
+- if (do_link(from, to) == 0) {
++ if (do_link_at(from, to) == 0) {
+ if (DEBUG_GTE(BACKUP, 1))
+ rprintf(FINFO, "make_backup: HLINK %s successful.\n", from);
+ return 2;
+@@ -207,7 +207,7 @@ static inline int link_or_rename(const char *from, const char *to,
+ return 0;
+ }
+ #endif
+- if (do_rename(from, to) == 0) {
++ if (do_rename_at(from, to) == 0) {
+ if (stp->st_nlink > 1 && !S_ISDIR(stp->st_mode)) {
+ /* If someone has hard-linked the file into the backup
+ * dir, rename() might return success but do nothing! */
+@@ -246,7 +246,7 @@ int make_backup(const char *fname, BOOL prefer_rename)
+ goto success;
+ if (errno == EEXIST || errno == EISDIR) {
+ STRUCT_STAT bakst;
+- if (do_lstat(buf, &bakst) == 0) {
++ if (do_lstat_at(buf, &bakst) == 0) {
+ int flags = get_del_for_flag(bakst.st_mode) | DEL_FOR_BACKUP | DEL_RECURSE;
+ if (delete_item(buf, bakst.st_mode, flags) != 0)
+ return 0;
+@@ -277,7 +277,7 @@ int make_backup(const char *fname, BOOL prefer_rename)
+ /* Check to see if this is a device file, or link */
+ if ((am_root && preserve_devices && IS_DEVICE(file->mode))
+ || (preserve_specials && IS_SPECIAL(file->mode))) {
+- if (do_mknod(buf, file->mode, sx.st.st_rdev) < 0)
++ if (do_mknod_at(buf, file->mode, sx.st.st_rdev) < 0)
+ rsyserr(FERROR, errno, "mknod %s failed", full_fname(buf));
+ else if (DEBUG_GTE(BACKUP, 1))
+ rprintf(FINFO, "make_backup: DEVICE %s successful.\n", fname);
+@@ -294,7 +294,7 @@ int make_backup(const char *fname, BOOL prefer_rename)
+ }
+ ret = 2;
+ } else {
+- if (do_symlink(sl, buf) < 0)
++ if (do_symlink_at(sl, buf) < 0)
+ rsyserr(FERROR, errno, "link %s -> \"%s\"", full_fname(buf), sl);
+ else if (DEBUG_GTE(BACKUP, 1))
+ rprintf(FINFO, "make_backup: SYMLINK %s successful.\n", fname);
+diff --git a/cleanup.c b/cleanup.c
+index 40d26baa..0493fbbb 100644
+--- a/cleanup.c
++++ b/cleanup.c
+@@ -198,7 +198,7 @@ NORETURN void _exit_cleanup(int code, const char *file, int line)
+ switch_step++;
+
+ if (cleanup_fname)
+- do_unlink(cleanup_fname);
++ do_unlink_at(cleanup_fname);
+ if (exit_code)
+ kill_all(SIGUSR1);
+ if (cleanup_pid && cleanup_pid == getpid()) {
+diff --git a/delete.c b/delete.c
+index ded0ab2a..4a52122d 100644
+--- a/delete.c
++++ b/delete.c
+@@ -160,7 +160,7 @@ enum delret delete_item(char *fbuf, uint16 mode, uint16 flags)
+
+ if (S_ISDIR(mode)) {
+ what = "rmdir";
+- ok = do_rmdir(fbuf) == 0;
++ ok = do_rmdir_at(fbuf) == 0;
+ } else {
+ if (make_backups > 0 && !(flags & DEL_FOR_BACKUP) && (backup_dir || !is_backup_file(fbuf))) {
+ what = "make_backup";
+diff --git a/generator.c b/generator.c
+index e5aff654..e5b2d176 100644
+--- a/generator.c
++++ b/generator.c
+@@ -984,7 +984,7 @@ static int try_dests_reg(struct file_struct *file, char *fname, int ndx,
+ if (find_exact_for_existing) {
+ if (alt_dest_type == LINK_DEST && real_st.st_dev == sxp->st.st_dev && real_st.st_ino == sxp->st.st_ino)
+ return -1;
+- if (do_unlink(fname) < 0 && errno != ENOENT)
++ if (do_unlink_at(fname) < 0 && errno != ENOENT)
+ goto got_nothing_for_ya;
+ }
+ #ifdef SUPPORT_HARD_LINKS
+@@ -1112,7 +1112,7 @@ static int try_dests_non(struct file_struct *file, char *fname, int ndx,
+ && !IS_SPECIAL(file->mode) && !IS_DEVICE(file->mode)
+ #endif
+ && !S_ISDIR(file->mode)) {
+- if (do_link(cmpbuf, fname) < 0) {
++ if (do_link_at(cmpbuf, fname) < 0) {
+ rsyserr(FERROR_XFER, errno,
+ "failed to hard-link %s with %s",
+ cmpbuf, fname);
+@@ -1315,7 +1315,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ }
+ }
+ if (relative_paths && !implied_dirs && file->mode != 0
+- && do_stat(dn, &sx.st) < 0) {
++ && do_stat_at(dn, &sx.st) < 0) {
+ if (dry_run)
+ goto parent_is_dry_missing;
+ if (make_path(fname, MKP_DROP_NAME | MKP_SKIP_SLASH) < 0) {
+@@ -1427,7 +1427,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ && (stype == FT_DIR
+ || delete_item(fname, sx.st.st_mode, del_opts | DEL_FOR_DIR) != 0))
+ goto cleanup; /* Any errors get reported later. */
+- if (do_mkdir(fname, (file->mode|added_perms) & 0700) == 0)
++ if (do_mkdir_at(fname, (file->mode|added_perms) & 0700) == 0)
+ file->flags |= FLAG_DIR_CREATED;
+ goto cleanup;
+ }
+@@ -1469,10 +1469,10 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ itemize(fnamecmp, file, ndx, statret, &sx,
+ statret ? ITEM_LOCAL_CHANGE : 0, 0, NULL);
+ }
+- if (real_ret != 0 && do_mkdir(fname,file->mode|added_perms) < 0 && errno != EEXIST) {
++ if (real_ret != 0 && do_mkdir_at(fname,file->mode|added_perms) < 0 && errno != EEXIST) {
+ if (!relative_paths || errno != ENOENT
+ || make_path(fname, MKP_DROP_NAME | MKP_SKIP_SLASH) < 0
+- || (do_mkdir(fname, file->mode|added_perms) < 0 && errno != EEXIST)) {
++ || (do_mkdir_at(fname, file->mode|added_perms) < 0 && errno != EEXIST)) {
+ rsyserr(FERROR_XFER, errno,
+ "recv_generator: mkdir %s failed",
+ full_fname(fname));
+@@ -1808,7 +1808,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ ;
+ else if (quick_check_ok(FT_REG, fnamecmp, file, &sx.st)) {
+ if (partialptr) {
+- do_unlink(partialptr);
++ do_unlink_at(partialptr);
+ handle_partial_dir(partialptr, PDIR_DELETE);
+ }
+ set_file_attrs(fname, file, &sx, NULL, maybe_ATTRS_REPORT | maybe_ATTRS_ACCURATE_TIME);
+@@ -2016,7 +2016,7 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const
+
+ if (slnk) {
+ #ifdef SUPPORT_LINKS
+- if (do_symlink(slnk, create_name) < 0) {
++ if (do_symlink_at(slnk, create_name) < 0) {
+ rsyserr(FERROR_XFER, errno, "symlink %s -> \"%s\" failed",
+ full_fname(create_name), slnk);
+ return 0;
+@@ -2032,7 +2032,7 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const
+ return 0;
+ #endif
+ } else {
+- if (do_mknod(create_name, file->mode, rdev) < 0) {
++ if (do_mknod_at(create_name, file->mode, rdev) < 0) {
+ rsyserr(FERROR_XFER, errno, "mknod %s failed",
+ full_fname(create_name));
+ return 0;
+@@ -2040,14 +2040,14 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const
+ }
+
+ if (!skip_atomic) {
+- if (do_rename(tmpname, fname) < 0) {
++ if (do_rename_at(tmpname, fname) < 0) {
+ char *full_tmpname = strdup(full_fname(tmpname));
+ if (full_tmpname == NULL)
+ out_of_memory("atomic_create");
+ rsyserr(FERROR_XFER, errno, "rename %s -> \"%s\" failed",
+ full_tmpname, full_fname(fname));
+ free(full_tmpname);
+- do_unlink(tmpname);
++ do_unlink_at(tmpname);
+ return 0;
+ }
+ }
+diff --git a/hlink.c b/hlink.c
+index 2c14407a..eb36730f 100644
+--- a/hlink.c
++++ b/hlink.c
+@@ -454,7 +454,7 @@ int hard_link_check(struct file_struct *file, int ndx, char *fname,
+ int hard_link_one(struct file_struct *file, const char *fname,
+ const char *oldname, int terse)
+ {
+- if (do_link(oldname, fname) < 0) {
++ if (do_link_at(oldname, fname) < 0) {
+ enum logcode code;
+ if (terse) {
+ if (!INFO_GTE(NAME, 1))
+diff --git a/receiver.c b/receiver.c
+index 5a2c8c5a..8cf8366b 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -442,7 +442,7 @@ static void handle_delayed_updates(char *local_name)
+ }
+ /* We don't use robust_rename() here because the
+ * partial-dir must be on the same drive. */
+- if (do_rename(partialptr, fname) < 0) {
++ if (do_rename_at(partialptr, fname) < 0) {
+ rsyserr(FERROR_XFER, errno,
+ "rename failed for %s (from %s)",
+ full_fname(fname), partialptr);
+@@ -926,7 +926,7 @@ int recv_files(int f_in, int f_out, char *local_name)
+ recv_ok = -1;
+ else if (fnamecmp == partialptr) {
+ if (!one_inplace)
+- do_unlink(partialptr);
++ do_unlink_at(partialptr);
+ handle_partial_dir(partialptr, PDIR_DELETE);
+ }
+ } else if (keep_partial && partialptr && (!one_inplace || delay_updates)) {
+@@ -935,7 +935,7 @@ int recv_files(int f_in, int f_out, char *local_name)
+ "Unable to create partial-dir for %s -- discarding %s.\n",
+ local_name ? local_name : f_name(file, NULL),
+ recv_ok ? "completed file" : "partial file");
+- do_unlink(fnametmp);
++ do_unlink_at(fnametmp);
+ recv_ok = -1;
+ } else if (!finish_transfer(partialptr, fnametmp, fnamecmp, NULL,
+ file, recv_ok, !partial_dir))
+@@ -946,7 +946,7 @@ int recv_files(int f_in, int f_out, char *local_name)
+ } else
+ partialptr = NULL;
+ } else if (!one_inplace)
+- do_unlink(fnametmp);
++ do_unlink_at(fnametmp);
+
+ cleanup_disable();
+
+diff --git a/rsync.c b/rsync.c
+index cc46a2f9..1d2ae82a 100644
+--- a/rsync.c
++++ b/rsync.c
+@@ -547,7 +547,7 @@ int set_file_attrs(const char *fname, struct file_struct *file, stat_x *sxp,
+ if (am_root >= 0) {
+ uid_t uid = change_uid ? (uid_t)F_OWNER(file) : sxp->st.st_uid;
+ gid_t gid = change_gid ? (gid_t)F_GROUP(file) : sxp->st.st_gid;
+- if (do_lchown(fname, uid, gid) != 0) {
++ if (do_lchown_at(fname, uid, gid) != 0) {
+ /* We shouldn't have attempted to change uid
+ * or gid unless have the privilege. */
+ rsyserr(FERROR_XFER, errno, "%s %s failed",
+@@ -758,7 +758,7 @@ int finish_transfer(const char *fname, const char *fnametmp,
+ full_fname(fnametmp), fname);
+ if (!partialptr || (ret == -2 && temp_copy_name)
+ || robust_rename(fnametmp, partialptr, NULL, file->mode) < 0)
+- do_unlink(fnametmp);
++ do_unlink_at(fnametmp);
+ return 0;
+ }
+ if (ret == 0) {
+@@ -774,7 +774,7 @@ int finish_transfer(const char *fname, const char *fnametmp,
+ ok_to_set_time ? ATTRS_ACCURATE_TIME : ATTRS_SKIP_MTIME | ATTRS_SKIP_ATIME | ATTRS_SKIP_CRTIME);
+
+ if (temp_copy_name) {
+- if (do_rename(fnametmp, fname) < 0) {
++ if (do_rename_at(fnametmp, fname) < 0) {
+ rsyserr(FERROR_XFER, errno, "rename %s -> \"%s\"",
+ full_fname(fnametmp), fname);
+ return 0;
+diff --git a/syscall.c b/syscall.c
+index 06d5ed3f..ffd8df20 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -93,6 +93,63 @@ int do_unlink(const char *path)
+ return unlink(path);
+ }
+
++/*
++ Symlink-race-safe variant of do_unlink() for receiver-side use. See
++ the comment on do_chmod_at() for the threat model. unlink() resolves
++ parent components, so a parent-symlink swap can delete an outside
++ file under the daemon's authority. Defence: open the parent of path
++ under secure_relative_open() and use unlinkat() (flags=0) against
++ that dirfd.
++
++ Falls through to do_unlink() for the same dry-run / non-daemon /
++ chrooted / no-parent / absolute-path cases as the other wrappers.
++*/
++int do_unlink_at(const char *path)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return unlink(path);
++
++ if (!path || !*path || *path == '/')
++ return unlink(path);
++
++ slash = strrchr(path, '/');
++ if (!slash)
++ return unlink(path);
++
++ dlen = slash - path;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, path, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = unlinkat(dfd, bname, 0);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_unlink(path);
++#endif
++}
++
+ #ifdef SUPPORT_LINKS
+ int do_symlink(const char *lnk, const char *path)
+ {
+@@ -117,6 +174,70 @@ int do_symlink(const char *lnk, const char *path)
+ return symlink(lnk, path);
+ }
+
++/*
++ Symlink-race-safe variant of do_symlink() for receiver-side use. See
++ the comment on do_chmod_at() for the threat model. Only the parent
++ directory of `path` needs protection -- symlinkat() does not resolve
++ the final component (it creates it). Defence: open parent of `path`
++ under secure_relative_open() and call symlinkat() against that
++ dirfd. The link target string `lnk` is stored verbatim and not
++ resolved at creation time, so it doesn't need scrutiny here.
++
++ Falls through to do_symlink() for the --fake-super (am_root < 0)
++ path -- that code path opens `path` with do_open() which has its
++ own (separate) symlink-race exposure tracked elsewhere.
++*/
++int do_symlink_at(const char *lnk, const char *path)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return do_symlink(lnk, path);
++
++#if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS
++ if (am_root < 0)
++ return do_symlink(lnk, path);
++#endif
++
++ if (!path || !*path || *path == '/')
++ return do_symlink(lnk, path);
++
++ slash = strrchr(path, '/');
++ if (!slash)
++ return do_symlink(lnk, path);
++
++ dlen = slash - path;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, path, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = symlinkat(lnk, dfd, bname);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_symlink(lnk, path);
++#endif
++}
++
+ #if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS
+ ssize_t do_readlink(const char *path, char *buf, size_t bufsiz)
+ {
+@@ -153,6 +274,106 @@ int do_link(const char *old_path, const char *new_path)
+ return link(old_path, new_path);
+ #endif
+ }
++
++/*
++ Symlink-race-safe variant of do_link() for receiver-side use. See
++ the comment on do_chmod_at() for the threat model. link() resolves
++ parent components of *both* old_path and new_path, so a parent-
++ symlink swap on either side can plant the new hard link outside
++ the module, or hard-link an outside file into the module (read
++ disclosure).
++
++ Defence: open each parent under secure_relative_open() and use
++ linkat() between the two dirfds, reusing one when the parents
++ match. flags=0 matches the existing do_link() (don't follow a
++ symbolic-link old_path). Only available on systems with linkat();
++ pre-AT_FDCWD systems fall through to do_link().
++*/
++int do_link_at(const char *old_path, const char *new_path)
++{
++#if defined AT_FDCWD && defined HAVE_LINKAT
++ extern int am_daemon, am_chrooted;
++ char old_dirpath[MAXPATHLEN], new_dirpath[MAXPATHLEN];
++ const char *old_bname, *new_bname;
++ const char *old_slash, *new_slash;
++ int old_dfd = AT_FDCWD, new_dfd = AT_FDCWD;
++ BOOL old_owns = False, new_owns = False;
++ int ret, e;
++ size_t old_dlen = 0, new_dlen = 0;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return do_link(old_path, new_path);
++
++ if (!old_path || !*old_path || *old_path == '/'
++ || !new_path || !*new_path || *new_path == '/')
++ return do_link(old_path, new_path);
++
++ old_slash = strrchr(old_path, '/');
++ new_slash = strrchr(new_path, '/');
++
++ /* Resolve each path's parent dir independently. A path without a
++ * slash lives in CWD (AT_FDCWD), no parent open required. A path
++ * with a slash needs secure_relative_open to confine its parent
++ * resolution -- otherwise a parent symlink (e.g. --link-dest=cd
++ * where cd -> /outside) lets the kernel-level linkat(AT_FDCWD,
++ * "cd/target.txt", ...) escape the module. */
++ if (old_slash) {
++ old_dlen = old_slash - old_path;
++ if (old_dlen >= sizeof old_dirpath) { errno = ENAMETOOLONG; return -1; }
++ memcpy(old_dirpath, old_path, old_dlen);
++ old_dirpath[old_dlen] = '\0';
++ old_bname = old_slash + 1;
++ old_dfd = secure_relative_open(NULL, old_dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (old_dfd < 0)
++ return -1;
++ old_owns = True;
++ } else {
++ old_bname = old_path;
++ }
++
++ if (new_slash) {
++ new_dlen = new_slash - new_path;
++ if (new_dlen >= sizeof new_dirpath) {
++ e = ENAMETOOLONG;
++ if (old_owns) close(old_dfd);
++ errno = e;
++ return -1;
++ }
++ memcpy(new_dirpath, new_path, new_dlen);
++ new_dirpath[new_dlen] = '\0';
++ new_bname = new_slash + 1;
++ if (old_owns && old_dlen == new_dlen
++ && memcmp(old_dirpath, new_dirpath, old_dlen) == 0) {
++ new_dfd = old_dfd;
++ } else {
++ new_dfd = secure_relative_open(NULL, new_dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (new_dfd < 0) {
++ e = errno;
++ if (old_owns) close(old_dfd);
++ errno = e;
++ return -1;
++ }
++ new_owns = True;
++ }
++ } else {
++ new_bname = new_path;
++ }
++
++ ret = linkat(old_dfd, old_bname, new_dfd, new_bname, 0);
++ e = errno;
++ if (new_owns)
++ close(new_dfd);
++ if (old_owns)
++ close(old_dfd);
++ errno = e;
++ return ret;
++#else
++ return do_link(old_path, new_path);
++#endif
++}
+ #endif
+
+ int do_lchown(const char *path, uid_t owner, gid_t group)
+@@ -165,6 +386,66 @@ int do_lchown(const char *path, uid_t owner, gid_t group)
+ return lchown(path, owner, group);
+ }
+
++/*
++ Symlink-race-safe variant of do_lchown() for receiver-side use. See the
++ comment on do_chmod_at() for the threat model and design rationale.
++
++ Resolves the parent directory under secure_relative_open() and invokes
++ fchownat(..., AT_SYMLINK_NOFOLLOW) against that dirfd, so that an
++ attacker who substitutes a symlink into one of the parent components
++ cannot redirect the chown outside the receiver's confinement. The
++ AT_SYMLINK_NOFOLLOW flag matches lchown()'s "do not follow a final-
++ component symlink" semantics.
++
++ Falls through to do_lchown() in the dry-run / non-daemon / chrooted /
++ absolute-path / no-parent cases, identical to do_chmod_at().
++*/
++int do_lchown_at(const char *fname, uid_t owner, gid_t group)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return do_lchown(fname, owner, group);
++
++ if (!fname || !*fname || *fname == '/')
++ return do_lchown(fname, owner, group);
++
++ slash = strrchr(fname, '/');
++ if (!slash)
++ return do_lchown(fname, owner, group);
++
++ dlen = slash - fname;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, fname, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = fchownat(dfd, bname, owner, group, AT_SYMLINK_NOFOLLOW);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_lchown(fname, owner, group);
++#endif
++}
++
+ int do_mknod(const char *pathname, mode_t mode, dev_t dev)
+ {
+ if (dry_run) return 0;
+@@ -215,6 +496,76 @@ int do_mknod(const char *pathname, mode_t mode, dev_t dev)
+ #endif
+ }
+
++/*
++ Symlink-race-safe variant of do_mknod() for receiver-side use. See
++ the comment on do_chmod_at() for the threat model. Defence: open
++ the parent of pathname under secure_relative_open() and use
++ mknodat() against that dirfd. mknodat() covers both regular-file
++ (S_IFREG with dev=0) and FIFO (S_IFIFO) and device-node creation.
++
++ Falls through to do_mknod() for fake-super (am_root < 0) and for
++ sockets, both of which use auxiliary path-based syscalls that
++ don't have an *at() variant in any portable form.
++*/
++int do_mknod_at(const char *pathname, mode_t mode, dev_t dev)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return do_mknod(pathname, mode, dev);
++
++ if (am_root < 0)
++ return do_mknod(pathname, mode, dev);
++
++#if !defined MKNOD_CREATES_SOCKETS && defined HAVE_SYS_UN_H
++ if (S_ISSOCK(mode))
++ return do_mknod(pathname, mode, dev);
++#endif
++
++ if (!pathname || !*pathname || *pathname == '/')
++ return do_mknod(pathname, mode, dev);
++
++ slash = strrchr(pathname, '/');
++ if (!slash)
++ return do_mknod(pathname, mode, dev);
++
++ dlen = slash - pathname;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, pathname, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++#if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO
++ if (S_ISFIFO(mode))
++ ret = mkfifoat(dfd, bname, mode);
++ else
++#endif
++ ret = mknodat(dfd, bname, mode, dev);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_mknod(pathname, mode, dev);
++#endif
++}
++
+ int do_rmdir(const char *pathname)
+ {
+ if (dry_run) return 0;
+@@ -222,6 +573,57 @@ int do_rmdir(const char *pathname)
+ return rmdir(pathname);
+ }
+
++/*
++ Symlink-race-safe variant of do_rmdir(). See do_unlink_at() above;
++ same shape but with AT_REMOVEDIR set to require the target be a
++ directory.
++*/
++int do_rmdir_at(const char *pathname)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return rmdir(pathname);
++
++ if (!pathname || !*pathname || *pathname == '/')
++ return rmdir(pathname);
++
++ slash = strrchr(pathname, '/');
++ if (!slash)
++ return rmdir(pathname);
++
++ dlen = slash - pathname;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, pathname, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = unlinkat(dfd, bname, AT_REMOVEDIR);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_rmdir(pathname);
++#endif
++}
++
+ int do_open(const char *pathname, int flags, mode_t mode)
+ {
+ if (flags != O_RDONLY) {
+@@ -370,6 +772,89 @@ int do_rename(const char *old_path, const char *new_path)
+ return rename(old_path, new_path);
+ }
+
++/*
++ Symlink-race-safe variant of do_rename() for receiver-side use. See
++ the comment on do_chmod_at() for the threat model and design rationale.
++
++ rename() is the central tmp -> final operation in rsync; if either the
++ source or the destination has an attacker-substituted symlink in one
++ of its parent components, the rename can publish or vanish files
++ outside the module. Defence: open the parent of *each* path under
++ secure_relative_open() and use renameat() against the resulting
++ dirfds. When old_path and new_path share the same parent (the common
++ case -- tmp file living next to its final name), we reuse the same
++ dirfd for both sides.
++
++ Falls through to do_rename() in dry-run, non-daemon, chrooted, no-
++ parent and absolute-path cases, identical to the other do_*_at()
++ wrappers.
++*/
++int do_rename_at(const char *old_path, const char *new_path)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char old_dirpath[MAXPATHLEN], new_dirpath[MAXPATHLEN];
++ const char *old_bname, *new_bname;
++ const char *old_slash, *new_slash;
++ int old_dfd = -1, new_dfd = -1, ret = -1, e;
++ size_t old_dlen, new_dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return do_rename(old_path, new_path);
++
++ if (!old_path || !*old_path || *old_path == '/'
++ || !new_path || !*new_path || *new_path == '/')
++ return do_rename(old_path, new_path);
++
++ old_slash = strrchr(old_path, '/');
++ new_slash = strrchr(new_path, '/');
++ if (!old_slash || !new_slash)
++ return do_rename(old_path, new_path);
++
++ old_dlen = old_slash - old_path;
++ new_dlen = new_slash - new_path;
++ if (old_dlen >= sizeof old_dirpath || new_dlen >= sizeof new_dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(old_dirpath, old_path, old_dlen);
++ old_dirpath[old_dlen] = '\0';
++ memcpy(new_dirpath, new_path, new_dlen);
++ new_dirpath[new_dlen] = '\0';
++ old_bname = old_slash + 1;
++ new_bname = new_slash + 1;
++
++ old_dfd = secure_relative_open(NULL, old_dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (old_dfd < 0)
++ return -1;
++
++ if (old_dlen == new_dlen && memcmp(old_dirpath, new_dirpath, old_dlen) == 0) {
++ new_dfd = old_dfd;
++ } else {
++ new_dfd = secure_relative_open(NULL, new_dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (new_dfd < 0) {
++ e = errno;
++ close(old_dfd);
++ errno = e;
++ return -1;
++ }
++ }
++
++ ret = renameat(old_dfd, old_bname, new_dfd, new_bname);
++ e = errno;
++ if (new_dfd != old_dfd)
++ close(new_dfd);
++ close(old_dfd);
++ errno = e;
++ return ret;
++#else
++ return do_rename(old_path, new_path);
++#endif
++}
++
+ #ifdef HAVE_FTRUNCATE
+ int do_ftruncate(int fd, OFF_T size)
+ {
+@@ -412,6 +897,66 @@ int do_mkdir(char *path, mode_t mode)
+ return mkdir(path, mode);
+ }
+
++/*
++ Symlink-race-safe variant of do_mkdir() for receiver-side use. See
++ the comment on do_chmod_at() for the threat model and design rationale.
++
++ mkdir() resolves parent symlinks at every component, so a parent-
++ component swap can place an attacker-named directory outside the
++ module. Defence: open the parent of fname under secure_relative_open()
++ and call mkdirat() against that dirfd.
++
++ Mutates path in place to trim trailing slashes (matches do_mkdir()).
++ Falls through to do_mkdir() in dry-run, non-daemon, chrooted, no-
++ parent and absolute-path cases.
++*/
++int do_mkdir_at(char *path, mode_t mode)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++ trim_trailing_slashes(path);
++
++ if (!am_daemon || am_chrooted)
++ return mkdir(path, mode);
++
++ if (!path || !*path || *path == '/')
++ return mkdir(path, mode);
++
++ slash = strrchr(path, '/');
++ if (!slash)
++ return mkdir(path, mode);
++
++ dlen = slash - path;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, path, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = mkdirat(dfd, bname, mode);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_mkdir(path, mode);
++#endif
++}
++
+ /* like mkstemp but forces permissions */
+ int do_mkstemp(char *template, mode_t perms)
+ {
+@@ -465,6 +1010,76 @@ int do_lstat(const char *path, STRUCT_STAT *st)
+ #endif
+ }
+
++/*
++ Symlink-race-safe variants of do_stat() / do_lstat() for receiver-
++ side use. See the comment on do_chmod_at() for the threat model.
++ stat() and lstat() resolve parent components, so a parent-symlink
++ swap can make the receiver's stat see attributes of a victim file
++ outside the module -- which then drives later behaviour (e.g.
++ "this isn't a directory, delete it" -> attacker-controlled unlink
++ on something outside the module).
++
++ Defence: open the parent under secure_relative_open() and use
++ fstatat() with AT_SYMLINK_NOFOLLOW (lstat) or 0 (stat) against
++ that dirfd. Same fall-through gating as the other wrappers.
++*/
++static int do_xstat_at(const char *path, STRUCT_STAT *st, int at_flags, int (*fallback)(const char *, STRUCT_STAT *))
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (!am_daemon || am_chrooted)
++ return fallback(path, st);
++
++ if (!path || !*path || *path == '/')
++ return fallback(path, st);
++
++ slash = strrchr(path, '/');
++ if (!slash)
++ return fallback(path, st);
++
++ dlen = slash - path;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, path, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = fstatat(dfd, bname, st, at_flags);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return fallback(path, st);
++#endif
++}
++
++int do_stat_at(const char *path, STRUCT_STAT *st)
++{
++ return do_xstat_at(path, st, 0, do_stat);
++}
++
++int do_lstat_at(const char *path, STRUCT_STAT *st)
++{
++#ifdef SUPPORT_LINKS
++ return do_xstat_at(path, st, AT_SYMLINK_NOFOLLOW, do_lstat);
++#else
++ return do_xstat_at(path, st, 0, do_stat);
++#endif
++}
++
+ int do_fstat(int fd, STRUCT_STAT *st)
+ {
+ #ifdef USE_STAT64_FUNCS
+@@ -486,12 +1101,26 @@ OFF_T do_lseek(int fd, OFF_T offset, int whence)
+ #ifdef HAVE_SETATTRLIST
+ int do_setattrlist_times(const char *path, STRUCT_STAT *stp)
+ {
++ extern int am_daemon, am_chrooted;
+ struct attrlist attrList;
+ struct timespec ts[2];
+
+ if (dry_run) return 0;
+ RETURN_ERROR_IF_RO_OR_LO;
+
++ /* setattrlist() takes a raw path and follows parent symlinks
++ * (FSOPT_NOFOLLOW only blocks the final component). On a
++ * daemon-no-chroot deployment, return ENOSYS so set_times()'
++ * tier walk falls through to do_utimensat_at(), which routes
++ * the timestamp update through a secure parent dirfd. The
++ * macOS-specific attribute set this function would have used
++ * (ATTR_CMN_MODTIME / ATTR_CMN_ACCTIME) is the same set
++ * utimensat() handles, so no functionality is lost. */
++ if (am_daemon && !am_chrooted) {
++ errno = ENOSYS;
++ return -1;
++ }
++
+ /* Yes, this is in the opposite order of utime and similar. */
+ ts[0].tv_sec = stp->st_mtime;
+ ts[0].tv_nsec = stp->ST_MTIME_NSEC;
+@@ -508,12 +1137,25 @@ int do_setattrlist_times(const char *path, STRUCT_STAT *stp)
+ #ifdef SUPPORT_CRTIMES
+ int do_setattrlist_crtime(const char *path, time_t crtime)
+ {
++ extern int am_daemon, am_chrooted;
+ struct attrlist attrList;
+ struct timespec ts;
+
+ if (dry_run) return 0;
+ RETURN_ERROR_IF_RO_OR_LO;
+
++ /* Same path-follows-parent-symlinks concern as
++ * do_setattrlist_times. There is no portable at-aware variant
++ * of setattrlist that targets ATTR_CMN_CRTIME, so on a
++ * daemon-no-chroot deployment we return -1 and accept that
++ * crtime preservation is silently dropped for that file (the
++ * caller treats this as "crtime not updated"). The transfer
++ * itself continues normally. */
++ if (am_daemon && !am_chrooted) {
++ errno = ENOSYS;
++ return -1;
++ }
++
+ ts.tv_sec = crtime;
+ ts.tv_nsec = 0;
+
+@@ -529,10 +1171,19 @@ int do_setattrlist_crtime(const char *path, time_t crtime)
+ time_t get_create_time(const char *path, STRUCT_STAT *stp)
+ {
+ #ifdef HAVE_GETATTRLIST
++ extern int am_daemon, am_chrooted;
+ static struct create_time attrBuf;
+ struct attrlist attrList;
+
+ (void)stp;
++ /* getattrlist() is also path-based and follows parent
++ * symlinks. In daemon-no-chroot, refuse rather than read the
++ * crtime of a file the parent-symlink chain might point at
++ * outside the module. The caller's "no crtime available"
++ * path returns 0; the file gets a fresh crtime instead of
++ * preserving the source's. */
++ if (am_daemon && !am_chrooted)
++ return 0;
+ memset(&attrList, 0, sizeof attrList);
+ attrList.bitmapcount = ATTR_BIT_MAP_COUNT;
+ attrList.commonattr = ATTR_CMN_CRTIME;
+@@ -598,6 +1249,81 @@ int do_utimensat(const char *path, STRUCT_STAT *stp)
+ #endif
+ return utimensat(AT_FDCWD, path, t, AT_SYMLINK_NOFOLLOW);
+ }
++
++/*
++ Symlink-race-safe variant of do_utimensat() for receiver-side use.
++ See the comment on do_chmod_at() for the threat model. utimes()
++ resolves parent components and follows a final-component symlink;
++ lutimes() doesn't follow the final component but still resolves
++ parents. Either way, a parent-symlink swap can redirect the
++ timestamp update outside the module. Defence: open the parent of
++ path under secure_relative_open() and call utimensat() with
++ AT_SYMLINK_NOFOLLOW against that dirfd.
++
++ Falls through to do_utimensat() in the same dry-run / non-daemon /
++ chrooted / no-parent / absolute-path cases as the other wrappers.
++ Returns -1 with errno=ENOSYS on systems without utimensat()
++ (caller is expected to fall back to the legacy tier walk).
++*/
++int do_utimensat_at(const char *path, STRUCT_STAT *stp)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ struct timespec t[2];
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (dry_run) return 0;
++ RETURN_ERROR_IF_RO_OR_LO;
++
++ if (!am_daemon || am_chrooted)
++ return do_utimensat(path, stp);
++
++ if (!path || !*path || *path == '/')
++ return do_utimensat(path, stp);
++
++ slash = strrchr(path, '/');
++ if (!slash)
++ return do_utimensat(path, stp);
++
++ dlen = slash - path;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, path, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ t[0].tv_sec = stp->st_atime;
++#ifdef ST_ATIME_NSEC
++ t[0].tv_nsec = stp->ST_ATIME_NSEC;
++#else
++ t[0].tv_nsec = 0;
++#endif
++ t[1].tv_sec = stp->st_mtime;
++#ifdef ST_MTIME_NSEC
++ t[1].tv_nsec = stp->ST_MTIME_NSEC;
++#else
++ t[1].tv_nsec = 0;
++#endif
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++ ret = utimensat(dfd, bname, t, AT_SYMLINK_NOFOLLOW);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_utimensat(path, stp);
++#endif
++}
+ #endif
+
+ #ifdef HAVE_LUTIMES
+@@ -820,6 +1546,30 @@ int do_open_nofollow(const char *pathname, int flags)
+ The relpath must also not contain any ../ elements in the path.
+ */
+
++/* Returns 1 if path has any "/"-separated component that is exactly
++ * "..", 0 otherwise. Used by secure_relative_open's front-door
++ * validation to reject inputs that the per-component walk fallback
++ * would otherwise resolve through ".." -- e.g. bare "..", "foo/..",
++ * "subdir/.." -- which RESOLVE_BENEATH-equivalent kernels reject in
++ * the kernel but the per-component fallback (NetBSD/OpenBSD/Solaris/
++ * Cygwin/pre-5.6 Linux) does not. */
++static int path_has_dotdot_component(const char *path)
++{
++ const char *p = path;
++
++ while (*p) {
++ const char *q;
++ if (*p == '/') { p++; continue; }
++ q = p;
++ while (*q && *q != '/')
++ q++;
++ if (q - p == 2 && p[0] == '.' && p[1] == '.')
++ return 1;
++ p = q;
++ }
++ return 0;
++}
++
+ #ifdef __linux__
+ static int secure_relative_open_linux(const char *basedir, const char *relpath, int flags, mode_t mode)
+ {
+@@ -833,10 +1583,25 @@ static int secure_relative_open_linux(const char *basedir, const char *relpath,
+
+ if (basedir == NULL) {
+ dirfd = AT_FDCWD;
+- } else {
++ } else if (basedir[0] == '/') {
++ /* Absolute basedir: operator-trusted (module_dir and the
++ * like). Plain openat. */
+ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
+ if (dirfd == -1)
+ return -1;
++ } else {
++ /* Relative basedir: may be wire-influenced via
++ * --link-dest / --copy-dest / --compare-dest. Resolve it
++ * under the same RESOLVE_BENEATH guarantee as relpath, so
++ * a parent symlink on basedir cannot redirect the dirfd
++ * outside the CWD anchor. */
++ struct open_how bhow;
++ memset(&bhow, 0, sizeof bhow);
++ bhow.flags = O_RDONLY | O_DIRECTORY;
++ bhow.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS;
++ dirfd = syscall(SYS_openat2, AT_FDCWD, basedir, &bhow, sizeof bhow);
++ if (dirfd == -1)
++ return -1;
+ }
+
+ retfd = syscall(SYS_openat2, dirfd, relpath, &how, sizeof how);
+@@ -859,10 +1624,17 @@ static int secure_relative_open_resolve_beneath(const char *basedir, const char
+
+ if (basedir == NULL) {
+ dirfd = AT_FDCWD;
+- } else {
++ } else if (basedir[0] == '/') {
++ /* Absolute basedir: operator-trusted, plain openat. */
+ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
+ if (dirfd == -1)
+ return -1;
++ } else {
++ /* Relative basedir: confine its resolution beneath CWD
++ * (see secure_relative_open_linux for the rationale). */
++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY | O_RESOLVE_BENEATH);
++ if (dirfd == -1)
++ return -1;
+ }
+
+ retfd = openat(dirfd, relpath, flags | O_RESOLVE_BENEATH, mode);
+@@ -880,8 +1652,20 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ errno = EINVAL;
+ return -1;
+ }
+- if (strncmp(relpath, "../", 3) == 0 || strstr(relpath, "/../")) {
+- // no ../ elements allowed in the relpath
++ /* Reject any path with a literal ".." component (bare "..",
++ * "../foo", "foo/..", "foo/../bar", "subdir/.."). The previous
++ * substring-based check caught only "../" prefix and "/../"
++ * substring; bare ".." and trailing "/.." escape on the per-
++ * component walk fallback used by NetBSD/OpenBSD/Solaris/Cygwin
++ * and pre-5.6 Linux. RESOLVE_BENEATH on Linux/FreeBSD/macOS
++ * catches some of these in-kernel with EXDEV, but the front
++ * door must reject them consistently with EINVAL across all
++ * platforms so callers can rely on the validation. */
++ if (path_has_dotdot_component(relpath)) {
++ errno = EINVAL;
++ return -1;
++ }
++ if (basedir && basedir[0] != '/' && path_has_dotdot_component(basedir)) {
+ errno = EINVAL;
+ return -1;
+ }
+@@ -911,15 +1695,47 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ #else
+ int dirfd = AT_FDCWD;
+ if (basedir != NULL) {
+- dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
+- if (dirfd == -1) {
+- return -1;
++ if (basedir[0] == '/') {
++ /* Absolute basedir: operator-trusted, plain openat. */
++ dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
++ if (dirfd == -1) {
++ return -1;
++ }
++ } else {
++ /* Relative basedir: walk it component-by-component
++ * with O_NOFOLLOW. This is the per-component
++ * RESOLVE_BENEATH equivalent for platforms without
++ * kernel-supported confinement, and matches the
++ * relpath walk below. Symlinks in basedir are
++ * rejected outright on this fallback path; the
++ * Linux openat2 / O_RESOLVE_BENEATH paths above
++ * still allow within-tree symlinks. */
++ char *bcopy = my_strdup(basedir, __FILE__, __LINE__);
++ if (!bcopy)
++ return -1;
++ for (const char *part = strtok(bcopy, "/");
++ part != NULL;
++ part = strtok(NULL, "/"))
++ {
++ int next_fd = openat(dirfd, part, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
++ if (next_fd == -1) {
++ int save_errno = errno;
++ if (dirfd != AT_FDCWD) close(dirfd);
++ free(bcopy);
++ errno = save_errno;
++ return -1;
++ }
++ if (dirfd != AT_FDCWD) close(dirfd);
++ dirfd = next_fd;
++ }
++ free(bcopy);
+ }
+ }
+ int retfd = -1;
+
+ char *path_copy = my_strdup(relpath, __FILE__, __LINE__);
+ if (!path_copy) {
++ if (dirfd != AT_FDCWD) close(dirfd);
+ return -1;
+ }
+
+@@ -945,8 +1761,15 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ dirfd = next_fd;
+ }
+
+- // the path must be a directory
+- errno = EINVAL;
++ /* All components walked as directories. If the caller asked for
++ * O_DIRECTORY, return the dirfd we built up; otherwise the path
++ * resolved to a directory but the caller wanted a regular file. */
++ if ((flags & O_DIRECTORY) && dirfd != AT_FDCWD) {
++ retfd = dirfd;
++ dirfd = AT_FDCWD;
++ goto cleanup;
++ }
++ errno = EISDIR;
+
+ cleanup:
+ free(path_copy);
+diff --git a/t_secure_relpath.c b/t_secure_relpath.c
+new file mode 100644
+index 00000000..a0fdf0d2
+--- /dev/null
++++ b/t_secure_relpath.c
+@@ -0,0 +1,151 @@
++/*
++ * Test harness for secure_relative_open()'s front-door input
++ * validation. Codex audit Finding 5 noted that the existing check
++ *
++ * if (strncmp(relpath, "../", 3) == 0 || strstr(relpath, "/../"))
++ *
++ * catches "../foo" and "foo/../bar" but misses bare ".." (an actual
++ * one-level escape on platforms that fall back to the per-component
++ * walk), as well as "a/..", "foo/..", and any other form that
++ * decomposes to a ".." component when split on "/". The kernel-
++ * enforced RESOLVE_BENEATH (Linux 5.6+) and O_RESOLVE_BENEATH
++ * (FreeBSD 13+, macOS 15+) reject these in-kernel; the per-
++ * component fallback used on NetBSD, OpenBSD, Solaris, Cygwin and
++ * pre-5.6 Linux does not, so the validation must happen at the
++ * front door.
++ *
++ * This helper invokes secure_relative_open() with each suspect
++ * input and checks both the failure (rc < 0) and the errno
++ * (EINVAL means "rejected at the front door"). Pre-fix, the kernel
++ * may reject with a different errno (EXDEV from RESOLVE_BENEATH);
++ * post-fix, the front-door check catches every variant up front
++ * with a consistent EINVAL across platforms.
++ *
++ * Not linked into rsync itself.
++ */
++
++#include "rsync.h"
++
++#include <sys/stat.h>
++
++int dry_run = 0;
++int am_root = 0;
++int am_sender = 0;
++int read_only = 0;
++int list_only = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
++extern int am_daemon, am_chrooted;
++
++short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG];
++
++static int errs = 0;
++
++static void check_relpath(const char *relpath)
++{
++ int fd;
++ int saved_errno;
++
++ errno = 0;
++ fd = secure_relative_open(NULL, relpath, O_RDONLY | O_DIRECTORY, 0);
++ saved_errno = errno;
++
++ if (fd >= 0) {
++ fprintf(stderr,
++ "FAIL [relpath=%-12s]: returned valid fd %d (escape) -- expected -1 EINVAL\n",
++ relpath, fd);
++ close(fd);
++ errs++;
++ return;
++ }
++
++ if (saved_errno != EINVAL) {
++ fprintf(stderr,
++ "FAIL [relpath=%-12s]: rejected but errno=%d (%s), expected EINVAL\n",
++ relpath, saved_errno, strerror(saved_errno));
++ errs++;
++ return;
++ }
++
++ fprintf(stderr, "OK [relpath=%-12s]: rejected with EINVAL\n", relpath);
++}
++
++static void check_basedir(const char *basedir)
++{
++ int fd;
++ int saved_errno;
++
++ errno = 0;
++ fd = secure_relative_open(basedir, "ok", O_RDONLY | O_DIRECTORY, 0);
++ saved_errno = errno;
++
++ if (fd >= 0) {
++ fprintf(stderr,
++ "FAIL [basedir=%-12s]: returned valid fd %d -- expected -1 EINVAL\n",
++ basedir, fd);
++ close(fd);
++ errs++;
++ return;
++ }
++
++ if (saved_errno != EINVAL) {
++ fprintf(stderr,
++ "FAIL [basedir=%-12s]: rejected but errno=%d (%s), expected EINVAL\n",
++ basedir, saved_errno, strerror(saved_errno));
++ errs++;
++ return;
++ }
++
++ fprintf(stderr, "OK [basedir=%-12s]: rejected with EINVAL\n", basedir);
++}
++
++int main(int argc, char **argv)
++{
++ if (argc != 2) {
++ fprintf(stderr, "usage: %s <test-dir>\n", argv[0]);
++ return 2;
++ }
++ if (chdir(argv[1]) < 0) {
++ perror("chdir");
++ return 2;
++ }
++
++ /* secure_relative_open's daemon-only confinement protections only
++ * fire when am_daemon && !am_chrooted (the threat model is the
++ * daemon-no-chroot deployment), but the front-door input
++ * validation runs unconditionally. We set am_daemon anyway so the
++ * helper exercises the same code shape the receiver does. */
++ am_daemon = 1;
++ am_chrooted = 0;
++
++ mkdir("subdir", 0755);
++
++ /* Each of these relpaths must be rejected with EINVAL at the
++ * secure_relative_open() front door. ".." is the actual one-level
++ * escape; the others ("subdir/..", "subdir/../subdir") resolve
++ * back to the start dir on systems that allow them, but we still
++ * reject them as defence-in-depth: a path containing a ".." token
++ * is suspicious and the caller should normalise before passing
++ * it in. The "../foo" / "foo/../bar" / "/foo" / "/" cases are
++ * regression checks for the existing checks. */
++ check_relpath("..");
++ check_relpath("../foo");
++ check_relpath("subdir/..");
++ check_relpath("subdir/../subdir");
++ check_relpath("foo/../bar");
++ check_relpath("/foo");
++ check_relpath("/");
++
++ /* Same checks against basedir (which the codex Finding 2 fix
++ * routes through the same RESOLVE_BENEATH-equivalent). Absolute
++ * basedirs are operator-trusted and intentionally not validated
++ * here. */
++ check_basedir("..");
++ check_basedir("../subdir");
++ check_basedir("subdir/..");
++ check_basedir("foo/../bar");
++
++ if (errs)
++ fprintf(stderr, "\n%d failure(s)\n", errs);
++ return errs ? 1 : 0;
++}
+diff --git a/testsuite/alt-dest-symlink-race.test b/testsuite/alt-dest-symlink-race.test
+new file mode 100755
+index 00000000..2256f2f2
+--- /dev/null
++++ b/testsuite/alt-dest-symlink-race.test
+@@ -0,0 +1,96 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for the basedir-confinement gap in
++# secure_relative_open(). The function opens basedir with a plain
++# openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY), without
++# RESOLVE_BENEATH or a per-component O_NOFOLLOW walk, so a parent
++# symlink ON basedir is followed unrestrictedly. RESOLVE_BENEATH is
++# then applied only to relpath, anchored at the wrong directory.
++#
++# The receiver's basis-file lookup at receiver.c passes
++# basis_dir[fnamecmp_type] (from --copy-dest / --link-dest /
++# --compare-dest -- all sender-controllable in daemon mode) as
++# basedir. A daemon-module attacker with write access can plant a
++# symlink at module/cd -> /outside, then run --link-dest=cd to
++# make the daemon's basis-file lookup resolve into /outside,
++# leaking the contents of daemon-readable files via the rsync
++# delta-rolling read-disclosure primitive.
++#
++# We detect the escape by leveraging --link-dest: when basis
++# matches source exactly (content + mtime + mode), --link-dest
++# hard-links the destination to the basis file. With the bug, the
++# destination ends up as a hard link to the outside-the-module
++# file (same inode). With the fix, no basis is found and the
++# destination is a fresh copy (different inode).
++#
++# The vulnerable code path is the same on every platform
++# (including the per-component fallback on systems without
++# RESOLVE_BENEATH), so this test is not platform-gated.
++
++. "$suitedir/rsync.fns"
++
++mod="$scratchdir/module"
++outside="$scratchdir/outside"
++src="$scratchdir/src"
++conf="$scratchdir/test-rsyncd.conf"
++
++rm -rf "$mod" "$outside" "$src"
++mkdir -p "$mod" "$outside" "$src"
++
++# Portable inode-number helper (GNU coreutils stat -c, BSD stat -f).
++file_inode() {
++ stat -c %i "$1" 2>/dev/null || stat -f %i "$1"
++}
++
++# Outside-the-module file an attacker would like the daemon to
++# treat as a basis.
++echo "OUTSIDE_SECRET_DATA" > "$outside/target.txt"
++chmod 0644 "$outside/target.txt"
++
++# The symlink trap planted in the module by the local attacker.
++ln -s "$outside" "$mod/cd"
++
++# Source file matches outside/target.txt exactly (content + mtime
++# + mode) so --link-dest will hard-link the destination to the
++# basis file iff the daemon's basedir lookup reaches outside/.
++echo "OUTSIDE_SECRET_DATA" > "$src/target.txt"
++touch -r "$outside/target.txt" "$src/target.txt"
++chmod 0644 "$src/target.txt"
++
++cat > "$conf" <<EOF
++use chroot = no
++log file = $scratchdir/rsyncd.log
++[upload]
++ path = $mod
++ use chroot = no
++ read only = no
++EOF
++
++# Recursive --link-dest push directly into the module root. We
++# avoid pushing into a destination subdir because the receiver
++# would chdir into it before resolving --link-dest, making the
++# relative basedir "cd" resolve in the wrong CWD and masking the
++# bug. The realistic attack pushes into the module root (or the
++# attacker uses a basedir path that resolves correctly from
++# whichever subdir the receiver chdirs into).
++RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon" \
++ $RSYNC -rtp --link-dest=cd "$src/" rsync://localhost/upload/ \
++ >/dev/null 2>&1 || true
++
++if [ ! -f "$mod/target.txt" ]; then
++ test_fail "destination file was not created -- daemon transfer failed before the test could observe the basedir behaviour"
++fi
++
++outside_inode=$(file_inode "$outside/target.txt")
++dst_inode=$(file_inode "$mod/target.txt")
++
++if [ "$outside_inode" = "$dst_inode" ]; then
++ test_fail "basedir-escape: --link-dest hard-linked module/target.txt to outside/target.txt (inode $outside_inode); daemon's basis-file lookup followed the parent symlink on the basedir"
++fi
++
++exit 0
+diff --git a/testsuite/secure-relpath-validation.test b/testsuite/secure-relpath-validation.test
+new file mode 100755
+index 00000000..5b77f7cc
+--- /dev/null
++++ b/testsuite/secure-relpath-validation.test
+@@ -0,0 +1,34 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for codex audit Finding 5: secure_relative_open()'s
++# front-door input check rejects "../foo" and "foo/../bar" but
++# misses bare "..", "subdir/..", and other variants whose "/"-split
++# components contain a literal "..". The kernel-enforced
++# RESOLVE_BENEATH (Linux 5.6+) and O_RESOLVE_BENEATH
++# (FreeBSD 13+, macOS 15+) reject these in-kernel; the per-component
++# walk fallback used on NetBSD, OpenBSD, Solaris, Cygwin and pre-5.6
++# Linux does not -- so the validation must happen at the front door.
++#
++# This test invokes the t_secure_relpath helper, which calls
++# secure_relative_open() with each suspect input and verifies the
++# return value is -1 with errno == EINVAL. EINVAL is the marker
++# that the front-door rejected the input, not the kernel; pre-fix
++# the kernel returns -1 with EXDEV (or, on the per-component
++# fallback, may return a valid fd at all -- "escape").
++
++. "$suitedir/rsync.fns"
++
++testdir="$scratchdir/relpath-test"
++rm -rf "$testdir"
++mkdir -p "$testdir"
++
++if ! "$TOOLDIR/t_secure_relpath" "$testdir"; then
++ test_fail "t_secure_relpath rejected one or more inputs incorrectly (see stderr above for the specific case)"
++fi
++
++exit 0
+diff --git a/util1.c b/util1.c
+index 6e457d4f..8850019f 100644
+--- a/util1.c
++++ b/util1.c
+@@ -141,7 +141,7 @@ int set_times(const char *fname, STRUCT_STAT *stp)
+
+ #ifdef HAVE_UTIMENSAT
+ #include "case_N.h"
+- if (do_utimensat(fname, stp) == 0)
++ if (do_utimensat_at(fname, stp) == 0)
+ break;
+ if (errno != ENOSYS)
+ return -1;
+@@ -479,13 +479,13 @@ int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode)
+ int robust_unlink(const char *fname)
+ {
+ #ifndef ETXTBSY
+- return do_unlink(fname);
++ return do_unlink_at(fname);
+ #else
+ static int counter = 1;
+ int rc, pos, start;
+ char path[MAXPATHLEN];
+
+- rc = do_unlink(fname);
++ rc = do_unlink_at(fname);
+ if (rc == 0 || errno != ETXTBSY)
+ return rc;
+
+@@ -515,7 +515,7 @@ int robust_unlink(const char *fname)
+ }
+
+ /* maybe we should return rename()'s exit status? Nah. */
+- if (do_rename(fname, path) != 0) {
++ if (do_rename_at(fname, path) != 0) {
+ errno = ETXTBSY;
+ return -1;
+ }
+@@ -538,7 +538,7 @@ int robust_rename(const char *from, const char *to, const char *partialptr,
+ return 0;
+
+ while (tries--) {
+- if (do_rename(from, to) == 0)
++ if (do_rename_at(from, to) == 0)
+ return 0;
+
+ switch (errno) {
+@@ -559,7 +559,7 @@ int robust_rename(const char *from, const char *to, const char *partialptr,
+ }
+ if (copy_file(from, to, -1, mode) != 0)
+ return -2;
+- do_unlink(from);
++ do_unlink_at(from);
+ return 1;
+ default:
+ return -1;
+@@ -1329,20 +1329,20 @@ int handle_partial_dir(const char *fname, int create)
+ dir = partial_fname;
+ if (create) {
+ STRUCT_STAT st;
+- int statret = do_lstat(dir, &st);
++ int statret = do_lstat_at(dir, &st);
+ if (statret == 0 && !S_ISDIR(st.st_mode)) {
+- if (do_unlink(dir) < 0) {
++ if (do_unlink_at(dir) < 0) {
+ *fn = '/';
+ return 0;
+ }
+ statret = -1;
+ }
+- if (statret < 0 && do_mkdir(dir, 0700) < 0) {
++ if (statret < 0 && do_mkdir_at(dir, 0700) < 0) {
+ *fn = '/';
+ return 0;
+ }
+ } else
+- do_rmdir(dir);
++ do_rmdir_at(dir);
+ *fn = '/';
+
+ return 1;
+diff --git a/xattrs.c b/xattrs.c
+index 4462d63b..2e16024b 100644
+--- a/xattrs.c
++++ b/xattrs.c
+@@ -1249,7 +1249,12 @@ int set_stat_xattr(const char *fname, struct file_struct *file, mode_t new_mode)
+
+ int x_stat(const char *fname, STRUCT_STAT *fst, STRUCT_STAT *xst)
+ {
+- int ret = do_stat(fname, fst);
++ /* Use the *_at variants so that on a daemon-no-chroot deployment
++ * the metadata read goes through a secure parent dirfd instead
++ * of bare path resolution. The *_at wrappers fall through to
++ * plain do_stat outside the daemon-no-chroot context, so this
++ * change is transparent for non-daemon use. */
++ int ret = do_stat_at(fname, fst);
+ if ((ret < 0 || get_stat_xattr(fname, -1, fst, xst) < 0) && xst)
+ xst->st_mode = 0;
+ return ret;
+@@ -1257,7 +1262,7 @@ int x_stat(const char *fname, STRUCT_STAT *fst, STRUCT_STAT *xst)
+
+ int x_lstat(const char *fname, STRUCT_STAT *fst, STRUCT_STAT *xst)
+ {
+- int ret = do_lstat(fname, fst);
++ int ret = do_lstat_at(fname, fst);
+ if ((ret < 0 || get_stat_xattr(fname, -1, fst, xst) < 0) && xst)
+ xst->st_mode = 0;
+ return ret;
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch
new file mode 100644
index 00000000000..26d2122d7c9
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p4.patch
@@ -0,0 +1,568 @@
+From 1efd7d95ad3813ea3d4b303d277cd46297f7c2f5 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Wed, 6 May 2026 09:45:30 +1000
+Subject: [PATCH] util1+syscall: secure copy_file source/dest opens; bare-path
+ defence-in-depth
+
+Three related codex audit findings:
+
+ Finding 3a: copy_file()'s source open in util1.c used
+ do_open_nofollow(), which only rejects a final-component
+ symlink. A parent-component symlink (e.g. --copy-dest=cd where
+ cd -> /outside) follows freely and reads outside the module.
+ Route through secure_relative_open() with O_NOFOLLOW.
+
+ Finding 3b: generator.c's in-place backup-file create still
+ used a bare do_open with O_CREAT, leaving a tiny but reachable
+ parent-symlink window between the secure unlink (already
+ through do_unlink_at) and the create. Add do_open_at() that
+ goes through a secure parent dirfd, and route the call site
+ through it.
+
+ Finding 3c: copy_file()'s destination open in
+ unlink_and_reopen() had the same bare-do_open pattern; route
+ through do_open_at as well.
+
+Adds testsuite/copy-dest-source-symlink.test and
+testsuite/bare-do-open-symlink-race.test as regression coverage
+for both attack shapes.
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-43619
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/3cc6a9e8cdcffb637ecdd41dae47833096dca317]
+
+(cherry picked from commit 3cc6a9e8cdcffb637ecdd41dae47833096dca317)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ generator.c | 2 +-
+ syscall.c | 138 +++++++++++++++--
+ testsuite/bare-do-open-symlink-race.test | 186 +++++++++++++++++++++++
+ testsuite/copy-dest-source-symlink.test | 83 ++++++++++
+ util1.c | 21 ++-
+ 5 files changed, 416 insertions(+), 14 deletions(-)
+ create mode 100755 testsuite/bare-do-open-symlink-race.test
+ create mode 100755 testsuite/copy-dest-source-symlink.test
+
+diff --git a/generator.c b/generator.c
+index e5b2d176..311e9b78 100644
+--- a/generator.c
++++ b/generator.c
+@@ -1896,7 +1896,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ back_file = NULL;
+ goto cleanup;
+ }
+- if ((f_copy = do_open(backupptr, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, 0600)) < 0) {
++ if ((f_copy = do_open_at(backupptr, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, 0600)) < 0) {
+ rsyserr(FERROR_XFER, errno, "open %s", full_fname(backupptr));
+ unmake_file(back_file);
+ back_file = NULL;
+diff --git a/syscall.c b/syscall.c
+index ffd8df20..10a3c231 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -203,11 +203,6 @@ int do_symlink_at(const char *lnk, const char *path)
+ if (!am_daemon || am_chrooted)
+ return do_symlink(lnk, path);
+
+-#if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS
+- if (am_root < 0)
+- return do_symlink(lnk, path);
+-#endif
+-
+ if (!path || !*path || *path == '/')
+ return do_symlink(lnk, path);
+
+@@ -228,6 +223,34 @@ int do_symlink_at(const char *lnk, const char *path)
+ if (dfd < 0)
+ return -1;
+
++#if defined NO_SYMLINK_XATTRS || defined NO_SYMLINK_USER_XATTRS
++ /* For --fake-super, do_symlink writes the link target into a
++ * regular file rather than creating a real symlink. Do that
++ * here against the secure dirfd, with O_NOFOLLOW so a pre-
++ * planted symlink at the basename can't redirect the file
++ * creation. (Previously the fake-super branch fell through to
++ * the bare-path do_symlink at the top of the function.) */
++ if (am_root < 0) {
++ int len = strlen(lnk);
++ int fd = openat(dfd, bname,
++ O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW,
++ S_IWUSR | S_IRUSR);
++ if (fd < 0) {
++ e = errno;
++ close(dfd);
++ errno = e;
++ return -1;
++ }
++ ret = (write(fd, lnk, len) == len) ? 0 : -1;
++ if (close(fd) < 0)
++ ret = -1;
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++ }
++#endif
++
+ ret = symlinkat(lnk, dfd, bname);
+ e = errno;
+ close(dfd);
+@@ -503,9 +526,12 @@ int do_mknod(const char *pathname, mode_t mode, dev_t dev)
+ mknodat() against that dirfd. mknodat() covers both regular-file
+ (S_IFREG with dev=0) and FIFO (S_IFIFO) and device-node creation.
+
+- Falls through to do_mknod() for fake-super (am_root < 0) and for
+- sockets, both of which use auxiliary path-based syscalls that
+- don't have an *at() variant in any portable form.
++ Fake-super (am_root < 0) is handled inline against the secure
++ parent dirfd: it creates a regular empty file (the same file-as-
++ metadata-placeholder pattern do_mknod uses) via openat() with
++ O_NOFOLLOW. Sockets fall through to do_mknod() because their
++ bind(2) takes a path argument with no portable bindat() variant;
++ this is documented as a residual.
+ */
+ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev)
+ {
+@@ -523,9 +549,6 @@ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev)
+ if (!am_daemon || am_chrooted)
+ return do_mknod(pathname, mode, dev);
+
+- if (am_root < 0)
+- return do_mknod(pathname, mode, dev);
+-
+ #if !defined MKNOD_CREATES_SOCKETS && defined HAVE_SYS_UN_H
+ if (S_ISSOCK(mode))
+ return do_mknod(pathname, mode, dev);
+@@ -551,6 +574,29 @@ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev)
+ if (dfd < 0)
+ return -1;
+
++ if (am_root < 0) {
++ /* For --fake-super, do_mknod creates a regular empty
++ * file as a placeholder for the special-file metadata
++ * (which is stored in xattrs elsewhere). Do that against
++ * the secure dirfd, with O_NOFOLLOW so a pre-planted
++ * symlink at the basename can't redirect the file
++ * creation. */
++ int fd = openat(dfd, bname,
++ O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW,
++ S_IWUSR | S_IRUSR);
++ if (fd < 0) {
++ e = errno;
++ close(dfd);
++ errno = e;
++ return -1;
++ }
++ ret = (close(fd) < 0) ? -1 : 0;
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++ }
++
+ #if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO
+ if (S_ISFIFO(mode))
+ ret = mkfifoat(dfd, bname, mode);
+@@ -639,6 +685,76 @@ int do_open(const char *pathname, int flags, mode_t mode)
+ return open(pathname, flags | O_BINARY, mode);
+ }
+
++/*
++ Symlink-race-safe variant of do_open() for receiver-side use. See
++ the comment on do_chmod_at() for the threat model. open() resolves
++ parent components, so a parent-symlink swap can redirect the open
++ to a file outside the module. This wrapper is defence-in-depth for
++ bare-path do_open() sites that callers know are otherwise
++ protected by secure parent-syscalls (e.g. generator.c's in-place
++ backup creation, where robust_unlink() rejects the symlinked
++ parent before this open is reached): if any of those upstream
++ protections is later removed or regresses, the open here still
++ refuses to escape the module.
++
++ Defence: open the parent of pathname under secure_relative_open()
++ and call openat() against the resulting dirfd with O_NOFOLLOW
++ (so the basename itself isn't followed if it happens to be a
++ pre-planted symlink, which is what we want for O_CREAT|O_EXCL).
++*/
++int do_open_at(const char *pathname, int flags, mode_t mode)
++{
++#ifdef AT_FDCWD
++ extern int am_daemon, am_chrooted;
++ char dirpath[MAXPATHLEN];
++ const char *bname;
++ const char *slash;
++ int dfd, ret, e;
++ size_t dlen;
++
++ if (flags != O_RDONLY) {
++ RETURN_ERROR_IF(dry_run, 0);
++ RETURN_ERROR_IF_RO_OR_LO;
++ }
++
++ if (!am_daemon || am_chrooted)
++ return do_open(pathname, flags, mode);
++
++ if (!pathname || !*pathname || *pathname == '/')
++ return do_open(pathname, flags, mode);
++
++ slash = strrchr(pathname, '/');
++ if (!slash)
++ return do_open(pathname, flags, mode);
++
++ dlen = slash - pathname;
++ if (dlen >= sizeof dirpath) {
++ errno = ENAMETOOLONG;
++ return -1;
++ }
++ memcpy(dirpath, pathname, dlen);
++ dirpath[dlen] = '\0';
++ bname = slash + 1;
++
++ dfd = secure_relative_open(NULL, dirpath, O_RDONLY | O_DIRECTORY, 0);
++ if (dfd < 0)
++ return -1;
++
++#ifdef O_NOATIME
++ if (open_noatime)
++ flags |= O_NOATIME;
++#endif
++
++ ret = openat(dfd, bname, flags | O_NOFOLLOW | O_BINARY, mode);
++ e = errno;
++ close(dfd);
++ errno = e;
++ return ret;
++#else
++ return do_open(pathname, flags, mode);
++#endif
++}
++
+ #ifdef HAVE_CHMOD
+ int do_chmod(const char *path, mode_t mode)
+ {
+diff --git a/testsuite/bare-do-open-symlink-race.test b/testsuite/bare-do-open-symlink-race.test
+new file mode 100755
+index 00000000..b8c51bbe
+--- /dev/null
++++ b/testsuite/bare-do-open-symlink-race.test
+@@ -0,0 +1,186 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for codex audit Findings 3b and 3c:
++#
++# 3b: generator.c:1905 -- the in-place backup creation opens
++# backupptr via bare do_open(O_WRONLY|O_CREAT|O_TRUNC|O_EXCL).
++# With --backup-dir set to an attacker-planted parent symlink,
++# the backup file is written outside the module under the
++# daemon's authority.
++#
++# 3c-symlink: syscall.c:207 -- do_symlink_at falls through to bare
++# do_symlink for am_root < 0 (fake-super), which then opens
++# the destination path with bare open() (final-component
++# fake-super file). A parent symlink on the destination path
++# redirects the file creation outside the module.
++#
++# 3c-mknod: syscall.c:506 -- do_mknod_at falls through to bare
++# do_mknod for am_root < 0, same path-based open(). For
++# FIFOs/sockets/devices the bare path is also used.
++#
++# Each scenario plants a "secret" file outside the module at a
++# location the symlink trap points to. The check is that the
++# outside file's content and mode are unchanged after the attack
++# attempt.
++
++. "$suitedir/rsync.fns"
++
++# All three scenarios depend on receiver-side daemon code paths
++# that are only secured on platforms with a working
++# secure_relative_open. The chdir/chmod tests already skip the
++# same set; mirror that.
++case "$(uname -s)" in
++ SunOS|OpenBSD|NetBSD|CYGWIN*)
++ test_skipped "secure_relative_open relies on RESOLVE_BENEATH-equivalent kernel support not available on $(uname -s)"
++ ;;
++esac
++
++mod="$scratchdir/module"
++outside="$scratchdir/outside"
++src="$scratchdir/src"
++conf="$scratchdir/test-rsyncd.conf"
++
++# Portable inode-and-mode helpers.
++file_mode() {
++ stat -c %a "$1" 2>/dev/null || stat -f %Lp "$1"
++}
++
++setup() {
++ rm -rf "$mod" "$outside" "$src"
++ mkdir -p "$mod" "$outside" "$src"
++
++ echo "OUTSIDE_PROTECTED_DATA" > "$outside/target.txt"
++ chmod 0644 "$outside/target.txt"
++ outside_pristine="$scratchdir/outside-pristine.txt"
++ cp -p "$outside/target.txt" "$outside_pristine"
++
++ ln -s "$outside" "$mod/cd"
++}
++
++verify_outside_unchanged() {
++ label="$1"
++ mode=$(file_mode "$outside/target.txt")
++ case "$mode" in
++ 644|0644) ;;
++ *) test_fail "$label: outside/target.txt mode changed from 644 to $mode" ;;
++ esac
++ if ! cmp -s "$outside/target.txt" "$outside_pristine"; then
++ test_fail "$label: outside/target.txt content changed -- daemon followed the cd symlink"
++ fi
++}
++
++verify_outside_unchanged_or_absent() {
++ label="$1"
++ target="$2" # specific file under outside/ to check absence of
++ if [ -e "$outside/$target" ]; then
++ test_fail "$label: outside/$target was created -- daemon followed the cd symlink"
++ fi
++}
++
++
++############################################################
++# Scenario 3b: --inplace --backup --backup-dir=cd
++#
++# Pre-create module/target.txt so the receiver enters the in-place
++# update path; a backup of the existing content must be made
++# before the update. With --backup-dir=cd, backupptr resolves to
++# "cd/target.txt"; with the bug, robust_unlink and the bare
++# do_open at generator.c:1905 both follow the cd symlink, the
++# unlink deletes outside/target.txt and the create writes the
++# pre-existing module/target.txt content there.
++############################################################
++
++setup
++echo "EXISTING_MODULE_DATA" > "$mod/target.txt"
++chmod 0666 "$mod/target.txt"
++echo "NEW_DATA_FROM_SENDER" > "$src/target.txt"
++chmod 0644 "$src/target.txt"
++
++cat > "$conf" <<EOF
++use chroot = no
++log file = $scratchdir/rsyncd.log
++[upload]
++ path = $mod
++ use chroot = no
++ read only = no
++EOF
++
++RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon" \
++ $RSYNC --inplace --backup --backup-dir=cd "$src/target.txt" \
++ rsync://localhost/upload/target.txt >/dev/null 2>&1 || true
++
++verify_outside_unchanged "3b inplace+backup-dir=cd"
++
++
++############################################################
++# Scenario 3c-symlink: fake-super symlink push to a path with a
++# symlinked parent
++#
++# With "fake super = yes" set on the module, the receiver
++# represents symlinks as fake-super files (regular files with the
++# link target written to them). The path-based open() in
++# do_symlink's fake-super branch follows parent symlinks. We push
++# a single symlink to the destination path "cd/sym" so the
++# receiver's create-file call lands at "cd/sym" relative to the
++# module root, where cd is the symlink trap.
++############################################################
++
++setup
++
++mkdir -p "$src/cd"
++ln -s /etc/passwd "$src/cd/sym"
++
++cat > "$conf" <<EOF
++use chroot = no
++log file = $scratchdir/rsyncd.log
++[upload_fake]
++ path = $mod
++ use chroot = no
++ read only = no
++ fake super = yes
++EOF
++
++RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon" \
++ $RSYNC -rl "$src/" rsync://localhost/upload_fake/ >/dev/null 2>&1 || true
++
++verify_outside_unchanged_or_absent "3c-symlink fake-super symlink push" "sym"
++
++
++############################################################
++# Scenario 3c-mknod: fake-super FIFO push to a path with a
++# symlinked parent
++#
++# Similar to 3c-symlink but for special files. mkfifo works
++# without root; we push a FIFO and verify the receiver doesn't
++# create a fake-super file at outside/fifo.
++############################################################
++
++setup
++
++mkdir -p "$src/cd"
++mkfifo "$src/cd/fifo" 2>/dev/null
++if [ ! -p "$src/cd/fifo" ]; then
++ test_skipped "mkfifo unavailable; cannot exercise 3c-mknod"
++fi
++
++cat > "$conf" <<EOF
++use chroot = no
++log file = $scratchdir/rsyncd.log
++[upload_fake]
++ path = $mod
++ use chroot = no
++ read only = no
++ fake super = yes
++EOF
++
++RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon" \
++ $RSYNC -rD "$src/" rsync://localhost/upload_fake/ >/dev/null 2>&1 || true
++
++verify_outside_unchanged_or_absent "3c-mknod fake-super FIFO push" "fifo"
++
++exit 0
+diff --git a/testsuite/copy-dest-source-symlink.test b/testsuite/copy-dest-source-symlink.test
+new file mode 100755
+index 00000000..2d20fab4
+--- /dev/null
++++ b/testsuite/copy-dest-source-symlink.test
+@@ -0,0 +1,83 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for codex audit Finding 3a: copy_file()'s source
++# open in copy_altdest_file() is via do_open_nofollow(), which only
++# refuses a final-component symlink. Parent components are still
++# resolved with normal symlink-following. A daemon module attacker
++# who plants a parent symlink at module/cd -> /outside, then runs
++# --copy-dest=cd against a source file matching the size+mtime of
++# /outside/target.txt, drives the receiver to:
++#
++# 1. Find a match-level >= 2 basis at "cd/target.txt"
++# 2. Call copy_altdest_file -> copy_file(src="cd/target.txt", ...)
++# 3. do_open_nofollow follows the "cd" parent symlink and reads
++# the contents of /outside/target.txt under the daemon's
++# authority
++# 4. Copy that content into the module destination
++#
++# Result: outside/target.txt content lands at module/target.txt,
++# accessible to the attacker on a subsequent pull.
++#
++# We detect by content: src/target.txt and outside/target.txt have
++# identical metadata (size + mtime + mode) but different content.
++# After the transfer, module/target.txt should match src (no
++# basedir escape) -- if it matches outside, the bug copied across
++# the symlink boundary.
++
++. "$suitedir/rsync.fns"
++
++mod="$scratchdir/module"
++outside="$scratchdir/outside"
++src="$scratchdir/src"
++conf="$scratchdir/test-rsyncd.conf"
++
++rm -rf "$mod" "$outside" "$src"
++mkdir -p "$mod" "$outside" "$src"
++
++# Outside-the-module file the daemon should not read on the
++# attacker's behalf.
++echo "OUTSIDE_LEAKED_DATA!" > "$outside/target.txt"
++chmod 0644 "$outside/target.txt"
++
++# The symlink trap.
++ln -s "$outside" "$mod/cd"
++
++# Source: same size, same mtime, same mode as outside -- so the
++# generator's link_stat + quick_check_ok finds a match-level >= 2
++# basis and calls copy_altdest_file.
++echo "ATTACKER_KNOWN_DATA!" > "$src/target.txt"
++touch -r "$outside/target.txt" "$src/target.txt"
++chmod 0644 "$src/target.txt"
++
++cat > "$conf" <<EOF
++use chroot = no
++log file = $scratchdir/rsyncd.log
++[upload]
++ path = $mod
++ use chroot = no
++ read only = no
++EOF
++
++# --copy-dest push to module root.
++RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon" \
++ $RSYNC -rtp --copy-dest=cd "$src/" rsync://localhost/upload/ \
++ >/dev/null 2>&1 || true
++
++if [ ! -f "$mod/target.txt" ]; then
++ test_fail "destination file was not created -- daemon transfer failed before the test could observe the basedir behaviour"
++fi
++
++if cmp -s "$mod/target.txt" "$outside/target.txt"; then
++ test_fail "basedir-escape via copy_file source: module/target.txt now contains the contents of outside/target.txt -- daemon read /outside via the cd symlink and copied it into the module"
++fi
++
++if ! cmp -s "$mod/target.txt" "$src/target.txt"; then
++ test_fail "destination doesn't match source content (and isn't outside content either): unexpected state"
++fi
++
++exit 0
+diff --git a/util1.c b/util1.c
+index 8850019f..d28a8e02 100644
+--- a/util1.c
++++ b/util1.c
+@@ -336,7 +336,13 @@ static int unlink_and_reopen(const char *dest, mode_t mode)
+ mode |= S_IWUSR;
+ #endif
+ mode &= INITACCESSPERMS;
+- if ((ofd = do_open(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, mode)) < 0) {
++ /* Use do_open_at so the create/truncate goes through a secure
++ * parent dirfd in the daemon-no-chroot deployment. Otherwise
++ * an attacker could swap a parent component with a symlink in
++ * the window between robust_unlink (which uses do_unlink_at,
++ * already secure) and the create here, and redirect the new
++ * file outside the module. */
++ if ((ofd = do_open_at(dest, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL, mode)) < 0) {
+ int save_errno = errno;
+ rsyserr(FERROR_XFER, save_errno, "open %s", full_fname(dest));
+ errno = save_errno;
+@@ -360,12 +366,23 @@ static int unlink_and_reopen(const char *dest, mode_t mode)
+ * --copy-dest options. */
+ int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode)
+ {
++ extern int am_daemon, am_chrooted;
+ int ifd, ofd;
+ char buf[1024 * 8];
+ int len; /* Number of bytes read into `buf'. */
+ OFF_T prealloc_len = 0, offset = 0;
+
+- if ((ifd = do_open_nofollow(source, O_RDONLY)) < 0) {
++ /* On a daemon without chroot, route the source open through
++ * secure_relative_open so a parent-symlink on the source path
++ * (e.g. --copy-dest=cd where cd is a symlink to an outside
++ * directory) cannot redirect the read to a file the daemon can
++ * see but the attacker should not. Plain do_open_nofollow only
++ * refuses a final-component symlink; parents are still followed. */
++ if (am_daemon && !am_chrooted && source && *source && source[0] != '/')
++ ifd = secure_relative_open(NULL, source, O_RDONLY | O_NOFOLLOW, 0);
++ else
++ ifd = do_open_nofollow(source, O_RDONLY);
++ if (ifd < 0) {
+ int save_errno = errno;
+ rsyserr(FERROR_XFER, errno, "open %s", full_fname(source));
+ errno = save_errno;
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch
new file mode 100644
index 00000000000..8d2c3a75b78
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p5.patch
@@ -0,0 +1,69 @@
+From d944dae7e5c1c194db23a1fefa443dd240d52afd Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Thu, 4 Jun 2026 14:46:38 +1000
+Subject: [PATCH] build: fall back to do_mknod() when mknodat() is unavailable
+ (#896)
+
+do_mknod_at() (the symlink-race-safe variant used by a non-chrooted
+daemon receiver) calls mknodat()/mkfifoat(), but the at-variant was
+gated only on AT_FDCWD. Older Darwin declares AT_FDCWD without
+mknodat(), so the build failed with "mknodat undeclared".
+
+Probe mknodat()/mkfifoat() in configure and require HAVE_MKNODAT for the
+at-variant; without it do_mknod_at() falls back to do_mknod(), exactly
+as it already does where AT_FDCWD is missing. Linux keeps the mknodat
+path since HAVE_MKNODAT is defined there.
+
+Thanks to @debohman for the report (#896).
+
+Fixes: #896
+
+CVE: CVE-2026-43619
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/f3757a470ad3defdb2c4c6ad334e3839f3c7f1ae]
+
+(cherry picked from commit f3757a470ad3defdb2c4c6ad334e3839f3c7f1ae)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ configure.ac | 2 +-
+ syscall.c | 6 ++++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index d2bcb471..1d9b3713 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -888,7 +888,7 @@ AC_FUNC_UTIME_NULL
+ AC_FUNC_ALLOCA
+ AC_CHECK_FUNCS(waitpid wait4 getcwd chown chmod lchmod mknod mkfifo \
+ fchmod fstat ftruncate strchr readlink link utime utimes lutimes strftime \
+- chflags getattrlist mktime innetgr linkat \
++ chflags getattrlist mktime innetgr linkat mknodat mkfifoat \
+ memmove lchown vsnprintf snprintf vasprintf asprintf setsid strpbrk \
+ strlcat strlcpy stpcpy strtol mallinfo mallinfo2 getgroups setgroups geteuid getegid \
+ setlocale setmode open64 lseek64 mkstemp64 mtrace va_copy __va_copy \
+diff --git a/syscall.c b/syscall.c
+index 10a3c231..25c92aac 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -535,7 +535,9 @@ int do_mknod(const char *pathname, mode_t mode, dev_t dev)
+ */
+ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev)
+ {
+-#ifdef AT_FDCWD
++ /* HAVE_MKNODAT: older Darwin declares AT_FDCWD but not mknodat(), so
++ * the at-variant won't build there; fall back to do_mknod() (#896). */
++#if defined(AT_FDCWD) && defined(HAVE_MKNODAT)
+ extern int am_daemon, am_chrooted;
+ char dirpath[MAXPATHLEN];
+ const char *bname;
+@@ -597,7 +599,7 @@ int do_mknod_at(const char *pathname, mode_t mode, dev_t dev)
+ return ret;
+ }
+
+-#if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO
++#if !defined MKNOD_CREATES_FIFOS && defined HAVE_MKFIFO && defined HAVE_MKFIFOAT
+ if (S_ISFIFO(mode))
+ ret = mkfifoat(dfd, bname, mode);
+ else
+--
+2.35.6
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch
new file mode 100644
index 00000000000..d023217a909
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43619_p6.patch
@@ -0,0 +1,258 @@
+From 94e63a8632a3c3bc10ac630a53a99ed01a82f9de Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 6 Jun 2026 15:37:25 +1000
+Subject: [PATCH] build: openat2 autodetect + android probe (R1 #924/#905/#900,
+ R10 #904)
+
+configure now probes for <linux/openat2.h> + SYS_openat2 and defines
+HAVE_OPENAT2 only when both are present; syscall.c gates the openat2 include
+and the openat2(RESOLVE_BENEATH) tier on HAVE_OPENAT2, so the build no longer
+fails on kernels/headers that lack the openat2 header (3.4.3 included it
+unconditionally on Linux). android.c probes openat2 usability behind a SIGSYS
+handler so the Android/Termux seccomp sandbox falls back to the portable
+resolver instead of killing the process.
+
+Backport combining c73e0063, 83a24c21, the syscall.c guards from 1d5b5ab8, and
+4634b0ad; the --disable-openat2/gcov coverage knobs and test changes are omitted.
+
+Thanks to @mmayer (#924), @fda77 (#905), @darkshram (#900) and @ketas (#904) for the reports.
+
+CVE: CVE-2026-43619
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/c14e2258b59a3f16a99c6e83a28660ba438a73e9]
+
+(cherry picked from commit c14e2258b59a3f16a99c6e83a28660ba438a73e9)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ Makefile.in | 12 ++++-----
+ android.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ configure.ac | 22 +++++++++++++++++
+ syscall.c | 23 +++++++++++++----
+ 4 files changed, 128 insertions(+), 11 deletions(-)
+ create mode 100644 android.c
+
+diff --git a/Makefile.in b/Makefile.in
+index c0cc7a06..f2590b69 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -49,7 +49,7 @@ LIBOBJ=lib/wildmatch.o lib/compat.o lib/snprintf.o lib/mdfour.o lib/md5.o \
+ zlib_OBJS=zlib/deflate.o zlib/inffast.o zlib/inflate.o zlib/inftrees.o \
+ zlib/trees.o zlib/zutil.o zlib/adler32.o zlib/compress.o zlib/crc32.o
+ OBJS1=flist.o rsync.o generator.o receiver.o cleanup.o sender.o exclude.o \
+- util1.o util2.o main.o checksum.o match.o syscall.o log.o backup.o delete.o
++ util1.o util2.o main.o checksum.o match.o syscall.o android.o log.o backup.o delete.o
+ OBJS2=options.o io.o compat.o hlink.o token.o uidlist.o socket.o hashtable.o \
+ usage.o fileio.o batch.o clientname.o chmod.o acls.o xattrs.o
+ OBJS3=progress.o pipe.o @MD5_ASM@ @ROLL_SIMD@ @ROLL_ASM@
+@@ -58,7 +58,7 @@ popt_OBJS=popt/findme.o popt/popt.o popt/poptconfig.o \
+ popt/popthelp.o popt/poptparse.o popt/poptint.o
+ OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@
+
+-TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@
++TLS_OBJ = tls.o syscall.o android.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@
+
+ # Programs we must have to run the test cases
+ CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \
+@@ -176,19 +176,19 @@ getgroups$(EXEEXT): getgroups.o
+ getfsdev$(EXEEXT): getfsdev.o
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ getfsdev.o $(LIBS)
+
+-TRIMSLASH_OBJ = trimslash.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o
++TRIMSLASH_OBJ = trimslash.o syscall.o android.o util2.o t_stub.o lib/compat.o lib/snprintf.o
+ trimslash$(EXEEXT): $(TRIMSLASH_OBJ)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TRIMSLASH_OBJ) $(LIBS)
+
+-T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
++T_UNSAFE_OBJ = t_unsafe.o syscall.o android.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
+ t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_UNSAFE_OBJ) $(LIBS)
+
+-T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
++T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o android.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+ t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS)
+
+-T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
++T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o android.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+ t_secure_relpath$(EXEEXT): $(T_SECURE_RELPATH_OBJ)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SECURE_RELPATH_OBJ) $(LIBS)
+
+diff --git a/android.c b/android.c
+new file mode 100644
+index 00000000..572f5f21
+--- /dev/null
++++ b/android.c
+@@ -0,0 +1,82 @@
++/*
++ * Android-specific helpers.
++ *
++ * openat2() usability probe
++ * -------------------------
++ * openat2(2) is invoked directly via syscall() because the C library lacked a
++ * wrapper for it for years. Under a seccomp filter that uses
++ * SECCOMP_RET_TRAP -- as the Android application sandbox does -- a disallowed
++ * syscall raises SIGSYS and *kills the process* rather than failing with
++ * ENOSYS, so inspecting errno after the call is too late. We therefore probe
++ * openat2() once, behind a temporary SIGSYS handler, so a trapped syscall is
++ * caught and secure_relative_open_linux() can fall back to the portable
++ * per-component O_NOFOLLOW resolver instead of the whole process dying.
++ *
++ * This is only needed on Android, so the probe body is compiled only there.
++ * __ANDROID__ is defined by Bionic's headers and reflects the *target*, not
++ * the build host: it is set both for NDK cross-compiles (from a Linux/macOS
++ * host) and for native Termux builds, and is unset on every other platform.
++ * That makes it a reliable compile-time switch for cross builds -- there is
++ * nothing to detect in configure. Everywhere else openat2() is never
++ * seccomp-trapped to SIGSYS (a missing syscall simply returns ENOSYS), so
++ * openat2_usable() collapses to a constant 1 with no run-time cost.
++ */
++
++#include "rsync.h"
++
++#if defined(__ANDROID__) && defined(HAVE_OPENAT2)
++
++#include <setjmp.h>
++#include <sys/syscall.h>
++#include <linux/openat2.h>
++
++static sigjmp_buf openat2_probe_env;
++
++static void openat2_probe_handler(int signo)
++{
++ (void)signo;
++ siglongjmp(openat2_probe_env, 1);
++}
++
++#endif
++
++int openat2_usable(void)
++{
++#if defined(__ANDROID__) && defined(HAVE_OPENAT2)
++ static int cached = -1;
++ struct sigaction sa, old_sa;
++
++ if (cached >= 0)
++ return cached;
++
++ memset(&sa, 0, sizeof sa);
++ sa.sa_handler = openat2_probe_handler;
++ sigemptyset(&sa.sa_mask);
++ if (sigaction(SIGSYS, &sa, &old_sa) != 0)
++ return cached = 0;
++
++ if (sigsetjmp(openat2_probe_env, 1) != 0) {
++ /* SIGSYS delivered: openat2 is blocked by a seccomp filter. */
++ cached = 0;
++ } else {
++ struct open_how how;
++ int fd;
++ memset(&how, 0, sizeof how);
++ how.flags = O_RDONLY | O_DIRECTORY;
++ how.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS;
++ fd = syscall(SYS_openat2, AT_FDCWD, ".", &how, sizeof how);
++ if (fd >= 0)
++ close(fd);
++ /* Usable only if the probe actually succeeded. Any failure --
++ * ENOSYS (kernel < 5.6), a seccomp SECCOMP_RET_ERRNO denial
++ * (EPERM/EACCES), or EINVAL (RESOLVE_BENEATH unsupported) --
++ * means we must fall back to the portable O_NOFOLLOW walk. */
++ cached = fd >= 0;
++ }
++
++ sigaction(SIGSYS, &old_sa, NULL);
++ return cached;
++#else
++ return 1;
++#endif
++}
+diff --git a/configure.ac b/configure.ac
+index 1d9b3713..123480e1 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -331,6 +331,28 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ ]], [[return 0;]])],
+ CFLAGS="$OLD_CFLAGS"
+ AC_SUBST(NOEXECSTACK)
+
++dnl Only define HAVE_OPENAT2 when both the <linux/openat2.h> header and the
++dnl SYS_openat2 syscall number are present. syscall.c uses openat2(RESOLVE_BENEATH)
++dnl for the secure resolver on Linux 5.6+; defining it unconditionally broke the
++dnl build on older kernels/headers that lack the header (#924, #905, #900).
++AC_CACHE_CHECK([for openat2],rsync_cv_HAVE_OPENAT2,[
++ AC_COMPILE_IFELSE([
++ AC_LANG_PROGRAM([[
++#include <sys/syscall.h>
++#include <linux/openat2.h>
++]], [[
++struct open_how how;
++how.resolve = RESOLVE_BENEATH;
++return SYS_openat2 + (int)how.resolve;
++]])
++ ],
++ [rsync_cv_HAVE_OPENAT2=yes], [rsync_cv_HAVE_OPENAT2=no])
++])
++if test x"$rsync_cv_HAVE_OPENAT2" = x"yes"; then
++ AC_DEFINE([HAVE_OPENAT2], 1,
++ [Define to use Linux openat2(RESOLVE_BENEATH) in secure_relative_open where available.])
++fi
++
+ # arrgh. libc in some old debian version screwed up the largefile
+ # stuff, getting byte range locking wrong
+ AC_CACHE_CHECK([for broken largefile support],rsync_cv_HAVE_BROKEN_LARGEFILE,[
+diff --git a/syscall.c b/syscall.c
+index 25c92aac..f26b144d 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -33,7 +33,7 @@
+ #include <sys/syscall.h>
+ #endif
+
+-#ifdef __linux__
++#if defined(__linux__) && defined(HAVE_OPENAT2)
+ #include <sys/syscall.h>
+ #include <linux/openat2.h>
+ #endif
+@@ -1688,7 +1688,20 @@ static int path_has_dotdot_component(const char *path)
+ return 0;
+ }
+
+-#ifdef __linux__
++#if defined(__linux__) && defined(HAVE_OPENAT2)
++/* openat2(RESOLVE_BENEATH) via the raw syscall, gated on openat2_usable() so a
++ * seccomp filter that traps openat2 with SIGSYS (e.g. the Android sandbox)
++ * makes us report ENOSYS and fall back rather than killing the process. Only
++ * the openat2 call is gated here; a plain openat() is always safe to attempt. */
++static int openat2_beneath(int dirfd, const char *path, const struct open_how *how)
++{
++ if (!openat2_usable()) {
++ errno = ENOSYS;
++ return -1;
++ }
++ return syscall(SYS_openat2, dirfd, path, how, sizeof *how);
++}
++
+ static int secure_relative_open_linux(const char *basedir, const char *relpath, int flags, mode_t mode)
+ {
+ struct open_how how;
+@@ -1717,12 +1726,12 @@ static int secure_relative_open_linux(const char *basedir, const char *relpath,
+ memset(&bhow, 0, sizeof bhow);
+ bhow.flags = O_RDONLY | O_DIRECTORY;
+ bhow.resolve = RESOLVE_BENEATH | RESOLVE_NO_MAGICLINKS;
+- dirfd = syscall(SYS_openat2, AT_FDCWD, basedir, &bhow, sizeof bhow);
++ dirfd = openat2_beneath(AT_FDCWD, basedir, &bhow);
+ if (dirfd == -1)
+ return -1;
+ }
+
+- retfd = syscall(SYS_openat2, dirfd, relpath, &how, sizeof how);
++ retfd = openat2_beneath(dirfd, relpath, &how);
+
+ if (dirfd != AT_FDCWD)
+ close(dirfd);
+@@ -1788,7 +1797,7 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ return -1;
+ }
+
+-#ifdef __linux__
++#if defined(__linux__) && defined(HAVE_OPENAT2)
+ {
+ int fd = secure_relative_open_linux(basedir, relpath, flags, mode);
+ /* ENOSYS = kernel < 5.6 doesn't have the syscall even though
diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
index e2fe0128d53..47e195ef24a 100644
--- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
@@ -20,6 +20,12 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2026-29518_p2.patch \
file://CVE-2026-29518_p3.patch \
file://CVE-2026-29518_p4.patch \
+ file://CVE-2026-43619_p1.patch \
+ file://CVE-2026-43619_p2.patch \
+ file://CVE-2026-43619_p3.patch \
+ file://CVE-2026-43619_p4.patch \
+ file://CVE-2026-43619_p5.patch \
+ file://CVE-2026-43619_p6.patch \
"
SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 08/36] rsync: Fix CVE-2026-43618
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (6 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 07/36] rsync: Fix CVE-2026-43619 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 09/36] rsync: Fix CVE-2026-43620 Yoann Congal
` (27 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Ashishkumar Parmar <asparmar@cisco.com>
This patch applies the upstream v3.4.3 backport for
CVE-2026-43618. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/RsyncProject/rsync/commit/c44c90e9460c666c965446a8c0957f0b9fa4c66a
[2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-g37v-g3gj-pmwq
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../rsync/files/CVE-2026-43618.patch | 248 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 +
2 files changed, 249 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43618.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43618.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43618.patch
new file mode 100644
index 00000000000..d4b13d91818
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43618.patch
@@ -0,0 +1,248 @@
+From a93cfc86b6daa2dfd754bcbe261cf01afef056f4 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Wed, 29 Apr 2026 11:10:59 +1000
+Subject: [PATCH] token: harden compressed-token decoding against integer
+ overflow
+
+The receiver's three compressed-token decoders --
+recv_deflated_token (zlib), recv_zstd_token, and
+recv_compressed_token (lz4) -- accumulated rx_token (a 32-bit
+signed counter) without overflow checking. A malicious sender
+could craft a compressed-token stream that walked rx_token past
+INT32_MAX, with careful manipulation leaking process memory
+contents to the wire (environment variables, passwords, heap
+pointers, library pointers -- significantly weakening ASLR
+and facilitating further exploitation).
+
+Cap rx_token at MAX_TOKEN_INDEX = 0x7ffffffe. Fold the
+bookkeeping into recv_compressed_token_num() and
+recv_compressed_token_run() shared by all three decoders. Reject
+negative or out-of-range token values explicitly. Also cap the
+simple_recv_token literal-block length at the source: any
+wire-supplied length > CHUNK_SIZE is ill-formed (the matching
+simple_send_token never writes a chunk larger than CHUNK_SIZE),
+so reject before looping on attacker-controlled bytes.
+
+Reach: an authenticated daemon connection with compression
+enabled (the default for protocols >= 30 when both peers
+advertise it). Disabling compression on the daemon
+("refuse options = compress" in rsyncd.conf) is the available
+workaround.
+
+Reporter: Omar Elsayed (seks99x).
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-43618
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/c44c90e9460c666c965446a8c0957f0b9fa4c66a]
+
+Backport Changes:
+- Resolved token.c context differences against Wrynose's 3.4.1
+ source, which lacks all three negative-token validation blocks
+ present in the upstream patch context.
+- The Wrynose hunk replaces the older per-decoder token bookkeeping
+ with the upstream recv_compressed_token_num() and
+ recv_compressed_token_run() helper calls at the matching zlib,
+ zstd, and lz4 decoder sites.
+
+(cherry picked from commit c44c90e9460c666c965446a8c0957f0b9fa4c66a)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ receiver.c | 11 +++++-
+ token.c | 102 ++++++++++++++++++++++++++++++-----------------------
+ 2 files changed, 67 insertions(+), 46 deletions(-)
+
+diff --git a/receiver.c b/receiver.c
+index 8cf8366b..a487ad5a 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -318,7 +318,12 @@ static int receive_data(int f_in, char *fname_r, int fd_r, OFF_T size_r,
+ }
+ }
+
+- while ((i = recv_token(f_in, &data)) != 0) {
++ while (1) {
++ data = NULL;
++ i = recv_token(f_in, &data);
++ if (i == 0)
++ break;
++
+ if (INFO_GTE(PROGRESS, 1))
+ show_progress(offset, total_size);
+
+@@ -326,6 +331,10 @@ static int receive_data(int f_in, char *fname_r, int fd_r, OFF_T size_r,
+ maybe_send_keepalive(time(NULL), MSK_ALLOW_FLUSH | MSK_ACTIVE_RECEIVER);
+
+ if (i > 0) {
++ if (!data) {
++ rprintf(FERROR, "Invalid literal token with no data [%s]\n", who_am_i());
++ exit_cleanup(RERR_PROTOCOL);
++ }
+ if (DEBUG_GTE(DELTASUM, 3)) {
+ rprintf(FINFO,"data recv %d at %s\n",
+ i, big_num(offset));
+diff --git a/token.c b/token.c
+index c108b3af..02dabd8d 100644
+--- a/token.c
++++ b/token.c
+@@ -291,6 +291,14 @@ static int32 simple_recv_token(int f, char **data)
+ int32 i = read_int(f);
+ if (i <= 0)
+ return i;
++ /* simple_send_token caps each literal chunk at CHUNK_SIZE;
++ * reject anything larger so a hostile peer cannot drive the
++ * read_buf below past our static CHUNK_SIZE buffer. */
++ if (i > CHUNK_SIZE) {
++ rprintf(FERROR, "invalid uncompressed token length %ld [%s]\n",
++ (long)i, who_am_i());
++ exit_cleanup(RERR_PROTOCOL);
++ }
+ residue = i;
+ }
+
+@@ -493,9 +501,52 @@ static char *cbuf;
+ static char *dbuf;
+
+ /* for decoding runs of tokens */
++#define MAX_TOKEN_INDEX ((int32)0x7ffffffe)
++
+ static int32 rx_token;
+ static int32 rx_run;
+
++static NORETURN void invalid_compressed_token(void)
++{
++ rprintf(FERROR, "invalid token number in compressed stream\n");
++ exit_cleanup(RERR_PROTOCOL);
++}
++
++static int32 recv_compressed_token_num(int f, int32 flag)
++{
++ if (flag & TOKEN_REL) {
++ int32 incr = flag & 0x3f;
++ if (rx_token > MAX_TOKEN_INDEX - incr)
++ invalid_compressed_token();
++ rx_token += incr;
++ flag >>= 6;
++ } else {
++ rx_token = read_int(f);
++ if (rx_token < 0 || rx_token > MAX_TOKEN_INDEX)
++ invalid_compressed_token();
++ }
++
++ if (flag & 1) {
++ rx_run = read_byte(f);
++ rx_run += read_byte(f) << 8;
++ if (rx_run <= 0 || rx_token > MAX_TOKEN_INDEX - rx_run)
++ invalid_compressed_token();
++ recv_state = r_running;
++ }
++
++ return -1 - rx_token;
++}
++
++static int32 recv_compressed_token_run(void)
++{
++ if (rx_run <= 0 || rx_token >= MAX_TOKEN_INDEX)
++ invalid_compressed_token();
++ ++rx_token;
++ if (--rx_run == 0)
++ recv_state = r_idle;
++ return -1 - rx_token;
++}
++
+ /* Receive a deflated token and inflate it */
+ static int32 recv_deflated_token(int f, char **data)
+ {
+@@ -586,17 +637,7 @@ static int32 recv_deflated_token(int f, char **data)
+ }
+
+ /* here we have a token of some kind */
+- if (flag & TOKEN_REL) {
+- rx_token += flag & 0x3f;
+- flag >>= 6;
+- } else
+- rx_token = read_int(f);
+- if (flag & 1) {
+- rx_run = read_byte(f);
+- rx_run += read_byte(f) << 8;
+- recv_state = r_running;
+- }
+- return -1 - rx_token;
++ return recv_compressed_token_num(f, flag);
+
+ case r_inflating:
+ rx_strm.next_out = (Bytef *)dbuf;
+@@ -616,10 +657,7 @@ static int32 recv_deflated_token(int f, char **data)
+ break;
+
+ case r_running:
+- ++rx_token;
+- if (--rx_run == 0)
+- recv_state = r_idle;
+- return -1 - rx_token;
++ return recv_compressed_token_run();
+ }
+ }
+ }
+@@ -828,17 +866,7 @@ static int32 recv_zstd_token(int f, char **data)
+ return 0;
+ }
+ /* here we have a token of some kind */
+- if (flag & TOKEN_REL) {
+- rx_token += flag & 0x3f;
+- flag >>= 6;
+- } else
+- rx_token = read_int(f);
+- if (flag & 1) {
+- rx_run = read_byte(f);
+- rx_run += read_byte(f) << 8;
+- recv_state = r_running;
+- }
+- return -1 - rx_token;
++ return recv_compressed_token_num(f, flag);
+
+ case r_inflated: /* zstd doesn't get into this state */
+ break;
+@@ -869,10 +897,7 @@ static int32 recv_zstd_token(int f, char **data)
+ break;
+
+ case r_running:
+- ++rx_token;
+- if (--rx_run == 0)
+- recv_state = r_idle;
+- return -1 - rx_token;
++ return recv_compressed_token_run();
+ }
+ }
+ }
+@@ -992,17 +1017,7 @@ static int32 recv_compressed_token(int f, char **data)
+ }
+
+ /* here we have a token of some kind */
+- if (flag & TOKEN_REL) {
+- rx_token += flag & 0x3f;
+- flag >>= 6;
+- } else
+- rx_token = read_int(f);
+- if (flag & 1) {
+- rx_run = read_byte(f);
+- rx_run += read_byte(f) << 8;
+- recv_state = r_running;
+- }
+- return -1 - rx_token;
++ return recv_compressed_token_num(f, flag);
+
+ case r_inflating:
+ avail_out = LZ4_decompress_safe(next_in, dbuf, avail_in, size);
+@@ -1018,10 +1033,7 @@ static int32 recv_compressed_token(int f, char **data)
+ break;
+
+ case r_running:
+- ++rx_token;
+- if (--rx_run == 0)
+- recv_state = r_idle;
+- return -1 - rx_token;
++ return recv_compressed_token_run();
+ }
+ }
+ }
diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
index 47e195ef24a..f84f269692e 100644
--- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
@@ -26,6 +26,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2026-43619_p4.patch \
file://CVE-2026-43619_p5.patch \
file://CVE-2026-43619_p6.patch \
+ file://CVE-2026-43618.patch \
"
SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 09/36] rsync: Fix CVE-2026-43620
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (7 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 08/36] rsync: Fix CVE-2026-43618 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 10/36] rsync: Fix CVE-2026-43617 Yoann Congal
` (26 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Ashishkumar Parmar <asparmar@cisco.com>
This patch applies the upstream v3.4.3 backport for
CVE-2026-43620. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/RsyncProject/rsync/commit/0cf200ecbb8baaf58070d825c4fbd892b4a63b69
[2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-28pw-r563-rxvm
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../rsync/files/CVE-2026-43620.patch | 122 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 +
2 files changed, 123 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43620.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43620.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43620.patch
new file mode 100644
index 00000000000..2852b74b8d4
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43620.patch
@@ -0,0 +1,122 @@
+From 271771f089f5f7acff5cce1ca3242849b0f6a6a0 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 5 May 2026 16:48:16 +1000
+Subject: [PATCH] receiver: add parent_ndx<0 guard, mirroring 797e17f
+
+Commit 797e17f ("fixed an invalid access to files array") added a
+parent_ndx < 0 guard to send_files() in sender.c, but the visually-
+identical block in recv_files() in receiver.c was not updated. A
+malicious rsync:// server can therefore drive any connecting client
+into the same out-of-bounds dir_flist->files[-1] read followed by a
+file_struct dereference in f_name() one line later.
+
+Reach: protocol-30+ default (inc_recurse) makes flist.c:2745 set
+parent_ndx = -1 on the first received flist when the sender omits a
+leading "." entry; rsync.c flist_for_ndx() does not reject ndx == 0
+in that state because the range check evaluates 0 < 0 = false; and
+read_ndx_and_attrs() only validates ndx with the ITEM_TRANSFER bit
+set, so iflags=ITEM_IS_NEW (or any other non-transfer iflag word)
+bypasses the check.
+
+Apply the same guard receiver-side. Confirmed: the same PoC (a
+minimal Python rsyncd that handshakes with CF_INC_RECURSE, sends a
+no-leading-"." flist, and emits ndx=0 with ITEM_IS_NEW) crashes
+unpatched 3.4.2 with SEGV_MAPERR si_addr=0x4101a-class in the
+receiver child; with this guard it exits cleanly with code 2
+(RERR_PROTOCOL).
+
+The attack surface delta over the sender variant is large:
+the original was malicious-client -> daemon, this is
+malicious-server -> any rsync client doing a normal rsync://
+or remote-shell pull.
+
+Reported by Pratham Gupta (alchemy1729).
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-43620
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/0cf200ecbb8baaf58070d825c4fbd892b4a63b69]
+
+(cherry picked from commit 0cf200ecbb8baaf58070d825c4fbd892b4a63b69)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ generator.c | 4 ++++
+ io.c | 3 +++
+ receiver.c | 7 ++++++-
+ sender.c | 2 ++
+ 4 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/generator.c b/generator.c
+index 311e9b78..89f99db4 100644
+--- a/generator.c
++++ b/generator.c
+@@ -2146,6 +2146,8 @@ void check_for_finished_files(int itemizing, enum logcode code, int check_redo)
+ if (send_failed)
+ ndx = get_hlink_num();
+ flist = flist_for_ndx(ndx, "check_for_finished_files.1");
++ if (ndx < flist->ndx_start)
++ exit_cleanup(RERR_PROTOCOL);
+ file = flist->files[ndx - flist->ndx_start];
+ assert(file->flags & FLAG_HLINKED);
+ if (send_failed)
+@@ -2174,6 +2176,8 @@ void check_for_finished_files(int itemizing, enum logcode code, int check_redo)
+
+ flist = cur_flist;
+ cur_flist = flist_for_ndx(ndx, "check_for_finished_files.2");
++ if (ndx < cur_flist->ndx_start)
++ exit_cleanup(RERR_PROTOCOL);
+
+ file = cur_flist->files[ndx - cur_flist->ndx_start];
+ if (solo_file)
+diff --git a/io.c b/io.c
+index bb60eeca..c654a7ba 100644
+--- a/io.c
++++ b/io.c
+@@ -1090,6 +1090,9 @@ static void got_flist_entry_status(enum festatus status, int ndx)
+ {
+ struct file_list *flist = flist_for_ndx(ndx, "got_flist_entry_status");
+
++ if (ndx < flist->ndx_start)
++ exit_cleanup(RERR_PROTOCOL);
++
+ if (remove_source_files) {
+ active_filecnt--;
+ active_bytecnt -= F_LENGTH(flist->files[ndx - flist->ndx_start]);
+diff --git a/receiver.c b/receiver.c
+index a487ad5a..3fa68d71 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -467,7 +467,10 @@ static void handle_delayed_updates(char *local_name)
+ static void no_batched_update(int ndx, BOOL is_redo)
+ {
+ struct file_list *flist = flist_for_ndx(ndx, "no_batched_update");
+- struct file_struct *file = flist->files[ndx - flist->ndx_start];
++ struct file_struct *file;
++ if (ndx < flist->ndx_start)
++ exit_cleanup(RERR_PROTOCOL);
++ file = flist->files[ndx - flist->ndx_start];
+
+ rprintf(FERROR_XFER, "(No batched update for%s \"%s\")\n",
+ is_redo ? " resend of" : "", f_name(file, NULL));
+@@ -604,6 +607,8 @@ int recv_files(int f_in, int f_out, char *local_name)
+
+ if (ndx - cur_flist->ndx_start >= 0)
+ file = cur_flist->files[ndx - cur_flist->ndx_start];
++ else if (cur_flist->parent_ndx < 0)
++ exit_cleanup(RERR_PROTOCOL);
+ else
+ file = dir_flist->files[cur_flist->parent_ndx];
+ fname = local_name ? local_name : f_name(file, fbuf);
+diff --git a/sender.c b/sender.c
+index 99f431fe..033f87e5 100644
+--- a/sender.c
++++ b/sender.c
+@@ -140,6 +140,8 @@ void successful_send(int ndx)
+ return;
+
+ flist = flist_for_ndx(ndx, "successful_send");
++ if (ndx < flist->ndx_start)
++ exit_cleanup(RERR_PROTOCOL);
+ file = flist->files[ndx - flist->ndx_start];
+ if (!change_pathname(file, NULL, 0))
+ return;
diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
index f84f269692e..2145d4ce7e3 100644
--- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
@@ -27,6 +27,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2026-43619_p5.patch \
file://CVE-2026-43619_p6.patch \
file://CVE-2026-43618.patch \
+ file://CVE-2026-43620.patch \
"
SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 10/36] rsync: Fix CVE-2026-43617
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (8 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 09/36] rsync: Fix CVE-2026-43620 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 11/36] rsync: Fix CVE-2026-45232 Yoann Congal
` (25 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Ashishkumar Parmar <asparmar@cisco.com>
This patch applies the upstream v3.4.3 backport for
CVE-2026-43617. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/RsyncProject/rsync/commit/c38f20c5ffabacd0c0c483786ab224a36e14bf43
[2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../rsync/files/CVE-2026-43617.patch | 201 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 +
2 files changed, 202 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-43617.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-43617.patch b/meta/recipes-devtools/rsync/files/CVE-2026-43617.patch
new file mode 100644
index 00000000000..5b3190224ed
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-43617.patch
@@ -0,0 +1,201 @@
+From d811094dc63486a8b6acf23963daccc23e9dbf43 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Wed, 31 Dec 2025 13:50:35 +1100
+Subject: [PATCH] clientserver: fix hostname ACL bypass when using daemon
+ chroot
+
+On an rsync daemon configured with "daemon chroot", the reverse-DNS
+lookup of the connecting client was performed *after* the chroot
+had been entered. If the chroot did not contain the files glibc
+needs for resolution (/etc/resolv.conf, /etc/nsswitch.conf,
+/etc/hosts, NSS service modules), the lookup failed and
+client_name() returned "UNKNOWN". Hostname-based deny rules
+("hosts deny = *.evil.example") therefore could not match, and
+an attacker controlling their PTR record could connect from a
+hostname the administrator had intended to deny. IP-based ACLs
+were unaffected.
+
+Do the reverse DNS lookup before chroot/setuid; client_name()
+caches its result, so the post-chroot call uses the cached value
+and hostname-based ACLs work even when DNS is unavailable
+post-chroot.
+
+Adds testsuite/daemon-chroot-acl.test as end-to-end regression
+coverage. The test sets up an empty chroot directory, configures
+"hosts deny = <localhost-resolved-name>" with daemon chroot, and
+asserts the connection is refused with @ERROR access denied.
+Uses unshare --user --map-root-user for non-root CAP_SYS_CHROOT;
+skips cleanly on non-Linux or when user namespaces aren't
+available.
+
+Reporter: Joshua Rogers (MegaManSec).
+
+Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
+
+CVE: CVE-2026-43617
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/c38f20c5ffabacd0c0c483786ab224a36e14bf43]
+
+Backport Changes:
+- Omitted upstream .github/workflows/macos-build.yml because the
+ Yocto recipe does not carry upstream CI workflow files. That
+ upstream hunk only adds daemon-chroot-acl to the macOS
+ RSYNC_EXPECT_SKIPPED list and has no rsync source/runtime effect.
+
+(cherry picked from commit c38f20c5ffabacd0c0c483786ab224a36e14bf43)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ clientserver.c | 22 ++++++
+ testsuite/daemon-chroot-acl.test | 111 +++++++++++++++++++++++++++++++
+ 2 files changed, 133 insertions(+)
+ create mode 100644 testsuite/daemon-chroot-acl.test
+
+diff --git a/clientserver.c b/clientserver.c
+index b6eba098..3333aa96 100644
+--- a/clientserver.c
++++ b/clientserver.c
+@@ -1310,6 +1310,28 @@ int start_daemon(int f_in, int f_out)
+ if (lp_proxy_protocol() && !read_proxy_protocol_header(f_in))
+ return -1;
+
++ /* Do reverse DNS lookup before chroot/setuid. The result is cached,
++ * so the later client_name() call will use this cached value. This
++ * ensures hostname-based ACLs work even when DNS is unavailable
++ * after chroot.
++ *
++ * "reverse lookup" can be set globally OR per-module, so we also
++ * scan each module: a deployment with "reverse lookup = no" in the
++ * global section but "reverse lookup = yes" in a specific module
++ * still triggers a post-chroot lookup at access-check time
++ * (rsync_module() in this file), which would also fail in the
++ * chroot and turn hostname-based deny rules into silent bypasses. */
++ {
++ int need_reverse = lp_reverse_lookup(-1);
++ int j, num_modules = lp_num_modules();
++ for (j = 0; !need_reverse && j < num_modules; j++) {
++ if (lp_reverse_lookup(j))
++ need_reverse = 1;
++ }
++ if (need_reverse)
++ (void)client_name(client_addr(f_in));
++ }
++
+ p = lp_daemon_chroot();
+ if (*p) {
+ log_init(0); /* Make use we've initialized syslog before chrooting. */
+diff --git a/testsuite/daemon-chroot-acl.test b/testsuite/daemon-chroot-acl.test
+new file mode 100644
+index 00000000..9d1c1b63
+--- /dev/null
++++ b/testsuite/daemon-chroot-acl.test
+@@ -0,0 +1,111 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for GHSA-rjfm-3w2m-jf4f: a hostname-based "hosts deny"
++# rule must still match when the daemon performs a 'daemon chroot' and
++# the chroot does not contain the NSS files glibc needs for reverse DNS.
++#
++# Pre-fix, reverse DNS happened *after* the daemon chroot. With an empty
++# chroot the NSS lookup failed, client_name() returned "UNKNOWN", and a
++# deny rule referring to the connecting hostname silently failed to
++# match.
++#
++# Two scenarios are exercised so we can distinguish the case the fix
++# definitely covers from the per-module path that may still be
++# vulnerable:
++# A. global "reverse lookup = yes" (covered by b6abdb4c)
++# B. only module "reverse lookup = yes" (gap to verify)
++
++. "$suitedir/rsync.fns"
++
++case `uname -s` in
++Linux*) ;;
++*) test_skipped "test is Linux-specific (uses chroot+unshare)" ;;
++esac
++
++# We need CAP_SYS_CHROOT. Re-exec under a user namespace if not root.
++if ! chroot / /bin/true 2>/dev/null; then
++ if [ -z "$RSYNC_UNSHARED" ] && unshare --user --map-root-user true 2>/dev/null; then
++ echo "Re-running under unshare --user --map-root-user..."
++ RSYNC_UNSHARED=1 exec unshare --user --map-root-user "$SHELL_PATH" $RUNSHFLAGS "$0"
++ fi
++ test_skipped "need CAP_SYS_CHROOT (root or unshare --user --map-root-user)"
++fi
++
++# We need 127.0.0.1 to reverse-resolve to a real hostname while NSS is
++# still working (i.e. before the daemon's chroot). The daemon will
++# look that name up itself as part of its hostname-based ACL check;
++# we then deny that name and assert the connection is rejected.
++client_hostname=`getent hosts 127.0.0.1 2>/dev/null | awk 'NR==1 {print $2}'`
++if [ -z "$client_hostname" ] || [ "$client_hostname" = "127.0.0.1" ]; then
++ test_skipped "no reverse DNS for 127.0.0.1"
++fi
++
++chrootdir="$scratchdir/chroot"
++rm -rf "$chrootdir"
++mkdir -p "$chrootdir/modroot"
++echo "from chroot" > "$chrootdir/modroot/file1"
++
++conf="$scratchdir/test-rsyncd.conf"
++logfile="$scratchdir/rsyncd.log"
++
++write_conf() {
++ cat >"$conf" <<EOF
++use chroot = no
++log file = $logfile
++daemon chroot = $chrootdir
++reverse lookup = $1
++hosts deny = $client_hostname
++max verbosity = 4
++
++[chrootmod]
++ path = /modroot
++ read only = yes
++ reverse lookup = $2
++EOF
++}
++
++# Run a transfer and return 0 if the daemon refused with @ERROR access
++# denied (the expected outcome when the deny rule matches).
++run_check() {
++ label="$1"
++
++ rm -f "$logfile"
++ rm -rf "$todir"
++ mkdir -p "$todir"
++
++ out="$scratchdir/run.out"
++
++ RSYNC_CONNECT_PROG="$RSYNC --config=$conf --daemon" \
++ $RSYNC -av localhost::chrootmod/ "$todir/" >"$out" 2>&1
++ rc=$?
++
++ echo "----- $label (rsync exit $rc):"
++ cat "$out"
++ echo "----- daemon log:"
++ [ -f "$logfile" ] && cat "$logfile"
++ echo "-----"
++
++ grep -q '@ERROR.*access denied' "$out"
++}
++
++# Scenario A: global reverse lookup. Covered by b6abdb4c.
++write_conf yes yes
++if ! run_check "Scenario A (global reverse lookup = yes)"; then
++ test_fail "Scenario A: hostname deny rule was bypassed"
++fi
++
++# Scenario B: only the per-module reverse-lookup setting is enabled.
++# The b6abdb4c fix only pre-warms client_name()'s cache when the
++# global setting is on, so the post-chroot lookup in this path may
++# still produce "UNKNOWN" and bypass the deny rule.
++write_conf no yes
++if ! run_check "Scenario B (per-module reverse lookup only)"; then
++ test_fail "Scenario B: hostname deny rule was bypassed (per-module reverse lookup with daemon chroot still has the bypass)"
++fi
++
++exit 0
diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
index 2145d4ce7e3..d0d57defe8d 100644
--- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
@@ -28,6 +28,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2026-43619_p6.patch \
file://CVE-2026-43618.patch \
file://CVE-2026-43620.patch \
+ file://CVE-2026-43617.patch \
"
SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 11/36] rsync: Fix CVE-2026-45232
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (9 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 10/36] rsync: Fix CVE-2026-43617 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-28 13:25 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 12/36] gnutls: fix CVE-2026-3833 Yoann Congal
` (24 subsequent siblings)
35 siblings, 1 reply; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Ashishkumar Parmar <asparmar@cisco.com>
This patch applies the upstream v3.4.3 backport for
CVE-2026-45232. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/RsyncProject/rsync/commit/a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba
[2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../rsync/files/CVE-2026-45232.patch | 240 ++++++++++++++++++
meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 +
2 files changed, 241 insertions(+)
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-45232.patch
diff --git a/meta/recipes-devtools/rsync/files/CVE-2026-45232.patch b/meta/recipes-devtools/rsync/files/CVE-2026-45232.patch
new file mode 100644
index 00000000000..544793bd1d1
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/CVE-2026-45232.patch
@@ -0,0 +1,240 @@
+From de47c801a8083f1913e149c6ee6d0e864b728995 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Wed, 13 May 2026 20:35:35 +1000
+Subject: [PATCH] socket: reject over-long proxy response line
+
+fixes a one byte stack overflow when using RSYNC_PROXY with a
+malicious proxy.
+
+Reach: only when RSYNC_PROXY is set and a malicious or MITM'd
+proxy returns the pathological response. The byte written is
+always '\0' and the attacker doesn't choose the offset, so impact
+is corruption of one adjacent stack byte and possible later
+misbehaviour or crash -- no information disclosure beyond the
+existing rprintf of buffer contents.
+
+Reported by Aisle Research via Michal Ruprich
+
+CVE: CVE-2026-45232
+Upstream-Status: Backport [https://github.com/RsyncProject/rsync/commit/a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba]
+
+(cherry picked from commit a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba)
+Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
+---
+ socket.c | 30 +++--
+ testsuite/proxy-response-line-too-long.test | 128 ++++++++++++++++++++
+ 2 files changed, 145 insertions(+), 13 deletions(-)
+ create mode 100755 testsuite/proxy-response-line-too-long.test
+
+diff --git a/socket.c b/socket.c
+index c2075adf..6a8f6f4a 100644
+--- a/socket.c
++++ b/socket.c
+@@ -47,21 +47,23 @@ static struct sigaction sigact;
+
+ static int sock_exec(const char *prog);
+
++#define PROXY_BUF_SIZE 1024
++
+ /* Establish a proxy connection on an open socket to a web proxy by using the
+ * CONNECT method. If proxy_user and proxy_pass are not NULL, they are used to
+ * authenticate to the proxy using the "Basic" proxy-authorization protocol. */
+ static int establish_proxy_connection(int fd, char *host, int port, char *proxy_user, char *proxy_pass)
+ {
+- char *cp, buffer[1024];
+- char *authhdr, authbuf[1024];
++ char *cp, buffer[PROXY_BUF_SIZE + 1];
++ char *authhdr, authbuf[PROXY_BUF_SIZE + 1];
+ int len;
+
+ if (proxy_user && proxy_pass) {
+- stringjoin(buffer, sizeof buffer,
++ stringjoin(buffer, PROXY_BUF_SIZE,
+ proxy_user, ":", proxy_pass, NULL);
+ len = strlen(buffer);
+
+- if ((len*8 + 5) / 6 >= (int)sizeof authbuf - 3) {
++ if ((len*8 + 5) / 6 >= PROXY_BUF_SIZE - 3) {
+ rprintf(FERROR,
+ "authentication information is too long\n");
+ return -1;
+@@ -74,14 +76,14 @@ static int establish_proxy_connection(int fd, char *host, int port, char *proxy_
+ authhdr = "";
+ }
+
+- len = snprintf(buffer, sizeof buffer, "CONNECT %s:%d HTTP/1.0%s%s\r\n\r\n", host, port, authhdr, authbuf);
+- assert(len > 0 && len < (int)sizeof buffer);
++ len = snprintf(buffer, PROXY_BUF_SIZE, "CONNECT %s:%d HTTP/1.0%s%s\r\n\r\n", host, port, authhdr, authbuf);
++ assert(len > 0 && len < PROXY_BUF_SIZE);
+ if (write(fd, buffer, len) != len) {
+ rsyserr(FERROR, errno, "failed to write to proxy");
+ return -1;
+ }
+
+- for (cp = buffer; cp < &buffer[sizeof buffer - 1]; cp++) {
++ for (cp = buffer; cp < &buffer[PROXY_BUF_SIZE - 1]; cp++) {
+ if (read(fd, cp, 1) != 1) {
+ rsyserr(FERROR, errno, "failed to read from proxy");
+ return -1;
+@@ -90,11 +92,13 @@ static int establish_proxy_connection(int fd, char *host, int port, char *proxy_
+ break;
+ }
+
+- if (*cp != '\n')
+- cp++;
+- *cp-- = '\0';
+- if (*cp == '\r')
+- *cp = '\0';
++ if (cp == &buffer[PROXY_BUF_SIZE - 1]) {
++ rprintf(FERROR, "proxy response line too long\n");
++ return -1;
++ }
++ *cp = '\0';
++ if (cp > buffer && cp[-1] == '\r')
++ cp[-1] = '\0';
+ if (strncmp(buffer, "HTTP/", 5) != 0) {
+ rprintf(FERROR, "bad response from proxy -- %s\n",
+ buffer);
+@@ -110,7 +114,7 @@ static int establish_proxy_connection(int fd, char *host, int port, char *proxy_
+ }
+ /* throw away the rest of the HTTP header */
+ while (1) {
+- for (cp = buffer; cp < &buffer[sizeof buffer - 1]; cp++) {
++ for (cp = buffer; cp < &buffer[PROXY_BUF_SIZE]; cp++) {
+ if (read(fd, cp, 1) != 1) {
+ rsyserr(FERROR, errno,
+ "failed to read from proxy");
+diff --git a/testsuite/proxy-response-line-too-long.test b/testsuite/proxy-response-line-too-long.test
+new file mode 100755
+index 00000000..7f55c43b
+--- /dev/null
++++ b/testsuite/proxy-response-line-too-long.test
+@@ -0,0 +1,128 @@
++#!/bin/sh
++
++# Copyright (C) 2026 by Andrew Tridgell
++
++# This program is distributable under the terms of the GNU GPL (see
++# COPYING).
++
++# Regression test for the off-by-one stack OOB write in
++# establish_proxy_connection() in socket.c when a malicious or
++# man-in-the-middle HTTP proxy returns a first response line of
++# 1023+ bytes without a '\n' terminator.
++#
++# Pre-fix: the read loop walked buffer[0..sizeof-2] one byte at a
++# time, then post-loop logic did "if (*cp != '\n') cp++; *cp-- =
++# '\0';". If no newline arrived before the loop filled the buffer,
++# cp was left at &buffer[sizeof-1] (never written by the loop),
++# *cp held stale stack bytes, and cp++ pushed cp one past the array.
++# The null-termination then wrote one byte out of bounds on the
++# stack. AddressSanitizer reports stack-buffer-overflow at the
++# null-termination site.
++#
++# Post-fix: the bound-exhaustion case is detected by position and
++# rejected with an "proxy response line too long" message, so no
++# OOB write occurs and rsync exits with a non-signal status.
++
++. "$suitedir/rsync.fns"
++
++command -v python3 >/dev/null 2>&1 || test_skipped "python3 not available"
++
++workdir="$scratchdir/workdir"
++mkdir -p "$workdir"
++cd "$workdir"
++
++port_file="$workdir/port"
++proxy_log="$workdir/proxy.log"
++
++# A minimal TCP listener: binds to an ephemeral port on 127.0.0.1,
++# writes the chosen port to $port_file *before* accept() so the test
++# can synchronise without a sleep, accepts one connection, reads
++# until end-of-headers or 64 KiB, sends exactly 1023 bytes of 'X'
++# with no '\n', then closes.
++python3 - "$port_file" >"$proxy_log" 2>&1 <<'PYEOF' &
++import socket, sys, os
++port_file = sys.argv[1]
++s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
++s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
++s.bind(("127.0.0.1", 0))
++port = s.getsockname()[1]
++tmp = port_file + ".tmp"
++with open(tmp, "w") as fp:
++ fp.write("%d\n" % port)
++os.rename(tmp, port_file) # atomic visibility to the shell side
++s.listen(1)
++conn, _ = s.accept()
++conn.settimeout(5)
++try:
++ data = b""
++ while b"\r\n\r\n" not in data and len(data) < 65536:
++ chunk = conn.recv(8192)
++ if not chunk:
++ break
++ data += chunk
++except socket.timeout:
++ pass
++conn.sendall(b"X" * 1023) # exactly the buffer-1 trigger size
++try:
++ conn.shutdown(socket.SHUT_RDWR)
++except OSError:
++ pass
++conn.close()
++s.close()
++PYEOF
++proxy_pid=$!
++
++# Wait up to ~10s for the listener to publish its port.
++i=0
++while [ ! -s "$port_file" ] && [ $i -lt 10 ]; do
++ sleep 1
++ i=$((i + 1))
++done
++
++if [ ! -s "$port_file" ]; then
++ kill "$proxy_pid" 2>/dev/null
++ cat "$proxy_log" >&2 2>/dev/null
++ test_fail "proxy listener never published a port"
++fi
++
++port=`cat "$port_file"`
++case "$port" in
++ *[!0-9]*|"") kill "$proxy_pid" 2>/dev/null; test_fail "bogus port from listener: '$port'" ;;
++esac
++
++# Run rsync through the malicious proxy. Any rsync:// URL works:
++# the proxy intercepts the CONNECT and never forwards anywhere.
++rsync_err="$workdir/rsync.err"
++
++# rsync MUST exit non-zero here (the proxy is misbehaving).
++# Use `|| status=$?` so we capture the real exit code under `sh -e`;
++# `if ! cmd; then status=$?` would only ever see 0 because the `!`
++# is the last command before `$?`.
++status=0
++RSYNC_PROXY="127.0.0.1:$port" \
++ $RSYNC rsync://example.invalid:873/whatever/ "$workdir/out/" \
++ >/dev/null 2>"$rsync_err" || status=$?
++
++# Reap the listener.
++wait "$proxy_pid" 2>/dev/null || true
++
++# 1. rsync must not have crashed (SIGSEGV/SIGABRT report >= 128).
++if [ "$status" -ge 128 ]; then
++ cat "$rsync_err" >&2
++ test_fail "rsync killed by signal (status=$status) -- possible stack OOB regression"
++fi
++
++# 2. rsync must have actually exited non-zero (i.e. saw the bad proxy).
++if [ "$status" -eq 0 ]; then
++ cat "$rsync_err" >&2
++ test_fail "rsync returned success despite malformed proxy response"
++fi
++
++# 3. The new error message must appear.
++if ! grep -q "proxy response line too long" "$rsync_err"; then
++ cat "$rsync_err" >&2
++ test_fail "expected 'proxy response line too long' in rsync stderr"
++fi
++
++echo "OK: over-long proxy response line rejected cleanly without crashing"
++exit 0
diff --git a/meta/recipes-devtools/rsync/rsync_3.4.1.bb b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
index d0d57defe8d..2744b3a80f7 100644
--- a/meta/recipes-devtools/rsync/rsync_3.4.1.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.4.1.bb
@@ -29,6 +29,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
file://CVE-2026-43618.patch \
file://CVE-2026-43620.patch \
file://CVE-2026-43617.patch \
+ file://CVE-2026-45232.patch \
"
SRC_URI[sha256sum] = "2924bcb3a1ed8b551fc101f740b9f0fe0a202b115027647cf69850d65fd88c52"
^ permalink raw reply related [flat|nested] 39+ messages in thread* Re: [OE-core][wrynose 11/36] rsync: Fix CVE-2026-45232
2026-07-27 22:55 ` [OE-core][wrynose 11/36] rsync: Fix CVE-2026-45232 Yoann Congal
@ 2026-07-28 13:25 ` Yoann Congal
0 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-28 13:25 UTC (permalink / raw)
To: Yoann Congal, openembedded-core, Ashishkumar Parmar
On Tue Jul 28, 2026 at 12:55 AM CEST, Yoann Congal wrote:
> From: Ashishkumar Parmar <asparmar@cisco.com>
>
> This patch applies the upstream v3.4.3 backport for
> CVE-2026-45232. The upstream fix commit is referenced in [1],
> and the public CVE advisory is referenced in [2].
>
> [1] https://github.com/RsyncProject/rsync/commit/a5fc5ebe7a8ef1aa72f6e344599f97fd4427ecba
> [2] https://github.com/RsyncProject/rsync/security/advisories/GHSA-8f85-j2cv-59m8
>
> Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
> ---
> .../rsync/files/CVE-2026-45232.patch | 240 ++++++++++++++++++
> meta/recipes-devtools/rsync/rsync_3.4.1.bb | 1 +
> 2 files changed, 241 insertions(+)
> create mode 100644 meta/recipes-devtools/rsync/files/CVE-2026-45232.patch
This rsync series does not build on debian11:
|[yocon@debian11 build]$ bitbake rsync-native
|Build Configuration:
|BB_VERSION = "2.18.0"
|BUILD_SYS = "x86_64-linux"
|NATIVELSBSTRING = "universal"
|TARGET_SYS = "x86_64-poky-linux"
|MACHINE = "qemux86-64"
|SDKMACHINE = "x86_64"
|DISTRO = "poky"
|DISTRO_VERSION = "6.0.2"
|TUNE_FEATURES = "m64 x86-64-v3"
|meta = "stable/wrynose-nut:d174aa123d5a3e7dab771a060b2d173192e11535"
|meta-yocto-bsp
|meta-poky = "stable/wrynose-nut:cc2e16655b852958a7bb0ef636e9286b91bcb43f"
|workspace = "<unknown>:<unknown>"
|
|Sstate summary: Wanted 71 Local 64 Mirrors 0 Missed 7 Current 20 (90% match, 92% complete)
|Initialising tasks: 100% |#####################################################################################################################################################| Time: 0:00:00
|NOTE: Executing Tasks
|ERROR: rsync-native-3.4.1-r0 do_configure: configure failed
|ERROR: rsync-native-3.4.1-r0 do_configure: Execution of '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/temp/run.do_configure.1808145' failed with exit code 1
|ERROR: Logfile of failure stored in: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/temp/log.do_configure.1808145
|Log data follows:
|| DEBUG: Executing python function extend_recipe_sysroot
|| NOTE: Direct dependencies are ['.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/libtool/libtool-native_2.5.4.bb:do_populate_sysroot', '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/quilt/quilt-native_0.69.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-core/zlib/zlib_1.3.2.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/autoconf/autoconf_2.73.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/automake/automake_1.18.1.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/attr/acl_2.3.2.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/attr/attr_2.5.2.bb:do_populate_sysroot', 'virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/popt/popt_1.19.bb:do_populate_sysroot']
|| NOTE: Installed into sysroot: []
|| NOTE: Skipping as already exists in sysroot: ['gettext-minimal-native', 'libtool-native', 'm4-native', 'quilt-native', 'texinfo-dummy-native', 'zlib-native', 'autoconf-native', 'automake-native', 'gnu-config-native', 'acl-native', 'attr-native', 'popt-native']
|| DEBUG: Python function extend_recipe_sysroot finished
|| DEBUG: Executing shell function autotools_preconfigure
|| DEBUG: Shell function autotools_preconfigure finished
|| DEBUG: Executing python function autotools_sitefiles
|| DEBUG: SITE files ['endian-little', 'common-linux', 'common-glibc', 'bit-64', 'x86_64-linux', 'common']
|| DEBUG: Python function autotools_sitefiles finished
|| DEBUG: Executing shell function do_configure
|| NOTE: Executing ACLOCAL="aclocal --aclocal-path=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/aclocal/" autoreconf -Wcross --verbose --install --force --exclude=autopoint
|| autoreconf: export WARNINGS=cross,no-obsolete
|| autoreconf: Entering directory '.'
|| autoreconf: configure.ac: not running autopoint: --exclude autopoint was given
|| autoreconf: running: aclocal --aclocal-path=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/aclocal/ --force
|| autoreconf: configure.ac: tracing
|| autoreconf: configure.ac: not using Libtool
|| autoreconf: configure.ac: not using Intltool
|| autoreconf: configure.ac: not using Gtkdoc
|| autoreconf: configure.ac: no need to run autopoint (confirmed)
|| autoreconf: running: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/bin/autoconf --force
|| configure.ac:287: warning: AC_RUN_IFELSE called without default to allow cross compiling
|| ../sources/autoconf-2.73/lib/autoconf/general.m4:3037: AC_RUN_IFELSE is expanded from...
|| configure.ac:287: the top level
|| autoreconf: running: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/bin/autoheader --force
|| autoreconf: configure.ac: not using Automake
|| autoreconf: './config.sub' is updated
|| autoreconf: './config.guess' is updated
|| autoreconf: './install-sh' is updated
|| autoreconf: configure.ac: not running make: --make not given
|| autoreconf: Leaving directory '.'
|| NOTE: Running ./configure --build=x86_64-linux --host=x86_64-linux --target=x86_64-linux --prefix=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr --exec_prefix=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr --bindir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/bin --sbindir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/sbin --libexecdir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/libexec --datadir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share --sysconfdir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/etc --sharedstatedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/com --localstatedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/var --libdir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/lib --includedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/include --oldincludedir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/include --infodir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/info --mandir=.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/recipe-sysroot-native/usr/share/man --disable-silent-rules --disable-dependency-tracking --disable-md2man --with-nobody-group=nogroup --without-included-zlib --disable-static --enable-acl-support --enable-xattr-support --enable-ipv6 --disable-lz4 --disable-openssl --disable-xxhash --disable-zstd
|| configure: WARNING: unrecognized options: --disable-silent-rules, --disable-dependency-tracking, --disable-static
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/endian-little
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/common-linux
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/common-glibc
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/x86_64-linux
|| configure: loading site script .../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/site/common
|| checking for x86_64-linux-gcc... gcc
|| checking whether the C compiler works... no
|| configure: error: in '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/sources/rsync-3.4.1':
|| configure: error: C compiler cannot create executables
|| See 'config.log' for more details
|| NOTE: The following config.log files may provide further information.
|| NOTE: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/sources/rsync-3.4.1/config.log
|| ERROR: configure failed
|| WARNING: exit code 1 from a shell command.
|ERROR: Task (virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/rsync/rsync_3.4.1.bb:do_configure) failed with exit code '1'
|NOTE: Tasks Summary: Attempted 189 tasks of which 168 didn't need to be rerun and 1 failed.
|
|Summary: 1 task failed:
| virtual:native:.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-devtools/rsync/rsync_3.4.1.bb:do_configure
| log: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86_64-linux/rsync-native/3.4.1/temp/log.do_configure.1808145
|Summary: There were 2 ERROR messages, returning a non-zero exit code.
The config.log shows:
|/usr/bin/ld: unrecognized option '--no-rosegment'
|/usr/bin/ld: use the --help option for usage information
|collect2: error: ld returned 1 exit status
Ashishkumar, can you look into that?
Thanks!
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 39+ messages in thread
* [OE-core][wrynose 12/36] gnutls: fix CVE-2026-3833
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (10 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 11/36] rsync: Fix CVE-2026-45232 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 13/36] libpng: set status for CVE-2026-40930 Yoann Congal
` (23 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Backport patch to fix CVE-2026-3833.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-3833
Upstream fix:
https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5
Tested with ptest:
Before: PASSED: 371, FAILED: 0, SKIPPED: 15
After: PASSED: 371, FAILED: 0, SKIPPED: 15
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gnutls/gnutls/CVE-2026-3833.patch | 90 +++++++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 1 +
2 files changed, 91 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch
new file mode 100644
index 00000000000..25ba126054c
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3833.patch
@@ -0,0 +1,90 @@
+From 0af3e60734ade8e89e6bec6c2687164e273fcbf2 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Mon, 16 Mar 2026 15:29:40 +0100
+Subject: [PATCH] x509/name-constraints: compare domain names case-insensitive
+
+RFC 5280 7.2:
+> When comparing DNS names for equality, conforming implementations
+> MUST perform a case-insensitive exact match on the entire DNS name.
+> When evaluating name constraints, conforming implementations MUST
+> perform a case-insensitive exact match on a label-by-label basis.
+
+Domain name comparison during name constraints processing
+was case-sensitive. For excluded name constraints, this could lead to
+incorrectly accepting domain names that should've been rejected.
+The code for comparing domain names and domain name parts of emails
+has been modified to perform case-insensitive comparison instead.
+
+Reported-by: Oleh Konko <security@1seal.org>
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1223
+Fixes: #1803
+Fixes: #1852
+Fixes: CVE-2026-3833
+Fixes: GNUTLS-SA-2026-04-29-5
+CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+
+CVE: CVE-2026-3833
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/19f6508647bdcd3ce21130201e484d7ca6d962c5]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/x509/name_constraints.c | 23 ++++++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c
+index 04722bdf4..dee045d25 100644
+--- a/lib/x509/name_constraints.c
++++ b/lib/x509/name_constraints.c
+@@ -35,6 +35,7 @@
+ #include "x509_int.h"
+ #include "x509_ext_int.h"
+ #include <libtasn1.h>
++#include "c-strcase.h"
+
+ #include "ip.h"
+ #include "ip-in-cidr.h"
+@@ -80,7 +81,7 @@ enum name_constraint_relation {
+ NC_SORTS_AFTER = 2 /* unrelated constraints */
+ };
+
+-/* A helper to compare just a pair of strings with this rich comparison */
++/* Helpers to compare just a pair of strings with this rich comparison */
+ static enum name_constraint_relation
+ compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len)
+ {
+@@ -96,6 +97,22 @@ compare_strings(const void *n1, size_t n1_len, const void *n2, size_t n2_len)
+ return NC_EQUAL;
+ }
+
++static enum name_constraint_relation
++compare_strings_case_insensitive(const void *n1, size_t n1_len, const void *n2,
++ size_t n2_len)
++{
++ int r = c_strncasecmp(n1, n2, MIN(n1_len, n2_len));
++ if (r < 0)
++ return NC_SORTS_BEFORE;
++ if (r > 0)
++ return NC_SORTS_AFTER;
++ if (n1_len < n2_len)
++ return NC_SORTS_BEFORE;
++ if (n1_len > n2_len)
++ return NC_SORTS_AFTER;
++ return NC_EQUAL;
++}
++
+ /* Rich-compare DNS names. Example order/relationships:
+ * z.x.a INCLUDED_BY x.a BEFORE y.a INCLUDED_BY a BEFORE x.b BEFORE y.b */
+ static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1,
+@@ -121,8 +138,8 @@ static enum name_constraint_relation compare_dns_names(const gnutls_datum_t *n1,
+ while (j && n2->data[j - 1] != '.')
+ j--;
+
+- rel = compare_strings(&n1->data[i], i_end - i, &n2->data[j],
+- j_end - j);
++ rel = compare_strings_case_insensitive(&n1->data[i], i_end - i,
++ &n2->data[j], j_end - j);
+ if (rel == NC_SORTS_BEFORE) /* x.a BEFORE y.a */
+ return NC_SORTS_BEFORE;
+ if (rel == NC_SORTS_AFTER) /* y.a AFTER x.a */
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index 3085a62310a..3ad011742e4 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -36,6 +36,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://CVE-2026-3832_p2.patch \
file://CVE-2026-42009_p1.patch \
file://CVE-2026-42009_p2.patch \
+ file://CVE-2026-3833.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 13/36] libpng: set status for CVE-2026-40930
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (11 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 12/36] gnutls: fix CVE-2026-3833 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 14/36] python3-cryptography: set CVE_PRODUCT Yoann Congal
` (22 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Per [1]:
* The vulnerable code originates from the third-party libpng-apng patch,
which adds APNG support to libpng 1.6.x.
* Upstream libpng 1.6.x (without the apng patch) is not affected.
As Yocto never included libpng-apng patch, we can ignore this CVE.
[1] https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8a4758455a2534050ee4b5cedcfdf86da9f243c2)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-multimedia/libpng/libpng_1.6.56.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
index 9dbd0d26e06..9a85d44f52b 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
@@ -72,3 +72,5 @@ do_install_ptest() {
}
BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2026-40930] = "cpe-incorrect: Yocto never included affected libpng-apng patch"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 14/36] python3-cryptography: set CVE_PRODUCT
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (12 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 13/36] libpng: set status for CVE-2026-40930 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 15/36] python3-ply: " Yoann Congal
` (21 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: mark.yang <mark.yang@lge.com>
NVD lists it as cryptography.io:cryptography and CNA lists it as
pyca:cryptography, so set both vendor:product pairs to match correctly
and precisely.
Suggested-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b721019e0b2ccbaa8de267e14b282c48a5a3de8b)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3-cryptography.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb
index fc5cb50b029..42e8c5ff19c 100644
--- a/meta/recipes-devtools/python/python3-cryptography.bb
+++ b/meta/recipes-devtools/python/python3-cryptography.bb
@@ -73,4 +73,6 @@ FILES:${PN}-dbg += " \
${PYTHON_SITEPACKAGES_DIR}/${SRCNAME}/hazmat/bindings/.debug \
"
+CVE_PRODUCT = "cryptography.io:cryptography pyca:cryptography"
+
BBCLASSEXTEND = "native nativesdk"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 15/36] python3-ply: set CVE_PRODUCT
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (13 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 14/36] python3-cryptography: set CVE_PRODUCT Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 16/36] python3-pyasn1: " Yoann Congal
` (20 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: mark.yang <mark.yang@lge.com>
NVD registers ply as dabeaz:ply, so the default python:ply vendor
prefix never matches and no CVEs are reported. Use the exact
vendor:product pair.
CVE-2025-56005 will then show as unpatched; no fixed release exists.
Suggested-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb80fef9a76649fb1144408fbc7e2903439cd556)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3-ply_3.11.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-ply_3.11.bb b/meta/recipes-devtools/python/python3-ply_3.11.bb
index 2c5fa3f215e..06393ac4fed 100644
--- a/meta/recipes-devtools/python/python3-ply_3.11.bb
+++ b/meta/recipes-devtools/python/python3-ply_3.11.bb
@@ -14,4 +14,6 @@ RDEPENDS:${PN}:class-target += "\
python3-shell \
"
+CVE_PRODUCT = "dabeaz:ply"
+
BBCLASSEXTEND = "native nativesdk"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 16/36] python3-pyasn1: set CVE_PRODUCT
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (14 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 15/36] python3-ply: " Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 17/36] python3-setuptools: Fix CVE-2026-59890 Yoann Congal
` (19 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: mark.yang <mark.yang@lge.com>
The default python:pyasn1 does not match the NVD/CNA entries which use
pyasn1 as vendor, so CVEs like CVE-2026-30922 are never reported. Use
the exact pyasn1:pyasn1 pair.
Suggested-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4971337840e8855740409e8f5dadb3ab3661f033)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb b/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb
index 01157e251e6..b44e8774474 100644
--- a/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb
+++ b/meta/recipes-devtools/python/python3-pyasn1_0.6.2.bb
@@ -14,4 +14,6 @@ RDEPENDS:${PN}:class-target += " \
python3-shell \
"
+CVE_PRODUCT = "pyasn1:pyasn1"
+
BBCLASSEXTEND = "native nativesdk"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 17/36] python3-setuptools: Fix CVE-2026-59890
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (15 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 16/36] python3-pyasn1: " Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 18/36] openssh: set status for CVE-2026-59998 Yoann Congal
` (18 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
[1] https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59890
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python3-setuptools/CVE-2026-59890.patch | 194 ++++++++++++++++++
.../python/python3-setuptools_82.0.1.bb | 3 +-
2 files changed, 196 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch
diff --git a/meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch b/meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch
new file mode 100644
index 00000000000..7a6c86b40a4
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-setuptools/CVE-2026-59890.patch
@@ -0,0 +1,194 @@
+From 22e38898b6cec34f7e816c2664016e95afb024ad Mon Sep 17 00:00:00 2001
+From: "Jason R. Coombs" <jaraco@jaraco.com>
+Date: Sat, 27 Jun 2026 10:46:34 -0400
+Subject: [PATCH] Normalize Unicode form when matching MANIFEST.in patterns
+
+FileList matched MANIFEST.in patterns against on-disk names byte-for-byte
+with no Unicode normalization. On macOS APFS/HFS+, a file stored NFD and a
+pattern authored NFC denote the same file but differ byte-for-byte, so an
+exclude/global-exclude/recursive-exclude/prune rule could silently fail to
+drop a non-ASCII-named file, publishing it in the sdist despite the rule.
+
+Normalize both the pattern and the candidate path to NFC before matching,
+via a new unicode_utils.normalize() helper and a _NormalizedMatcher wrapper
+around the compiled pattern in translate_pattern.
+
+Fixes GHSA-h35f-9h28-mq5c.
+
+CVE: CVE-2026-59890
+Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f]
+
+Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
+(cherry picked from commit dd9f436a36486b4cb8a4c70a2321548b0be09b8f)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst | 7 +++
+ setuptools/command/egg_info.py | 28 +++++++++++-
+ setuptools/tests/test_manifest.py | 45 +++++++++++++++++++
+ setuptools/unicode_utils.py | 14 ++++++
+ 4 files changed, 93 insertions(+), 1 deletion(-)
+ create mode 100644 newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst
+
+diff --git a/newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst b/newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst
+new file mode 100644
+index 000000000..42d6c4cfe
+--- /dev/null
++++ b/newsfragments/+ghsa-h35f-9h28-mq5c.bugfix.rst
+@@ -0,0 +1,7 @@
++``MANIFEST.in`` matching (via ``FileList``) is now insensitive to Unicode
++normalization form. A pattern authored in one form (e.g. NFC, as typically
++saved by editors) now matches a file whose name is stored on disk in another
++(e.g. NFD, as produced by macOS APFS/HFS+). Previously an ``exclude``,
++``global-exclude``, ``recursive-exclude``, or ``prune`` rule could silently
++fail to drop a non-ASCII-named file from the source distribution, publishing
++it despite the exclusion -- see GHSA-h35f-9h28-mq5c.
+diff --git a/setuptools/command/egg_info.py b/setuptools/command/egg_info.py
+index a5b593270..138e29ee6 100644
+--- a/setuptools/command/egg_info.py
++++ b/setuptools/command/egg_info.py
+@@ -37,6 +37,27 @@ from distutils.util import convert_path
+ PY_MAJOR = f'{sys.version_info.major}.{sys.version_info.minor}'
+
+
++class _NormalizedMatcher:
++ """
++ Wrap a compiled pattern so that matching is insensitive to Unicode
++ normalization form.
++
++ File names walked from disk (NFD on macOS APFS/HFS+) and patterns from
++ ``MANIFEST.in`` (typically NFC) can denote the same file while differing
++ byte-for-byte. Normalizing both sides before matching keeps an exclusion
++ (or inclusion) from silently failing. See GHSA-h35f-9h28-mq5c.
++ """
++
++ def __init__(self, pattern: re.Pattern) -> None:
++ self._pattern = pattern
++
++ def match(self, path):
++ return self._pattern.match(unicode_utils.normalize(path))
++
++ def search(self, path):
++ return self._pattern.search(unicode_utils.normalize(path))
++
++
+ def translate_pattern(glob): # noqa: C901 # is too complex (14) # FIXME
+ """
+ Translate a file path glob like '*.txt' in to a regular expression.
+@@ -46,6 +67,11 @@ def translate_pattern(glob): # noqa: C901 # is too complex (14) # FIXME
+ """
+ pat = ''
+
++ # Normalize the pattern so it matches paths regardless of the Unicode
++ # normalization form used on disk (GHSA-h35f-9h28-mq5c). Candidate paths
++ # are normalized to the same form by ``_NormalizedMatcher``.
++ glob = unicode_utils.normalize(glob)
++
+ # This will split on '/' within [character classes]. This is deliberate.
+ chunks = glob.split(os.path.sep)
+
+@@ -117,7 +143,7 @@ def translate_pattern(glob): # noqa: C901 # is too complex (14) # FIXME
+ pat += sep
+
+ pat += r'\Z'
+- return re.compile(pat, flags=re.MULTILINE | re.DOTALL)
++ return _NormalizedMatcher(re.compile(pat, flags=re.MULTILINE | re.DOTALL))
+
+
+ class InfoCommon:
+diff --git a/setuptools/tests/test_manifest.py b/setuptools/tests/test_manifest.py
+index 903a528db..10bd41b88 100644
+--- a/setuptools/tests/test_manifest.py
++++ b/setuptools/tests/test_manifest.py
+@@ -10,6 +10,7 @@ import os
+ import shutil
+ import sys
+ import tempfile
++import unicodedata
+
+ import pytest
+
+@@ -157,6 +158,21 @@ def test_translated_pattern_mismatch(pattern_mismatch):
+ assert not translate_pattern(pattern).match(target)
+
+
++def test_translate_pattern_unicode_normalization():
++ """
++ Matching is insensitive to Unicode normalization form: a pattern authored
++ in one form matches a path stored on disk in another (and vice versa), so
++ that an exclusion cannot be bypassed by an NFC/NFD mismatch.
++
++ Regression test for GHSA-h35f-9h28-mq5c.
++ """
++ nfc = unicodedata.normalize('NFC', 'café.txt') # 'café.txt' composed
++ nfd = unicodedata.normalize('NFD', 'café.txt') # 'café.txt' decomposed
++ assert nfc != nfd # the two byte forms genuinely differ
++ assert translate_pattern(nfc).match(nfd)
++ assert translate_pattern(nfd).match(nfc)
++
++
+ class TempDirTestCase:
+ def setup_method(self, method):
+ self.temp_dir = tempfile.mkdtemp()
+@@ -331,6 +347,35 @@ class TestManifestTest(TempDirTestCase):
+ files = default_files | set([ml('app/a.txt'), ml('app/b.txt'), ml('app/c.rst')])
+ assert files == self.get_files()
+
++ def test_global_exclude_unicode_normalization(self):
++ """
++ A ``global-exclude`` authored NFC must drop a file whose on-disk name
++ is NFD: on macOS APFS/HFS+ the two are the same file, and even on
++ case/normalization-exact filesystems the decomposed name can be
++ committed and reach the build. Otherwise the file is published in the
++ sdist despite the exclusion.
++
++ Regression test for GHSA-h35f-9h28-mq5c.
++ """
++ nfc_name = unicodedata.normalize('NFC', 'café.txt')
++ nfd_name = unicodedata.normalize('NFD', 'café.txt')
++ assert nfc_name != nfd_name
++ # write the file under its decomposed (NFD) name ...
++ touch(os.path.join(self.temp_dir, 'app', nfd_name))
++ # ... and exclude it with the composed (NFC) form.
++ self.make_manifest(
++ f"""
++ global-include *.txt
++ global-exclude {nfc_name}
++ """
++ )
++ leaked = {
++ f
++ for f in self.get_files()
++ if unicodedata.normalize('NFC', os.path.basename(f)) == nfc_name
++ }
++ assert not leaked, f"excluded file leaked into manifest: {leaked}"
++
+
+ class TestFileListTest(TempDirTestCase):
+ """
+diff --git a/setuptools/unicode_utils.py b/setuptools/unicode_utils.py
+index f502f5b08..dbce03e1d 100644
+--- a/setuptools/unicode_utils.py
++++ b/setuptools/unicode_utils.py
+@@ -19,6 +19,20 @@ def decompose(path):
+ return path
+
+
++def normalize(text):
++ """
++ Return *text* in a canonical Unicode form (NFC) so that names which are
++ visually identical but encoded differently compare equal.
++
++ macOS APFS/HFS+ store file names in decomposed form (NFD), while patterns
++ in ``MANIFEST.in`` are typically authored composed (NFC). The two denote
++ the same file but differ byte-for-byte, so matching them directly lets an
++ exclusion silently fail. Normalizing both the walked path and the pattern
++ to a single form before matching avoids that (GHSA-h35f-9h28-mq5c).
++ """
++ return unicodedata.normalize('NFC', text) if isinstance(text, str) else text
++
++
+ def filesys_decode(path):
+ """
+ Ensure that the given path is decoded,
+--
+2.35.6
diff --git a/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb b/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb
index c413578faf5..36cfd91e94a 100644
--- a/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb
+++ b/meta/recipes-devtools/python/python3-setuptools_82.0.1.bb
@@ -9,7 +9,8 @@ inherit pypi python_setuptools_build_meta
CVE_PRODUCT = "python3-setuptools python:setuptools"
SRC_URI += " \
- file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch"
+ file://0001-_distutils-sysconfig.py-make-it-possible-to-substite.patch \
+ file://CVE-2026-59890.patch"
SRC_URI[sha256sum] = "7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 18/36] openssh: set status for CVE-2026-59998
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (16 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 17/36] python3-setuptools: Fix CVE-2026-59890 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 19/36] libgcrypt: fix CVE-2026-41989 Yoann Congal
` (17 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
Analysis:
- CVE-2026-59998 concerns an undocumented limitation of
GSSAPIStrictAcceptorCheck in Windows Active Directory environments [1].
- Upstream OpenSSH 10.4 only documents the existing behavior and provides no
code remediation [2].
- The recipe disables Kerberos/GSSAPI by default. Mark the CVE
not-applicable-config when PACKAGECONFIG lacks kerberos, and unpatched when
kerberos is enabled.
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59998
[2] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: See previous version of this patch for context about ignoring vs
this CVE vs patching:
https://patchwork.yoctoproject.org/project/oe-core/patch/20260720175518.3546447-3-devanshp@cisco.com/#40497 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-connectivity/openssh/openssh_10.3p1.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index f5184b1fce3..b13488e2652 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -44,6 +44,7 @@ Red Hat Enterprise Linux 7 and when running in a Kerberos environment"
CVE_STATUS[CVE-2008-3844] = "not-applicable-platform: Only applies to some distributed RHEL binaries."
CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1."
CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh."
+CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}"
PAM_SRC_URI = "file://sshd"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 19/36] libgcrypt: fix CVE-2026-41989
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (17 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 18/36] openssh: set status for CVE-2026-59998 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 20/36] libgcrypt: fix CVE-2026-41990 Yoann Congal
` (16 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Backport patch to fix CVE-2026-41989.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-41989
https://osv.dev/list?q=CVE-2026-41989
Upstream fix:
https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3
Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libgcrypt/files/CVE-2026-41989.patch | 42 +++++++++++++++++++
.../libgcrypt/libgcrypt_1.12.1.bb | 1 +
2 files changed, 43 insertions(+)
create mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch
diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch
new file mode 100644
index 00000000000..aba3ca318b4
--- /dev/null
+++ b/meta/recipes-support/libgcrypt/files/CVE-2026-41989.patch
@@ -0,0 +1,42 @@
+From d8874dd38f78454dd3a760617ebe8d9aa9270649 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 10 Apr 2026 16:58:57 +0900
+Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve.
+
+* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding
+mistake and add updating RAWMPILEN.
+
+--
+
+Reported by Calif.io in collaboration with Claude and Anthropic
+Research.
+
+GnuPG-bug-id: 8211
+Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7
+Suggested-by: Bronson Yen <bronson@calif.io>
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+
+CVE: CVE-2026-41989
+Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3]
+
+Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
+---
+ cipher/ecc-misc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c
+index 615b0df2..ab3799dc 100644
+--- a/cipher/ecc-misc.c
++++ b/cipher/ecc-misc.c
+@@ -438,7 +438,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ec, mpi_point_t result)
+ *--p = *buf++;
+
+ if (rawmpilen < nbytes)
+- memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen);
++ {
++ memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen);
++ rawmpilen = nbytes;
++ }
+ }
+ else
+ {
diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
index b3c0d050b7d..55872a5c237 100644
--- a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
+++ b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
@@ -25,6 +25,7 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \
file://no-native-gpg-error.patch \
file://no-bench-slope.patch \
file://run-ptest \
+ file://CVE-2026-41989.patch \
"
SRC_URI[sha256sum] = "7df5c08d952ba33f9b6bdabdb06a61a78b2cf62d2122c2d1d03a91a79832aa3c"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 20/36] libgcrypt: fix CVE-2026-41990
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (18 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 19/36] libgcrypt: fix CVE-2026-41989 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 21/36] sqlite3: fix CVE-2026-11822 and CVE-2026-11824 Yoann Congal
` (15 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Backport patch to fix CVE-2026-41990.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-41990
https://osv.dev/list?q=CVE-2026-41990
Upstream fix:
https://github.com/gpg/libgcrypt/commit/905e00f046a71e5670517779afaf85a354952832
Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libgcrypt/files/CVE-2026-41990.patch | 316 ++++++++++++++++++
.../libgcrypt/libgcrypt_1.12.1.bb | 1 +
2 files changed, 317 insertions(+)
create mode 100644 meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch
diff --git a/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch b/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch
new file mode 100644
index 00000000000..a4f18092274
--- /dev/null
+++ b/meta/recipes-support/libgcrypt/files/CVE-2026-41990.patch
@@ -0,0 +1,316 @@
+From 024391fc505ebf9c47e51953d7d85995ba179576 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Mon, 13 Apr 2026 11:51:46 +0900
+Subject: [PATCH] cipher:dilithium: Check the label length by caller.
+
+* cipher/dilithium.h (dilithium_keypair, dilithium_sign)
+(dilithium_verify): Return gpg_err_code_t.
+* cipher/dilithium.c (dilithium_keypair): Return gpg_err_code_t.
+(dilithium_sign, dilithium_verify): Ditto. Check CTXLEN.
+* cipher/pubkey-dilithium.c (mldsa_generate): Follow the change.
+(mldsa_sign, mldsa_verify): Likewise.
+
+--
+
+Reported by Calif.io in collaboration with Claude and Anthropic
+Research.
+
+GnuPG-bug-id: 8208
+Co-authored-by: Thai Duong <thai@calif.io>
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+
+CVE: CVE-2026-41990
+Upstream-Status: Backport [https://github.com/gpg/libgcrypt/commit/905e00f046a71e5670517779afaf85a354952832]
+
+Signed-off-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
+---
+ cipher/dilithium.c | 101 ++++++++++++++++++++++++++++----------
+ cipher/dilithium.h | 20 ++++----
+ cipher/pubkey-dilithium.c | 34 +++++--------
+ 3 files changed, 99 insertions(+), 56 deletions(-)
+
+diff --git a/cipher/dilithium.c b/cipher/dilithium.c
+index 955feb2a..212c4afe 100644
+--- a/cipher/dilithium.c
++++ b/cipher/dilithium.c
+@@ -82,6 +82,7 @@
+ #include "gcrypt-int.h"
+ #include "const-time.h"
+
++/* With glue code, we only use the "_internal" API of Dilithium. */
+ #define DILITHIUM_INTERNAL_API_ONLY 1
+
+ #include "dilithium.h"
+@@ -120,23 +121,33 @@ static int crypto_sign_verify_internal_5 (const uint8_t *sig, size_t siglen,
+ const uint8_t *pre, size_t prelen,
+ const uint8_t *pk);
+
+-int
++gpg_err_code_t
+ dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk,
+ const uint8_t seed[SEEDBYTES])
+ {
++ int r;
++
+ switch (algo)
+ {
+ case GCRY_MLDSA44:
+- return crypto_sign_keypair_internal_2 (pk, sk, seed);
++ r = crypto_sign_keypair_internal_2 (pk, sk, seed);
++ break;
+ case GCRY_MLDSA65:
+ default:
+- return crypto_sign_keypair_internal_3 (pk, sk, seed);
++ r = crypto_sign_keypair_internal_3 (pk, sk, seed);
++ break;
+ case GCRY_MLDSA87:
+- return crypto_sign_keypair_internal_5 (pk, sk, seed);
++ r = crypto_sign_keypair_internal_5 (pk, sk, seed);
++ break;
+ }
++
++ if (r < 0)
++ return GPG_ERR_INTERNAL;
++
++ return 0;
+ }
+
+-int
++gpg_err_code_t
+ dilithium_sign (int algo, uint8_t *sig, size_t siglen,
+ const uint8_t *m, size_t mlen,
+ const uint8_t *ctx, size_t ctxlen,
+@@ -145,9 +156,17 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen,
+ size_t i;
+ uint8_t pre[257];
+ size_t prelen;
++ int r;
+
+- if (ctx == NULL && ctxlen == -1)
+- prelen = 0;
++ if (ctx == NULL)
++ {
++ if (ctxlen == -1)
++ prelen = 0;
++ else
++ return GPG_ERR_INV_DATA;
++ }
++ else if (ctxlen > 255)
++ return GPG_ERR_INV_DATA;
+ else
+ {
+ /* Prepare pre = (0, ctxlen, ctx) */
+@@ -158,28 +177,44 @@ dilithium_sign (int algo, uint8_t *sig, size_t siglen,
+ prelen = 2 + ctxlen;
+ }
+
++ /*
++ * Note that the second argument of the upstream routine is the
++ * pointer to output length of signature. It assumes the first
++ * argument (pointer to output signature) should have correct (or
++ * more) length, beforehand.
++ *
++ * Before calling the routine, we should check the length.
++ */
+ switch (algo)
+ {
+ case GCRY_MLDSA44:
+ if (siglen != CRYPTO_BYTES_2)
+- return -1;
+- return crypto_sign_signature_internal_2 (sig, &siglen, m, mlen,
+- pre, prelen, rnd, sk);
++ return GPG_ERR_INV_DATA;
++ r = crypto_sign_signature_internal_2 (sig, &siglen, m, mlen,
++ pre, prelen, rnd, sk);
++ break;
+ case GCRY_MLDSA65:
+ default:
+ if (siglen != CRYPTO_BYTES_3)
+- return -1;
+- return crypto_sign_signature_internal_3 (sig, &siglen, m, mlen,
+- pre, prelen, rnd, sk);
++ return GPG_ERR_INV_DATA;
++ r = crypto_sign_signature_internal_3 (sig, &siglen, m, mlen,
++ pre, prelen, rnd, sk);
++ break;
+ case GCRY_MLDSA87:
+ if (siglen != CRYPTO_BYTES_5)
+- return -1;
+- return crypto_sign_signature_internal_5 (sig, &siglen, m, mlen,
+- pre, prelen, rnd, sk);
++ return GPG_ERR_INV_DATA;
++ r = crypto_sign_signature_internal_5 (sig, &siglen, m, mlen,
++ pre, prelen, rnd, sk);
++ break;
+ }
++
++ if (r < 0)
++ return GPG_ERR_INTERNAL;
++
++ return 0;
+ }
+
+-int
++gpg_err_code_t
+ dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
+ const uint8_t *m, size_t mlen,
+ const uint8_t *ctx, size_t ctxlen,
+@@ -188,9 +223,17 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
+ size_t i;
+ uint8_t pre[257];
+ size_t prelen;
++ int r;
+
+- if (ctx == NULL && ctxlen == -1)
+- prelen = 0;
++ if (ctx == NULL)
++ {
++ if (ctxlen == -1)
++ prelen = 0;
++ else
++ return GPG_ERR_INV_DATA;
++ }
++ else if (ctxlen > 255)
++ return GPG_ERR_INV_DATA;
+ else
+ {
+ /* Prepare pre = (0, ctxlen, ctx) */
+@@ -204,16 +247,24 @@ dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
+ switch (algo)
+ {
+ case GCRY_MLDSA44:
+- return crypto_sign_verify_internal_2 (sig, siglen, m, mlen,
+- pre, prelen, pk);
++ r = crypto_sign_verify_internal_2 (sig, siglen, m, mlen,
++ pre, prelen, pk);
++ break;
+ case GCRY_MLDSA65:
+ default:
+- return crypto_sign_verify_internal_3 (sig, siglen, m, mlen,
+- pre, prelen, pk);
++ r = crypto_sign_verify_internal_3 (sig, siglen, m, mlen,
++ pre, prelen, pk);
++ break;
+ case GCRY_MLDSA87:
+- return crypto_sign_verify_internal_5 (sig, siglen, m, mlen,
+- pre, prelen, pk);
++ r = crypto_sign_verify_internal_5 (sig, siglen, m, mlen,
++ pre, prelen, pk);
++ break;
+ }
++
++ if (r < 0)
++ return GPG_ERR_BAD_SIGNATURE;
++
++ return 0;
+ }
+
+ typedef struct {
+diff --git a/cipher/dilithium.h b/cipher/dilithium.h
+index 88a48094..dc18f158 100644
+--- a/cipher/dilithium.h
++++ b/cipher/dilithium.h
+@@ -64,16 +64,16 @@
+ #define DILITHIUM_SIGN_STACK_BURN (161 * 1024)
+ #define DILITHIUM_VERIFY_STACK_BURN (122 * 1024)
+
+-int dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk,
+- const uint8_t seed[SEEDBYTES]);
+-int dilithium_sign (int algo, uint8_t *sig, size_t siglen,
+- const uint8_t *m, size_t mlen,
+- const uint8_t *ctx, size_t ctxlen,
+- const uint8_t *sk, const uint8_t rnd[RNDBYTES]);
+-int dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
+- const uint8_t *m, size_t mlen,
+- const uint8_t *ctx, size_t ctxlen,
+- const uint8_t *pk);
++gpg_err_code_t dilithium_keypair (int algo, uint8_t *pk, uint8_t *sk,
++ const uint8_t seed[SEEDBYTES]);
++gpg_err_code_t dilithium_sign (int algo, uint8_t *sig, size_t siglen,
++ const uint8_t *m, size_t mlen,
++ const uint8_t *ctx, size_t ctxlen,
++ const uint8_t *sk, const uint8_t rnd[RNDBYTES]);
++gpg_err_code_t dilithium_verify (int algo, const uint8_t *sig, size_t siglen,
++ const uint8_t *m, size_t mlen,
++ const uint8_t *ctx, size_t ctxlen,
++ const uint8_t *pk);
+ #endif
+
+ #if defined(DILITHIUM_MODE)
+diff --git a/cipher/pubkey-dilithium.c b/cipher/pubkey-dilithium.c
+index 03958bb0..8c3f650e 100644
+--- a/cipher/pubkey-dilithium.c
++++ b/cipher/pubkey-dilithium.c
+@@ -170,7 +170,7 @@ mldsa_generate (const gcry_sexp_t genparms, gcry_sexp_t *r_skey)
+ memcpy (seed, seed_supplied, SEEDBYTES);
+ }
+
+- dilithium_keypair (info->algo, pk, sk, seed);
++ rc = dilithium_keypair (info->algo, pk, sk, seed);
+ _gcry_burn_stack (DILITHIUM_KEYPAIR_STACK_BURN);
+
+ if (!rc)
+@@ -206,7 +206,6 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
+ size_t data_len;
+ const unsigned char *sk;
+ const struct mldsa_info *info = mldsa_get_info (keyparms);
+- int r;
+
+ if (!info)
+ return GPG_ERR_PUBKEY_ALGO;
+@@ -258,17 +257,14 @@ mldsa_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
+ else
+ randombytes (rnd, RNDBYTES);
+ if (ctx.flags & PUBKEY_FLAG_NO_PREFIX)
+- r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
+- NULL, -1, sk, rnd);
++ rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
++ NULL, -1, sk, rnd);
+ else
+- r = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
+- ctx.label, ctx.labellen, sk, rnd);
++ rc = dilithium_sign (info->algo, sig, info->sig_len, data, data_len,
++ ctx.label, ctx.labellen, sk, rnd);
+ _gcry_burn_stack (DILITHIUM_SIGN_STACK_BURN);
+- if (r < 0)
+- {
+- rc = GPG_ERR_INTERNAL;
+- goto leave;
+- }
++ if (rc)
++ goto leave;
+
+ rc = sexp_build (r_sig, NULL, "(sig-val(%s(s%b)))", info->name,
+ info->sig_len, sig);
+@@ -300,7 +296,6 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
+ size_t data_len;
+ const unsigned char *pk;
+ const struct mldsa_info *info = mldsa_get_info (keyparms);
+- int r;
+
+ if (!info)
+ return GPG_ERR_PUBKEY_ALGO;
+@@ -350,17 +345,14 @@ mldsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms)
+ }
+
+ if (ctx.flags & PUBKEY_FLAG_NO_PREFIX)
+- r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
+- NULL, -1, pk);
++ rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
++ NULL, -1, pk);
+ else
+- r = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
+- ctx.label, ctx.labellen, pk);
++ rc = dilithium_verify (info->algo, sig, info->sig_len, data, data_len,
++ ctx.label, ctx.labellen, pk);
+ _gcry_burn_stack (DILITHIUM_VERIFY_STACK_BURN);
+- if (r < 0)
+- {
+- rc = GPG_ERR_BAD_SIGNATURE;
+- goto leave;
+- }
++ if (rc)
++ goto leave;
+
+ leave:
+ _gcry_pk_util_free_encoding_ctx (&ctx);
diff --git a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
index 55872a5c237..d7f8563ae6e 100644
--- a/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
+++ b/meta/recipes-support/libgcrypt/libgcrypt_1.12.1.bb
@@ -26,6 +26,7 @@ SRC_URI = "${GNUPG_MIRROR}/libgcrypt/libgcrypt-${PV}.tar.bz2 \
file://no-bench-slope.patch \
file://run-ptest \
file://CVE-2026-41989.patch \
+ file://CVE-2026-41990.patch \
"
SRC_URI[sha256sum] = "7df5c08d952ba33f9b6bdabdb06a61a78b2cf62d2122c2d1d03a91a79832aa3c"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 21/36] sqlite3: fix CVE-2026-11822 and CVE-2026-11824
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (19 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 20/36] libgcrypt: fix CVE-2026-41990 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 22/36] curl: add annotation for CVE-2026-10536 Yoann Congal
` (14 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix [1], which addresses memory
corruption vulnerabilities in the SQLite FTS5 full-text search extension.
The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in
shown in [2].
[1] https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f
[2] https://sqlite.org/src/info/061febcf41ca
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-11822
https://nvd.nist.gov/vuln/detail/CVE-2026-11824
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../CVE-2026-11822_CVE-2026-11824.patch | 41 +++++++++++++++++++
meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 5 ++-
2 files changed, 45 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch
diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch
new file mode 100644
index 00000000000..0bac4412b18
--- /dev/null
+++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch
@@ -0,0 +1,41 @@
+From d38b8fb5636c6d77f76dbeb5291f49ab594dcad4 Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Mon, 11 May 2026 12:00:19 +0000
+Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when
+ processing corrupt records.
+
+FossilOrigin-Name: 061febcf41ca4872a0f407951e1507209daca7895122b909a7806c60b6e200c4
+
+CVE: CVE-2026-11822 CVE-2026-11824
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f]
+
+Backport Changes:
+- Applied the upstream fts5LeafRead() fix from ext/fts5/fts5_index.c
+ to sqlite3.c because the Yocto sqlite-autoconf source uses the
+ amalgamated SQLite layout.
+- Omitted ext/fts5/test/fts5corruptA.test because this extracted
+ recipe source contains the SQLite autoconf/amalgamation layout and
+ does not carry the upstream Tcl test tree.
+- Omitted Git mirror metadata files manifest and manifest.uuid because
+ they are not required for the security fix in this source layout.
+
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ sqlite3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 851a2504c..2f4b77429 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -248157,7 +248157,7 @@ static void fts5DataRelease(Fts5Data *pData){
+ static Fts5Data *fts5LeafRead(Fts5Index *p, i64 iRowid){
+ Fts5Data *pRet = fts5DataRead(p, iRowid);
+ if( pRet ){
+- if( pRet->nn<4 || pRet->szLeaf>pRet->nn ){
++ if( pRet->szLeaf<4 || pRet->szLeaf>pRet->nn ){
+ FTS5_CORRUPT_ROWID(p, iRowid);
+ fts5DataRelease(pRet);
+ pRet = 0;
+--
+2.51.0
diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb
index 0a8727e4f2c..2b0a9c0e4d7 100644
--- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb
+++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb
@@ -6,4 +6,7 @@ LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed0
SRC_URI = "http://www.sqlite.org/2026/sqlite-autoconf-${SQLITE_PV}.tar.gz"
SRC_URI[sha256sum] = "81f5be397049b0cae1b167f2225af7646fc0f82e4a9b3c48c9ea3a533e21d77a"
-SRC_URI += "file://0001-Add-option-to-disable-zlib.patch"
+SRC_URI += "\
+ file://0001-Add-option-to-disable-zlib.patch \
+ file://CVE-2026-11822_CVE-2026-11824.patch \
+"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 22/36] curl: add annotation for CVE-2026-10536
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (20 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 21/36] sqlite3: fix CVE-2026-11822 and CVE-2026-11824 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 23/36] package.bbclass: hardcode emit_pkgdata to run last Yoann Congal
` (13 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: João Marcos Costa <joaomarcos.costa@bootlin.com>
This CVE is detailed here: https://curl.se/docs/CVE-2026-10536.html
and the fix essentially consolidates the fact that HTTP2 stream
dependency is deprecated.
While oe-core provides a PACKAGECONFIG to enable HTTP2, it is not
actually used so the affected part of the code is not compiled. For
instance, in the do_configure logs:
"""
(...)
HTTP2: no (--with-nghttp2, --with-hyper)
(...)
"""
Ignore this CVE unless 'nghttp2' is enabled.
Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index bdd6e730199..097b3056d8e 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -33,6 +33,7 @@ SRC_URI[sha256sum] = "4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d33
# Curl has used many names over the years...
CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"
CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack"
+CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}"
inherit autotools pkgconfig binconfig multilib_header ptest
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 23/36] package.bbclass: hardcode emit_pkgdata to run last
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (21 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 22/36] curl: add annotation for CVE-2026-10536 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 24/36] systemd-systemctl-native: disable libpam meson option Yoann Congal
` (12 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Ensure emit_pkgdata runs after all PACKAGEFUNCS to allow layers to
extend packaging behavior.
Layers can now append custom functions via PACKAGEFUNCS += "func_name"
and they will run before emit_pkgdata generates package metadata.
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit aa85baff9ebdd3f932811c3b43d1918c38373cb9)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes-global/package.bbclass | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/meta/classes-global/package.bbclass b/meta/classes-global/package.bbclass
index 67148fc1acb..0d1be442c1e 100644
--- a/meta/classes-global/package.bbclass
+++ b/meta/classes-global/package.bbclass
@@ -472,8 +472,7 @@ PACKAGEFUNCS += " \
package_do_shlibs \
package_do_pkgconfig \
read_shlibdeps \
- package_depchains \
- emit_pkgdata"
+ package_depchains"
python do_package () {
# Change the following version to cause sstate to invalidate the package
@@ -564,9 +563,13 @@ python do_package () {
for file in files:
pkgfiles[pkg].append(walkroot + os.sep + file)
+
+ # We want emit_pkgdata to run last, after everything
for f in (d.getVar('PACKAGEFUNCS') or '').split():
bb.build.exec_func(f, d)
+ bb.build.exec_func("emit_pkgdata", d)
+
oe.qa.exit_if_errors(d)
}
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 24/36] systemd-systemctl-native: disable libpam meson option
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (22 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 23/36] package.bbclass: hardcode emit_pkgdata to run last Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 25/36] util-linux: upgrade 2.41.3 -> 2.41.5 Yoann Congal
` (11 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Daniel Turull <daniel.turull@ericsson.com>
When building on rhel8.10 we got the following crash during do_compile
systemctl-259.5/src/shared/pam-util.c
| ../sources/systemd-systemctl-259.5/src/shared/pam-util.c:3:10: fatal error: security/pam_ext.h: No such file or directory
| 3 | #include <security/pam_ext.h>
| | ^~~~~~~~~~~~~~~~~~~~
| compilation terminated.
| ninja: build stopped: subcommand failed.
| INFO: autodetecting backend as ninja
libpam is not needed for systemctl task done by bitbake, therfore
disable MESON option.
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
[YC: On master, this is done in "systemd: upgrade to 261.1"]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb b/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb
index 3d01d60e9c1..3c0dcd35a32 100644
--- a/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb
+++ b/meta/recipes-core/systemd/systemd-systemctl-native_259.5.bb
@@ -12,6 +12,7 @@ MESON_TARGET = "systemctl:executable"
MESON_INSTALL_TAGS = "systemctl"
EXTRA_OEMESON += "-Dlink-systemctl-shared=false"
EXTRA_OEMESON += "-Dsysvinit-path= -Dsysvrcnd-path="
+EXTRA_OEMESON += "-Dpam=disabled"
# Systemctl is supposed to operate on target, but the target sysroot is not
# determined at run-time, but rather set during configure
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 25/36] util-linux: upgrade 2.41.3 -> 2.41.5
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (23 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 24/36] systemd-systemctl-native: disable libpam meson option Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 26/36] linux-yocto/6.18: update to v6.18.36 Yoann Congal
` (10 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Siva Balasubramanian <sivakumar.bs@gmail.com>
2.41.4 and 2.41.5 are point releases in the same 2.41 stable series and
contain only bug fixes and security fixes (no new features, no API/ABI
breaks), so the upgrade complies with the stable branch policy.
Among the fixes pulled in:
- Several mount(8) TOCTOU / symlink hardening fixes (incl. CVE-2026-27456)
- libblkid integer overflow in parse_dos_extended() and a use-after-free
in partition probing
- pam_lastlog2: fix libpam linking in the autotools build so
pam_lastlog2.so links against libpam, fixing the runtime "undefined
symbol: pam_syslog" / dlopen failure [YOCTO #16320]
Drop the loopdev symlink-attack backport that is now part of the release:
- 0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch
(upstream f55f9906, released in 2.41.4)
Full changes: https://github.com/util-linux/util-linux/compare/v2.41.3...v2.41.5
Signed-off-by: Siva Balasubramanian <sivakumar.bs@gmail.com>
[YC: Also dropped CVE-2026-13595.patch merged 2.41.5:
https://github.com/util-linux/util-linux/commit/132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
...2.41.3.bb => util-linux-libuuid_2.41.5.bb} | 0
meta/recipes-core/util-linux/util-linux.inc | 4 +-
...DEV_FL_NOFOLLOW-to-prevent-symlink-a.patch | 114 --------------
.../util-linux/CVE-2026-13595.patch | 148 ------------------
...l-linux_2.41.3.bb => util-linux_2.41.5.bb} | 0
5 files changed, 1 insertion(+), 265 deletions(-)
rename meta/recipes-core/util-linux/{util-linux-libuuid_2.41.3.bb => util-linux-libuuid_2.41.5.bb} (100%)
delete mode 100644 meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch
delete mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
rename meta/recipes-core/util-linux/{util-linux_2.41.3.bb => util-linux_2.41.5.bb} (100%)
diff --git a/meta/recipes-core/util-linux/util-linux-libuuid_2.41.3.bb b/meta/recipes-core/util-linux/util-linux-libuuid_2.41.5.bb
similarity index 100%
rename from meta/recipes-core/util-linux/util-linux-libuuid_2.41.3.bb
rename to meta/recipes-core/util-linux/util-linux-libuuid_2.41.5.bb
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 2a994d7a386..aec8721ca32 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -20,10 +20,8 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://0001-lsfd-mkfds-foreign-sockets-skip-when-lacking-sock_di.patch \
file://0001-ts-kill-decode-use-RTMIN-from-kill-L-instead-of-hard.patch \
file://0001-tests-script-Disable-size-option-test.patch \
- file://0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch \
- file://CVE-2026-13595.patch \
"
-SRC_URI[sha256sum] = "3330d873f0fceb5560b89a7dc14e4f3288bbd880e96903ed9b50ec2b5799e58b"
+SRC_URI[sha256sum] = "f586e35d320ff537aab3ffeca37e9ecd482ccbe013590db4429a414d8aa6a728"
CVE_PRODUCT = "util-linux"
diff --git a/meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch b/meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch
deleted file mode 100644
index 0951c9f5fbe..00000000000
--- a/meta/recipes-core/util-linux/util-linux/0001-loopdev-add-LOOPDEV_FL_NOFOLLOW-to-prevent-symlink-a.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From f55f9906b4f6eeb2b4a4120317df9de935253c10 Mon Sep 17 00:00:00 2001
-From: Karel Zak <kzak@redhat.com>
-Date: Thu, 19 Feb 2026 13:59:46 +0100
-Subject: [PATCH] loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks
-
-Add a new LOOPDEV_FL_NOFOLLOW flag for loop device context that
-prevents symlink following in both path canonicalization and file open.
-
-When set:
-- loopcxt_set_backing_file() uses strdup() instead of
- ul_canonicalize_path() (which calls realpath() and follows symlinks)
-- loopcxt_setup_device() adds O_NOFOLLOW to open() flags
-
-The flag is set for non-root (restricted) mount operations in
-libmount's loop device hook. This prevents a TOCTOU race condition
-where an attacker could replace the backing file (specified in
-/etc/fstab) with a symlink to an arbitrary root-owned file between
-path resolution and open().
-
-Vulnerable Code Flow:
-
- mount /mnt/point (non-root, SUID)
- mount.c: sanitize_paths() on user args (mountpoint only)
- mnt_context_mount()
- mnt_context_prepare_mount()
- mnt_context_apply_fstab() <-- source path from fstab
- hooks run at MNT_STAGE_PREP_SOURCE
- hook_loopdev.c: setup_loopdev()
- backing_file = fstab source path ("/home/user/disk.img")
- loopcxt_set_backing_file() <-- calls realpath() as ROOT
- ul_canonicalize_path() <-- follows symlinks!
- loopcxt_setup_device()
- open(lc->filename, O_RDWR|O_CLOEXEC) <-- no O_NOFOLLOW
-
-Two vulnerabilities in the path:
-
-1) loopcxt_set_backing_file() calls ul_canonicalize_path() which uses
- realpath() -- this follows symlinks as euid=0. If the attacker swaps
- the file to a symlink before this call, lc->filename becomes the
- resolved target path (e.g., /root/secret.img).
-
-2) loopcxt_setup_device() opens lc->filename without O_NOFOLLOW. Even
- if canonicalization happened correctly, the file can be swapped to a
- symlink between canonicalize and open.
-
-Addresses: https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g
-Signed-off-by: Karel Zak <kzak@redhat.com>
-(cherry picked from commit 5e390467b26a3cf3fecc04e1a0d482dff3162fc4)
-
-CVE: CVE-2026-27456
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- include/loopdev.h | 3 ++-
- lib/loopdev.c | 7 ++++++-
- libmount/src/hook_loopdev.c | 3 ++-
- 3 files changed, 10 insertions(+), 3 deletions(-)
-
-diff --git a/include/loopdev.h b/include/loopdev.h
-index e5ec1c98a..6bdb1393a 100644
---- a/include/loopdev.h
-+++ b/include/loopdev.h
-@@ -140,7 +140,8 @@ enum {
- LOOPDEV_FL_NOIOCTL = (1 << 6),
- LOOPDEV_FL_DEVSUBDIR = (1 << 7),
- LOOPDEV_FL_CONTROL = (1 << 8), /* system with /dev/loop-control */
-- LOOPDEV_FL_SIZELIMIT = (1 << 9)
-+ LOOPDEV_FL_SIZELIMIT = (1 << 9),
-+ LOOPDEV_FL_NOFOLLOW = (1 << 10) /* O_NOFOLLOW, don't follow symlinks */
- };
-
- /*
-diff --git a/lib/loopdev.c b/lib/loopdev.c
-index 2359bf781..76685be70 100644
---- a/lib/loopdev.c
-+++ b/lib/loopdev.c
-@@ -1267,7 +1267,10 @@ int loopcxt_set_backing_file(struct loopdev_cxt *lc, const char *filename)
- if (!lc)
- return -EINVAL;
-
-- lc->filename = canonicalize_path(filename);
-+ if (lc->flags & LOOPDEV_FL_NOFOLLOW)
-+ lc->filename = strdup(filename);
-+ else
-+ lc->filename = canonicalize_path(filename);
- if (!lc->filename)
- return -errno;
-
-@@ -1408,6 +1411,8 @@ int loopcxt_setup_device(struct loopdev_cxt *lc)
-
- if (lc->config.info.lo_flags & LO_FLAGS_DIRECT_IO)
- flags |= O_DIRECT;
-+ if (lc->flags & LOOPDEV_FL_NOFOLLOW)
-+ flags |= O_NOFOLLOW;
-
- if ((file_fd = open(lc->filename, mode | flags)) < 0) {
- if (mode != O_RDONLY && (errno == EROFS || errno == EACCES))
-diff --git a/libmount/src/hook_loopdev.c b/libmount/src/hook_loopdev.c
-index 444d69d6f..34351116c 100644
---- a/libmount/src/hook_loopdev.c
-+++ b/libmount/src/hook_loopdev.c
-@@ -272,7 +272,8 @@ static int setup_loopdev(struct libmnt_context *cxt,
- }
-
- DBG(LOOP, ul_debugobj(cxt, "not found; create a new loop device"));
-- rc = loopcxt_init(&lc, 0);
-+ rc = loopcxt_init(&lc,
-+ mnt_context_is_restricted(cxt) ? LOOPDEV_FL_NOFOLLOW : 0);
- if (rc)
- goto done_no_deinit;
- if (mnt_opt_has_value(loopopt)) {
---
-2.43.0
-
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
deleted file mode 100644
index 894844bc1f4..00000000000
--- a/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From c3844c348f2903d929dd5ded0ea8147394cce607 Mon Sep 17 00:00:00 2001
-From: Karel Zak <kzak@redhat.com>
-Date: Thu, 7 May 2026 12:50:48 +0200
-Subject: [PATCH] libblkid: fix use-after-free in nested partition probing
-
-The partitions list stores partitions in a contiguous array grown by
-reallocarray(). When the array is reallocated to a new address, all
-existing blkid_partition pointers (tab->parent, ls->next_parent, local
-parent variables in nested probers) become dangling.
-
-Fix this by changing the storage from an array of structs to an array
-of pointers, where each partition is individually allocated via
-calloc(). This makes all blkid_partition pointers stable across
-reallocations -- only the pointer array itself may move, which is
-harmless since no code caches pointers into the pointer array.
-
-This eliminates the need for callers to re-fetch parent pointers after
-every blkid_partlist_add_partition() call.
-
-CVE: CVE-2026-13595
-Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa]
-
-Reported-by: Thai Duong <thaidn@gmail.com>
-Signed-off-by: Karel Zak <kzak@redhat.com>
-(cherry picked from commit c0186f14fbdb02f64c8e0ba701ce727ea764ff4c)
-(cherry picked from commit 132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa)
-Signed-off-by: Deepak Rathore <deeratho@cisco.com>
----
- libblkid/src/partitions/partitions.c | 34 +++++++++++++++++-----------
- 1 file changed, 21 insertions(+), 13 deletions(-)
-
-diff --git a/libblkid/src/partitions/partitions.c b/libblkid/src/partitions/partitions.c
-index 9df813c92..e600e5e45 100644
---- a/libblkid/src/partitions/partitions.c
-+++ b/libblkid/src/partitions/partitions.c
-@@ -198,7 +198,7 @@ struct blkid_struct_partlist {
-
- int nparts; /* number of partitions */
- int nparts_max; /* max.number of partitions */
-- blkid_partition parts; /* array of partitions */
-+ blkid_partition *parts; /* array of pointers to partitions */
-
- struct list_head l_tabs; /* list of partition tables */
- };
-@@ -357,13 +357,16 @@ static void reset_partlist(blkid_partlist ls)
- free_parttables(ls);
-
- if (ls->next_partno) {
-- /* already initialized - reset */
-- int tmp_nparts = ls->nparts_max;
-- blkid_partition tmp_parts = ls->parts;
-+ /* already initialized - free individually allocated partitions */
-+ int i, tmp_nparts_max = ls->nparts_max;
-+ blkid_partition *tmp_parts = ls->parts;
-+
-+ for (i = 0; i < ls->nparts; i++)
-+ free(ls->parts[i]);
-
- memset(ls, 0, sizeof(struct blkid_struct_partlist));
-
-- ls->nparts_max = tmp_nparts;
-+ ls->nparts_max = tmp_nparts_max;
- ls->parts = tmp_parts;
- }
-
-@@ -398,6 +401,7 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)),
- void *data)
- {
- blkid_partlist ls = (blkid_partlist) data;
-+ int i;
-
- if (!ls)
- return;
-@@ -405,6 +409,8 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)),
- free_parttables(ls);
-
- /* deallocate partitions and partlist */
-+ for (i = 0; i < ls->nparts; i++)
-+ free(ls->parts[i]);
- free(ls->parts);
- free(ls);
- }
-@@ -438,15 +444,17 @@ static blkid_partition new_partition(blkid_partlist ls, blkid_parttable tab)
- * generic Linux machine -- let start with 32 partitions.
- */
- void *tmp = reallocarray(ls->parts, ls->nparts_max + 32,
-- sizeof(struct blkid_struct_partition));
-+ sizeof(blkid_partition));
- if (!tmp)
- return NULL;
- ls->parts = tmp;
- ls->nparts_max += 32;
- }
-
-- par = &ls->parts[ls->nparts++];
-- memset(par, 0, sizeof(struct blkid_struct_partition));
-+ par = calloc(1, sizeof(struct blkid_struct_partition));
-+ if (!par)
-+ return NULL;
-+ ls->parts[ls->nparts++] = par;
-
- ref_parttable(tab);
- par->tab = tab;
-@@ -851,7 +859,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr,
-
- /* check if the partition table fits into the device */
- for (i = 0; i < nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if (par->start + par->size > (pr->size >> 9)) {
- DBG(LOWPROBE, ul_debug("partition #%d overflows "
-@@ -863,7 +871,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr,
-
- /* check if the requested area is covered by PT */
- for (i = 0; i < nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if (start >= par->start && end <= par->start + par->size) {
- rc = 1;
-@@ -962,7 +970,7 @@ blkid_partition blkid_partlist_get_partition(blkid_partlist ls, int n)
- if (n < 0 || n >= ls->nparts)
- return NULL;
-
-- return &ls->parts[n];
-+ return ls->parts[n];
- }
-
- blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start)
-@@ -1074,7 +1082,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno
- * and an entry in partition table.
- */
- for (i = 0; i < ls->nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if (partno != blkid_partition_get_partno(par))
- continue;
-@@ -1090,7 +1098,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno
- DBG(LOWPROBE, ul_debug("searching by offset/size"));
-
- for (i = 0; i < ls->nparts; i++) {
-- blkid_partition par = &ls->parts[i];
-+ blkid_partition par = ls->parts[i];
-
- if ((uint64_t)blkid_partition_get_start(par) == start &&
- (uint64_t)blkid_partition_get_size(par) == size)
diff --git a/meta/recipes-core/util-linux/util-linux_2.41.3.bb b/meta/recipes-core/util-linux/util-linux_2.41.5.bb
similarity index 100%
rename from meta/recipes-core/util-linux/util-linux_2.41.3.bb
rename to meta/recipes-core/util-linux/util-linux_2.41.5.bb
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 26/36] linux-yocto/6.18: update to v6.18.36
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (24 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 25/36] util-linux: upgrade 2.41.3 -> 2.41.5 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 27/36] linux-yocto/6.18: update to v6.18.38 Yoann Congal
` (9 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
275d294b2b24 Linux 6.18.36
5d634afb8b83 netfilter: require Ethernet MAC header before using eth_hdr()
bf7a9cacd95e cfi: Include uaccess.h for get_kernel_nofault()
f455405e3207 vsock/virtio: fix skb overhead overflow on 32-bit builds
36a0faaa4e3d block: fix handling of dead zone write plugs
7b569b3a2f29 arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
99abe00c605e arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
d4fd42822040 arm64: errata: Mitigate TLBI errata on various Arm CPUs
8097f93f9b77 arm64: cputype: Add C1-Premium definitions
e9ea7cb17677 arm64: cputype: Add C1-Ultra definitions
eca6743b148a vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
9bdc637fde66 vsock/virtio: fix potential unbounded skb queue
cdce1e797add ipvs: skip ipv6 extension headers for csum checks
afd35fec9297 RDMA/umem: Fix truncation for block sizes >= 4G
cd26d54bfbc2 RDMA: Move DMA block iterator logic into dedicated files
ebf22feff492 RDMA/umem: fix kernel-doc warnings
84d8f58cf28a netfilter: nft_fib: fix stale stack leak via the OIFNAME register
2904e985a291 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
f58efaf9fcf7 RDMA/umem: Add helpers for umem dmabuf revoke lock
5f3286ca5fbb RDMA/umem: Move umem dmabuf revoke logic into helper function
ceddd32231dd RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
0ffcad63b19a sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
37c059d4d92f wifi: mac80211: tests: mark HT check strict
4dac39a4db14 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
17faa39ba980 driver core: reject devices with unregistered buses
20a93e397abe fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
e09689286385 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
454d3b3d499c drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
bb6f705b73b5 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
c000da79df78 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
3f32d52ec604 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
1906064d50d1 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
0e56f460bddb drm/amd/display: Bound VBIOS record-chain walk loops
57607fe55e6d drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
932642791cb1 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
8979ded4d899 drm/amd/pm: fix smu13 power limit default/cap calculation
39b5397bf8de drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
fcd51a085e9a drm/amdgpu: restart the CS if some parts of the VM are still invalidated
68455b117258 drm/amdgpu: fix waiting for all submissions for userptrs
9655b56b6de9 drm/v3d: Skip CSD when it has zeroed workgroups
90b629269088 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
3e1947573140 drm/v3d: Fix global performance monitor reference counting
11e9bdf8824b drm/v3d: Wait for pending L2T flush before cleaning caches
4c10fd55187a drm/xe: Clear pending_disable before signaling suspend fence
0f68ddfaaebf drm/xe/display: fix oops in suspend/shutdown without display
d3efcadfe3ee drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
72e259a32084 drm/amdkfd: fix NULL dereference in get_queue_ids()
c0639ede2f24 drm/gem: Try to fix change_handle ioctl, attempt 4
9f0d45d509b4 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
8f4b371f4939 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
5204cd22c1c7 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
dd8e1025a84e slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
24ec89123fc9 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
3bb2ac834ed3 slimbus: qcom-ngd-ctrl: Fix probe error path ordering
d6cb003e4661 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
6890bd2451a9 slimbus: qcom-ngd-ctrl: fix OF node refcount
b5daa920f44c thunderbolt: Limit XDomain response copy to actual frame size
46da5c3ea011 thunderbolt: Validate XDomain request packet size before type cast
fcbd0cdab928 thunderbolt: Clamp XDomain response data copy to allocation size
60ba62174607 thunderbolt: Bound root directory content to block size
2e0ddac549eb thunderbolt: Reject zero-length property entries in validator
d5ea0b3e261f sctp: stream: fully roll back denied add-stream state
78c4f964b2f9 sctp: diag: reject stale associations in dump_one path
566c4c1244de rxrpc: Fix the ACK parser to extract the SACK table for parsing
1bf84f4013fa rtase: Reset TX subqueue when clearing TX ring
54f9cdcd7311 rtase: Avoid sleeping in get_stats64()
ddcf84b25af0 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source
0d11992d1898 pmdomain: imx: fix OF node refcount
0aecf3c7b8f8 mmc: sdhci: add signal voltage switch in sdhci_resume_host
535ff092b686 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
2f72d36f8acc mmc: litex_mmc: Set mandatory idle clocks before CMD0
7f8007be13e6 mmc: dw_mmc-rockchip: Add missing private data for very old controllers
c677b13671dc mmc: core: Fix host controller programming for fixed driver type
a8f91ddf67f6 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
c19ff4351214 mm/list_lru: drain before clearing xarray entry on reparent
c72469ac0f27 mm/hugetlb: restore reservation on error in hugetlb folio copy paths
ecc24f0a8a30 mm/hugetlb: avoid false positive lockdep assertion
66bc00ea37fa mm/damon/reclaim: handle ctx allocation failure
6d48f1565939 mm/damon/lru_sort: handle ctx allocation failure
d83390b21a02 mm/cma_debug: fix invalid accesses for inactive CMA areas
52078596dce1 mm/cma: fix reserved page leak on activation failure
d5d37b7b72a9 io_uring/wait: fix min_timeout behavior
c888d5198ffc io_uring/kbuf: don't truncate end buffer for bundles
3fdcca838f97 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
e646b86b3b48 octeontx2-af: fix memory leak in rvu_setup_hw_resources()
4a4d21f531cc nvmem: layouts: onie-tlv: fix hang on unknown types
cb85ef5a227b nvmem: core: fix use-after-free bugs in error paths
bef389a210e7 net: sfp: initialize i2c_block_size at adapter configure time
1d4ec754ee38 net: rds: clear i_sends on setup unwind
52b8f5ef82c8 net: phonet: free phonet_device after RCU grace period
4a73cacb5586 net: mv643xx: fix OF node refcount
bcb8fad90f27 net: bonding: fix NULL pointer dereference in bond_do_ioctl()
01f7d4b50458 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
e0df4d9c0909 net/mlx5: Reorder completion before putting command entry in cmd_work_handler
0a46c7a5646d firmware: samsung: acpm: Fix mailbox channel leak on probe error
d5de9cb5355d misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
53e06f8a3c2b misc: fastrpc: fix DMA address corruption due to find_vma misuse
992f121796b7 misc: fastrpc: fix use-after-free race in fastrpc_map_create
5278ccd357e0 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
89bd8215e25a memcg: use round-robin victim selection in refill_stock
a388e3dfaf95 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
db752ebfdaf2 ipc/shm: serialize orphan cleanup with shm_nattch updates
ab61c990a87d iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
f35a368fee8a Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
a3dff1e1a554 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
7f59e4f72a78 i2c: tegra: Fix NOIRQ suspend/resume
6018d73137cd i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
a162a260c8c4 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
9fa82cf393ba i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
b39f30c0a72f i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
16f8e17184b3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
56763afa0134 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
12df4cfa738a fuse: reject fuse_notify() pagecache ops on directories
57a9c085be07 fs/qnx6: fix pointer arithmetic in directory iteration
2990f143ec86 pidfd: refuse access to tasks that have started exiting harder
89b909e97045 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
df422fd273c9 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
32138633e51e fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
3884976f8744 bnxt_en: Fix NULL pointer dereference
6f72b902c34d ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
735dabdf2156 staging: rtl8723bs: fix buffer over-read in rtw_update_protection
1d6c2062b77b timers/migration: Fix livelock in tmigr_handle_remote_up()
ba9ad6015937 vsock/vmci: fix sk_ack_backlog leak on failed handshake
265c07c09c83 wifi: nl80211: reject oversized EMA RNR lists
ac2000be0cbe wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
fcfdff42e841 xfs: fix rtgroup cleanup in CoW fork repair
d84ed2f9718e xfs: fix error returns in CoW fork repair
9f21885c11ba mptcp: add-addr: always drop other suboptions
6ea1134f1b5f selftests: mptcp: add test for extra_subflows underflow on userspace PM
7bbc11437a20 mptcp: sockopt: set sockopt on all subflows
f591cbc088c9 mptcp: sockopt: check timestamping ret value
c0c152fc4ae6 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
653245266913 mptcp: allow subflow rcv wnd to shrink
3b8cbba7c0ed mptcp: close TOCTOU race while computing rcv_wnd
edaf0c955ace mptcp: fix retransmission loop when csum is enabled
95f27fcda681 arm64: mm: call pagetable dtor when freeing hot-removed page tables
517720913bd3 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
da295adc9dab ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
6243a363ec90 ARM: socfpga: Fix OF node refcount leak in SMP setup
6822eed69572 udp: clear skb->dev before running a sockmap verdict
c96786d6ff1a zram: fix use-after-free in zram_bvec_write_partial()
f92a285db7ff RDMA/srp: bound SRP_RSP sense copy by the received length
bd5e818be796 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
96b6e98ff12d RDMA/core: Validate the passed in fops for ib_get_ucaps()
e99807bdcd20 mm/huge_memory: update file PUD counter before folio_put()
cb5230b6d8a0 mm/damon/ops-common: call folio_test_lru() after folio_get()
5f5b604e1e6b mm/huge_memory: update file PMD counter before folio_put()
edabfe80e34e drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
8348567a6afb drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
0bbc9481f970 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
3d39da65b5c4 ALSA: timer: Fix UAF at snd_timer_user_params()
f46093dd2296 ALSA: timer: Forcibly close timer instances at closing
372f33ebed74 USB: serial: kl5kusb105: fix bulk-out buffer overflow
85bd2b3afa0a USB: serial: option: add usb-id for Dell Wireless DW5826e-m
294692d3296e USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
f96cf7bf9fbf USB: serial: io_ti: fix heap overflow in get_manuf_info()
a13ca53e47e5 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
dd66f7f6e360 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
f9b38a8fbfa0 xfrm: espintcp: do not reuse an in-progress partial send
14d2eee0193a ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
0b38870d81ab hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
32d4c5d328a3 drm/i915/gem: Fix phys BO pread/pwrite with offset
0b79bcff7210 KVM: arm64: Restore POR_EL0 access to host EL0
196f1ee137eb KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
343e95c8ecc4 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
0864bdde152e mshv: add a missing padding field
8bcbedce9bfa mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
a0a4600b396b rust: kasan/kbuild: fix rustc-option when cross-compiling
d0f25a1755f2 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
5037b2ee1a17 ARM: Do not select HAVE_RUST when KASAN is enabled
00875811f372 rust: x86: support Rust >= 1.98.0 target spec
592be0dc491d tracing/probes: Point the error offset correctly for eprobe argument error
09df291fdf96 tracing: Fix CFI violation in probestub being called by tprobes
45cb105b8642 accel/ivpu: Fix signed integer truncation in IPC receive
fa598556ecef accel/ivpu: Add buffer overflow check in MS get_info_ioctl
8ec70c0dbdf0 accel/ivpu: Add bounds checks for firmware log indices
dd77a83915b0 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
cc160ce08540 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
dedc92b96dc1 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
dafc9f57140e Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
c10c9c48b290 tee: shm: fix shm leak in register_shm_helper()
07acb9798477 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
941d7394efda netfilter: nft_tunnel: fix use-after-free on object destroy
e83fc4c28226 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
361e97d81331 drm/xe: fix refcount leak in xe_range_fence_insert()
02f5e4db57c0 drm/vc4: fix krealloc() memory leak
19a6a00ff50c drm/virtio: Fix driver removal with disabled KMS
dda720b2928d drm/i915/edp: Check supported link rates DPCD read
489f6d759fa4 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
3a4fc3617b7e clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
656939c67595 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked
f34689e7a0b3 KVM: VMX: Update SVI during runtime APICv activation
07d9a0870a17 ipv6: Fix a potential NPD in cleanup_prefix_route()
2c98343c9b23 net: txgbe: initialize module info buffer
19a4d2aace1d net: txgbe: rename the SFP related
9157060fed92 net: txgbe: support CR modules for AML devices
7649ba2b1291 net: txgbe: optimize the flow to setup PHY for AML devices
af08fe9ba091 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
8a2126c5afe8 net: mvpp2: refill RX buffers before XDP or skb use
910617a4e67d net: mvpp2: limit XDP frame size to the RX buffer
a13199fa224e net: mvpp2: sync RX data at the hardware packet offset
78069a6d8bc8 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
af1b7699466f netfilter: nf_log: validate MAC header was set before dumping it
08a3e218064d netfilter: x_tables: avoid leaking percpu counter pointers
9d017671dcfc netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
4beffcd726e2 netfilter: revalidate bridge ports
865e94f6d8a5 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
5ae8a38169fc rds: mark snapshot pages dirty in rds_info_getsockopt()
2abfb19bbb81 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
5fd1fa5a4254 tun: zero the whole vnet header in tun_put_user()
dcf458120add net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
3dde4fb941fa net: guard timestamp cmsgs to real error queue skbs
7560afb8cdda sctp: validate embedded INIT chunk and address list lengths in cookie
ecf8904067dc ip6_vti: set netns_immutable on the fallback device.
f76a8b323e28 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
d23d53355300 ASoC: SOF: amd: fix for ipc flags check
6c75ee4d1d40 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
9c46f3ee1837 net: mctp: usb: fix race between urb completion and rx_retry cancellation
bace7b99bfa5 gpio: rockchip: fix generic IRQ chip leak on remove
5d4bca5cbb69 gpio: zynq: fix runtime PM leak on remove
c838ffc154cb r8152: handle the return value of usb_reset_device()
ecc55aad3390 net: openvswitch: fix possible kfree_skb of ERR_PTR
2fa49b2715e1 ipv6: sit: reload inner IPv6 header after GSO offloads
289c06418ed9 net/mlx5: Use effective affinity mask for IRQ selection
2789b74ae1f4 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
0f807764bb12 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
ab269990ed58 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
3a254779c169 net: phy: clean the sfp upstream if phy probing fails
c299321bc623 netdev: fix double-free in netdev_nl_bind_rx_doit()
c09c2e236eef net: ibm: emac: Fix use-after-free during device removal
8b0541231091 net/mlx4: avoid GCC 10 __bad_copy_from() false positive
0cde3a004119 net: add pskb_may_pull() to skb_gro_receive_list()
ede69b8f6670 tcp: restrict SO_ATTACH_FILTER to priv users
12e579b88962 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
6136c1474db8 gpio: mvebu: fix NULL pointer dereference in suspend/resume
0c4bb32ad7fd netlabel: validate unlabeled address and mask attribute lengths
972c106f5d01 bnge: fix context mem iteration
6b8baf42b1b7 net: ena: PHC: Add missing barrier
640edc281d2f idpf: fix mailbox capability for set device clock time
6bdbe6f43ecf ice: fix missing priority callbacks for U.FL DPLL pins
b5316e2b8614 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
5513dcb378f9 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
4ee4d628c4d9 dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
8d9a79fbf517 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
e27c17346628 tap: free page on error paths in tap_get_user_xdp()
0c03692e2372 verification/rvgen: Fix ltl2k writing True as a literal
43ad0a0da486 verification/rvgen: Fix options shared among commands
73590b4cfd05 tools/rv: Fix cleanup after failed trace setup
fd1923910bbf tools/rv: Fix substring match when listing container monitors
2122d68f0864 tools/rv: Fix substring match bug in monitor name search
618193aba6fe tools/rv: Ensure monitor name and desc are NUL-terminated
65046b0d853d cpufreq/amd-pstate: drop stale @epp_cached kdoc
63a9f6012f45 spi: cadence-quadspi: fix unclocked access on unbind
6671a46144f8 ALSA: seq: dummy: fix UMP event stack overread
cd98837db15f ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
6b71956c25f9 time: Fix off-by-one in settimeofday() usec validation
ed0ad6574126 hyperv: Clean up and fix the guest ID comment in hvgdk.h
8c046f36222c signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
6dc6e5b5c32e selftests: harness: fix pidfd leak in __wait_for_test
752e22ecf4df drm/hyperv: During panic do VMBus unload after frame buffer is flushed
b0f77f76231b Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
1639df1a9844 Drivers: hv: VMBus protocol version 6.0
a6207349e703 sctp: purge outqueue on stale COOKIE-ECHO handling
42446ca0f357 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
285b0842f2e0 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
3b7ee029b556 vxlan: vnifilter: fix spurious notification on VNI update
8e4d1188bad7 vxlan: vnifilter: send notification on VNI add
eb676fb14427 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
cc272185c9a9 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
b198ed4e5258 net/sched: fix pedit partial COW leading to page cache corruption
e634408d2b0c net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
6f829e2c17a5 net: airoha: Fix use-after-free in metadata dst teardown
9a263bbd1ec0 ptp: vclock: Switch from RCU to SRCU
a4f3fd651692 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
91106d0348a5 af_unix: Fix inq_len update problem in partial read
f010cf9aea01 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
ddf930f28be6 octeontx2-pf: Fix NDC sync operation errors
0dfe05b93843 xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
58d810354de1 Bluetooth: MGMT: Fix backward compatibility with userspace
446a17b1b509 Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
ab84fd7779a2 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
33d677d2e371 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
ce4b4cac3c57 Bluetooth: fix memory leak in error path of hci_alloc_dev()
c893e17d2809 Bluetooth: bnep: reject short frames before parsing
7f5367f1ad9b Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
3eabc6d47a0a Bluetooth: RFCOMM: validate skb length in MCC handlers
1a3c8ffbb469 Bluetooth: MGMT: validate advertising TLV before type checks
8802413ce631 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
fb8db813eba2 wifi: fix leak if split 6 GHz scanning fails
15be7e9fdbff ipv6: anycast: insert aca into global hash under idev->lock
23bf7d5c250b net: fec: fix pinctrl default state restore order on resume
76244b33640b net: lan743x: permit VLAN-tagged packets up to configured MTU
04e22fefac1a net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
66a46e22396f hsr: Remove WARN_ONCE() in hsr_addr_is_self().
07f13816be5a net: Annotate sk->sk_write_space() for UDP SOCKMAP.
83810d51d699 pcnet32: stop holding device spin lock during napi_complete_done
9b40c59bab08 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
e3f6ba5f8cf3 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
927f96861f93 devlink: Release nested relation on devlink free
e251d4cdfc72 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
c32f30ef5e66 6lowpan: fix off-by-one in multicast context address compression
b60e9391142e net/sched: act_api: use RCU with deferred freeing for action lifecycle
42ff6774ecd9 dm cache policy smq: check allocation under invalidate lock
b18675263db1 netfilter: bridge: make ebt_snat ARP rewrite writable
f071b0bf0781 netfilter: nft_ct: bail out on template ct in get eval
9e5da2379f96 netfilter: conntrack_irc: fix possible out-of-bounds read
aaf80701dc2f netfilter: synproxy: add mutex to guard hook reference counting
25918720ba97 ipvs: clear the svc scheduler ptr early on edit
cdaf13260c99 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
e735dbd489e3 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
9dca67624721 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
00bf6868df65 erofs: fix use-after-free on sbi->sync_decompress
50fd261b1ec4 erofs: tidy up synchronous decompression
8db2fabb5ecd tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()
ac7eca1ae4e5 tee: fix tee_ioctl_object_invoke_arg padding
633db9a1991a soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
40fc6ed12f91 ARM: dts: microchip: sam9x7: fix GMAC clock configuration
9cb93ec617fb arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins
a171bc68e9af soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
d5b57bb314d7 tee: optee: prevent use-after-free when the client exits before the supplicant
dcd90f42a33e net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
4203806f700b ipv6: mcast: Fix use-after-free when processing MLD queries
ffbcf31f032e i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
97706097f9b8 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
9e767af5f109 ARM: fix branch predictor hardening
05e22564a4f9 ARM: fix hash_name() fault
8bdb574b2176 ARM: allow __do_kernel_fault() to report execution of memory faults
22e26df355af ARM: group is_permission_fault() with is_translation_fault()
87dfb977bdb6 bpf: Free reuseport cBPF prog after RCU grace period.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 358c27b4e0011285b4e329c90d2c4c3b1f581537)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 00c0b090df0..c4c68844ce9 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "35a623d1a755631bbc73e11fa02eee0e1092188b"
-SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7"
+SRCREV_machine ?= "f477695299adc9d29b883d1642a6672e4899a83f"
+SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.35"
+LINUX_VERSION ?= "6.18.36"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index e2fd09a403e..d8eb5724c8f 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.35"
+LINUX_VERSION ?= "6.18.36"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7"
+SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 2b1298dedf9..148b440fd4d 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "84b49a9fef57bf4ff3a2919591fde336fe7944bf"
-SRCREV_machine:qemuarm64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemuloongarch64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
+SRCREV_machine:qemuarm ?= "15e3830e8c3a3c15924ce4e6f65430e6e9800512"
+SRCREV_machine:qemuarm64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuloongarch64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemuriscv64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemuriscv32 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemux86 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_machine:qemux86-64 ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
+SRCREV_machine:qemuppc ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuriscv64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuriscv32 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemux86 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemux86-64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "efc05d9af9f5b5a647e229c92542e413c3a9915d"
-SRCREV_meta ?= "4dafe0e420087b6381728e68eeeff6d9af0a32e7"
+SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "acb7cf4c1184e27622be0faf89244d5001ed1e87"
+SRCREV_machine:class-devupstream ?= "275d294b2b24abcd65452198551cd8a5b8d4f775"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.35"
+LINUX_VERSION ?= "6.18.36"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 27/36] linux-yocto/6.18: update to v6.18.38
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (25 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 26/36] linux-yocto/6.18: update to v6.18.36 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 28/36] linux-yocto/6.18: update to v6.18.39 Yoann Congal
` (8 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
e46dc0adfe397 Linux 6.18.38
92c63a5ef3c7a apparmor: advertise the tcp fast open fix is applied
e77fbefd1269b net/tcp-ao: fix use-after-free of key in del_async path
3d205fe80f218 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
7627ff8c4f991 ksmbd: fix out-of-bounds read in smb_check_perm_dacl()
62c26720121bf NFS: Prevent resource leak in nfs_alloc_server()
6919eb549e8f3 NFSv4: clear exception state on successful mkdir retry
012d37a568bfb NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr
d8c90c7cc0612 NFSv4/flexfiles: reject zero filehandle version count
4367afc119c51 nfsd: reset write verifier on deferred writeback errors
017a6150106b0 nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
0f28337f54cfb nfsd: check get_user() return when reading princhashlen
dba7da4835de7 nfsd: fix inverted cp_ttl check in async copy reaper
136b416593f13 nfsd: fix posix_acl leak on SETACL decode failure
c8a24effd96d4 NFSD: Fix SECINFO_NO_NAME decode error cleanup
6a946038f2a5a i2c: core: fix adapter registration race
fc6aa9bdbae60 fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
4d418cf8daf57 fbdev: modedb: fix a possible UAF in fb_find_mode()
eea16b6f805c0 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
7643e5622994f riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()
3b33dbb43e21a riscv: mm: Extract helper mark_new_valid_map()
2205275be9be9 power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()
720949ed666f3 KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
e36095d8d922b KVM: x86: hyper-v: Bound the bank index when querying sparse banks
f9b57a0015c24 MIPS: smp: report dying CPU to RCU in stop_this_cpu()
6dbe9443d9f5f 9p: avoid putting oldfid in p9_client_walk() error path
4cd57ebee3950 ocfs2: reject oversized group bitmap descriptors
104d100212396 rpmsg: char: Fix use-after-free on probe error path
369496d885b4c fpga: region: fix use-after-free in child_regions_with_firmware()
b3a3831b2eb88 irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
200e7637f4d6a pNFS: Fix use-after-free in pnfs_update_layout()
90e254f18b8c2 LoongArch: Report dying CPU to RCU in stop_this_cpu()
e18769616fd5a tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
5e5b7f2ef8549 blk-cgroup: fix UAF in __blkcg_rstat_flush()
5a84398101bf9 hdlc_ppp: sync per-proto timers before freeing hdlc state
e91df6d273445 pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
b85ef03f726b1 gfs2: fix use-after-free in gfs2_qd_dealloc
8d8507a457667 crypto: nx - fix nx_crypto_ctx_exit argument
5da9b1a87ec7c KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
18587f9831612 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
adfacfbaeae2c exfat: fix potential use-after-free in exfat_find_dir_entry()
6e61fc2e06e44 MIPS: DEC: Prevent initial console buffer from landing in XKPHYS
65bd0c0afb0e1 bpf: use kvfree() for replaced sysctl write buffer
3804e6de30ae7 block: Avoid mounting the bdev pseudo-filesystem in userspace
db2c5b9fb9087 f2fs: keep atomic write retry from zeroing original data
20190e4980579 f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node()
ff83de56882cb f2fs: validate ACL entry sizes in f2fs_acl_from_disk()
888d94cc9afbf f2fs: fix to round down start offset of fallocate for pin file
77f216ff9ce5c f2fs: validate compress cache inode only when enabled
8aad54746c251 f2fs: validate orphan inode entry count
1e48fefac682c f2fs: pass correct iostat type for single node writes
1de92789ce31e wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
b0b07e04f0c72 wifi: iwlwifi: mld: fix race condition in PTP removal
df626f284cb90 wifi: iwlwifi: mvm: fix race condition in PTP removal
200d58c851b8f wifi: rtw88: usb: fix memory leaks on USB write failures
73d427d271f7a wifi: rtw88: increase TX report timeout to fix race condition
0aeb4d3ff6ced wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
40aa3c2b0cb8e wifi: ath11k: fix warning when unbinding
a7cdc384c9c57 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
7e25b5e22c1f4 wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
ec1c9e8962555 userfaultfd: ensure mremap_userfaultfd_fail() releases mmap_changing
7216ce8cb12fe keys: Pin request_key_auth payload in instantiate paths
b11c1fa326676 KEYS: fix overflow in keyctl_pkey_params_get_2()
49d893b9cbcfc gcov: use atomic counter updates to fix concurrent access crashes
2b7ec72786094 err.h: use __always_inline on all error pointer helpers
1fcca1260c6e7 KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
97e1044e79c5d block: invalidate cached plug timestamp after task switch
99e6c712cc300 kernel/fork: clear PF_BLOCK_TS in copy_process()
0d35f9f194a85 fbdev: fix use-after-free in store_modes()
81371dbd23601 NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
c3ca2631073b2 apparmor: fix use-after-free in rawdata dedup loop
4a69b83045d31 apparmor: mediate the implicit connect of TCP fast open sendmsg
1697957eb0971 net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
1acdd14c0990d net: skmsg: preserve sg.copy across SG transforms
bd968bdd568be mac802154: llsec: add skb_cow_data() before in-place crypto
0cfa78c050662 af_unix: Set gc_in_progress to true in unix_gc().
3c499851753a2 wifi: mt76: add wcid publish check in mt76_sta_add
5e658b9245a52 ntfs3: reject direct userspace writes to reserved $LX* xattrs
77798d7be6ef7 ipv4: account for fraggap on the paged allocation path
6374fb9edf72c ipv6: account for fraggap on the paged allocation path
565ab66005b14 batman-adv: tvlv: avoid race of cifsnotfound handler state
4cc9f7711bb89 batman-adv: tvlv: enforce 2-byte alignment
04e1a6557fbf8 batman-adv: dat: prevent false sharing between VLANs
3f82fc92cf523 batman-adv: tt: track roam count per VID
3470d583fc652 batman-adv: tt: don't merge change entries with different VIDs
af5a069805f67 batman-adv: tp_meter: handle overlapping packets
d511c72a83dd5 batman-adv: tp_meter: prevent parallel modifications of last_recv
1dafdd0794be1 batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
2233787658db8 batman-adv: tp_meter: restrict number of unacked list entries
3d4548c96d6f2 batman-adv: v: prevent OGM aggregation on disabled hardif
44ae137a2acef batman-adv: frag: avoid underflow of TTL
116e94025f0f4 batman-adv: frag: ensure fragment is writable before modifying TTL
0473ae882624a batman-adv: fix (m|b)cast csum after decrementing TTL
49bf27fcd7ee4 batman-adv: ensure bcast is writable before modifying TTL
646b68639c06b batman-adv: gw: don't deselect gateway with active hardif
95a061f587b76 batman-adv: tp_meter: initialize last_recv_time during init
75612c100a9e2 batman-adv: prevent ELP transmission interval underflow
43733e5b525fb batman-adv: bla: annotate lasttime access with READ/WRITE_ONCE
23d085bd63086 batman-adv: tp_meter: add only finished tp_vars to lists
b8bf8400e50cb batman-adv: tp_meter: handle seqno wrap-around for fast recovery detection
1db02f3e315da batman-adv: tp_meter: fix fast recovery precondition
7d2a44bc6bbe3 batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd
8e77fe0414f5c batman-adv: tp_meter: avoid window underflow
7cb88d91d5f9f batman-adv: tp_meter: initialize dec_cwnd explicitly
696c4cae872cc batman-adv: tp_meter: initialize dup_acks explicitly
1c5a1268418e8 batman-adv: tp_meter: keep unacked list in ascending ordered
e055e74b80eb8 lockd: fix TEST handling when not all permissions are available.
671ec2eabb874 Revert "PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support"
d844702198395 selinux: fix overlayfs mmap() and mprotect() access checks
5dfcb15974e7d lsm: add backing_file LSM hooks
5e470998a23e4 KVM: x86: Fix shadow paging use-after-free due to unexpected role
0c503cf3dde2e Linux 6.18.37
71003a32bef54 mm: do not copy page tables unnecessarily for VM_UFFD_WP
2abfd3ffbd945 virtiofs: fix UAF on submount umount
f965cf22dda7f media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si
7cad3ceaf679c ksmbd: reject non-VALID session in compound request branch
6c25bf4e44a2b drivers/base/memory: set mem->altmap after successful device registration
50b72074c5e8d serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
7cc3dd79777f6 vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
b8ebf008696de crypto: qat - remove unused character device and IOCTLs
d08d82d83ed45 iio: adc: ti-ads1298: add bounds check to pga_settings index
0a89002737ee3 iio: light: veml6075: add bounds check to veml6075_it_ms index
76db054931846 net: net_failover: Fix the deadlock in slave register
c5b3871b567c2 net: export netif_open for self_test usage
cc1494fd6c65d testing/selftests/mm: add soft-dirty merge self-test
f563ce913a831 mm: propagate VM_SOFTDIRTY on merge
b836839c1fd94 mm: set the VM_MAYBE_GUARD flag on guard region install
3d6cb2ed06f7f mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one
05cdec24a8589 mm: implement sticky VMA flags
a093c80a1f139 mm: update vma_modify_flags() to handle residual flags, document
bdeadba743375 mm: add atomic VMA flags and set VM_MAYBE_GUARD as such
efce8a486bffc mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps
0de7db2eb27e8 sctp: disable BH before calling udp_tunnel_xmit_skb()
eee6be6ab6375 firmware: samsung: acpm: Fix cross-thread RX length corruption
02ac3ba41628a Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs
072bbd2846d1b hv: utils: handle and propagate errors in kvp_register
bde74af8d4466 regulator: core: fix locking in regulator_resolve_supply() error path
9477cbc5107a8 rose: don't free fd-owned sockets when reaping in the heartbeat
395b6573b389f rose: clear neighbour pointer in rose_kill_by_device()
9e8fc2195f8b5 rose: cancel neighbour timers in rose_neigh_put() before freeing
c31a0fa15a4b4 rose: drop CALL_REQUEST in loopback timer when device is not running
74cbe94c913a4 rose: release netdev ref and destroy orphaned incoming sockets
c794d35f73a7b rose: fix netdev double-hold in rose_make_new()
ce27bcdd857a9 rose: disconnect orphaned STATE_2 sockets when device is gone
ab849a6972c99 rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup
c98cc00c2d3b1 rose: fix notifier unregistered too early in rose_exit()
19139026dc1c0 rose: fix netdev double-hold in rose_rx_call_request()
1d94857c11d60 rose: guard rose_neigh_put() against NULL in timer expiry
270ef709257eb rose: clear neighbour pointer after rose_neigh_put() in state machines
940f39e153323 rose: fix race between loopback timer and module removal
fe8cbcc3e79d4 rose: hold loopback neighbour reference across timer callback
7dac298524b41 rose: fix dev_put() leak in rose_loopback_timer()
19b3691ec9402 ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()
53483a9f4ee9e agp/amd64: Fix broken error propagation in agp_amd64_probe()
8b17adf6d4fb6 net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
5f4d2bd028ebb i2c: stub: Reject I2C block transfers with invalid length
e2b143df29003 RDMA/bnxt_re: zero shared page before exposing to userspace
44b8b03a9fb5c debugobjects: Dont call fill_pool() in early boot hardirq context
3a408cae608d9 debugobjects: Do not fill_pool() if pi_blocked_on
9cd2087cd7026 debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP
a460935022f51 debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING
95f9eb19d5e65 Revert "NFSD: Defer sub-object cleanup in export put callbacks"
af2892249d982 fuse: re-lock request before replacing page cache folio
29706ac73f93b net: stmmac: fix stm32 (and potentially others) resume regression
b6099150949f8 io_uring/net: Avoid msghdr on op_connect/op_bind async data
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dd5c480785a427fff97907646fb298f5002336ed)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index c4c68844ce9..23c43c0cc19 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "f477695299adc9d29b883d1642a6672e4899a83f"
-SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
+SRCREV_machine ?= "0d0c54addf4ff32e49c485061bd9ea5bde241d94"
+SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.36"
+LINUX_VERSION ?= "6.18.38"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index d8eb5724c8f..e186b5f9926 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.36"
+LINUX_VERSION ?= "6.18.38"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
+SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 148b440fd4d..5c849202ada 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "15e3830e8c3a3c15924ce4e6f65430e6e9800512"
-SRCREV_machine:qemuarm64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemuloongarch64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuarm ?= "053c98bdd6c074a24771d69d24ff077f6016b299"
+SRCREV_machine:qemuarm64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuloongarch64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemuriscv64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemuriscv32 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemux86 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_machine:qemux86-64 ?= "f1d01f240ab00120824a557c26509996d02ac37c"
+SRCREV_machine:qemuppc ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuriscv64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuriscv32 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemux86 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemux86-64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "f1d01f240ab00120824a557c26509996d02ac37c"
-SRCREV_meta ?= "0267ec897e3d765fd04d70212dc834570e72d438"
+SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "275d294b2b24abcd65452198551cd8a5b8d4f775"
+SRCREV_machine:class-devupstream ?= "e46dc0adfe39724bcf52cea47b8f9c9aed86a394"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.36"
+LINUX_VERSION ?= "6.18.38"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 28/36] linux-yocto/6.18: update to v6.18.39
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (26 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 27/36] linux-yocto/6.18: update to v6.18.38 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 29/36] linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Yoann Congal
` (7 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.18 to the latest korg -stable release that comprises
the following commits:
f89c296854b75 Linux 6.18.39
06b1729436efc xfs: use rtrefcount btree cursor in xchk_xref_is_rt_cow_staging
457a93a233bd7 xfs: write the rg superblock when fixing it
e696ef088f557 xfs: fix off-by-one error when calling xchk_xref_has_rt_owner
6403ef9a81e6c xfs: don't zap bmbt forks if they are MAXLEVELS tall
1ea0868a477b7 xfs: fully check the parent handle when it points to the rootdir
c9662ffd62c4e xfs: clamp timestamp nanoseconds correctly
424be21ed8cd4 xfs: handle non-inode owners for rtrmap record checking
d399b026a6b34 xfs: set xfarray killable sort correctly
08b191ae64659 xfs: use the rt version of the cow staging checker
104584477883b xfs: grab rtrmap btree when checking rgsuper
d1c4c40599c37 xfs: don't wrap around quota ids in dqiterate
206c09b04dc54 xfs: resample the data fork mapping after cycling ILOCK
d98f22d2e11e0 xfs: fail recovery on a committed log item with no regions
dca861f2cc9e6 xfs: fix null pointer dereference in tracepoint
fdafa1e68dc75 smb: client: reject overlapping data areas in SMB2 responses
1991d49433e90 Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block"
1c56c46519353 Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
e697df336662b timekeeping: Register default clocksource before taking tk_core.lock
9e04055ab5fc0 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks
75e1d2787005d sched/fair: Only update stats for allowed CPUs when looking for dst group
0b466cf1b96e1 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
e1711479e9068 fuse-uring: make a fuse_req on SQE commit only findable after memcpy
39c8e925b207a fuse-uring: Avoid queue->stopped races and set/read that value under lock
23a356e0bd96c fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
bb476ef8e1027 fuse-uring: end fuse_req on io-uring cancel task work
50f3e03db823c fuse-uring: fix moving cancelled entry to ent_in_userspace list
b156bb9966972 fuse-uring: fix data races on ring->ready
0483fffdeeb36 fuse-uring: fix EFAULT clobber in fuse_uring_commit
7366e6f4d2b4c fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
096cb2e58a6db fuse: fix io-uring background queue dispatch on request completion
be353caffa864 fuse: re-lock request before returning from fuse_ref_folio()
e6620208bdd34 fuse: fix device node leak in cuse_process_init_reply()
6e2d84fdeac05 fuse: avoid 32-bit prune notification count wrap
69cfae58b9a32 fuse: back uncached readdir buffers with pages
423a78ff7928c RDMA/siw: bound Read Response placement to the RREAD length
ab45808c141a3 RDMA/core: Fix broadcast address falsely detected as local
5a45d0aa1fa50 RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
95de76f6ad474 Input: maplecontrol - set driver data before registering input device
9376c744bea2c Input: maplemouse - set driver data before registering input device
699e3abac02de Input: maple_keyb - set driver data before registering input device
d7f66fbab5d21 Input: mms114 - fix multi-touch slot corruption
1b4cb75f254fb Input: maplemouse - fix NULL pointer dereference in open()
37fbe63bccf21 Input: gscps2 - advance receive buffer write index
8301c33530534 Input: mms114 - reject an oversized device packet size
3e6f007b43e2f Input: touchwin - reset the packet index on every complete packet
05dee4007cf30 Input: ads7846 - don't use scratch for tx_buf when clearing register
75b12874b4172 Input: mms114 - fix touch indexing for MMS134S and MMS136
70019779325f2 Input: iforce - bound the device-reported force-feedback effect index
3b32303460155 Input: goodix - clamp the device-reported contact count
01e0317c256c5 Input: elan_i2c - prevent division by zero and arithmetic underflow
e849c6f51e687 Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
8db211aed8373 Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
11f275f01c46b Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
bb5133a7d5f3f i2c: i801: fix hardware state machine corruption in error path
b2523f26979e0 i2c: imx-lpi2c: mark I2C adapter when hardware is powered down
369635fbcf7f3 i2c: stm32f7: truncate clock period instead of rounding it
b65667ec5e9a9 i2c: davinci: Unregister cpufreq notifier on probe failure
56945871123e2 i2c: mpc: Fix timeout calculations
b6d2af6fe9c1f i2c: core: fix adapter deregistration race
71b7da959031f i2c: core: fix adapter debugfs creation
0345994d64761 i2c: core: fix adapter probe deferral loop
3351c5e77749a i2c: core: fix NULL-deref on adapter registration failure
9ec02cc9a04e5 i2c: core: fix irq domain leak on adapter registration failure
59070040fd12e fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
34696563461c9 dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning
f8e1dc70efe48 udmabuf: fix DMA direction mismatch in release_udmabuf()
0c93681aea0a1 KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier
4ad73ef0e7966 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits
ab253cf6e1118 KVM: VMX: Handle bad values on proxied writes to LBR MSRs
eeb456eb35565 KVM: VMX: Refresh GUEST_PENDING_DBG_EXCEPTIONS.BS on all injected #DBs
35f3ea7e49a37 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
7949aa38e1094 KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
4b200e0c9c339 KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
6bea2f8becdb2 KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
2d710d4fcd2cd LoongArch: KVM: Add missing slots_lock for device register/unregister
7c73a269a880b KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB
b51a7439c166a selftests/landlock: Filter dealloc records in audit_count_records()
859fef2c3d40a landlock: Set audit_net.sk for socket access checks
e4427c19554b5 audit: fix removal of dangling executable rules
32ca4aed2a662 iommufd: Set upper bounds on cache invalidation entry_num and entry_len
67daea4c09351 iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read()
5539da127d03c iommufd: Break the loop on failure in iommufd_fault_fops_read()
f2dbe1dba01e6 iommufd: Reject invalid read count in iommufd_fault_fops_read()
f549a749b6255 iommufd: Reject invalid read count in iommufd_veventq_fops_read()
64011399d8819 iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails
f565297edf316 iommufd: Set veventq_depth upper bound
5c5f1b5184f7d iommufd: Fix data_len byte-count vs element-count mismatch
04a177f91160e iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
50612ce318b1c iommu/amd: Don't split flush for amd_iommu_domain_flush_all()
bb354384f40bb iommu/vt-d: Avoid WARNING in sva unbind path
037ec8353711c crypto: loongson - Remove broken and unused loongson-rng
6bbe2000d9f9f selftests/mm: pagemap_ioctl: use the correct page size for transact_test()
5c942ad7df759 mm: do file ownership checks with the proper mount idmap
8dcaa0f87a88d mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access
785ebd42b8b50 selftests: mm: fix and speedup "droppable" test
279c2fa731122 mm: fix mmap errno value when MAP_DROPPABLE is not supported
4d730cab96e6b riscv: mm: Unconditionally sfence.vma for spurious fault
90405c8822c5d riscv: mm: Define DIRECT_MAP_PHYSMEM_END
1c8889e0db01f NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()
33c0b96d7e167 exfat: bound uniname advance in exfat_find_dir_entry()
a82e170637e05 module: decompress: check return value of module_extend_max_pages()
b883733302508 rqspinlock: Fix order in raw_res_spin_(un)lock_irq to allow schedule
a937e92c1d005 NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
75ca99875aa4e audit: fix potential integer overflow in audit_log_n_hex()
2dad64a97e1df tracing: Prevent out-of-bounds read in glob matching
c8b7e113f7b61 perf/aux: Fix page UAF in map_range()
af6048e913052 i2c: core: fix hang on adapter registration failure
22cb337370e65 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
6b01ed165d298 watchdog: apple: Add "apple,t8103-wdt" compatible
f4dd5621a6eef EDAC/i10nm: Don't fail probing if ADXL is missing
add1e4112e00b x86/mm: Fix freeing of PMD-sized vmemmap pages
808033d80d5c9 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
18d6048b1b1b4 spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
75422f5e50222 arm64: fpsimd: Fix type mismatch in sme_{save,load}_state()
93f000e89976e crypto: talitos/hash - fix SEC2 64k - 1 ahash request limitation
fda9cb9b7191c crypto: talitos/hash - remove useless wrapper
99cc3f5511d8b crypto: talitos/hash - rename first_desc/last_desc to first_request/last_request
b960edc92c81b crypto: talitos/hash - drop workqueue mechanism for SEC1
042730207a991 crypto: talitos/hash - use descriptor chaining for SEC1 instead of workqueue
40a2e90acdb1a crypto: talitos/hash - prepare SEC1 descriptor chaining, remove additional descriptor
a8decb89920a1 crypto: talitos - move code in current_desc_hdr() into a standalone function
aea8cfbd60da9 crypto: talitos - move dma mapping code in talitos_submit() into a standalone dma_map_request() function
3fa1846f75edf crypto: talitos - move dma unmapping code in flush_channel() into a standalone dma_unmap_request() function
664e7f16e74fc crypto: talitos - add chaining of arbitrary number of descriptor for the SEC1
f52aa95e3cae1 crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
7584c92f72447 crypto: qat - factor out AER reset helpers
6fb62b767f3e2 crypto: qat - validate RSA CRT component lengths
fabf364ef9db5 crypto: qat - skip restart for down devices
c3c5925791cff crypto: qat - protect service table iterations with service_lock
e310e8dc8ce72 crypto: qat - notify fatal error before AER reset preparation
45b65a21edbe0 crypto: qat - keep VFs enabled during reset
33cfc0ce28ac9 crypto: qat - handle sysfs-triggered reset callbacks
050bded706ee5 crypto: qat - centralize bus master enable
5337b5cd3608a crypto: drbg - Fix the fips_enabled priority boost
53d38b93cadc0 crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
23b8b188cb32e crypto: drbg - Fix returning success on failure in CTR_DRBG
441ea32cf2755 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
92567ed9306d5 crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD)
7a361c74bb12f crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
9e983d0a74a6a crypto: ccp - Do not initialize SNP for SEV ioctls
53b8fb85f332b crypto: loongson - Select CRYPTO_RNG
cc4e42b3ee9fc crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
c4bd2f4c35b0e crypto: pcrypt - restore callback for non-parallel fallback
ee6a2a25665c6 crypto: hisi-trng - Remove crypto_rng interface
774ddddf5eb26 crypto: ecc - Fix carry overflow in vli multiplication
ac667f9f18c6b crypto: crypto4xx - Remove insecure and unused rng_alg
0016d3c21c6ab crypto: chacha20poly1305 - validate poly1305 template argument
d0b8cafd529b4 crypto: caam - use print_hex_dump_devel to guard key hex dumps again
6f7b8e0321f3a crypto: caam - use print_hex_dump_devel to guard key hex dumps
7465ed1524ace crypto: af_alg - Remove zero-copy support from skcipher and aead
b5699642640d6 isofs: bound Rock Ridge symlink components to the SL record
ce93228e2193a partitions: aix: bound the pp_count scan to the ppe array
7a64521802997 btrfs: do not trim a device which is not writeable
0912b98151eea btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC
6d7649c1231da nvmet-auth: validate reply message payload bounds against transfer length
56c021a086926 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
7a69463e9ad23 nvme-multipath: set BIO_REMAPPED on bios remapped to per-path namespace disks
13f2f5defb4d7 dm-ioctl: report an error if a device has no table
427c82497e269 block: partitions: fix of_node refcount leak in of_partition()
a8803c4f0ac3f nvme: target: rdma: fix ndev refcount leak on queue connect
d161d47aba31d crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
c60932d6f8373 hwrng: jh7110 - fix refcount leak in starfive_trng_read()
04f4599a9efb9 udf: validate sparing table length as an entry count, not a byte count
e610fb113cdfa udf: validate VAT header length against the VAT inode size
335202ab25b01 udf: validate free block extents against the partition length
d944b8add3318 bpf: Prefer dirty packs for eBPF allocations
0229944ba7923 bpf: Prefer packs that won't trigger an IBPB flush on allocation
f1f36bf9bb117 bpf: Skip redundant IBPB in pack allocator
666fc2e6e4d0a bpf: Restrict JIT predictor flush to cBPF
8a4c8af9ae67e x86/bugs: Enable IBPB flush on BPF JIT allocation
8ff183ee4d8c4 bpf: Support for hardening against JIT spraying
bd818dcf4783e rust_binder: fix BINDER_GET_EXTENDED_ERROR
e5049526a7aac rust_binder: introduce TransactionInfo
be1567992417d x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled
b7b2d2ccdbc4d mm: shmem: fix potential livelock issue for shmem direct swapin
9818bcae3c0ca block: skip sync_blockdev() on surprise removal in bdev_mark_dead()
e086c16962a1b usb: gadget: f_fs: Fix DMA fence leak
b45be66ed47d4 usb: typec: ucsi: cancel pending work on system suspend
f5c772b76bbd9 usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
b1dfdff51a865 usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
8c00aec752ce1 usb: typec: ucsi: Invert DisplayPort role assignment
3e1b1ac47e816 usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
0bc177820bd38 usb: typec: tcpm: Fix VDM type for Enter Mode commands
bf6aa6c0ce0db usb: typec: class: drop PD lookup reference
1126f1110b86c usb: typec: anx7411: use devm_pm_runtime_enable()
347b59e9f9671 usbip: vudc: fix NULL deref in vep_dequeue()
6c7e8e2514374 usbip: tools: support SuperSpeedPlus devices
2d84c8376f7aa USB: usb-storage: ene_ub6250: restore media-ready check
1967a7f0cd5c0 USB: ulpi: fix memory leak on registration failure
1243f12079004 USB: serial: digi_acceleport: fix write buffer corruption
2b7dc482f859f USB: serial: digi_acceleport: fix hard lockup on disconnect
eab394781e932 USB: serial: digi_acceleport: fix broken rx after throttle
4b147eb6ae6e0 USB: serial: option: add Telit Cinterion FE990D50 compositions
cf6ca0aefae03 USB: serial: keyspan_pda: fix information leak
8c29d9cfab1c3 usb: mtu3: unmap request DMA on queue failure
729b68a5bad71 USB: misc: uss720: unregister parport on probe failure
48394f94211cf usb: misc: usbio: bound bulk IN response length to the received transfer
964d572b6c009 USB: storage: include US_FL_NO_SAME in quirks mask
e0886775952e3 usb: sl811-hcd: disable controller wakeup on remove
766738ecf2b81 USB: legousbtower: fix use-after-free on disconnect race
6af28345cbf8b USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
b748f97aff339 USB: iowarrior: fix use-after-free on disconnect
2107a4fc8ff1c USB: ldusb: fix use-after-free on disconnect race
54c2b7356b4ae USB: idmouse: fix use-after-free on disconnect race
8a5eba992c862 usb: gadget: f_printer: take kref only for successful open
b52476a83d9e1 usb: gadget: udc: Fix use-after-free in gadget_match_driver
01feaf024f296 usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
6bc17a78a0567 usb: free iso schedules on failed submit
0bbab8882a319 usb: dwc3: meson-g12a: fix refcount leak in dwc3_meson_g12a_resume()
4b0779207e36d USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
c00826e87bb75 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()
e22f044b0b20d usb: cdc_acm: Add quirk for Uniden BC125AT scanner
e24eb271061db net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
cd407de2ef5dc bpf: Validate BTF repeated field counts before expansion
d94ab0e91d3ff bpf: Restore sysctl new-value from 1 to 0
a9bb2d9c798cb bpf: Reject fragmented frames in devmap
c3d3d2212c296 xfs: fix memory leak in xfs_dqinode_metadir_create()
a62ef2d13d6e7 xfs: fix exchmaps reservation limit check
55e4d8413fb54 xfs: fix pointer arithmetic error on 32-bit systems
dd8d0665cdabf xfs: fix unreachable BIGTIME check in dquot flush validation
936618643591c xfs: release dquot buffer after dqflush failure
200794d0354cd xfs: use null daddr for unset first bad log block
1cd54e217c6e2 serial: 8250_mid: Disable DMA for selected platforms
973408ceab145 media: mtk-jpeg: cancel workqueue on release for supported platforms only
223463c488b05 nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
f3461b84a4865 hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
c63bc6308da71 HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
4d0d51bc12d24 HID: lg-g15: cancel pending work on remove to fix a use-after-free
b363d964ca829 HID: appleir: fix UAF on pending key_up_timer in remove()
37daa8c96bd56 HID: multitouch: fix out-of-bounds bit access on mt_io_flags
3eca1a8165b5e HID: letsketch: fix UAF on inrange_timer at driver unbind
bbe1e55629bfa HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
ca899a926c11a HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
cb90a01e478c2 HID: pidff: Use correct effect type in effect update
416095e9a6037 HID: wacom: stop hardware after post-start probe failures
7ce2c7dd28ab8 HID: uhid: convert to hid_safe_input_report()
dae1d000ddfd5 HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
abf07f5c3584f tools/mm/slabinfo: fix total_objects attribute name
e0eec7497bcc7 tools/mm/slabinfo: Fix trace disable logic inversion
2382971aaaef5 mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
18d90dc05d98b X.509: Fix validation of ASN.1 certificate header
28390912740a2 perf/arm-cmn: Fix DVM node events
be79d285bea70 s390: Revert support for DCACHE_WORD_ACCESS
2421a7b24f9c8 clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
cd25e9819620a time/jiffies: Register jiffies clocksource before usage
7776f9226e99e posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
6ba6f6783be2f cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
6e175c00c62dc cpufreq: Fix hotplug-suspend race during reboot
4bd0da48fbc1d sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
f77e55baeeb8c cpufreq: intel_pstate: Sync policy->cur during CPU offline
59626d0d29217 perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
b9d45d328fcda libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()
92f41769e5fd1 firmware_loader: fix device reference leak in firmware_upload_register()
e904961332801 cpufreq: qcom-cpufreq-hw: Fix possible double free
a277489337c7d OPP: of: Fix potential memory leak in opp_parse_supplies()
685fc15a41088 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
c6c484a7d5bff smb: client: mask server-provided mode to 07777 in modefromsid
157c67a657a7d smb: client: fix atime clamp check in read completion
86c5d470f5d42 smb: client: harden POSIX SID length parsing
3d89ae65ef78a smb: client: use unaligned reads in parse_posix_ctxt()
297243e365fc9 smb: client: Fix next buffer leak in receive_encrypted_standard()
d15d83125007f smb: client: fix double-free in SMB2_close() replay
14498ff5ce0f2 smb: client: fix double-free in SMB2_open() replay
3407240cde132 smb: client: fix double-free in SMB2_flush() replay
52af1975f0dfa smb: client: fix change notify replay double-free
276c8efbc49f9 smb: client: fix double-free in SMB2_ioctl() replay
f1add4acb656f smb: client: fix query_info() replay double-free
00b0fa4259414 smb: client: fix query directory replay double-free
2b4592cea2146 ksmbd: use opener credentials for ADS I/O
e72c15085b6d8 ksmbd: use opener credentials for delete-on-close
df501c0f320b5 ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
2ca82bfff49c8 ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
20ee516a62989 ksmbd: run set info with opener credentials
f56535db508ea ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
db231af842868 ksmbd: require source read access for duplicate extents
5aa1cb01155f9 ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation
a1d5d31cad593 ksmbd: serialize QUERY_DIRECTORY requests per file
57f2042fd87d7 ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
baae7b39673ec ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
a187883cc1dc7 smb/client: Fix error code in smb2_aead_req_alloc()
91b8a58c6ac15 smb: client: resolve SWN tcon from live registrations
661a019ac0413 coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
08fad5d5a26cc fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
6dd58c56ab864 fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
764e6f76fdbd4 fs/ntfs3: fsync files by syncing parent inodes
38cbb1feebcf5 fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr
4718007870547 iommu/vt-d: Fix race condition during PASID entry replacement
73abbaf91aa33 Bluetooth: L2CAP: validate option length before reading conf opt value
d5616beb3355b Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
b84eeb7636d69 Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync()
b9dd39cf1667e Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled
61701912c58a0 Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
26168db1ce5a9 Bluetooth: fix UAF in bt_accept_dequeue()
2a68a77308920 Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3()
a6b22dbd80926 Bluetooth: bnep: pin L2CAP connection during netdev registration
0039bdde36b23 Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()
81a5971cbe18b netfilter: flowtable: fix offloaded ct timeout never being extended
6fe8d3cecd20b netfilter: ebtables: terminate table name before find_table_lock()
13a5f532e3a4f netfilter: ebtables: module names must be null-terminated
9f74d28e903fa netfilter: ebtables: zero chainstack array
fc5bfe63bacf8 netfilter: handle unreadable frags
a8f03a3793289 netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump
69c0e6246575b mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup
b415c00bf23df mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
006467ab93269 mm: shrinker: fix NULL pointer dereference in debugfs
6465ff3ce6513 mm: shrinker: fix shrinker_info teardown race with expansion
560e21e8ccff8 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
b5f41d5bf08e7 mfd: cros_ec: Delay dev_set_drvdata() until probe success
bbae351c0f32f net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
2ca18df1c2611 ipv4: igmp: remove multicast group from hash table on device destruction
a33f37f8d079d netpoll: fix a use-after-free on shutdown path
f090acf881a26 io_uring/rw: preserve partial result for iopoll
1636d85dc139b io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
722869fcff598 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
4508366ab7dd0 gpio: sch: use raw_spinlock_t in the irq startup path
4750909a40da9 gpio: eic-sprd: use raw_spinlock_t in the irq startup path
f71e8d9875069 NTB: epf: Avoid calling pci_irq_vector() from hardirq context
cf28fc1658463 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns
c00164c9e7fa6 debugobjects: Plug race against a concurrent OOM disable
cbb684ef39e9f coresight: etb10: restore atomic_t for shared reading state
b346efa825b5e Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete
d3b739db5dc6f Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
fe997a84a385f audit: Fix data races of skb_queue_len() readers on audit_queue
e8417353cbd07 net: af_key: initialize alg_key_len for IPComp states
94083db751930 ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
ef6feb77e2d91 crypto: krb5 - filter out async aead implementations at alloc
84a00be9b736a crypto: amlogic - avoid double cleanup in meson_crypto_probe()
6f91621fc4502 staging: rtl8723bs: fix OOB write in HT_caps_handler()
a6105ea8ca6eb staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
c38d16b1ffac3 staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
69f174a0673b6 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
04f612dc03427 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
64ec4192d9c10 staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
b9c4bf133c3c4 staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
b5ddc7257bee7 staging: media: ipu7: fix double-free and use-after-free in error paths
1ca4f310c6b1f staging: media: atomisp: reduce load_primary_binaries() stack usage
b4ba13dafa13c media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
e3ceafa6d8ee6 staging: vme_user: fix location monitor leak in tsi148 bridge
a921486313975 staging: vme_user: fix location monitor leak in fake bridge
ceb875a375ded smb: client: restrict implied bcc[0] exemption to responses without data area
e99f2df433c63 staging: vme_user: bound slave read/write to the kern_buf size
2de42e2681747 tipc: fix out-of-bounds read in broadcast Gap ACK blocks
0beccbcf50de1 6lowpan: fix NHC entry use-after-free on error path
c40090f8d19b4 usb: misc: usbio: fix disconnect UAF in client teardown
c4e232bd07fe2 usb: dwc3: run gadget disconnect from sleepable suspend context
2a52d55c86a42 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
285e17c44e387 hwrng: virtio: clamp device-reported used.len at copy_data()
65e93ec592f5b virtio-mmio: fix device release warning on module unload
075bc3c779e1e virtio_pci: fix vq info pointer lookup via wrong index
81d54c766337b netfilter: ipset: fix race between dump and ip_set_list resize
9c8f31eaae614 mm/damon/ops-common: handle extreme intervals in damon_hot_score()
657646c08c94e tcp: restore RCU grace period in tcp_ao_destroy_sock
b775246212504 PCI/IOV: Skip VF Resizable BAR restore on read error
1115680bca1d7 PCI: qcom: Initialize DWC MSI lock for firmware-managed ECAM hosts
6e6a529d6f779 PCI: mediatek: Fix IRQ domain leak when port fails to enable
69416a5308675 PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
1d2e66a4bc0dd PCI: host-common: Request bus reassignment when not probe-only
9c698af5c2a12 PCI: Always lift 2.5GT/s restriction in PCIe failed link retraining
09c43b7b7d29c PCI: altera: Fix resource leaks on probe failure
5e42a981887d2 PCI: altera: Do not dispose parent IRQ mapping
d666c5aec822d PCI: loongson: Override PCIe bridge supported speeds for Loongson-3C6000 series
e5406c8fb71cd usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
99d00a9e35e31 xhci: sideband: fix ring sg table pages leak
f90586129cf9e usb: xhci: Fix sleep in atomic context in xhci_free_streams()
91b27f8172cdb rust_binder: clear freeze listener on node removal
281335996ab21 rust_binder: synchronize Rust Binder stats with freeze commands
08e21d86d2722 rust_binder: reject context manager self-transaction
89b8cc948dce6 rust_binder: use a u64 stride when cleaning up the offsets array
328ccf32acb87 binder: fix UAF in binder_free_transaction()
ea02df466df60 binder: fix UAF in binder_thread_release()
17a2d3f903455 Bluetooth: btusb: fix wakeup source leak on probe failure
a7e941a395711 Bluetooth: btusb: fix use-after-free on marvell probe failure
8db0ce3de7836 Bluetooth: btusb: fix use-after-free on registration failure
79f9e221dddec Bluetooth: btusb: Add USB ID 2c4e:0128 for Mercusys MA60XNB
a53109ffb6b51 vfio: Remove device debugfs before releasing devres
7f2d6b31089e4 vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc
ba96666d991e6 vfio/pci: Fix racy bitfields and tighten struct layout
52adb2dff7ce3 vfio/pci: Release the VGA arbiter client on register_device() failure
f6c67cf0051f9 vfio/pci: Latch disable_idle_d3 per device
a385d3435a7af vfio/pci: Use a private flag to prevent power state change with VFs
afc90150551dd ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
54c448e4f26a7 ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
f3e8a6cca15b8 ALSA: usb-audio: Roll back quirk control caches on write errors
3061b6c114458 ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
bfd28b07541e5 ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
a263eb12cbe2e ALSA: usb-audio: avoid kobject path lookup in DualSense match
16f14f55141d4 ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
651ba82fe2a14 ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()
71b87108ad93d ALSA: ice1712: check snd_ctl_new1() return value
04dd210180575 ALSA: hda/realtek: Fix noisy mic for Clevo V6xxAW
1933e6ee136b1 ALSA: hda/hdmi: Use 'AC_PINSENSE_ELDV' to detect pinsense for Loongson
4dd2552e559bd ALSA: hda/hdmi: Add force-connect quirk for HP EliteDesk 800 G5 Mini
ce0a903d0591e ALSA: hda/cs35l41: Fix firmware load work teardown
5e74e5e8cb7cc ALSA: gus: check snd_ctl_new1() return value
8e48a29813df8 ALSA: firewire: isight: bound the sample count to the packet payload
db25755e7629d ALSA: FCP: Add Focusrite ISA C8X support
9e53e99b6fa3c ALSA: es1938: check snd_ctl_new1() return value
b27a75d42044d ALSA: compress: Fix task creation error unwind
af2b009b773bc ALSA: cmipci: check snd_ctl_new1() return value
a5fd3122283bf ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
fd786466889e4 ALSA: aoa: check snd_ctl_new1() return value
f6538a318947b ALSA: ymfpci: check snd_ctl_new1() return value
5da9742de22db ALSA: virtio: Validate control metadata from the device
df0fe53a7104b ALSA: virtio: Add missing 384 kHz PCM rate mapping
c071df05bcda0 ALSA: usx2y: us144mkii: fix work UAF on disconnect
a4f8491da9563 iio: temperature: tmp006: use devm_iio_trigger_register
62a0d75bedd4b iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
e16258913be6a iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
b50344ab202f3 iio: temperature: Build mlx90635 with CONFIG_MLX90635
7d4d60f7c0541 iio: resolver: ad2s1210: notify trigger and clear state on fault read error
c6ca87c7bbb3f iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths
b3f1af4ba8e9c iio: pressure: mpl115: fix runtime PM leak on read error
e2d5b9673bf71 iio: pressure: bmp280: zero-init bmp580 trigger handler buffer
f829d6c32f31b iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
0975e013179d3 iio: light: veml6030: fix channel type when pushing events
ef6c2a521454f iio: light: tsl2591: return actual error from probe IRQ failure
9d421c2827ea1 iio: light: opt3001: fix missing state reset on timeout
0c655d067ac69 iio: light: gp2ap002: fix runtime PM leak on read error
a60bf629a760d iio: light: al3320a: read both ALS ADC registers again
a1dafc918d793 iio: light: al3320a: add missing REGMAP_I2C to Kconfig
a00d471cf3580 iio: light: al3010: read both ALS ADC registers again
cd278561640c7 iio: light: al3010: fix incorrect scale for the highest gain range
9fb4ff07d97e3 iio: light: al3010: add missing REGMAP_I2C to Kconfig
6afb69bb969ed iio: light: al3000a: add missing REGMAP_I2C to Kconfig
482b24660ec3b iio: imu: st_lsm6dsx: deselect shub page before reading whoami
76e12a71ac053 iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
34656a59322e5 iio: imu: inv_icm42600: fix timestamp clock period by using lower value
0522819228284 iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
bdafd53ae671e iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
001527e2382e3 iio: gyro: bmg160: wait full startup time after mode change at probe
7bbf02b63961f iio: gyro: bmg160: bail out when bandwidth/filter is not in table
9edefd4c56bee iio: event: Fix event FIFO reset race
2358da87315d1 iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source()
e166a8cfb28a3 iio: core: fix uninitialized data in debugfs
b947bde73461f iio: common: st_sensors: honour channel endianness in read_axis_data
82accdd574043 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
c28835b8618ec iio: backend: fix uninitialized data in debugfs
0f30e68dd6c1f iio: adc: ti-ads124s08: Return reset GPIO lookup errors
ffb2195921c3d iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
bbfebae473ac2 iio: adc: spear: Initialize completion before requesting IRQ
9e2e8b8cdfd37 iio: adc: lpc32xx: Initialize completion before requesting IRQ
c313bb7c38855 iio: adc: ad_sigma_delta: fix CS held asserted and state leaks
3394e0b332842 iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices
46e93fcbe7c2c iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
24a9514b606e7 iio: adc: ad7768-1: Select GPIOLIB
e6ade81631d76 iio: adc: ad7380: select REGMAP
6293211d14260 iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
3e766526827ac iio: accel: bmc150: clamp the device-reported FIFO frame count
7515a6d4a9e9e usb: gadget: function: rndis: add length check for header
e01e7814b4223 usb: gadget: function: rndis: add length check to response query
9d1dc507b99ce fscrypt: Replace mk_users keyring with simple list
85f8b440a09ba fscrypt: Fix key setup in edge case with multiple data unit sizes
20133754d46fe rust: kasan: KASAN+RUST requires clang
a2d5d3ee7b6e3 perf/core: Detach event groups during remove_on_exec
94396fd93226a futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
1cc8f512cd905 rust: Kbuild: set frame-pointer llvm module flag for CONFIG_FRAME_POINTER
70fe1ac8647b0 rust: doctest: fix incorrect pattern in replacement
e7636f26f7707 rust: block: fix GenDisk cleanup paths
c1dd0b1071004 rust: cpufreq: clean new `clippy::map_or_identity` lint for Rust 1.98.0
30d5d4eef35a9 LoongArch: Add PIO for early access before ACPI PCI root register
86df6499dfd23 platform/x86: intel-hid: Protect ACPI notify handler against recursion
452945662fd8e ACPI: NFIT: core: Fix possible NULL pointer dereference
f29dc6132d496 ACPI: CPPC: Suppress UBSAN warning caused by field misuse
ff9c4c6428883 KVM: x86: Unconditionally recompute CR8 intercept on PPR update
3dcfb04dd43b1 KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
0d0187a46b16e KVM: x86: Move update_cr8_intercept() to lapic.c
9baa2833e6bc8 perf trace beauty fcntl: Fix build with older kernel headers
47e4c6e06e78e slab: recognize @GFP parameter as optional in kernel-doc
1776f29327a13 default_gfp(): avoid using the "newfangled" __VA_OPT__ trick
50c26b461b8e7 add default_gfp() helper macro and use it in the new *alloc_obj() helpers
2dca62902eb35 slab: Introduce kmalloc_flex() and family
1c2672781b1b3 mm/khugepaged: write all dirty file folios when collapsing
2539f67b75461 nfsd: change nfs4_client_to_reclaim() to allocate data
05e48af3bf58d nfsd: move name lookup out of nfsd4_list_rec_dir()
c4b70c1512b8f net/sched: dualpi2: fix GSO backlog accounting
076b1aa65f77a fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
406c28af75123 f2fs: fix to do sanity check on f2fs_get_node_folio_ra()
3f42fbd3c891d f2fs: detect more inconsistent cases in sanity_check_node_footer()
ed87e57558dc5 f2fs: optimize trace_f2fs_write_checkpoint with enums
8dbc4c5686820 f2fs: introduce f2fs_schedule_timeout()
599d7d82eeecc f2fs: use memalloc_retry_wait() as much as possible
ec9f79c8d5b28 f2fs: fix listxattr handling of corrupted xattr entries
89479a27fa4e1 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
998536c96b6ad f2fs: fix potential deadlock in f2fs_balance_fs()
4ce2d52f680c1 f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
a499f77c06050 f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
5a4d3968cf820 f2fs: remove non-uptodate folio from the page cache in move_data_block
9c86a1f930bb2 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
60d696a037eee userfaultfd: gate must_wait writability check on pte_present()
3436a7dd067c5 rust: str: clean unused import for Rust >= 1.98
3603500c868a1 rust: str: use the "kernel vertical" imports style
8dee7c278f1c2 nfsd: release layout stid on setlease failure
6f88ca186a984 nfsd: update mtime/ctime on COPY in presence of delegated attributes
7c702bb4f8d83 nfsd: update mtime/ctime on CLONE in presense of delegated attributes
501543207378f bpf, arm64: Reject out-of-range B.cond targets
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d98dedd769718f70bac1c6b963eeba5a58d1c769)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.18.bb | 6 ++---
.../linux/linux-yocto-tiny_6.18.bb | 6 ++---
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +++++++++----------
3 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 23c43c0cc19..6d287cdc7d5 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,13 +15,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "0d0c54addf4ff32e49c485061bd9ea5bde241d94"
-SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
+SRCREV_machine ?= "0156acd2db993abc3baa366fee892d503aab1ccc"
+SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.18.38"
+LINUX_VERSION ?= "6.18.39"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index e186b5f9926..8b9201a73e3 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -9,7 +9,7 @@ require recipes-kernel/linux/linux-yocto.inc
include recipes-kernel/linux/cve-exclusion.inc
include recipes-kernel/linux/cve-exclusion_6.18.inc
-LINUX_VERSION ?= "6.18.38"
+LINUX_VERSION ?= "6.18.39"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -18,8 +18,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
+SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 5c849202ada..8528869a5ed 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,25 +17,25 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "053c98bdd6c074a24771d69d24ff077f6016b299"
-SRCREV_machine:qemuarm64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemuloongarch64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuarm ?= "162946cfb65f28f0a5f60e927bdae5615e6356a8"
+SRCREV_machine:qemuarm64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuloongarch64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemuriscv64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemuriscv32 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemux86 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_machine:qemux86-64 ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
+SRCREV_machine:qemuppc ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuriscv64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuriscv32 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemux86 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemux86-64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "00e8270271ee18a1c5a5f04c37dacae77acb5636"
-SRCREV_meta ?= "bf23930cc9805c0e87bdaff762832446c730a39b"
+SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "e46dc0adfe39724bcf52cea47b8f9c9aed86a394"
+SRCREV_machine:class-devupstream ?= "f89c296854b755a66657065c35b05406fc18264d"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.18/base"
@@ -43,7 +43,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.18;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.18.38"
+LINUX_VERSION ?= "6.18.39"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 29/36] linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (27 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 28/36] linux-yocto/6.18: update to v6.18.39 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 30/36] xmlto: correct srcrev to point to released version Yoann Congal
` (6 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
To partially (or fully) address: https://bugzilla.yoctoproject.org/show_bug.cgi?id=16217
Integrating the following commit(s) to linux-yocto/6.18:
1/1 [
Author: Ryosuke Yasuoka
Email: ryasuoka@redhat.com
Subject: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
Date: Mon, 13 Jul 2026 22:01:00 +0900
A probe-time deadlock can occur between the dequeue worker and
drm_client_register(). During probe, drm_client_register() holds
clientlist_mutex and calls the fbdev hotplug callback, which triggers an
atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs()
waiting for virtqueue space. The dequeue worker that would free that
space calls virtio_gpu_cmd_get_display_info_cb(), which invokes
drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting
to acquire the same clientlist_mutex. Since wake_up() is only called
after the resp_cb loop, the probe thread is never woken and both threads
deadlock.
Fix this by removing the hotplug notification from
virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info)
is still updated synchronously in the callback.
For the init path, drm_client_register() already fires an initial
hotplug when the client is registered, which picks up the connector
state updated by display_info_cb.
For the runtime config_changed path, add a wait_event_timeout() in
config_changed_work_func() so that display_info_cb updates the connector
data before the hotplug notification is sent. Also replace
drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since
virtio-gpu never calls drm_kms_helper_poll_init() and thus
drm_helper_hpd_irq_event() always returns false without doing anything.
Fixes: 27655b9bb9f0 ("drm/client: Send hotplug event after registering a client")
Closes: https://syzkaller.appspot.com/bug?id=d6dd6f86d3aaf7eebe7406e45c1c6e549453f224
Closes: https://syzkaller.appspot.com/bug?id=908bd910da5dd79b88de4cf7baf376cc873a922e
Suggested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260713-virtiogpu_syzbot-v2-1-2958fa37d46d@redhat.com
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 496ab6151ead169d9f4873d1e2a3f5e646c73b07)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.18.bb | 2 +-
.../linux/linux-yocto-tiny_6.18.bb | 2 +-
meta/recipes-kernel/linux/linux-yocto_6.18.bb | 18 +++++++++---------
3 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 6d287cdc7d5..9d44c803eb9 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,7 +15,7 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "0156acd2db993abc3baa366fee892d503aab1ccc"
+SRCREV_machine ?= "56572c42354027a50e261f16fe13b057604873e7"
SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index 8b9201a73e3..7ff47505aa0 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -18,7 +18,7 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 8528869a5ed..6111ae89daa 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,17 +17,17 @@ KBRANCH:qemux86-64 ?= "v6.18/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.18/standard/base"
KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
-SRCREV_machine:qemuarm ?= "162946cfb65f28f0a5f60e927bdae5615e6356a8"
-SRCREV_machine:qemuarm64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemuloongarch64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuarm ?= "78e0248ce3cecd33f63926cd1d54c64e163d076c"
+SRCREV_machine:qemuarm64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemuloongarch64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemuriscv64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemuriscv32 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemux86 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemux86-64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuppc ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemuriscv64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemuriscv32 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemux86 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemux86-64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 30/36] xmlto: correct srcrev to point to released version
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (28 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 29/36] linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 31/36] vim: Security Fix for CVE-2026-42307 Yoann Congal
` (5 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Daniel Turull <daniel.turull@ericsson.com>
0.0.29 released has done Jun 11, 2024, 635dcd5bc8
https://codeberg.org/xmlto/xmlto/tags
current srcrev was 1 commit ahead
https://codeberg.org/xmlto/xmlto/commit/74862a684907ada3d4ed2ce0f8111adf626e1456
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0813c7dc9f379636b9f7adf0fee082187e24b26a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/xmlto/xmlto_0.0.29.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb b/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb
index c26cd21dd07..29652bd7d64 100644
--- a/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb
+++ b/meta/recipes-devtools/xmlto/xmlto_0.0.29.bb
@@ -6,8 +6,8 @@ LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552"
-SRCREV = "74862a684907ada3d4ed2ce0f8111adf626e1456"
-SRC_URI = "git://codeberg.org/xmlto/xmlto.git;protocol=https;branch=master"
+SRCREV = "635dcd5bc84a7b67a3a2050a179d96e1d3050b15"
+SRC_URI = "git://codeberg.org/xmlto/xmlto.git;protocol=https;branch=master;tag=${PV}"
inherit autotools
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 31/36] vim: Security Fix for CVE-2026-42307
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (29 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 30/36] xmlto: correct srcrev to point to released version Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 32/36] vim: Security Fix for CVE-2026-43961 Yoann Congal
` (4 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Picking patch as per [1], and same patch is mentioned in [2]
References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-42307
[2] https://security-tracker.debian.org/tracker/CVE-2026-42307
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../vim/files/CVE-2026-42307.patch | 177 ++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 178 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-42307.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-42307.patch b/meta/recipes-support/vim/files/CVE-2026-42307.patch
new file mode 100644
index 00000000000..037f6cba273
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-42307.patch
@@ -0,0 +1,177 @@
+From 405e2fb6d54d5653523809e2853d99d1c000a5fc Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Tue, 21 Apr 2026 19:03:02 +0000
+Subject: [PATCH] patch 9.2.0383: [security]: runtime(netrw): shell-injection
+ via sftp: and file: URLs
+
+Problem: runtime(netrw): shell-injection via sftp: and file: URLs
+ (Joshua Rogers)
+Solution: Escape temporary file names, harden filename suffix regex,
+ drop unused g:netrw_tmpfile_escape variable
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc]
+CVE: CVE-2026-42307
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ runtime/doc/pi_netrw.txt | 4 ---
+ runtime/doc/tags | 1 -
+ .../pack/dist/opt/netrw/autoload/netrw.vim | 16 +++++-----
+ runtime/pack/dist/opt/netrw/doc/netrw.txt | 4 ---
+ src/testdir/test_plugin_netrw.vim | 30 +++++++++++++++++++
+ src/version.c | 2 ++
+ 6 files changed, 41 insertions(+), 16 deletions(-)
+
+diff --git a/runtime/doc/pi_netrw.txt b/runtime/doc/pi_netrw.txt
+index a86cac36ba..2d98a8407b 100644
+--- a/runtime/doc/pi_netrw.txt
++++ b/runtime/doc/pi_netrw.txt
+@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|)
+ such as listing, file removal, etc.
+ default: ssh
+
+- *g:netrw_tmpfile_escape* =' &;'
+- escape() is applied to all temporary files
+- to escape these characters.
+-
+ *g:netrw_timefmt* specify format string to vim's strftime().
+ The default, "%c", is "the preferred date
+ and time representation for the current
+diff --git a/runtime/doc/tags b/runtime/doc/tags
+index 1e0720b21a..023996c0eb 100644
+--- a/runtime/doc/tags
++++ b/runtime/doc/tags
+@@ -7966,7 +7966,6 @@ g:netrw_ssh_browse_reject pi_netrw.txt /*g:netrw_ssh_browse_reject*
+ g:netrw_ssh_cmd pi_netrw.txt /*g:netrw_ssh_cmd*
+ g:netrw_sshport pi_netrw.txt /*g:netrw_sshport*
+ g:netrw_timefmt pi_netrw.txt /*g:netrw_timefmt*
+-g:netrw_tmpfile_escape pi_netrw.txt /*g:netrw_tmpfile_escape*
+ g:netrw_uid pi_netrw.txt /*g:netrw_uid*
+ g:netrw_use_noswf pi_netrw.txt /*g:netrw_use_noswf*
+ g:netrw_use_nt_rcp pi_netrw.txt /*g:netrw_use_nt_rcp*
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index 8e5fdb5397..78ce0cbc3c 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -398,7 +398,6 @@ else
+ call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\')
+ endif
+ call s:NetrwInit("g:netrw_menu_escape",'.&? \')
+-call s:NetrwInit("g:netrw_tmpfile_escape",' &;')
+ call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\<C-V>\"")
+ if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4')
+ let s:treedepthstring= "│ "
+@@ -1819,14 +1818,14 @@ function netrw#NetRead(mode,...)
+ ".........................................
+ " NetRead: (sftp) NetRead Method #9 {{{3
+ elseif b:netrw_method == 9
+- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".tmpfile)
++ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1))
+ let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method)
+ let b:netrw_lastfile = choice
+
+ ".........................................
+ " NetRead: (file) NetRead Method #10 {{{3
+ elseif b:netrw_method == 10 && exists("g:netrw_file_cmd")
+- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".tmpfile)
++ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1))
+ let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method)
+ let b:netrw_lastfile = choice
+
+@@ -8959,14 +8958,17 @@ function s:GetTempfile(fname)
+ endif
+
+ " use fname's suffix for the temporary file
++ " Restrict the suffix to word characters so shell metacharacters in a
++ " remote filename (e.g. sftp://host/foo.txt;id) cannot ride along into
++ " the tempfile name and out into a downstream shell command.
+ if a:fname != ""
+- if a:fname =~ '\.[^./]\+$'
++ if a:fname =~ '\.\w\+$'
+ if a:fname =~ '\.tar\.gz$' || a:fname =~ '\.tar\.bz2$' || a:fname =~ '\.tar\.xz$'
+- let suffix = ".tar".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e')
++ let suffix = ".tar".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e')
+ elseif a:fname =~ '.txz$'
+- let suffix = ".txz".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e')
++ let suffix = ".txz".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e')
+ else
+- let suffix = substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e')
++ let suffix = substitute(a:fname,'^.*\(\.\w\+\)$','\1','e')
+ endif
+ let tmpfile= substitute(tmpfile,'\.tmp$','','e')
+ let tmpfile .= suffix
+diff --git a/runtime/pack/dist/opt/netrw/doc/netrw.txt b/runtime/pack/dist/opt/netrw/doc/netrw.txt
+index 01a5bda597..144bab5fb3 100644
+--- a/runtime/pack/dist/opt/netrw/doc/netrw.txt
++++ b/runtime/pack/dist/opt/netrw/doc/netrw.txt
+@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|)
+ such as listing, file removal, etc.
+ default: ssh
+
+- *g:netrw_tmpfile_escape* =' &;'
+- escape() is applied to all temporary files
+- to escape these characters.
+-
+ *g:netrw_timefmt* specify format string to vim's strftime().
+ The default, "%c", is "the preferred date
+ and time representation for the current
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index b234670928..6be32911ce 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -604,6 +604,36 @@ func Test_netrw_FileUrlEdit_pipe_injection()
+ call assert_false(filereadable(fname), 'Command injection via pipe in file URL')
+ endfunc
+
++" The remote filename after '.' was allowed to contain shell metacharacters
++" and rode unescaped into the tempfile name passed to sftp/file_cmd, giving a
++" shell injection on :e sftp://host/foo.txt;<cmd>.
++func Test_netrw_tempfile_suffix_injection()
++ CheckUnix
++ CheckExecutable id
++ let save_sftp = g:netrw_sftp_cmd
++ let save_file = exists('g:netrw_file_cmd') ? g:netrw_file_cmd : v:null
++ let g:netrw_sftp_cmd = 'true'
++ let g:netrw_file_cmd = 'true'
++ let fname = 'Xrce_marker'
++ try
++ call delete(fname)
++ sil! call netrw#NetRead(2, 'sftp://localhost/foo.txt;id>'..fname)
++ call assert_false(filereadable(fname), 'Command injection via sftp:// tempfile suffix')
++
++ call delete(fname)
++ sil! call netrw#NetRead(2, 'file://localhost/foo.txt;id>'..fname)
++ call assert_false(filereadable(fname), 'Command injection via file:// tempfile suffix')
++ finally
++ call delete(fname)
++ let g:netrw_sftp_cmd = save_sftp
++ if save_file is v:null
++ unlet! g:netrw_file_cmd
++ else
++ let g:netrw_file_cmd = save_file
++ endif
++ endtry
++endfunc
++
+ func Test_netrw_RFC2396()
+ let fname = 'a%20b'
+ call assert_equal('a b', netrw#RFC2396(fname))
+diff --git a/src/version.c b/src/version.c
+index 560233fafc..4508ae3f18 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 383,
+ /**/
+ 340,
+ /**/
+--
+2.34.1
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index e34cc17fe57..0ad78ab4f08 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -23,6 +23,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-52858.patch \
file://CVE-2026-52859.patch \
file://CVE-2026-52860.patch \
+ file://CVE-2026-42307.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 32/36] vim: Security Fix for CVE-2026-43961
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (30 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 31/36] vim: Security Fix for CVE-2026-42307 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 33/36] vim: Security Fix for CVE-2026-47162 Yoann Congal
` (3 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Picking patch as per [1], and same patch is mentioned in [2]
References:
[1] https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e
[2] https://security-tracker.debian.org/tracker/CVE-2026-43961
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../vim/files/CVE-2026-43961.patch | 104 ++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 105 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-43961.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-43961.patch b/meta/recipes-support/vim/files/CVE-2026-43961.patch
new file mode 100644
index 00000000000..e2633ac04f1
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-43961.patch
@@ -0,0 +1,104 @@
+From 8af0f098c3a42a28661d0295364e6e0fd7dbc92c Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 14 May 2026 16:43:15 +0000
+Subject: [PATCH] patch 9.2.0480: [security]: runtime(netrw): code injection
+ via mf command
+
+Problem: [security]: runtime(netrw): code injection via mf command
+ (Christopher Lusk, Zdenek Dohnal)
+Solution: Do not use string concatenation inside the filter() commands
+ (Zdenek Dohnal)
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e]
+CVE: CVE-2026-43961
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ runtime/pack/dist/opt/netrw/autoload/netrw.vim | 7 +++----
+ src/testdir/test_plugin_netrw.vim | 15 +++++++++++++++
+ src/version.c | 2 ++
+ 3 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index 78ce0cbc3c..3a460e675b 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -5175,7 +5175,7 @@ function s:NetrwMarkFile(islocal,fname)
+
+ else
+ " remove filename from buffer's markfilelist
+- call filter(s:netrwmarkfilelist_{curbufnr},'v:val != a:fname')
++ call filter(s:netrwmarkfilelist_{curbufnr}, {_, v -> v !=# a:fname})
+ if s:netrwmarkfilelist_{curbufnr} == []
+ " local markfilelist is empty; remove it entirely
+ call s:NetrwUnmarkList(curbufnr,curdir)
+@@ -5196,7 +5196,6 @@ function s:NetrwMarkFile(islocal,fname)
+
+ else
+ " initialize new markfilelist
+-
+ let s:netrwmarkfilelist_{curbufnr}= []
+ call add(s:netrwmarkfilelist_{curbufnr},substitute(a:fname,'[|@]$','',''))
+
+@@ -5216,7 +5215,7 @@ function s:NetrwMarkFile(islocal,fname)
+ call add(s:netrwmarkfilelist,netrw#fs#ComposePath(b:netrw_curdir,a:fname))
+ else
+ " remove new filename from global markfilelist
+- call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"')
++ call filter(s:netrwmarkfilelist, {_, v -> v !=# dname})
+ if s:netrwmarkfilelist == []
+ unlet s:netrwmarkfilelist
+ endif
+@@ -7235,7 +7234,7 @@ function s:NetrwTreeDisplay(dir,depth)
+ " hide given patterns
+ let listhide= split(g:netrw_list_hide,',')
+ for pat in listhide
+- call filter(w:netrw_treedict[dir],'v:val !~ "'.escape(pat,'\\').'"')
++ call filter(w:netrw_treedict[dir], {_, v -> v !~# pat})
+ endfor
+
+ elseif g:netrw_hide == 2
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index 6be32911ce..7b34b52562 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -639,4 +639,19 @@ func Test_netrw_RFC2396()
+ call assert_equal('a b', netrw#RFC2396(fname))
+ endfunc
+
++func Test_netrw_mf_command_injection()
++ CheckUnix
++ CheckExecutable touch
++ let path = tempname()
++ let fname = 'x" . execute("silent! !touch poc") . "'
++ call mkdir(path, 'R')
++ exe "cd " path
++ call writefile([], fname)
++ Explore .
++ call search('^x')
++ :norm mf
++ :norm mf
++ call assert_false(filereadable('poc'), 'Command injection via mf command')
++endfunc
++
+ " vim:ts=8 sts=2 sw=2 et
+diff --git a/src/version.c b/src/version.c
+index 4508ae3f18..64008e0f37 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 480,
+ /**/
+ 383,
+ /**/
+--
+2.34.1
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 0ad78ab4f08..fd835a3cdbf 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -24,6 +24,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-52859.patch \
file://CVE-2026-52860.patch \
file://CVE-2026-42307.patch \
+ file://CVE-2026-43961.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 33/36] vim: Security Fix for CVE-2026-47162
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (31 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 32/36] vim: Security Fix for CVE-2026-43961 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 34/36] vim: Security Fix for CVE-2026-47167 Yoann Congal
` (2 subsequent siblings)
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Picking patch as per [1], and same patch is mentioned in [2]
References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-47162
[2] https://security-tracker.debian.org/tracker/CVE-2026-47162
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../vim/files/CVE-2026-47162.patch | 83 +++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 84 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-47162.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-47162.patch b/meta/recipes-support/vim/files/CVE-2026-47162.patch
new file mode 100644
index 00000000000..69714493d49
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-47162.patch
@@ -0,0 +1,83 @@
+From f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 17 May 2026 18:53:48 +0000
+Subject: [PATCH] patch 9.2.0495: [security]: runtime(netrw): code injection
+ via NetrwBookHistSave()
+
+Problem: [security]: runtime(netrw): code injection via
+ NetrwBookHistSave()
+Solution: Properly quote the directory name using string() function
+ (Srinivas Piskala Ganesh Babu)
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b]
+CVE: CVE-2026-47162
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ .../pack/dist/opt/netrw/autoload/netrw.vim | 2 +-
+ src/testdir/test_plugin_netrw.vim | 20 +++++++++++++++++++
+ src/version.c | 2 ++
+ 3 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index 3a460e675b..a04120d5f6 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -2957,7 +2957,7 @@ function s:NetrwBookHistSave()
+ while ( first || cnt != g:netrw_dirhistcnt )
+ let lastline= lastline + 1
+ if exists("g:netrw_dirhist_{cnt}")
+- call setline(lastline,'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'")
++ call setline(lastline,'let g:netrw_dirhist_'.cnt.'='.string(g:netrw_dirhist_{cnt}))
+ endif
+ let first = 0
+ let cnt = ( cnt - 1 ) % g:netrw_dirhistmax
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index 7b34b52562..cfce82f68a 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -654,4 +654,24 @@ func Test_netrw_mf_command_injection()
+ call assert_false(filereadable('poc'), 'Command injection via mf command')
+ endfunc
+
++func Test_netrw_injection()
++ let g:netrw_home = getcwd()
++ let savefile = g:netrw_home . '/.netrwhist'
++ let g:netrw_dirhistmax = 10
++ let g:netrw_dirhistcnt = 1
++ let g:netrw_dirhist_1 = "x'|let g:injected = 1|let y='z"
++ call delete(savefile)
++ try
++ call netrw#Call('NetrwBookHistSave')
++ call assert_true(filereadable(savefile), savefile . ' must be written')
++ unlet g:netrw_dirhist_1
++ execute 'source ' . fnameescape(savefile)
++ call assert_false(exists("g:injected"), 'injected statement must not execute')
++ call assert_equal("x'|let g:injected = 1|let y='z", g:netrw_dirhist_1, 'dirname must round-trip')
++ finally
++ call delete(savefile)
++ unlet! g:netrw_home g:netrw_dirhistmax g:netrw_dirhistcnt g:netrw_dirhist_1 g:injected
++ endtry
++endfunc
++
+ " vim:ts=8 sts=2 sw=2 et
+diff --git a/src/version.c b/src/version.c
+index 64008e0f37..cf62805e44 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 495,
+ /**/
+ 480,
+ /**/
+--
+2.34.1
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index fd835a3cdbf..8360b1622de 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -25,6 +25,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-52860.patch \
file://CVE-2026-42307.patch \
file://CVE-2026-43961.patch \
+ file://CVE-2026-47162.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 34/36] vim: Security Fix for CVE-2026-47167
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (32 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 33/36] vim: Security Fix for CVE-2026-47162 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 35/36] vim: Security Fix for CVE-2026-55892 Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 36/36] vim: Security Fix for CVE-2026-57452 Yoann Congal
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Picking patch as per [1], and same patch is mentioned in [2]
References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-47167
[2] https://security-tracker.debian.org/tracker/CVE-2026-47167
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../vim/files/CVE-2026-47167.patch | 102 ++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 103 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-47167.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-47167.patch b/meta/recipes-support/vim/files/CVE-2026-47167.patch
new file mode 100644
index 00000000000..f9a989cf3af
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-47167.patch
@@ -0,0 +1,102 @@
+From 5eb4bd1c12801f9ffb451f22b4d459ff2b7ff962 Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Sun, 17 May 2026 19:39:24 +0000
+Subject: [PATCH 4/6] patch 9.2.0496: [security]: Code Injection in cucumber
+ filetype plugin
+
+Problem: [security]: Code Injection in cucumber filetype plugin
+ (Christopher Lusk)
+Solution: Use rubys Regexp.new() with the untrusted pattern
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934]
+CVE: CVE-2026-47167
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ runtime/ftplugin/cucumber.vim | 5 ++++-
+ src/testdir/test_filetype.vim | 30 ++++++++++++++++++++++++++++++
+ src/version.c | 2 ++
+ 3 files changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/runtime/ftplugin/cucumber.vim b/runtime/ftplugin/cucumber.vim
+index f4848d1c60..9723898d15 100644
+--- a/runtime/ftplugin/cucumber.vim
++++ b/runtime/ftplugin/cucumber.vim
+@@ -2,6 +2,8 @@
+ " Language: Cucumber
+ " Maintainer: Tim Pope <vimNOSPAM@tpope.org>
+ " Last Change: 2016 Aug 29
++" 2026 May 26 by Vim Project: prevent Code Injection
++" https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9
+
+ " Only do this when not done yet for this buffer
+ if (exists("b:did_ftplugin"))
+@@ -96,7 +98,8 @@ function! s:stepmatch(receiver,target)
+ catch
+ endtry
+ if has("ruby") && pattern !~ '\\\@<!#{'
+- ruby VIM.command("return #{if (begin; Kernel.eval('/'+VIM.evaluate('pattern')+'/'); rescue SyntaxError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
++ " Use Regexp.new, so the pattern stays untrusted data and cannot inject Ruby
++ ruby VIM.command("return #{if (begin; Regexp.new(VIM.evaluate('pattern')); rescue RegexpError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
+ else
+ return 0
+ endif
+diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim
+index 70e269ee63..f6956795da 100644
+--- a/src/testdir/test_filetype.vim
++++ b/src/testdir/test_filetype.vim
+@@ -3433,4 +3433,34 @@ func Test_app_file()
+ filetype off
+ endfunc
+
++func Test_cucumber_code_injection()
++ CheckFeature ruby
++ filetype plugin on
++
++ call mkdir('Xcucu/features/step_definitions', 'pR')
++ call writefile([
++ \ 'Feature: demo',
++ \ ' Scenario: trigger',
++ \ ' Given xyzzy',
++ \ ], 'Xcucu/features/test.feature')
++ let marker = getcwd() . '/Xcucu/MARKER'
++ " Malicious step: terminates the regex literal, injects Ruby system(),
++ " comments the trailing slash. With the fix, the pattern is passed to
++ " Regexp.new() instead of Kernel.eval() and the payload is inert.
++ call writefile([
++ \ 'Given /xyzzy/; system("touch ' . marker . '"); #/ do',
++ \ 'end',
++ \ ], 'Xcucu/features/step_definitions/poc.rb')
++
++ new Xcucu/features/test.feature
++ call assert_equal('cucumber', &filetype)
++ call cursor(3, 1)
++ " Triggers s:jump -> s:steps -> s:stepmatch on every discovered step,
++ " including the malicious one. Suppress preview and error messages.
++ silent! normal [d
++ call assert_false(filereadable(marker), 'Ruby injection executed')
++ bwipe!
++ filetype plugin off
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index cf62805e44..03a520b146 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 496,
+ /**/
+ 495,
+ /**/
+--
+2.34.1
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 8360b1622de..7a4a0bc932f 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -26,6 +26,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-42307.patch \
file://CVE-2026-43961.patch \
file://CVE-2026-47162.patch \
+ file://CVE-2026-47167.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 35/36] vim: Security Fix for CVE-2026-55892
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (33 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 34/36] vim: Security Fix for CVE-2026-47167 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
2026-07-27 22:55 ` [OE-core][wrynose 36/36] vim: Security Fix for CVE-2026-57452 Yoann Congal
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Picking patch as per [1], and same patch is mentioned in [2]
References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-55892
[2] https://security-tracker.debian.org/tracker/CVE-2026-55892
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../vim/files/CVE-2026-55892.patch | 95 +++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 96 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-55892.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-55892.patch b/meta/recipes-support/vim/files/CVE-2026-55892.patch
new file mode 100644
index 00000000000..fc430953623
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-55892.patch
@@ -0,0 +1,95 @@
+From 8325b193bba5f01e7a7d8241fc8633d93dff996b Mon Sep 17 00:00:00 2001
+From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Date: Tue, 16 Jun 2026 20:32:21 +0000
+Subject: [PATCH] patch 9.2.0662: [security] Stack out-of-bounds write in
+ dump_prefixes()
+
+Problem: [security]: a crafted spell file with a self-referential
+ BY_INDEX node in the prefix tree can drive dump_prefixes()
+ past the end of its MAXWLEN-sized depth arrays on :spelldump
+ (cipher-creator)
+Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
+ walkers already do (Yasuhiro Matsumoto)
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h
+
+Supported by AI
+
+Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241fc8633d93dff996b]
+CVE: CVE-2026-55892
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ src/spell.c | 2 +-
+ src/testdir/test_spell.vim | 27 +++++++++++++++++++++++++++
+ src/version.c | 2 ++
+ 3 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/src/spell.c b/src/spell.c
+index 01eb57e3a9..72d1f0b521 100644
+--- a/src/spell.c
++++ b/src/spell.c
+@@ -4325,7 +4325,7 @@ dump_prefixes(
+ }
+ }
+ }
+- else
++ else if (depth < MAXWLEN - 1)
+ {
+ // Normal char, go one level deeper.
+ prefix[depth++] = c;
+diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
+index 58a2d58707..77eac49fd8 100644
+--- a/src/testdir/test_spell.vim
++++ b/src/testdir/test_spell.vim
+@@ -1581,4 +1581,31 @@ func Test_suggest_spell_restore()
+ bwipe!
+ endfunc
+
++" A crafted .spl with a self-referential BY_INDEX node in the PREFIXTREE drove
++" dump_prefixes() past its MAXWLEN-sized depth arrays (stack out-of-bounds
++" write). The tree parses cleanly (shared refs aren't recursed); the walk
++" happens on :spelldump. Reaching the assert means no OOB. Same class as the
++" tree_count_words() fix (9.2.0653).
++func Test_spelldump_prefixtree_overflow()
++ CheckUnix
++ call mkdir('Xrtp/spell', 'pR')
++ " VIMspell + v50, SN_PREFCOND(prefixcnt=1), SN_END,
++ " LWORDTREE word "a" with affixID=1 (so dump_prefixes runs),
++ " empty KWORDTREE, PREFIXTREE child BY_INDEX -> nodeidx 0 (self-cycle), 'A'
++ let spl = eval('0z56494D7370656C6C32030000000003000100FF00000004'
++ \ .. '0161010220010000000000000002010100000041')
++ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b')
++
++ new
++ set runtimepath+=./Xrtp
++ set spelllang=xx
++ set spell
++ spelldump
++ call assert_true(line('$') > 1)
++
++ set spell& spelllang& runtimepath&
++ bwipe!
++ bwipe!
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index 03a520b146..b40bd9be93 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 662,
+ /**/
+ 496,
+ /**/
+--
+2.34.1
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 7a4a0bc932f..f423e4d5cb0 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -27,6 +27,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-43961.patch \
file://CVE-2026-47162.patch \
file://CVE-2026-47167.patch \
+ file://CVE-2026-55892.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 39+ messages in thread* [OE-core][wrynose 36/36] vim: Security Fix for CVE-2026-57452
2026-07-27 22:55 [OE-core][wrynose 00/36] Patch review Yoann Congal
` (34 preceding siblings ...)
2026-07-27 22:55 ` [OE-core][wrynose 35/36] vim: Security Fix for CVE-2026-55892 Yoann Congal
@ 2026-07-27 22:55 ` Yoann Congal
35 siblings, 0 replies; 39+ messages in thread
From: Yoann Congal @ 2026-07-27 22:55 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Picking patch as per [1], and same patch is mentioned in [2]
References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57452
[2] https://security-tracker.debian.org/tracker/CVE-2026-57452
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../vim/files/CVE-2026-57452.patch | 90 +++++++++++++++++++
meta/recipes-support/vim/vim.inc | 1 +
2 files changed, 91 insertions(+)
create mode 100644 meta/recipes-support/vim/files/CVE-2026-57452.patch
diff --git a/meta/recipes-support/vim/files/CVE-2026-57452.patch b/meta/recipes-support/vim/files/CVE-2026-57452.patch
new file mode 100644
index 00000000000..e87007c00a2
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-57452.patch
@@ -0,0 +1,90 @@
+From c8777cec25dcfae89c42e9aff51af61f71c5745f Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 18 Jun 2026 18:41:16 +0000
+Subject: [PATCH] patch 9.2.0671: [security]: possible out-of-bounds read with
+ sodium encrypted files
+
+Problem: [security]: possible out-of-bounds read with sodium encrypted
+ files (cipher-creator)
+Solution: Verify that there is enough space before calling
+ crypto_secretstream_xchacha20poly1305_init_pull()
+
+Github Security Advisory:
+https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486
+
+Supported by AI
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+
+Upstream-Status: Backport [https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f]
+CVE: CVE-2026-57452
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ src/crypt.c | 3 ++-
+ src/testdir/test_crypt.vim | 24 ++++++++++++++++++++++++
+ src/version.c | 2 ++
+ 3 files changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/src/crypt.c b/src/crypt.c
+index 2fade5db9d..879ecbf6ce 100644
+--- a/src/crypt.c
++++ b/src/crypt.c
+@@ -1262,7 +1262,8 @@ crypt_sodium_buffer_decode(
+
+ if (sod_st->count == 0)
+ {
+- if (crypto_secretstream_xchacha20poly1305_init_pull(&sod_st->state,
++ if (len < crypto_secretstream_xchacha20poly1305_HEADERBYTES ||
++ crypto_secretstream_xchacha20poly1305_init_pull(&sod_st->state,
+ from, sod_st->key) != 0)
+ {
+ emsg(_(e_libsodium_decryption_failed_header_incomplete));
+diff --git a/src/testdir/test_crypt.vim b/src/testdir/test_crypt.vim
+index d540fbbd62..5c9dfe3baf 100644
+--- a/src/testdir/test_crypt.vim
++++ b/src/testdir/test_crypt.vim
+@@ -491,4 +491,28 @@ func Test_crypt_off_by_one()
+ bwipe!
+ endfunc
+
++func Test_crypt_sodium_short_body()
++ CheckFeature sodium
++ " A VimCrypt~04! file with a complete 36-byte header (12 magic + 16 salt +
++ " 8 seed) but a body shorter than one secretstream header (24 bytes) used to
++ " underflow the body length and crash with a wild out-of-bounds read in
++ " crypto_secretstream_xchacha20poly1305_pull(). It must now fail cleanly.
++ " Bytes: "VimCrypt~04!" + 16 salt + 8 seed + 8-byte body = 44 bytes.
++ call writefile(0z56696D43727970747E303421
++ \ + 0zA0A1A2A3A4A5A6A7A8A9AAABACADAEAF
++ \ + 0zB0B1B2B3B4B5B6B7
++ \ + 0z0000000000000000, 'Xtest_sodium_short')
++
++ let v:errmsg = ''
++ try
++ call feedkeys(":split Xtest_sodium_short\<CR>foobar\<CR>", "xt")
++ catch /^Vim\%((\S\+)\)\=:E1198:/
++ " no-op
++ endtry
++
++ bwipe!
++ call delete('Xtest_sodium_short')
++ set key=
++endfunc
++
+ " vim: shiftwidth=2 sts=2 expandtab
+diff --git a/src/version.c b/src/version.c
+index b40bd9be93..6eac3fc927 100644
+--- a/src/version.c
++++ b/src/version.c
+@@ -734,6 +734,8 @@ static char *(features[]) =
+
+ static int included_patches[] =
+ { /* Add new patch number below this line */
++/**/
++ 671,
+ /**/
+ 662,
+ /**/
+--
+2.34.1
+
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index f423e4d5cb0..20a5f7a0546 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -28,6 +28,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
file://CVE-2026-47162.patch \
file://CVE-2026-47167.patch \
file://CVE-2026-55892.patch \
+ file://CVE-2026-57452.patch \
"
PV .= ".0340"
^ permalink raw reply related [flat|nested] 39+ messages in thread