* [OE-core][scarthgap 01/55] scripts/install-buildtools: Update to 5.0.21
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 02/55] util-linux: patch CVE-2026-53614 Yoann Congal
` (53 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Yoann Congal <yoann.congal@smile.fr>
Update to the 5.0.21 release of the 5.0 series for buildtools
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
scripts/install-buildtools | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/install-buildtools b/scripts/install-buildtools
index f33f192e468..0094f7c3a8e 100755
--- a/scripts/install-buildtools
+++ b/scripts/install-buildtools
@@ -57,8 +57,8 @@ logger = scriptutils.logger_create(PROGNAME, stream=sys.stdout)
DEFAULT_INSTALL_DIR = os.path.join(os.path.split(scripts_path)[0],'buildtools')
DEFAULT_BASE_URL = 'https://downloads.yoctoproject.org/releases/yocto'
-DEFAULT_RELEASE = 'yocto-5.0.20'
-DEFAULT_INSTALLER_VERSION = '5.0.20'
+DEFAULT_RELEASE = 'yocto-5.0.21'
+DEFAULT_INSTALLER_VERSION = '5.0.21'
DEFAULT_BUILDDATE = '202110XX'
# Python version sanity check
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 02/55] util-linux: patch CVE-2026-53614
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 01/55] scripts/install-buildtools: Update to 5.0.21 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 03/55] util-linux: patch CVE-2026-53613 Yoann Congal
` (52 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41.5 release.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2026-53614.patch | 83 +++++++++++++++++++
2 files changed, 84 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index f651dc2dab4..70acf6dfec3 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -49,6 +49,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2026-27456.patch \
file://CVE-2026-13595.patch \
file://CVE-2026-3184.patch \
+ file://CVE-2026-53614.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch
new file mode 100644
index 00000000000..f1dd4ae5d74
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53614.patch
@@ -0,0 +1,83 @@
+From cc81bbcec598cb91f0eb8456282f33eed820ed5f Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 16 Jun 2026 10:58:32 +0200
+Subject: [PATCH] libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and
+ legacy mount path
+
+Use safe_getenv() for LIBMOUNT_FORCE_MOUNT2 to ignore the variable
+in SUID context, consistent with LIBMOUNT_FSTAB and other sensitive
+environment variables.
+
+Additionally, refuse multi-step mount(2) sequences (bind+remount and
+propagation) for restricted (non-root) users in the legacy mount path.
+The two-step approach has a window between syscalls where security
+flags (nosuid, noexec, ...) are not yet applied. The new mount API
+handles this atomically.
+
+CVE-2026-53614
+
+Reported-by: Xinyao Hu <ctf_0x01@foxmail.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 9cbfb823500f510b34767edabd3ffd5b436987b4)
+
+CVE: CVE-2026-53614
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/hook_mount.c | 3 ++-
+ libmount/src/hook_mount_legacy.c | 8 ++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/libmount/src/hook_mount.c b/libmount/src/hook_mount.c
+index 1ffd19e83..37179fb59 100644
+--- a/libmount/src/hook_mount.c
++++ b/libmount/src/hook_mount.c
+@@ -44,6 +44,7 @@
+ */
+
+ #include "mountP.h"
++#include "env.h"
+ #include "fileutils.h" /* statx() fallback */
+ #include "strutils.h"
+ #include "mount-api-utils.h"
+@@ -627,7 +628,7 @@ fail:
+
+ static int force_classic_mount(struct libmnt_context *cxt)
+ {
+- const char *env = getenv("LIBMOUNT_FORCE_MOUNT2");
++ const char *env = safe_getenv("LIBMOUNT_FORCE_MOUNT2");
+
+ if (env) {
+ if (strcmp(env, "always") == 0)
+diff --git a/libmount/src/hook_mount_legacy.c b/libmount/src/hook_mount_legacy.c
+index 18b7a0066..94a8fc685 100644
+--- a/libmount/src/hook_mount_legacy.c
++++ b/libmount/src/hook_mount_legacy.c
+@@ -282,6 +282,8 @@ static int hook_prepare(struct libmnt_context *cxt,
+
+ /* add extra mount(2) calls for each propagation flag */
+ if (flags & MS_PROPAGATION) {
++ if (mnt_context_is_restricted(cxt))
++ goto eperm;
+ rc = prepare_propagation(cxt, hs);
+ if (rc)
+ return rc;
+@@ -291,12 +293,18 @@ static int hook_prepare(struct libmnt_context *cxt,
+ if ((flags & MS_BIND)
+ && (flags & MNT_BIND_SETTABLE)
+ && !(flags & MS_REMOUNT)) {
++ if (mnt_context_is_restricted(cxt))
++ goto eperm;
+ rc = prepare_bindremount(cxt, hs);
+ if (rc)
+ return rc;
+ }
+
+ return rc;
++eperm:
++ DBG(HOOK, ul_debugobj(hs,
++ "multi-step mount(2) refused for non-root user"));
++ return -EPERM;
+ }
+
+ const struct libmnt_hookset hookset_mount_legacy =
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 03/55] util-linux: patch CVE-2026-53613
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 01/55] scripts/install-buildtools: Update to 5.0.21 Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 02/55] util-linux: patch CVE-2026-53614 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 04/55] util-linux: patch CVE-2026-53612 Yoann Congal
` (51 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41.5 release.
Also pick patches implementing used helper functions and fixing
consequent build errors.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 5 +
...ib-fileutils-add-ul_open_no_symlinks.patch | 98 +++++++++
...dd-ul_openat_resolve-openat2-wrapper.patch | 85 ++++++++
...x-RESOLVE_NO_SYMLINKS-fallback-value.patch | 71 +++++++
...x-unused-parameter-warnings-without-.patch | 64 ++++++
.../util-linux/CVE-2026-53613.patch | 192 ++++++++++++++++++
6 files changed, 515 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 70acf6dfec3..db698ef9367 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -50,6 +50,11 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2026-13595.patch \
file://CVE-2026-3184.patch \
file://CVE-2026-53614.patch \
+ file://0001-lib-fileutils-add-ul_open_no_symlinks.patch \
+ file://0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch \
+ file://0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch \
+ file://0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch \
+ file://CVE-2026-53613.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch
new file mode 100644
index 00000000000..d795e32087f
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_open_no_symlinks.patch
@@ -0,0 +1,98 @@
+From b639bf5c4277b7f828b3fcbdbf94bad5a4d20060 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Wed, 27 May 2026 10:35:39 +0200
+Subject: [PATCH] lib/fileutils: add ul_open_no_symlinks()
+
+Add a helper that opens a path rejecting symlinks at any component,
+not just the last one. Uses openat2(RESOLVE_NO_SYMLINKS) when
+available (Linux >= 5.6), falls back to open(O_NOFOLLOW).
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit e01e38b24346a21f1d01498c265486a12c009e61)
+
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/b639bf5c4277b7f828b3fcbdbf94bad5a4d20060]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ configure.ac | 1 +
+ include/fileutils.h | 2 ++
+ lib/fileutils.c | 24 ++++++++++++++++++++++++
+ meson.build | 1 +
+ 4 files changed, 28 insertions(+)
+
+diff --git a/configure.ac b/configure.ac
+index 3bbc94488..2d9388a3c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -316,6 +316,7 @@ AC_CHECK_HEADERS([ \
+ linux/kcmp.h \
+ linux/net_namespace.h \
+ linux/nsfs.h \
++ linux/openat2.h \
+ linux/pr.h \
+ linux/raw.h \
+ linux/securebits.h \
+diff --git a/include/fileutils.h b/include/fileutils.h
+index 6fc93d0db..996e18322 100644
+--- a/include/fileutils.h
++++ b/include/fileutils.h
+@@ -61,6 +61,8 @@ static inline int is_same_inode(const int fd, const struct stat *st)
+ return 1;
+ }
+
++extern int ul_open_no_symlinks(const char *path, int flags, mode_t mode);
++
+ extern int dup_fd_cloexec(int oldfd, int lowfd);
+ extern unsigned int get_fd_tabsize(void);
+
+diff --git a/lib/fileutils.c b/lib/fileutils.c
+index b7acae430..a9c2022be 100644
+--- a/lib/fileutils.c
++++ b/lib/fileutils.c
+@@ -11,7 +11,14 @@
+ #include <unistd.h>
+ #include <sys/time.h>
+ #include <sys/resource.h>
++#include <sys/syscall.h>
+ #include <string.h>
++#include <fcntl.h>
++#include <errno.h>
++
++#ifdef HAVE_LINUX_OPENAT2_H
++# include <linux/openat2.h>
++#endif
+
+ #include "c.h"
+ #include "all-io.h"
+@@ -311,3 +318,20 @@ int ul_reopen(int fd, int flags)
+
+ return open(buf, flags);
+ }
++
++int ul_open_no_symlinks(const char *path, int flags, mode_t mode)
++{
++#if defined(SYS_openat2) && defined(RESOLVE_NO_SYMLINKS)
++ struct open_how how = {
++ .flags = (__u64) flags,
++ .mode = (__u64) mode,
++ .resolve = RESOLVE_NO_SYMLINKS,
++ };
++ int fd = syscall(SYS_openat2, AT_FDCWD, path, &how, sizeof(how));
++
++ /* only fall back to O_NOFOLLOW if the syscall is unavailable */
++ if (fd >= 0 || errno != ENOSYS)
++ return fd;
++#endif
++ return open(path, flags | O_NOFOLLOW, mode);
++}
+diff --git a/meson.build b/meson.build
+index c79939c05..7b2b9ee71 100644
+--- a/meson.build
++++ b/meson.build
+@@ -177,6 +177,7 @@ headers = '''
+ linux/kcmp.h
+ linux/net_namespace.h
+ linux/nsfs.h
++ linux/openat2.h
+ linux/mount.h
+ linux/pr.h
+ linux/securebits.h
diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch
new file mode 100644
index 00000000000..f8320ae82d5
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-add-ul_openat_resolve-openat2-wrapper.patch
@@ -0,0 +1,85 @@
+From 4cccf4edc256507734e3484cfaedf5980945c2fa Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 20 Jul 2026 14:36:16 +0200
+Subject: [PATCH] lib/fileutils: add ul_openat_resolve() openat2 wrapper
+
+Add ul_openat_resolve() as a generic openat2(2) wrapper with
+caller-specified resolve flags. No fallback to weaker alternatives --
+returns -1/ENOSYS if openat2 is unavailable.
+
+Rewrite ul_open_no_symlinks() to use ul_openat_resolve() with
+RESOLVE_NO_SYMLINKS, dropping the unsafe O_NOFOLLOW fallback that
+only protected the final path component.
+
+Add fallback defines for RESOLVE_NO_SYMLINKS and RESOLVE_BENEATH
+in fileutils.h.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit b9e07ce6f5ad54c38cf3ebc7100101e487be91bd)
+(cherry picked from commit 1426aa06ff2f6a21cba9102c35e3577641b356ff)
+
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/4cccf4edc256507734e3484cfaedf5980945c2fa]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ include/fileutils.h | 9 +++++++++
+ lib/fileutils.c | 22 ++++++++++++++--------
+ 2 files changed, 23 insertions(+), 8 deletions(-)
+
+diff --git a/include/fileutils.h b/include/fileutils.h
+index 996e18322..09395620a 100644
+--- a/include/fileutils.h
++++ b/include/fileutils.h
+@@ -62,6 +62,15 @@ static inline int is_same_inode(const int fd, const struct stat *st)
+ }
+
+ extern int ul_open_no_symlinks(const char *path, int flags, mode_t mode);
++extern int ul_openat_resolve(int dirfd, const char *path, int flags,
++ mode_t mode, unsigned long long resolve);
++
++#ifndef RESOLVE_NO_SYMLINKS
++# define RESOLVE_NO_SYMLINKS 0x02
++#endif
++#ifndef RESOLVE_BENEATH
++# define RESOLVE_BENEATH 0x08
++#endif
+
+ extern int dup_fd_cloexec(int oldfd, int lowfd);
+ extern unsigned int get_fd_tabsize(void);
+diff --git a/lib/fileutils.c b/lib/fileutils.c
+index a9c2022be..c60070855 100644
+--- a/lib/fileutils.c
++++ b/lib/fileutils.c
+@@ -319,19 +319,25 @@ int ul_reopen(int fd, int flags)
+ return open(buf, flags);
+ }
+
+-int ul_open_no_symlinks(const char *path, int flags, mode_t mode)
++int ul_openat_resolve(int dirfd, const char *path, int flags,
++ mode_t mode, unsigned long long resolve)
+ {
+-#if defined(SYS_openat2) && defined(RESOLVE_NO_SYMLINKS)
++#if defined(SYS_openat2)
+ struct open_how how = {
+ .flags = (__u64) flags,
+ .mode = (__u64) mode,
+- .resolve = RESOLVE_NO_SYMLINKS,
++ .resolve = resolve,
+ };
+- int fd = syscall(SYS_openat2, AT_FDCWD, path, &how, sizeof(how));
+
+- /* only fall back to O_NOFOLLOW if the syscall is unavailable */
+- if (fd >= 0 || errno != ENOSYS)
+- return fd;
++ return syscall(SYS_openat2, dirfd, path, &how, sizeof(how));
++#else
++ errno = ENOSYS;
++ return -1;
+ #endif
+- return open(path, flags | O_NOFOLLOW, mode);
++}
++
++int ul_open_no_symlinks(const char *path, int flags, mode_t mode)
++{
++ return ul_openat_resolve(AT_FDCWD, path, flags, mode,
++ RESOLVE_NO_SYMLINKS);
+ }
diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch
new file mode 100644
index 00000000000..440b513f4b5
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch
@@ -0,0 +1,71 @@
+From ba905a1874959c70fd706aa7d49df61076864e0a Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 8 Sep 2026 10:26:38 +0200
+Subject: [PATCH] lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
+
+The fallback #define used 0x02, but that is RESOLVE_NO_MAGICLINKS.
+The correct value, as used by the kernel and glibc, is 0x04.
+
+The fallback is not dead code: no libmount source includes
+<linux/openat2.h>, and glibc provides the RESOLVE_* macros only via
+<bits/openat2.h>, which is a recent addition. On older glibc libmount
+then asks openat2() to block magic-links instead of symlinks. The
+syscall succeeds and follows the symlink, so the protection in
+mnt_context_open_tree(), hook_mount.c and hook_idmap.c is silently
+ineffective.
+
+Move the <linux/openat2.h> include from lib/fileutils.c to
+include/fileutils.h so all users get the kernel values, and correct
+the fallback.
+
+Fixes: b9e07ce6f ("lib/fileutils: add ul_openat_resolve() openat2 wrapper")
+Addresses: https://github.com/util-linux/util-linux/issues/4606
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 20361d66df4d3f32d5e137fe61a55cdf156c91f0)
+
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/ba905a1874959c70fd706aa7d49df61076864e0a]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ include/fileutils.h | 6 +++++-
+ lib/fileutils.c | 4 ----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/fileutils.h b/include/fileutils.h
+index 09395620a..0b36104be 100644
+--- a/include/fileutils.h
++++ b/include/fileutils.h
+@@ -11,6 +11,10 @@
+ #include <dirent.h>
+ #include <sys/stat.h>
+
++#ifdef HAVE_LINUX_OPENAT2_H
++# include <linux/openat2.h>
++#endif
++
+ #include "c.h"
+
+ extern int mkstemp_cloexec(char *template);
+@@ -66,7 +70,7 @@ extern int ul_openat_resolve(int dirfd, const char *path, int flags,
+ mode_t mode, unsigned long long resolve);
+
+ #ifndef RESOLVE_NO_SYMLINKS
+-# define RESOLVE_NO_SYMLINKS 0x02
++# define RESOLVE_NO_SYMLINKS 0x04
+ #endif
+ #ifndef RESOLVE_BENEATH
+ # define RESOLVE_BENEATH 0x08
+diff --git a/lib/fileutils.c b/lib/fileutils.c
+index 1142febb0..8ca2c0aae 100644
+--- a/lib/fileutils.c
++++ b/lib/fileutils.c
+@@ -16,10 +16,6 @@
+ #include <fcntl.h>
+ #include <errno.h>
+
+-#ifdef HAVE_LINUX_OPENAT2_H
+-# include <linux/openat2.h>
+-#endif
+-
+ #include "c.h"
+ #include "all-io.h"
+ #include "fileutils.h"
diff --git a/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch
new file mode 100644
index 00000000000..fe14fcae9f0
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch
@@ -0,0 +1,64 @@
+From 339ff352b7b8b868367d2370ed077675326c3bca Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Thu, 3 Sep 2026 09:45:29 +0200
+Subject: [PATCH] lib/fileutils: fix unused parameter warnings without
+ SYS_openat2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On systems without SYS_openat2 (older kernels), ul_openat_resolve()
+is a stub that returns -ENOSYS, making all parameters unused. With
+-Werror=unused-parameter this breaks the build.
+
+Move the #ifdef around the whole function so each branch has its own
+declaration — the SYS_openat2 branch uses all parameters normally,
+the fallback branch marks them __unused__.
+
+Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users")
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit a471b62e732a491f1abe42450352fb0f9b5b43ea)
+
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/339ff352b7b8b868367d2370ed077675326c3bca]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/fileutils.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/lib/fileutils.c b/lib/fileutils.c
+index c60070855..1142febb0 100644
+--- a/lib/fileutils.c
++++ b/lib/fileutils.c
+@@ -319,10 +319,10 @@ int ul_reopen(int fd, int flags)
+ return open(buf, flags);
+ }
+
++#if defined(SYS_openat2)
+ int ul_openat_resolve(int dirfd, const char *path, int flags,
+ mode_t mode, unsigned long long resolve)
+ {
+-#if defined(SYS_openat2)
+ struct open_how how = {
+ .flags = (__u64) flags,
+ .mode = (__u64) mode,
+@@ -330,11 +330,19 @@ int ul_openat_resolve(int dirfd, const char *path, int flags,
+ };
+
+ return syscall(SYS_openat2, dirfd, path, &how, sizeof(how));
++}
+ #else
++int ul_openat_resolve(
++ int dirfd __attribute__((__unused__)),
++ const char *path __attribute__((__unused__)),
++ int flags __attribute__((__unused__)),
++ mode_t mode __attribute__((__unused__)),
++ unsigned long long resolve __attribute__((__unused__)))
++{
+ errno = ENOSYS;
+ return -1;
+-#endif
+ }
++#endif
+
+ int ul_open_no_symlinks(const char *path, int flags, mode_t mode)
+ {
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch
new file mode 100644
index 00000000000..0fb313d3db2
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53613.patch
@@ -0,0 +1,192 @@
+From 2c002044d1be71ebf45c24571f1a4532a408d0d7 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 16 Jun 2026 11:13:54 +0200
+Subject: [PATCH 07/15] libmount: add fd_target to context for TOCTOU
+ prevention
+
+Add a pinned O_PATH target fd to libmnt_context with lazy-open getter
+mnt_context_get_target_fd() and mnt_context_close_target_fd().
+
+The fd is opened via ul_open_no_symlinks() (RESOLVE_NO_SYMLINKS) to
+reject symlinks at any path component. The fd is closed on context
+reset.
+
+CVE-2026-53613
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 78a860982e036f38fe9c0b3344998df5ac2c2ff5)
+
+CVE: CVE-2026-53613
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/context.c | 43 ++++++++++++++++++++++++++++++++
+ libmount/src/context_mount.c | 7 ++++++
+ libmount/src/hook_mount.c | 18 ++++++++++++-
+ libmount/src/hook_mount_legacy.c | 3 +++
+ libmount/src/mountP.h | 7 ++++++
+ 5 files changed, 77 insertions(+), 1 deletion(-)
+
+diff --git a/libmount/src/context.c b/libmount/src/context.c
+index 0cd320190..3055c63df 100644
+--- a/libmount/src/context.c
++++ b/libmount/src/context.c
+@@ -37,6 +37,7 @@
+ */
+
+ #include "mountP.h"
++#include "fileutils.h"
+ #include "strutils.h"
+ #include "namespace.h"
+ #include "match.h"
+@@ -65,6 +66,7 @@ struct libmnt_context *mnt_new_context(void)
+ cxt->ns_orig.fd = -1;
+ cxt->ns_tgt.fd = -1;
+ cxt->ns_cur = &cxt->ns_orig;
++ cxt->fd_target = -1;
+
+ cxt->map_linux = mnt_get_builtin_optmap(MNT_LINUX_MAP);
+ cxt->map_userspace = mnt_get_builtin_optmap(MNT_USERSPACE_MAP);
+@@ -171,6 +173,7 @@ int mnt_reset_context(struct libmnt_context *cxt)
+ cxt->map_userspace = mnt_get_builtin_optmap(MNT_USERSPACE_MAP);
+
+ mnt_context_reset_status(cxt);
++ mnt_context_close_target_fd(cxt);
+ mnt_context_deinit_hooksets(cxt);
+
+ if (cxt->table_fltrcb)
+@@ -395,6 +398,46 @@ int mnt_context_is_restricted(struct libmnt_context *cxt)
+ return cxt->restricted;
+ }
+
++int mnt_context_target_fd_required(struct libmnt_context *cxt)
++{
++ return mnt_context_is_restricted(cxt);
++}
++
++int mnt_context_reopen_target_fd(struct libmnt_context *cxt)
++{
++ assert(cxt);
++
++ if (!mnt_context_target_fd_required(cxt))
++ return 0;
++ mnt_context_close_target_fd(cxt);
++ if (mnt_context_get_target_fd(cxt) < 0)
++ return -errno;
++ return 0;
++}
++
++int mnt_context_get_target_fd(struct libmnt_context *cxt)
++{
++ assert(cxt);
++
++ if (cxt->fd_target < 0) {
++ const char *target = mnt_fs_get_target(cxt->fs);
++
++ if (target)
++ cxt->fd_target = ul_open_no_symlinks(target,
++ O_PATH | O_CLOEXEC, 0);
++ }
++ return cxt->fd_target;
++}
++
++void mnt_context_close_target_fd(struct libmnt_context *cxt)
++{
++ assert(cxt);
++
++ if (cxt->fd_target >= 0)
++ close(cxt->fd_target);
++ cxt->fd_target = -1;
++}
++
+ /**
+ * mnt_context_force_unrestricted:
+ * @cxt: mount context
+diff --git a/libmount/src/context_mount.c b/libmount/src/context_mount.c
+index 41986e74b..dd46bf053 100644
+--- a/libmount/src/context_mount.c
++++ b/libmount/src/context_mount.c
+@@ -726,6 +726,13 @@ static int prepare_target(struct libmnt_context *cxt)
+ if (rc == 0)
+ rc = mnt_context_call_hooks(cxt, MNT_STAGE_PREP_TARGET);
+
++ if (rc == 0
++ && mnt_context_target_fd_required(cxt)
++ && mnt_context_get_target_fd(cxt) < 0) {
++ DBG(CXT, ul_debugobj(cxt, "failed to pin target"));
++ rc = -errno;
++ }
++
+ if (!mnt_context_switch_ns(cxt, ns_old))
+ return -MNT_ERR_NAMESPACE;
+
+diff --git a/libmount/src/hook_mount.c b/libmount/src/hook_mount.c
+index 593111168..a34b2d4bd 100644
+--- a/libmount/src/hook_mount.c
++++ b/libmount/src/hook_mount.c
+@@ -527,9 +527,25 @@ static int hook_attach_target(struct libmnt_context *cxt,
+ umount2(target, MNT_DETACH);
+ }
+
+- rc = move_mount(api->fd_tree, "", AT_FDCWD, target, MOVE_MOUNT_F_EMPTY_PATH);
++ /* fd_target is open in restricted mode (see prepare_target()) */
++ if (mnt_context_target_fd_required(cxt)) {
++ int fd = mnt_context_get_target_fd(cxt);
++
++ if (fd < 0)
++ return -errno;
++ rc = move_mount(api->fd_tree, "", fd, "",
++ MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_T_EMPTY_PATH);
++ } else
++ rc = move_mount(api->fd_tree, "", AT_FDCWD, target,
++ MOVE_MOUNT_F_EMPTY_PATH);
++
+ set_syscall_status(cxt, "move_mount", rc == 0);
+
++ if (rc == 0) {
++ /* re-open to point to the mounted filesystem root */
++ rc = mnt_context_reopen_target_fd(cxt);
++ }
++
+ return rc == 0 ? 0 : -errno;
+ }
+
+diff --git a/libmount/src/hook_mount_legacy.c b/libmount/src/hook_mount_legacy.c
+index 56e92b05d..b7882a108 100644
+--- a/libmount/src/hook_mount_legacy.c
++++ b/libmount/src/hook_mount_legacy.c
+@@ -248,6 +248,9 @@ static int hook_mount(struct libmnt_context *cxt,
+ return rc;
+ }
+
++ /* re-open to point to the mounted filesystem root */
++ rc = mnt_context_reopen_target_fd(cxt);
++
+ cxt->syscall_status = 0;
+ return rc;
+ }
+diff --git a/libmount/src/mountP.h b/libmount/src/mountP.h
+index 339e2761a..37a00e571 100644
+--- a/libmount/src/mountP.h
++++ b/libmount/src/mountP.h
+@@ -442,6 +442,8 @@ struct libmnt_context
+ unsigned int has_selinux_opt : 1; /* temporary for broken fsconfig() syscall */
+ unsigned int force_clone : 1; /* OPEN_TREE_CLONE */
+
++ int fd_target; /* pinned target fd (RESOLVE_NO_SYMLINKS) */
++
+ struct list_head hooksets_datas; /* global hooksets data */
+ struct list_head hooksets_hooks; /* global hooksets data */
+ };
+@@ -630,6 +632,11 @@ extern int mnt_context_prepare_update(struct libmnt_context *cxt);
+ extern int mnt_context_merge_mflags(struct libmnt_context *cxt);
+ extern int mnt_context_update_tabs(struct libmnt_context *cxt);
+
++extern int mnt_context_target_fd_required(struct libmnt_context *cxt);
++extern int mnt_context_get_target_fd(struct libmnt_context *cxt);
++extern void mnt_context_close_target_fd(struct libmnt_context *cxt);
++extern int mnt_context_reopen_target_fd(struct libmnt_context *cxt);
++
+ extern int mnt_context_umount_setopt(struct libmnt_context *cxt, int c, char *arg);
+ extern int mnt_context_mount_setopt(struct libmnt_context *cxt, int c, char *arg);
+
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 04/55] util-linux: patch CVE-2026-53612
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (2 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 03/55] util-linux: patch CVE-2026-53613 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 05/55] util-linux: patch CVE-2024-28085 regression Yoann Congal
` (50 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41.5 release.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2026-53612.patch | 92 +++++++++++++++++++
2 files changed, 93 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index db698ef9367..4b889927c80 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -55,6 +55,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://0001-lib-fileutils-fix-unused-parameter-warnings-without-.patch \
file://0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch \
file://CVE-2026-53613.patch \
+ file://CVE-2026-53612.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch
new file mode 100644
index 00000000000..94a70c6159c
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53612.patch
@@ -0,0 +1,92 @@
+From 897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 16 Jun 2026 11:15:19 +0200
+Subject: [PATCH] libmount: use fd-based fchownat/chmod in hook_owner
+
+Replace path-based lchown()/chmod() with fd-based operations in the
+X-mount.{owner,group,mode} post-mount hook.
+
+For restricted users the fd_target is pinned in prepare_target() and
+re-opened after mount in hook_attach_target() to point to the mounted
+filesystem root. For root a local O_PATH fd is opened. Ownership is
+changed via fchownat(fd, "", ..., AT_EMPTY_PATH), mode via
+/proc/self/fd/N.
+
+This prevents TOCTOU attacks where an ancestor directory is swapped
+between mount and the chmod/chown operations.
+
+CVE-2026-53612
+
+Reported-by: Xinyao Hu <ctf_0x01@foxmail.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 24da33905c7115c4cbccd0afb2a469804e96467a)
+
+CVE: CVE-2026-53612
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/hook_owner.c | 32 ++++++++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/libmount/src/hook_owner.c b/libmount/src/hook_owner.c
+index 11b238c89..99f0e705d 100644
+--- a/libmount/src/hook_owner.c
++++ b/libmount/src/hook_owner.c
+@@ -17,6 +17,7 @@
+ #include <sched.h>
+
+ #include "mountP.h"
++#include "pathnames.h"
+ #include "fileutils.h"
+
+ struct hook_data {
+@@ -48,7 +49,7 @@ static int hook_post(
+ {
+ struct hook_data *hd = (struct hook_data *) data;
+ const char *target;
+- int rc = 0;
++ int rc = 0, fd;
+
+ assert(cxt);
+
+@@ -59,18 +60,33 @@ static int hook_post(
+ if (!target)
+ return 0;
+
++ /* fd_target is pinned in restricted mode (see prepare_target()),
++ * for root open it here to keep chmod/chown fd-based too */
++ if (mnt_context_target_fd_required(cxt))
++ fd = mnt_context_get_target_fd(cxt);
++ else
++ fd = open(target, O_PATH | O_CLOEXEC);
++
++ if (fd < 0)
++ return -MNT_ERR_CHMOD;
++
+ if (hd->owner != (uid_t) -1 || hd->group != (uid_t) -1) {
+- DBG(CXT, ul_debugobj(cxt, " lchown(%s, %u, %u)", target, hd->owner, hd->group));
+- if (lchown(target, hd->owner, hd->group) == -1)
+- return -MNT_ERR_CHOWN;
++ DBG(CXT, ul_debugobj(cxt, " fchownat(%s, %u, %u)", target, hd->owner, hd->group));
++ if (fchownat(fd, "", hd->owner, hd->group, AT_EMPTY_PATH) == -1)
++ rc = -MNT_ERR_CHOWN;
+ }
+
+- if (hd->mode != (mode_t) -1) {
+- DBG(CXT, ul_debugobj(cxt, " chmod(%s, %04o)", target, hd->mode));
+- if (chmod(target, hd->mode) == -1)
+- return -MNT_ERR_CHMOD;
++ if (!rc && hd->mode != (mode_t) -1) {
++ char buf[sizeof(_PATH_PROC_FDDIR) + 1 + sizeof(stringify_value(INT_MAX))];
++
++ snprintf(buf, sizeof(buf), _PATH_PROC_FDDIR "/%d", fd);
++ DBG(CXT, ul_debugobj(cxt, " chmod(%s, %04o)", buf, hd->mode));
++ if (chmod(buf, hd->mode) == -1)
++ rc = -MNT_ERR_CHMOD;
+ }
+
++ if (!mnt_context_target_fd_required(cxt))
++ close(fd);
+ return rc;
+ }
+
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 05/55] util-linux: patch CVE-2024-28085 regression
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (3 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 04/55] util-linux: patch CVE-2026-53612 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 06/55] util-linux: patch CVE-2026-78408 Yoann Congal
` (49 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41.6 release.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2024-28085-0003.patch | 77 +++++++++++++++++++
2 files changed, 78 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 4b889927c80..6598a92b30f 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -56,6 +56,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://0001-lib-fileutils-fix-RESOLVE_NO_SYMLINKS-fallback-value.patch \
file://CVE-2026-53613.patch \
file://CVE-2026-53612.patch \
+ file://CVE-2024-28085-0003.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch b/meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch
new file mode 100644
index 00000000000..63d09ef4a1b
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2024-28085-0003.patch
@@ -0,0 +1,77 @@
+From 61b49b7160bbb6780279344574746617e7fb11a4 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 24 Aug 2026 16:37:28 +0200
+Subject: [PATCH] wall, write: sanitize hostname in banner header
+
+The CVE-2024-28085 fix sanitized only message bodies via
+fputs_careful(), but the banner headers in wall(1) and write(1)
+still interpolate the system hostname without sanitization.
+
+An unprivileged user can set a malicious hostname containing
+terminal escape sequences via a user namespace (unshare -Ur -u
++ sethostname(2)), and wall/write will deliver those sequences
+to the terminals of all logged-in users.
+
+Fix by routing the banner output through fputs_careful() which
+strips control characters.
+
+This is an additional fix for CVE-2024-28085 (CVSS 3.1 score: 3.3).
+A new CVE ID has not been assigned (yet).
+
+Reported-by: Skyler Ferrante <sjf5462@rit.edu>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 9ce8f2b5aefa011ef5b0c34aa14df9bb9db02dab)
+(cherry picked from commit f358b098d47659837d85b66fb387201224b272a0)
+
+CVE: CVE-2024-28085
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/61b49b7160bbb6780279344574746617e7fb11a4]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ term-utils/wall.c | 3 ++-
+ term-utils/write.c | 6 ++++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/term-utils/wall.c b/term-utils/wall.c
+index 7a4a858f5..c1c47d531 100644
+--- a/term-utils/wall.c
++++ b/term-utils/wall.c
+@@ -316,7 +316,8 @@ static char *makemsg(char *fname, char **mvec, int mvecsz,
+ snprintf(lbuf, lbuflen,
+ _("Broadcast message from %s@%s (%s) (%s):"),
+ whom, hostname, where, date);
+- fprintf(fs, "%-*.*s\007\007\r\n", TERM_WIDTH, TERM_WIDTH, lbuf);
++ fputs_careful(lbuf, fs, '^', true, TERM_WIDTH);
++ fprintf(fs, "\007\007\r\n");
+ free(hostname);
+ }
+ fprintf(fs, "%*s\r\n", TERM_WIDTH, " ");
+diff --git a/term-utils/write.c b/term-utils/write.c
+index 3784f0300..d680d7464 100644
+--- a/term-utils/write.c
++++ b/term-utils/write.c
+@@ -233,6 +233,7 @@ static void do_write(const struct write_control *ctl)
+ time_t now;
+ struct tm *tm;
+ char *host, *line = NULL;
++ char buf[512];
+ size_t linelen = 0;
+ struct sigaction sigact;
+
+@@ -262,14 +263,15 @@ static void do_write(const struct write_control *ctl)
+ /* print greeting */
+ printf("\r\n\a\a\a");
+ if (strcmp(login, pwuid) != 0)
+- printf(_("Message from %s@%s (as %s) on %s at %02d:%02d ..."),
++ snprintf(buf, sizeof(buf), _("Message from %s@%s (as %s) on %s at %02d:%02d ..."),
+ login, host, pwuid, ctl->src_tty_name,
+ tm->tm_hour, tm->tm_min);
+ else
+- printf(_("Message from %s@%s on %s at %02d:%02d ..."),
++ snprintf(buf, sizeof(buf), _("Message from %s@%s on %s at %02d:%02d ..."),
+ login, host, ctl->src_tty_name,
+ tm->tm_hour, tm->tm_min);
+ free(host);
++ fputs_careful(buf, stdout, '^', true, 0);
+ printf("\r\n");
+
+ while (getline(&line, &linelen, stdin) >= 0) {
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 06/55] util-linux: patch CVE-2026-78408
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (4 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 05/55] util-linux: patch CVE-2024-28085 regression Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 07/55] util-linux: patch CVE-2026-78410 Yoann Congal
` (48 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41.6 release.
Regression patch as submitted to Wrynose is not needed as that code is
not yet present in 2.39.3.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: util-linux 2.41.6 release notes:
https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.6-ChangeLog ]
---
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2026-78408.patch | 98 +++++++++++++++++++
2 files changed, 99 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 6598a92b30f..2eb9251a704 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -57,6 +57,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2026-53613.patch \
file://CVE-2026-53612.patch \
file://CVE-2024-28085-0003.patch \
+ file://CVE-2026-78408.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch
new file mode 100644
index 00000000000..36f3c91ddc5
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78408.patch
@@ -0,0 +1,98 @@
+From 43ec8a89f6c99130727084b3496a2ffd2b4200f0 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 31 Aug 2026 17:03:32 +0200
+Subject: [PATCH] nsenter, unshare: add O_CLOEXEC to all open() calls
+ [CVE-2026-78408]
+
+Add O_CLOEXEC (and EFD_CLOEXEC for eventfd) as defense in depth to
+all file descriptor creation sites in nsenter and unshare. All these
+descriptors are already explicitly closed before exec, but O_CLOEXEC
+provides a safety net against future code changes that might
+accidentally introduce a leak path.
+
+No functional change.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+
+CVE: CVE-2026-78408
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/43ec8a89f6c99130727084b3496a2ffd2b4200f0]
+Backport notes:
+- 2 hunks left out as that code is not yet present in 2.39.3.
+- Verified that no other "open(" calls are in this version in patched files.
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ sys-utils/nsenter.c | 6 +++---
+ sys-utils/unshare.c | 8 ++++----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/sys-utils/nsenter.c b/sys-utils/nsenter.c
+index cf6c83174..9d9d90a48 100644
+--- a/sys-utils/nsenter.c
++++ b/sys-utils/nsenter.c
+@@ -134,7 +134,7 @@ static void open_target_fd(int *fd, const char *type, const char *path)
+ if (*fd >= 0)
+ close(*fd);
+
+- *fd = open(path, O_RDONLY);
++ *fd = open(path, O_RDONLY | O_CLOEXEC);
+ if (*fd < 0)
+ err(EXIT_FAILURE, _("cannot open %s"), path);
+ }
+@@ -492,7 +492,7 @@ int main(int argc, char *argv[])
+
+ /* Remember the current working directory if I'm not changing it */
+ if (root_fd >= 0 && wd_fd < 0 && wdns == NULL) {
+- wd_fd = open(".", O_RDONLY);
++ wd_fd = open(".", O_RDONLY | O_CLOEXEC);
+ if (wd_fd < 0)
+ err(EXIT_FAILURE,
+ _("cannot open current working directory"));
+@@ -515,7 +515,7 @@ int main(int argc, char *argv[])
+
+ /* working directory specified as in-namespace path */
+ if (wdns) {
+- wd_fd = open(wdns, O_RDONLY);
++ wd_fd = open(wdns, O_RDONLY | O_CLOEXEC);
+ if (wd_fd < 0)
+ err(EXIT_FAILURE,
+ _("cannot open current working directory"));
+diff --git a/sys-utils/unshare.c b/sys-utils/unshare.c
+index 05db627be..c47739862 100644
+--- a/sys-utils/unshare.c
++++ b/sys-utils/unshare.c
+@@ -108,7 +108,7 @@ static void setgroups_control(int action)
+ return;
+ cmd = setgroups_strings[action];
+
+- fd = open(file, O_WRONLY);
++ fd = open(file, O_WRONLY | O_CLOEXEC);
+ if (fd < 0) {
+ if (errno == ENOENT)
+ return;
+@@ -125,7 +125,7 @@ static void map_id(const char *file, uint32_t from, uint32_t to)
+ char *buf;
+ int fd;
+
+- fd = open(file, O_WRONLY);
++ fd = open(file, O_WRONLY | O_CLOEXEC);
+ if (fd < 0)
+ err(EXIT_FAILURE, _("cannot open %s"), file);
+
+@@ -219,7 +219,7 @@ static void settime(time_t offset, clockid_t clk_id)
+
+ len = snprintf(buf, sizeof(buf), "%d %" PRId64 " 0", clk_id, (int64_t) offset);
+
+- fd = open("/proc/self/timens_offsets", O_WRONLY);
++ fd = open("/proc/self/timens_offsets", O_WRONLY | O_CLOEXEC);
+ if (fd < 0)
+ err(EXIT_FAILURE, _("failed to open /proc/self/timens_offsets"));
+
+@@ -289,7 +289,7 @@ static pid_t fork_and_wait(int *fd)
+ pid_t pid;
+ uint64_t ch;
+
+- *fd = eventfd(0, 0);
++ *fd = eventfd(0, EFD_CLOEXEC);
+ if (*fd < 0)
+ err(EXIT_FAILURE, _("eventfd failed"));
+
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 07/55] util-linux: patch CVE-2026-78410
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (5 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 06/55] util-linux: patch CVE-2026-78408 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 08/55] util-linux: patch CVE-2026-76642 Yoann Congal
` (47 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patches referencing this CVE from 2.41.6 release.
Also pick regression patch and patch implementing helper function.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 4 +
..._open_tree-helper-for-safe-tree-open.patch | 85 +++++++++++++
.../util-linux/CVE-2026-78410-01.patch | 94 ++++++++++++++
.../util-linux/CVE-2026-78410-02.patch | 96 +++++++++++++++
.../util-linux/CVE-2026-78410-03.patch | 115 ++++++++++++++++++
5 files changed, 394 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 2eb9251a704..10803e38938 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -58,6 +58,10 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2026-53612.patch \
file://CVE-2024-28085-0003.patch \
file://CVE-2026-78408.patch \
+ file://0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch \
+ file://CVE-2026-78410-01.patch \
+ file://CVE-2026-78410-02.patch \
+ file://CVE-2026-78410-03.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch b/meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch
new file mode 100644
index 00000000000..efe68cc17c8
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/0001-libmount-add-mnt_open_tree-helper-for-safe-tree-open.patch
@@ -0,0 +1,85 @@
+From 71ff1c94be2fd2577bf600accb5c6ad2782276ef Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 20 Jul 2026 14:40:16 +0200
+Subject: [PATCH] libmount: add mnt_open_tree() helper for safe tree opening
+
+Add mnt_open_tree() that combines openat2() path pinning with
+open_tree() into a single call. When resolve flags are non-zero,
+the path is first pinned with ul_openat_resolve(), then cloned
+with open_tree(AT_EMPTY_PATH). When resolve is zero, open_tree()
+is called directly.
+
+This consolidates the openat2+open_tree pattern used for symlink
+protection in restricted mount operations.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit 37afc15d9e5a0accea94eb067b151e21f8494880)
+(cherry picked from commit 90a1f3b5b134b775dd30a46155064731ba40c519)
+
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/71ff1c94be2fd2577bf600accb5c6ad2782276ef]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/mountP.h | 2 ++
+ libmount/src/utils.c | 29 +++++++++++++++++++++++++++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/libmount/src/mountP.h b/libmount/src/mountP.h
+index 97d0bf8fa..9d022d14e 100644
+--- a/libmount/src/mountP.h
++++ b/libmount/src/mountP.h
+@@ -687,6 +687,8 @@ static inline struct libmnt_sysapi *mnt_context_get_sysapi(struct libmnt_context
+ {
+ return mnt_context_get_hookset_data(cxt, &hookset_mount);
+ }
++int mnt_open_tree(int dirfd, const char *path, unsigned long flags,
++ unsigned long long resolve);
+ #endif
+
+ #endif /* _LIBMOUNT_PRIVATE_H */
+diff --git a/libmount/src/utils.c b/libmount/src/utils.c
+index 4c90c951b..e4301689e 100644
+--- a/libmount/src/utils.c
++++ b/libmount/src/utils.c
+@@ -24,6 +24,7 @@
+ #include "strutils.h"
+ #include "pathnames.h"
+ #include "mountP.h"
++#include "fileutils.h"
+ #include "mangle.h"
+ #include "canonicalize.h"
+ #include "env.h"
+@@ -1286,6 +1287,34 @@ done:
+ return 1;
+ }
+
++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
++/*
++ * Open a mount tree, optionally pinning the path with openat2() first.
++ *
++ * When @resolve is non-zero, the path is resolved with openat2() using the
++ * given resolve flags, then the tree is opened with open_tree(AT_EMPTY_PATH).
++ * When @resolve is zero, open_tree() is called directly with the path.
++ */
++int mnt_open_tree(int dirfd, const char *path, unsigned long flags,
++ unsigned long long resolve)
++{
++ if (resolve) {
++ int pin_fd, fd;
++
++ pin_fd = ul_openat_resolve(dirfd, path,
++ O_PATH | O_CLOEXEC, 0, resolve);
++ if (pin_fd < 0)
++ return pin_fd;
++
++ fd = open_tree(pin_fd, "", flags | AT_EMPTY_PATH);
++ close(pin_fd);
++ return fd;
++ }
++
++ return open_tree(dirfd, path, flags);
++}
++#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */
++
+ #ifdef TEST_PROGRAM
+ static int test_match_fstype(struct libmnt_test *ts, int argc, char *argv[])
+ {
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch
new file mode 100644
index 00000000000..50dadbbe884
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-01.patch
@@ -0,0 +1,94 @@
+From b21f4cee55f723b045920dad5ce48a659d34cac8 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Thu, 9 Jul 2026 16:10:08 +0200
+Subject: [PATCH] libmount: restrict source path canonicalization for non-root
+ users [CVE-2026-78410]
+
+In restricted (suid, non-root) mode, mnt_context_prepare_srcpath()
+calls realpath() as euid=0 to canonicalize the source path. This
+follows symlinks through directories where the real user has write
+access (e.g. /home/user/), allowing redirection to arbitrary files.
+
+Only canonicalize /dev/ paths (e.g. /dev/cdrom -> /dev/sr0) and
+verify the result stays within /dev/. For non-/dev/ paths (e.g.
+disk images in user-writable directories), keep the original fstab
+path. Symlink protection for these paths is handled at open time
+by RESOLVE_NO_SYMLINKS in ul_open_no_symlinks().
+
+This is a follow-up to commits:
+ 5e390467b ("loopdev: add LOOPDEV_FL_NOFOLLOW to prevent symlink attacks")
+ d07aad41e ("libmount: ignore X-mount.nocanonicalize for restricted users")
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit e554245ccc165fcdd4b8ba68bf2994ee14b98607)
+(cherry picked from commit 6051830a27a852fed92ebd8493e57aa3d5d9cf18)
+
+CVE: CVE-2026-78410
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/b21f4cee55f723b045920dad5ce48a659d34cac8]
+Backport notes:
+- Left out hunk from manual not yet present in 2.39.3
+- Adapted to use the startswith() helper available in util-linux 2.39.3.
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/context.c | 17 ++++++++++++++++-
+ sys-utils/mount.8.adoc | 10 ++++++++--
+ 2 files changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/libmount/src/context.c b/libmount/src/context.c
+index 00fd099c9..8418b2d64 100644
+--- a/libmount/src/context.c
++++ b/libmount/src/context.c
+@@ -1888,7 +1888,22 @@ int mnt_context_prepare_srcpath(struct libmnt_context *cxt)
+ /*
+ * Source is PATH (canonicalize)
+ */
+- path = mnt_resolve_path(src, cache);
++ if (mnt_context_is_restricted(cxt)) {
++ /* In restricted mode, only canonicalize /dev/
++ * paths (e.g. /dev/cdrom -> /dev/sr0) and verify
++ * the result stays in /dev/. For non-/dev/ paths
++ * (e.g. disk images in user dirs), keep the
++ * original fstab path -- symlink protection is
++ * handled at open time by RESOLVE_NO_SYMLINKS.
++ */
++ if (startswith(src, "/dev/")) {
++ path = mnt_resolve_path(src, cache);
++ if (path && !startswith(path, "/dev/"))
++ path = NULL;
++ }
++ } else
++ path = mnt_resolve_path(src, cache);
++
+ if (path && strcmp(path, src) != 0)
+ rc = mnt_fs_set_source(cxt->fs, path);
+ }
+diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc
+index 2acf2e15c..add2914ae 100644
+--- a/sys-utils/mount.8.adoc
++++ b/sys-utils/mount.8.adoc
+@@ -186,6 +186,10 @@ For more details, see *fstab*(5). Only the user that mounted a filesystem can un
+
+ The *user* mount option is accepted if no username is specified. If used in the format *user=someone*, the option is silently ignored and visible only for external mount helpers (/sbin/mount.<type>) for compatibility with some network filesystems.
+
++For mount source paths, *mount*(8) only canonicalizes (resolves symlinks) paths starting with _/dev/_ for unprivileged users and verifies the result stays within _/dev/_. Source paths outside _/dev/_ (e.g. disk images in user-writable directories) are kept as-is from _fstab_.
++
++Filesystem type auto-detection for unprivileged users relies exclusively on *udev* metadata rather than direct device probing; this means file images that are not registered with udev require an explicit filesystem type in _fstab_.
++
+ === Bind mount operation
+
+ Remount part of the file hierarchy somewhere else. The call is:
+@@ -426,10 +430,12 @@ The argument following the *-t* is used to indicate the filesystem type. The fil
+ +
+ The programs *mount* and *umount*(8) support filesystem subtypes. The subtype is defined by a '.subtype' suffix. For example 'fuse.sshfs'. It's recommended to use subtype notation rather than add any prefix to the mount source (for example 'sshfs#example.com' is deprecated).
+ +
+-If no *-t* option is given, or if the *auto* type is specified, *mount* will try to guess the desired type. *mount* uses the *libblkid*(3) library for guessing the filesystem type; if that does not turn up anything that looks familiar, *mount* will try to read the file _/etc/filesystems_, or, if that does not exist, _/proc/filesystems_. All of the filesystem types listed there will be tried, except for those that are labeled "nodev" (e.g. _devpts_, _proc_ and _nfs_). If _/etc/filesystems_ ends in a line with a single {asterisk}, mount will read _/proc/filesystems_ afterwards. While trying, all filesystem types will be mounted with the mount option *silent*.
++If no *-t* option is given, or if the *auto* type is specified, *mount* will try to guess the desired type. The filesystem type is determined using *udev* metadata first, then by direct device probing via *libblkid*(3) for root users. If neither method identifies the type, *mount* will fall back to trying all types listed in _/etc/filesystems_, or if that file does not exist, _/proc/filesystems_. Types labeled "nodev" (e.g. _devpts_, _proc_ and _nfs_) are skipped. If _/etc/filesystems_ ends in a line with a single {asterisk}, mount will read _/proc/filesystems_ afterwards. While trying, all filesystem types will be mounted with the mount option *silent*.
+ //TRANSLATORS: Keep {asterisk} untranslated.
+ +
+-The *auto* type may be useful for user-mounted floppies. Creating a file _/etc/filesystems_ can be useful to change the probe order (e.g., to try vfat before msdos or ext3 before ext2) or if you use a kernel module autoloader.
++For unprivileged (non-root) users, direct device probing via *libblkid*(3) is disabled and filesystem type detection relies exclusively on *udev* metadata. This means file images that are not registered with *udev* require an explicit filesystem type in _fstab_.
+++
++Creating a file _/etc/filesystems_ can be useful to change the probe order (e.g., to try vfat before msdos or ext3 before ext2) or if you use a kernel module autoloader.
+ +
+ More than one type may be specified in a comma-separated list, for the *-t* option as well as in an _/etc/fstab_ entry. The list of filesystem types for the *-t* option can be prefixed with *no* to specify the filesystem types on which no action should be taken. The prefix *no* has no effect when specified in an _/etc/fstab_ entry.
+ +
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch
new file mode 100644
index 00000000000..27669463630
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-02.patch
@@ -0,0 +1,96 @@
+From 9fcb98bf08d9119d07ba3a3c709b1a85e4a1bbcb Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 20 Jul 2026 14:59:21 +0200
+Subject: [PATCH] libmount: pin source path with openat2() for restricted users
+ [CVE-2026-78410]
+
+In restricted (non-root) mode, mnt_context_open_tree() resolves the
+source path via open_tree(AT_FDCWD, path, ...) which follows symlinks
+in intermediate path components. A local attacker who can replace the
+fstab-authorized bind source path or an ancestor with a symlink can
+redirect the privileged mount operation to an arbitrary directory.
+
+When combined with X-mount.owner/group/mode the post-mount hook
+applies root-privileged chown/chmod to the bind source inode, giving
+a local ownership/permission modification primitive on paths not
+authorized by fstab.
+
+Fix by using mnt_open_tree() with RESOLVE_NO_SYMLINKS in restricted
+mode. Also fix hook_idmap.c fallback open_tree() call to use the
+same pattern. Unrestricted (root) callers pass resolve=0 and get
+the direct open_tree() path.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit fb8e2653553ce2ecd077a294d53a1422d7c6dbc0)
+(cherry picked from commit 9a8d0d60c55d3a55f89f6f75a17bae31bc5ee1c6)
+
+CVE: CVE-2026-78410
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/9fcb98bf08d9119d07ba3a3c709b1a85e4a1bbcb]
+Backport notes:
+- In 2.39.3, source tree opening is in hook_mount.c:open_mount_tree(),
+ not context.c:mnt_context_open_tree(). Apply that security hunk there.
+- Add fileutils.h to hook_idmap.c for the RESOLVE_NO_SYMLINKS definition;
+ without it, compilation fails when mountfd support is enabled.
+- Replace the duplicate fileutils.h include in utils.c with
+ mount-api-utils.h for the open_tree() declaration and syscall fallback.
+ The original fileutils.h include further down is retained.
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/hook_idmap.c | 7 +++++--
+ libmount/src/hook_mount.c | 3 ++-
+ libmount/src/utils.c | 2 +-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c
+index adaa9c636..97d8e0d1e 100644
+--- a/libmount/src/hook_idmap.c
++++ b/libmount/src/hook_idmap.c
+@@ -25,6 +25,7 @@
+ #include "strutils.h"
+ #include "all-io.h"
+ #include "namespace.h"
++#include "fileutils.h"
+ #include "mount-api-utils.h"
+
+ #include "mountP.h"
+@@ -330,9 +331,11 @@ static int hook_mount_post(
+ }
+ #endif
+ if (fd_tree < 0)
+- fd_tree = open_tree(-1, target,
++ fd_tree = mnt_open_tree(AT_FDCWD, target,
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC |
+- (recursive ? AT_RECURSIVE : 0));
++ (recursive ? AT_RECURSIVE : 0),
++ mnt_context_is_restricted(cxt) ?
++ RESOLVE_NO_SYMLINKS : 0);
+ if (fd_tree < 0) {
+ DBG(HOOK, ul_debugobj(hs, " failed to open tree"));
+ return -MNT_ERR_IDMAP;
+diff --git a/libmount/src/hook_mount.c b/libmount/src/hook_mount.c
+index a34b2d4..f5198c6 100644
+--- a/libmount/src/hook_mount.c
++++ b/libmount/src/hook_mount.c
+@@ -245,7 +245,8 @@ static int open_mount_tree(struct libmnt_context *cxt, const char *path, unsigne
+ DBG(HOOK, ul_debug("open_tree(path=%s%s%s)", path,
+ oflg & OPEN_TREE_CLONE ? " clone" : "",
+ oflg & AT_RECURSIVE ? " recursive" : ""));
+- fd = open_tree(AT_FDCWD, path, oflg);
++ fd = mnt_open_tree(AT_FDCWD, path, oflg,
++ mnt_context_is_restricted(cxt) ? RESOLVE_NO_SYMLINKS : 0);
+ set_syscall_status(cxt, "open_tree", fd >= 0);
+
+ return fd;
+diff --git a/libmount/src/utils.c b/libmount/src/utils.c
+index 9e2f4d53d..6c6f1aaeb 100644
+--- a/libmount/src/utils.c
++++ b/libmount/src/utils.c
+@@ -24,7 +24,7 @@
+ #include "strutils.h"
+ #include "pathnames.h"
+ #include "mountP.h"
+-#include "fileutils.h"
++#include "mount-api-utils.h"
+ #include "mangle.h"
+ #include "canonicalize.h"
+ #include "env.h"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch
new file mode 100644
index 00000000000..15366a8864d
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-78410-03.patch
@@ -0,0 +1,115 @@
+From 233cf7321e9d0fd2cea901d0a97e565c725640ad Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Thu, 3 Sep 2026 10:01:29 +0200
+Subject: [PATCH] libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
+
+The idmap hookset was originally guarded by HAVE_MOUNTFD_API (kernel
+headers have the new mount syscalls) rather than
+USE_LIBMOUNT_MOUNTFD_SUPPORT (libmount is built with mountfd support).
+
+This was intentional (commit 9040c0900, 2022) -- the idea was to keep
+idmap working even with --disable-libmount-mountfd-support by calling
+the raw open_tree() syscall directly, while using an inner #ifdef
+USE_LIBMOUNT_MOUNTFD_SUPPORT to optionally reuse the sysapi fd_tree.
+
+This fine-grained approach broke when the CVE-2026-78410 fix replaced
+the raw open_tree() call with mnt_open_tree(), which is only available
+under USE_LIBMOUNT_MOUNTFD_SUPPORT. The build fails with
+--disable-libmount-mountfd-support because mnt_open_tree() is
+undeclared.
+
+Rather than maintaining two code paths for a feature that fundamentally
+depends on the new mount API, gate the entire idmap hookset on
+USE_LIBMOUNT_MOUNTFD_SUPPORT -- consistent with how hookset_mount is
+guarded. Remove the now-redundant inner #ifdef.
+
+Also add a note to mount.8 that X-mount.idmap requires the new
+fd-based mount API.
+
+Addresses: https://github.com/util-linux/util-linux/issues/4598
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit e06799ac325a881a297d2ffd6fe568cacdcd00ab)
+
+CVE: CVE-2026-78410
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/233cf7321e9d0fd2cea901d0a97e565c725640ad]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/hook_idmap.c | 6 ++----
+ libmount/src/hooks.c | 2 +-
+ libmount/src/version.c | 2 +-
+ sys-utils/mount.8.adoc | 1 +
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c
+index d4d7fbacc..94c025097 100644
+--- a/libmount/src/hook_idmap.c
++++ b/libmount/src/hook_idmap.c
+@@ -34,7 +34,7 @@
+ # include <linux/nsfs.h>
+ #endif
+
+-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
+
+ typedef enum idmap_type_t {
+ ID_TYPE_UID, /* uidmap entry */
+@@ -319,7 +319,6 @@ static int hook_mount_post(
+ * Once a mount has been attached to the filesystem it can't be
+ * idmapped anymore. So create a new detached mount.
+ */
+-#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
+ {
+ struct libmnt_sysapi *api = mnt_context_get_sysapi(cxt);
+
+@@ -329,7 +328,6 @@ static int hook_mount_post(
+ DBG(HOOK, ul_debugobj(hs, " reuse tree FD"));
+ }
+ }
+-#endif
+ if (fd_tree < 0)
+ fd_tree = mnt_open_tree(AT_FDCWD, target,
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC |
+@@ -521,4 +519,4 @@ const struct libmnt_hookset hookset_idmap =
+ .deinit = hookset_deinit
+ };
+
+-#endif /* HAVE_MOUNTFD_API && HAVE_LINUX_MOUNT_H */
++#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */
+diff --git a/libmount/src/hooks.c b/libmount/src/hooks.c
+index 23eca4efd..5ae91edd7 100644
+--- a/libmount/src/hooks.c
++++ b/libmount/src/hooks.c
+@@ -46,7 +46,7 @@ static const struct libmnt_hookset *hooksets[] =
+ &hookset_mount,
+ #endif
+ &hookset_mount_legacy,
+-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
+ &hookset_idmap,
+ #endif
+ &hookset_owner
+diff --git a/libmount/src/version.c b/libmount/src/version.c
+index 3b61618b5..5c70ebf8a 100644
+--- a/libmount/src/version.c
++++ b/libmount/src/version.c
+@@ -38,7 +38,7 @@ static const char *lib_features[] = {
+ #ifdef USE_LIBMOUNT_SUPPORT_NAMESPACES
+ "namespaces",
+ #endif
+-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
+ "idmapping",
+ #endif
+ #ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
+diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc
+index add2914ae..4bc1bb0f9 100644
+--- a/sys-utils/mount.8.adoc
++++ b/sys-utils/mount.8.adoc
+@@ -724,6 +724,7 @@ Set _mountpoint_'s mode after mounting.
+
+ *X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__::
+ Use this option to create an idmapped mount.
++This feature requires the new file-descriptor-based mount API (available since Linux 5.2).
+ An idmapped mount allows to change ownership of all files located under a mount according to the ID-mapping associated with a user namespace.
+ The ownership change is tied to the lifetime and localized to the relevant mount.
+ The relevant ID-mapping can be specified in two ways:
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 08/55] util-linux: patch CVE-2026-76642
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (6 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 07/55] util-linux: patch CVE-2026-78410 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 09/55] tzdata/tzcode-native: upgrade 2026d -> 2026e Yoann Congal
` (46 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41.6 release.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2026-76642.patch | 136 ++++++++++++++++++
2 files changed, 137 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 10803e38938..fdc8c62f6e5 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -62,6 +62,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2026-78410-01.patch \
file://CVE-2026-78410-02.patch \
file://CVE-2026-78410-03.patch \
+ file://CVE-2026-76642.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch
new file mode 100644
index 00000000000..b5d811770a3
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-76642.patch
@@ -0,0 +1,136 @@
+From a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 28 Jul 2026 11:40:25 +0200
+Subject: [PATCH] libmount: skip post-mount hooks after failed mount helper
+ [CVE-2026-76642]
+
+When an external mount.<type> helper exits nonzero, exec_helper()
+stores the failure in helper_status but returns zero (meaning the
+fork/exec/wait infrastructure succeeded). This zero propagates as
+the mount result, causing MNT_STAGE_MOUNT_POST and MNT_STAGE_POST
+hooks to execute as if the mount had succeeded.
+
+This allows privileged post-mount operations on the pre-existing
+target filesystem:
+
+ - X-mount.idmap clones and idmaps the underlying target, creating
+ an overmount that inherits suid/exec from the root filesystem
+ (ignoring nosuid/nodev/noexec from fstab)
+
+ - X-mount.owner/group/mode changes the physical target inode
+ ownership and permissions even though no mount was created
+
+Gate both MNT_STAGE_MOUNT_POST in mnt_context_do_mount() and
+MNT_STAGE_POST in mnt_context_mount() on is_success_status(), which
+already correctly distinguishes helper exit status from process
+execution status. This is a centralized fix -- individual hooks do
+not need their own guards.
+
+Audit of all hooks registered at these stages:
+
+ MNT_STAGE_MOUNT_POST:
+ - hook_mount.c (attach, propagation, vfsflags): already skip when
+ helper executed (commit f94a7760)
+ - hook_idmap.c: would clone+idmap pre-existing target -- now blocked
+ - hook_subdir.c: deinit calls tmptgt_cleanup() -- safe
+ - hook_mount_legacy.c (propagation, bindremount): no resources to leak
+ - hook_loopdev.c: deinit fixed to call delete_loopdev() when the
+ cleanup hook is skipped (was only free(), leaking fd and device)
+ - hook_veritydev.c: deinit calls delete_veritydev() -- safe
+
+ MNT_STAGE_POST:
+ - hook_owner.c: would chown/chmod target -- now blocked; deinit
+ only frees uid/gid/mode struct, no resources to leak
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit f57cea130839c0af8dc0525274267ae4cfd66bbf)
+(cherry picked from commit 1d14676ea70003e9f5b2a6a76af0cadb1190411a)
+
+CVE: CVE-2026-76642
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libmount/src/context_mount.c | 23 ++++++++++++++++++++---
+ libmount/src/hook_loopdev.c | 13 +++++++++++--
+ 2 files changed, 31 insertions(+), 5 deletions(-)
+
+diff --git a/libmount/src/context_mount.c b/libmount/src/context_mount.c
+index 77435684b..80c45beeb 100644
+--- a/libmount/src/context_mount.c
++++ b/libmount/src/context_mount.c
+@@ -574,6 +574,22 @@ static int is_success_status(struct libmnt_context *cxt)
+ return 0;
+ }
+
++/* Check if the mount stage explicitly failed (helper or syscall returned
++ * an error). Unlike is_success_status(), this treats "nothing happened"
++ * as not-failed -- the MOUNT stage may be a no-op for operations like
++ * bind/move with the new mount API where open_tree() runs in PREP and
++ * move_mount() is deferred to MOUNT_POST. */
++static int is_mount_stage_failed(struct libmnt_context *cxt)
++{
++ if (mnt_context_helper_executed(cxt))
++ return mnt_context_get_helper_status(cxt) != 0;
++
++ if (mnt_context_syscall_called(cxt))
++ return mnt_context_get_status(cxt) != 1;
++
++ return 0;
++}
++
+ /* try mount(2) for all items in comma separated list of the filesystem @types */
+ static int do_mount_by_types(struct libmnt_context *cxt, const char *types)
+ {
+@@ -874,8 +890,9 @@ int mnt_context_do_mount(struct libmnt_context *cxt)
+ } else
+ res = do_mount_by_pattern(cxt, cxt->fstype_pattern);
+
+- /* after mount stage */
+- if (res == 0) {
++ /* after mount stage -- the post-mount hooks are commit-path only,
++ * skip them if the mount helper or syscall has failed */
++ if (res == 0 && !is_mount_stage_failed(cxt)) {
+ rc = mnt_context_call_hooks(cxt, MNT_STAGE_MOUNT_POST);
+ if (rc)
+ return rc;
+@@ -1058,7 +1075,7 @@ again:
+ }
+ }
+
+- if (rc == 0)
++ if (rc == 0 && !is_mount_stage_failed(cxt))
+ rc = mnt_context_call_hooks(cxt, MNT_STAGE_POST);
+
+ mnt_context_deinit_hooksets(cxt);
+diff --git a/libmount/src/hook_loopdev.c b/libmount/src/hook_loopdev.c
+index 34351116c..af9a52227 100644
+--- a/libmount/src/hook_loopdev.c
++++ b/libmount/src/hook_loopdev.c
+@@ -23,6 +23,8 @@ struct hook_data {
+ int loopdev_fd;
+ };
+
++static int delete_loopdev(struct libmnt_context *cxt, struct hook_data *hd);
++
+ /* de-initiallize this module */
+ static int hookset_deinit(struct libmnt_context *cxt, const struct libmnt_hookset *hs)
+ {
+@@ -30,9 +32,16 @@ static int hookset_deinit(struct libmnt_context *cxt, const struct libmnt_hookse
+
+ DBG(HOOK, ul_debugobj(hs, "deinit '%s'", hs->name));
+
+- /* remove all our hooks */
++ /* remove all our hooks and free hook data */
+ while (mnt_context_remove_hook(cxt, hs, 0, &data) == 0) {
+- free(data);
++ if (data) {
++ struct hook_data *hd = (struct hook_data *) data;
++
++ /* cleanup after skipped MOUNT_POST hook */
++ if (hd->loopdev_fd > -1)
++ delete_loopdev(cxt, hd);
++ free(hd);
++ }
+ data = NULL;
+ }
+
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 09/55] tzdata/tzcode-native: upgrade 2026d -> 2026e
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (7 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 08/55] util-linux: patch CVE-2026-76642 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 10/55] expat: patch CVE-2026-102633 Yoann Congal
` (45 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://www.iana.org/time-zones/releases/2026e
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 35a0a18640e92bd98eca22ec9150be11daca1df7)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-extended/timezone/timezone.inc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc
index 441dc9be998..704d6b603f9 100644
--- a/meta/recipes-extended/timezone/timezone.inc
+++ b/meta/recipes-extended/timezone/timezone.inc
@@ -6,7 +6,7 @@ SECTION = "base"
LICENSE = "PD & BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
-PV = "2026d"
+PV = "2026e"
SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \
http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \
@@ -16,5 +16,5 @@ S = "${WORKDIR}/tz"
UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
-SRC_URI[tzcode.sha256sum] = "2f5c9f7fe29e6b8cb863583667884b8ce17b0a485355a054b591c6bdfcd81791"
-SRC_URI[tzdata.sha256sum] = "0cb2aa8e333c3dc049badc42a0c61f21987b8cd44e107fa900bad764aacc7767"
+SRC_URI[tzcode.sha256sum] = "cc3d27ca2a0d8399504551b920970d80af83bfb9c216e8082a15491921935d54"
+SRC_URI[tzdata.sha256sum] = "b26882805f26aac59d5b222978e6580484b834ccdc98be89df2f05a6dc53a652"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 10/55] expat: patch CVE-2026-102633
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (8 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 09/55] tzdata/tzcode-native: upgrade 2026d -> 2026e Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 11/55] expat: patch CVE-2026-77214 Yoann Congal
` (44 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-102633
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-102633.patch | 68 +++++++++++++++++++
meta/recipes-core/expat/expat_2.8.3.bb | 1 +
2 files changed, 69 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-102633.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-102633.patch b/meta/recipes-core/expat/expat/CVE-2026-102633.patch
new file mode 100644
index 00000000000..17851201267
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-102633.patch
@@ -0,0 +1,68 @@
+From 69edbec09f2cd3e0bd6e0a093b55ea38af902d7d Mon Sep 17 00:00:00 2001
+From: Filippo Tedeschi <filippotedeschi98@gmail.com>
+Date: Thu, 24 Sep 2026 21:14:23 +0200
+Subject: [PATCH] lib|tests: Replace assert with runtime overflow check in
+ expat_realloc
+
+In expat_realloc, the size passed to realloc_fcn is calculated as
+sizeof(size_t) + EXPAT_MALLOC_PADDING + size. Previously, expat_realloc
+relied on an assertion:
+assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size);
+under the assumption that preceding accounting checks and parser
+invariants preclude reaching an overflow state in practice.
+
+However, in release builds compiled with NDEBUG, assertions are
+compiled out. Replace the assert with an explicit runtime check:
+if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) {
+ return NULL;
+}
+immediately preceding the addition, ensuring consistent defensive
+behavior across all build configurations.
+
+Also extend test_alloc_tracker_size_recorded in alloc_tests.c to
+exercise SIZE_MAX and SIZE_MAX / 2 with expat_realloc, verifying
+that the allocation fails and the recorded size remains unchanged.
+
+Signed-off-by: Filippo Tedeschi <filippotedeschi98@gmail.com>
+
+CVE: CVE-2026-102633
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/69edbec09f2cd3e0bd6e0a093b55ea38af902d7d]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 7 ++++---
+ tests/alloc_tests.c | 4 ++++
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index dfcfb0c2..67005454 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1023,9 +1023,10 @@ expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine) {
+ }
+ }
+
+- // NOTE: Integer overflow detection has already been done for us
+- // by expat_heap_increase_tolerable(..) above
+- assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size);
++ // Detect and prevent integer overflow
++ if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) {
++ return NULL;
++ }
+
+ // Actually allocate
+ mallocedPtr = parser->m_mem.realloc_fcn(
+diff --git a/tests/alloc_tests.c b/tests/alloc_tests.c
+index 6be0a073..a5cea463 100644
+--- a/tests/alloc_tests.c
++++ b/tests/alloc_tests.c
+@@ -2118,6 +2118,10 @@ START_TEST(test_alloc_tracker_size_recorded) {
+ assert_true(ptr != NULL);
+ assert_true(sizeRecordedFor(ptr) == 10);
+
++ assert_true(expat_realloc(parser, ptr, SIZE_MAX, -1) == NULL);
++
++ assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged
++
+ assert_true(expat_realloc(parser, ptr, SIZE_MAX / 2, -1) == NULL);
+
+ assert_true(sizeRecordedFor(ptr) == 10); // i.e. unchanged
diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb
index 6d08a3fd94b..3a179db62cc 100644
--- a/meta/recipes-core/expat/expat_2.8.3.bb
+++ b/meta/recipes-core/expat/expat_2.8.3.bb
@@ -18,6 +18,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-76957-02.patch \
file://CVE-2026-93990-01.patch \
file://CVE-2026-93990-02.patch \
+ file://CVE-2026-102633.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 11/55] expat: patch CVE-2026-77214
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (9 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 10/55] expat: patch CVE-2026-102633 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 12/55] popt: patch CVE-2026-18743 Yoann Congal
` (43 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-77214
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-77214.patch | 106 ++++++++++++++++++
meta/recipes-core/expat/expat_2.8.3.bb | 1 +
2 files changed, 107 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-77214.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-77214.patch b/meta/recipes-core/expat/expat/CVE-2026-77214.patch
new file mode 100644
index 00000000000..6d746487054
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-77214.patch
@@ -0,0 +1,106 @@
+From 4d9b1c499ecb66323260a7274edcf86c5eab0517 Mon Sep 17 00:00:00 2001
+From: Filippo Tedeschi <filippotedeschi98@gmail.com>
+Date: Fri, 25 Sep 2026 19:51:10 +0200
+Subject: [PATCH] lib|tests: Validate len against buffer capacity in
+ XML_ParseBuffer
+
+In XML_ParseBuffer(), if len exceeds the unoccupied capacity of the
+internal buffer (EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd)),
+parser->m_bufferEnd was previously advanced past parser->m_bufferLim.
+This violated the parser's internal pointer invariant (m_bufferEnd <=
+m_bufferLim) and caused callProcessor() to read unallocated or
+uninitialized heap memory beyond the buffer bounds.
+
+Validate that len <= EXPAT_SAFE_PTR_DIFF(m_bufferLim, m_bufferEnd) for
+both XML_INITIALIZED and XML_PARSING states. If len exceeds the
+available buffer capacity, return XML_STATUS_ERROR with
+XML_ERROR_INVALID_ARGUMENT.
+
+Also add test_parse_buffer_exceeds_buffer in tests/basic_tests.c.
+
+Co-authored-by: Sebastian Pipping <sebastian@pipping.org>
+Signed-off-by: Filippo Tedeschi <filippotedeschi98@gmail.com>
+
+CVE: CVE-2026-77214
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/4d9b1c499ecb66323260a7274edcf86c5eab0517]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 5 +++++
+ tests/basic_tests.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 46 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 08ef9f72..6e3af97b 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -2465,6 +2465,11 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+ parser->m_parsingStatus.parsing = XML_PARSING;
+ }
+
++ if (len > EXPAT_SAFE_PTR_DIFF(parser->m_bufferLim, parser->m_bufferEnd)) {
++ parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT;
++ return XML_STATUS_ERROR;
++ }
++
+ // Detect and avoid integer overflow
+ if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) {
+ parser->m_errorCode = XML_ERROR_NO_MEMORY;
+diff --git a/tests/basic_tests.c b/tests/basic_tests.c
+index 06268469..35e17d31 100644
+--- a/tests/basic_tests.c
++++ b/tests/basic_tests.c
+@@ -3605,6 +3605,46 @@ START_TEST(test_negative_len_parse_buffer) {
+ }
+ END_TEST
+
++/* Test XML_ParseBuffer rejects calls where len exceeds available buffer */
++START_TEST(test_parse_buffer_exceeds_buffer) {
++ for (int isFinal = 0; isFinal < 2; isFinal++) {
++ set_subtest("isFinal=%d", isFinal);
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++
++ /* Calling XML_ParseBuffer without any prior XML_GetBuffer call */
++ if (XML_ParseBuffer(parser, 10, isFinal) != XML_STATUS_ERROR)
++ fail("XML_ParseBuffer without XML_GetBuffer was expected to fail.");
++ if (XML_GetErrorCode(parser) != XML_ERROR_NO_BUFFER)
++ fail("Expected XML_ERROR_NO_BUFFER.");
++
++ /* Acquire a small buffer */
++ void *const buffer = XML_GetBuffer(parser, 10);
++ if (buffer == NULL)
++ fail("XML_GetBuffer failed.");
++
++ /* Calling XML_ParseBuffer with len exceeding available buffer capacity */
++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR)
++ fail("XML_ParseBuffer with len > capacity was expected to fail.");
++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT)
++ fail("Expected XML_ERROR_INVALID_ARGUMENT.");
++
++ /* Valid parse */
++ memcpy(buffer, "<r></r>", 7);
++ if (XML_ParseBuffer(parser, 7, XML_FALSE) != XML_STATUS_OK)
++ xml_failure(parser);
++
++ /* Subsequent XML_ParseBuffer where len exceeds remaining capacity */
++ if (XML_ParseBuffer(parser, 10000, isFinal) != XML_STATUS_ERROR)
++ fail("XML_ParseBuffer on subsequent chunk was expected to fail.");
++ if (XML_GetErrorCode(parser) != XML_ERROR_INVALID_ARGUMENT)
++ fail("Expected XML_ERROR_INVALID_ARGUMENT.");
++
++ XML_ParserFree(parser);
++ }
++}
++END_TEST
++
+ /* Test odd corners of the XML_GetBuffer interface */
+ static enum XML_Status
+ get_feature(enum XML_FeatureEnum feature_id, long *presult) {
+@@ -7054,6 +7094,7 @@ make_basic_test_case(Suite *s) {
+ tcase_add_test(tc_basic, test_empty_parse);
+ tcase_add_test(tc_basic, test_negative_len_parse);
+ tcase_add_test(tc_basic, test_negative_len_parse_buffer);
++ tcase_add_test(tc_basic, test_parse_buffer_exceeds_buffer);
+ tcase_add_test(tc_basic, test_get_buffer_1);
+ tcase_add_test(tc_basic, test_get_buffer_2);
+ #if XML_CONTEXT_BYTES > 0
diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb
index 3a179db62cc..02a8536440d 100644
--- a/meta/recipes-core/expat/expat_2.8.3.bb
+++ b/meta/recipes-core/expat/expat_2.8.3.bb
@@ -19,6 +19,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-93990-01.patch \
file://CVE-2026-93990-02.patch \
file://CVE-2026-102633.patch \
+ file://CVE-2026-77214.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 12/55] popt: patch CVE-2026-18743
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (10 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 11/55] expat: patch CVE-2026-77214 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 13/55] popt: patch CVE-2026-18739 Yoann Congal
` (42 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6a47df77d4dda066f6c3651480546a79fd445ae6)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../popt/popt/CVE-2026-18743.patch | 97 +++++++++++++++++++
meta/recipes-support/popt/popt_1.19.bb | 1 +
2 files changed, 98 insertions(+)
create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18743.patch
diff --git a/meta/recipes-support/popt/popt/CVE-2026-18743.patch b/meta/recipes-support/popt/popt/CVE-2026-18743.patch
new file mode 100644
index 00000000000..d57a39b4705
--- /dev/null
+++ b/meta/recipes-support/popt/popt/CVE-2026-18743.patch
@@ -0,0 +1,97 @@
+From ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe Mon Sep 17 00:00:00 2001
+From: Panu Matilainen <pmatilai@redhat.com>
+Date: Tue, 11 Aug 2026 11:45:44 +0300
+Subject: [PATCH] Fix CVE-2026-18743: buffer overflow(s) in
+ poptConfigFileToString()
+
+Fix the reallocation logic thinko, repeated twice in the function:
+if we need to reallocate, the current maximum value is not interesting
+in any way. Just allocate double the required size instead.
+
+The reproducer test is obviously closely tied to the initial buffer
+size of 480 and wouldn't work with other sizes, but with the current
+default this reliably crashes popt under ASAN prior to this fix.
+Also , the reproducer only exercises the first of these flaws.
+
+Fixes: CVE-2026-18743
+
+CVE: CVE-2026-18743
+Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/ea2092edba8d6c1a9acd60d9fd7a587c624d6ffe]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/poptparse.c | 10 ++++------
+ tests/test3-data/05.answer | 5 +++++
+ tests/test3-data/05.input | 2 ++
+ tests/testit.sh | 1 +
+ 4 files changed, 12 insertions(+), 6 deletions(-)
+ create mode 100644 tests/test3-data/05.answer
+ create mode 100644 tests/test3-data/05.input
+
+diff --git a/src/poptparse.c b/src/poptparse.c
+index f405081..c2a5435 100644
+--- a/src/poptparse.c
++++ b/src/poptparse.c
+@@ -139,7 +139,6 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
+ char * p;
+ char * q;
+ char * x;
+- size_t t;
+ size_t argvlen = 0;
+ size_t maxlinelen = sizeof(line);
+ size_t linelen;
+@@ -186,9 +185,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
+ if (*q == '\0') {
+ /* single command line option (ie, no name=val, just name) */
+ q[-1] = '\0'; /* kill off newline from fgets() call */
+- argvlen += (t = (size_t)(q - p)) + (sizeof(" --")-1);
++ argvlen += ((size_t)(q - p)) + (sizeof(" --")-1);
+ if (argvlen >= maxargvlen) {
+- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
++ maxargvlen = argvlen * 2;
+ argstr_tmp = realloc(argstr, maxargvlen);
+ if (argstr_tmp == NULL) {
+ free(argstr);
+@@ -218,10 +217,9 @@ int poptConfigFileToString(FILE *fp, char ** argstrp,
+ *x = '\0'; /* null out last char if space (including fgets() NL) */
+
+ /* rest of line accept */
+- t = (size_t)(x - p);
+- argvlen += t + (sizeof("' --='")-1);
++ argvlen += ((size_t)(x - p) + sizeof("' --='")-1);
+ if (argvlen >= maxargvlen) {
+- maxargvlen = (t > maxargvlen) ? t*2 : maxargvlen*2;
++ maxargvlen = argvlen * 2;
+ argstr_tmp = realloc(argstr, maxargvlen);
+ if (argstr_tmp == NULL) {
+ free(argstr);
+diff --git a/tests/test3-data/05.answer b/tests/test3-data/05.answer
+new file mode 100644
+index 0000000..37b7fb8
+--- /dev/null
++++ b/tests/test3-data/05.answer
+@@ -0,0 +1,5 @@
++single string: ' --aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa --bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
++popt array: size=2
++'--aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
++'--bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
++
+diff --git a/tests/test3-data/05.input b/tests/test3-data/05.input
+new file mode 100644
+index 0000000..2508292
+--- /dev/null
++++ b/tests/test3-data/05.input
+@@ -0,0 +1,2 @@
++aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
++bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+diff --git a/tests/testit.sh b/tests/testit.sh
+index 26724d6..4078f51 100755
+--- a/tests/testit.sh
++++ b/tests/testit.sh
+@@ -179,6 +179,7 @@ fi
+ run_diff test3 "test3 - 1" test3-data/01.input test3-data/01.answer
+ run_diff test3 "test3 - 2" test3-data/02.input test3-data/02.answer
+ run_diff test3 "test3 - 3" test3-data/03.input test3-data/03.answer
++run_diff test3 "test3 - 5" test3-data/05.input test3-data/05.answer
+
+ echo ""
+ echo "Passed."
diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb
index b1d8bea790e..c8b4875c1b7 100644
--- a/meta/recipes-support/popt/popt_1.19.bb
+++ b/meta/recipes-support/popt/popt_1.19.bb
@@ -10,6 +10,7 @@ DEPENDS = "virtual/libiconv"
SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \
file://run-ptest \
+ file://CVE-2026-18743.patch \
"
SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 13/55] popt: patch CVE-2026-18739
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (11 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 12/55] popt: patch CVE-2026-18743 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 14/55] glib-2.0: patch CVE-2026-15588 Yoann Congal
` (41 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE.
Convert change in cmake file to autotools/makefile.
Install the new test in recipe.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c211972ad21e1801abc7dd15951093316c5528f4)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: backport translated cmake to automake
(the project migrated in between) ]
---
.../popt/popt/CVE-2026-18739.patch | 92 +++++++++++++++++++
meta/recipes-support/popt/popt_1.19.bb | 2 +
2 files changed, 94 insertions(+)
create mode 100644 meta/recipes-support/popt/popt/CVE-2026-18739.patch
diff --git a/meta/recipes-support/popt/popt/CVE-2026-18739.patch b/meta/recipes-support/popt/popt/CVE-2026-18739.patch
new file mode 100644
index 00000000000..0a1e8f35907
--- /dev/null
+++ b/meta/recipes-support/popt/popt/CVE-2026-18739.patch
@@ -0,0 +1,92 @@
+From 14c42b415ba0c11640f7d4ee80920452d0287058 Mon Sep 17 00:00:00 2001
+From: Yao Zhang <294772273@qq.com>
+Date: Wed, 5 Aug 2026 14:52:10 +0800
+Subject: [PATCH] Fix CVE-2026-18739: off-by-one error in poptStuffArgs()
+
+The poptStuffArgs function only checks whether (con->os - con->optionStack)
+is equal to POPT_OPTION_DEPTH (10) before incrementing con->os, and does
+not increment the value by 1 to perform boundary pre-checking, as
+handleAlias does.
+
+Add a new test program as a reproducer for this case.
+
+Co-authored-by: Panu Matilainen <pmatilai@redhat.com>
+
+Fixes: CVE-2026-18739
+
+CVE: CVE-2026-18743
+Upstream-Status: Backport [https://github.com/rpm-software-management/popt/commit/14c42b415ba0c11640f7d4ee80920452d0287058]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/popt.c | 2 +-
+ tests/Makefile.am | 5 ++++-
+ tests/testit.sh | 2 ++
+ tests/tstuff.c | 17 +++++++++++++++++
+ 4 files changed, 24 insertions(+), 2 deletions(-)
+ create mode 100644 tests/tstuff.c
+
+diff --git a/src/popt.c b/src/popt.c
+index 9ea3dfe..458aadc 100644
+--- a/src/popt.c
++++ b/src/popt.c
+@@ -1668,7 +1668,7 @@ int poptStuffArgs(poptContext con, const char ** argv)
+ int argc;
+ int rc;
+
+- if ((con->os - con->optionStack) == POPT_OPTION_DEPTH)
++ if ((con->os - con->optionStack + 1) == POPT_OPTION_DEPTH)
+ return POPT_ERROR_OPTSTOODEEP;
+
+ for (argc = 0; argv[argc]; argc++)
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index c410389..99fbf64 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -11,7 +11,10 @@ EXTRA_DIST = testit.sh \
+
+ AM_CPPFLAGS = -I. -I$(top_srcdir)/src
+
+-noinst_PROGRAMS = test1 test2 tdict test3
++noinst_PROGRAMS = test1 test2 tdict test3 tstuff
++tstuff_SOURCES = tstuff.c
++tstuff_LDFLAGS =
++tstuff_LDADD = $(top_builddir)/src/libpopt.la
+ test1_SOURCES = test1.c
+ test1_LDFLAGS =
+ test1_LDADD = $(top_builddir)/src/libpopt.la
+diff --git a/tests/testit.sh b/tests/testit.sh
+index 4078f51..d26be3a 100755
+--- a/tests/testit.sh
++++ b/tests/testit.sh
+@@ -172,6 +172,8 @@ run test1 "test1 - 61" "" -x=f1
+
+ run test1 "test1 - 62" "arg1: 0 arg2: (none) aInt: 1" --randint=-1
+
++run tstuff "tstuff - 1" "-13"
++
+ if ! [ -e test3-data ]; then
+ # create symlink for running during 'make distcheck'
+ ln -s "${srcdir}/test3-data" test3-data
+diff --git a/tests/tstuff.c b/tests/tstuff.c
+new file mode 100644
+index 0000000..b820c7b
+--- /dev/null
++++ b/tests/tstuff.c
+@@ -0,0 +1,17 @@
++#include <stdio.h>
++#include <popt.h>
++
++int main(int argc, char *argv[])
++{
++ poptContext ctx = poptGetContext(argv[0], argc, (const char **)argv, NULL, 0);
++ int rc = 0;
++ for (int i = 0; i < 100; ++i) {
++ const char *ea[] = { "a", NULL };
++ if ((rc = poptStuffArgs(ctx, ea)))
++ break;
++ }
++ printf("%d\n", rc);
++
++ poptFreeContext(ctx);
++ return rc;
++}
diff --git a/meta/recipes-support/popt/popt_1.19.bb b/meta/recipes-support/popt/popt_1.19.bb
index c8b4875c1b7..18cc4f2867d 100644
--- a/meta/recipes-support/popt/popt_1.19.bb
+++ b/meta/recipes-support/popt/popt_1.19.bb
@@ -11,6 +11,7 @@ DEPENDS = "virtual/libiconv"
SRC_URI = "http://ftp.rpm.org/popt/releases/popt-1.x/${BP}.tar.gz \
file://run-ptest \
file://CVE-2026-18743.patch \
+ file://CVE-2026-18739.patch \
"
SRC_URI[sha256sum] = "c25a4838fc8e4c1c8aacb8bd620edb3084a3d63bf8987fdad3ca2758c63240f9"
@@ -25,6 +26,7 @@ do_compile_ptest() {
do_install_ptest() {
install ${B}/tests/.libs/test* ${D}/${PTEST_PATH}
install ${B}/tests/.libs/tdict ${D}/${PTEST_PATH}
+ install ${B}/tests/.libs/tstuff ${D}/${PTEST_PATH}
install ${B}/tests/testit.sh ${D}/${PTEST_PATH}
install ${B}/tests/test-poptrc ${D}/${PTEST_PATH}
}
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 14/55] glib-2.0: patch CVE-2026-15588
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (12 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 13/55] popt: patch CVE-2026-18739 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 15/55] glib-2.0: patch CVE-2026-16118 Yoann Congal
` (40 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-15588
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../glib-2.0/glib-2.0/CVE-2026-15588.patch | 267 ++++++++++++++++++
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 1 +
2 files changed, 268 insertions(+)
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch
new file mode 100644
index 00000000000..e5ff0e87d36
--- /dev/null
+++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-15588.patch
@@ -0,0 +1,267 @@
+From 4235f7b42ba51d6fdb4abd7c4276031802f39834 Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Sat, 4 Jul 2026 18:13:08 +0100
+Subject: [PATCH] gdbusauth: Limit length of lines read from client
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The client isn’t trusted at this point, and there was previously nothing
+limiting how long a line `GDBusAuth` would read. So an untrusted client
+could exhaust the server’s memory by sending anything except `\r\n`.
+
+Fix that by applying a reasonably length limit when reading a line, and
+add a unit test.
+
+Spotted by Gitee Codepecker Lab.
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+Fixes: #3985
+
+CVE: CVE-2026-15588
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/4235f7b42ba51d6fdb4abd7c4276031802f39834]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ gio/gdbusauth.c | 44 +++++++++++++++
+ gio/tests/gdbus-auth.c | 119 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 163 insertions(+)
+
+diff --git a/gio/gdbusauth.c b/gio/gdbusauth.c
+index 9e31c8318..a5938c969 100644
+--- a/gio/gdbusauth.c
++++ b/gio/gdbusauth.c
+@@ -262,6 +262,21 @@ find_mech_by_name (GDBusAuth *auth,
+ return ret;
+ }
+
++static size_t
++get_longest_mechanism_name_length (GDBusAuth *auth)
++{
++ size_t len = 0;
++
++ for (GList *l = auth->priv->available_mechanisms; l != NULL; l = l->next)
++ {
++ Mechanism *m = l->data;
++
++ len = MAX (len, strlen (m->name));
++ }
++
++ return len;
++}
++
+ GDBusAuth *
+ _g_dbus_auth_new (GIOStream *stream)
+ {
+@@ -270,6 +285,20 @@ _g_dbus_auth_new (GIOStream *stream)
+ NULL);
+ }
+
++/* Arbitrarily chosen limit on the length of a DATA command payload, to prevent
++ * unbounded reads from malicious clients.
++ *
++ * - The ANONYMOUS mechanism doesn’t use DATA.
++ * - The EXTERNAL mechanism just uses it to transfer a decimal-encoded UID.
++ * - The DBUS_COOKIE_SHA1 mechanism transfers a challenge and a SHA1 hash. The
++ * hash is bounded in length, but the challenge is not, so could potentially
++ * hit this limit. It doesn’t seem unreasonable to bound the challenge to
++ * ~4KB though. GDBus itself generates a 16 byte challenge.
++ *
++ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-command-data
++ */
++#define MAX_DATA_PAYLOAD_LENGTH_BYTES 4096
++
+ /* ---------------------------------------------------------------------------------------------------- */
+ /* like g_data_input_stream_read_line() but sets error if there's no content to read */
+ static gchar *
+@@ -307,6 +336,7 @@ _my_g_data_input_stream_read_line (GDataInputStream *dis,
+ */
+ static gchar *
+ _my_g_input_stream_read_line_safe (GInputStream *i,
++ size_t max_line_length,
+ gsize *out_line_length,
+ GCancellable *cancellable,
+ GError **error)
+@@ -316,11 +346,22 @@ _my_g_input_stream_read_line_safe (GInputStream *i,
+ gssize num_read;
+ gboolean last_was_cr;
+
++ g_assert (max_line_length <= SIZE_MAX - 2);
++
+ str = g_string_new (NULL);
+
+ last_was_cr = FALSE;
+ while (TRUE)
+ {
++ if (str->len >= max_line_length + 2 /* allow for \r\n */)
++ {
++ g_set_error_literal (error,
++ G_IO_ERROR,
++ G_IO_ERROR_FAILED,
++ _("Malformed D-Bus authentication line"));
++ goto fail;
++ }
++
+ num_read = g_input_stream_read (i,
+ &c,
+ 1,
+@@ -1073,6 +1114,7 @@ _g_dbus_auth_run_server (GDBusAuth *auth,
+ case SERVER_STATE_WAITING_FOR_AUTH:
+ debug_print ("SERVER: WaitingForAuth");
+ line = _my_g_input_stream_read_line_safe (g_io_stream_get_input_stream (auth->priv->stream),
++ strlen ("AUTH ") + get_longest_mechanism_name_length (auth) + strlen (" ") + MAX_DATA_PAYLOAD_LENGTH_BYTES,
+ &line_length,
+ cancellable,
+ error);
+@@ -1294,6 +1336,7 @@ _g_dbus_auth_run_server (GDBusAuth *auth,
+ case SERVER_STATE_WAITING_FOR_DATA:
+ debug_print ("SERVER: WaitingForData");
+ line = _my_g_input_stream_read_line_safe (g_io_stream_get_input_stream (auth->priv->stream),
++ strlen ("DATA ") + MAX_DATA_PAYLOAD_LENGTH_BYTES,
+ &line_length,
+ cancellable,
+ error);
+@@ -1336,6 +1379,7 @@ _g_dbus_auth_run_server (GDBusAuth *auth,
+ case SERVER_STATE_WAITING_FOR_BEGIN:
+ debug_print ("SERVER: WaitingForBegin");
+ line = _my_g_input_stream_read_line_safe (g_io_stream_get_input_stream (auth->priv->stream),
++ MAX (strlen ("BEGIN"), strlen ("NEGOTIATE_UNIX_FD")),
+ &line_length,
+ cancellable,
+ error);
+diff --git a/gio/tests/gdbus-auth.c b/gio/tests/gdbus-auth.c
+index 657571be3..3323d6eeb 100644
+--- a/gio/tests/gdbus-auth.c
++++ b/gio/tests/gdbus-auth.c
+@@ -263,6 +263,124 @@ temp_dbus_keyrings_teardown (void)
+ g_unsetenv ("G_DBUS_COOKIE_SHA1_KEYRING_DIR_IGNORE_PERMISSION");
+ }
+
++static void
++async_result_cb (GObject *obj,
++ GAsyncResult *result,
++ void *user_data)
++{
++ GAsyncResult **result_out = user_data;
++
++ g_assert (result_out != NULL);
++ g_assert (*result_out == NULL);
++
++ *result_out = g_object_ref (result);
++ g_main_context_wakeup (g_main_context_get_thread_default ());
++}
++
++static gboolean
++server_new_connection_unexpected_cb (GDBusServer *server,
++ GDBusConnection *connection,
++ void *user_data)
++{
++ g_assert_not_reached ();
++ return FALSE;
++}
++
++static void
++test_auth_server_read_limit (void)
++{
++ GDBusServer *server = NULL;
++ unsigned long new_connection_id = 0;
++ const char *server_address;
++ GIOStream *client_stream = NULL;
++ GOutputStream *client_output_stream;
++ GInputStream *client_input_stream;
++ GAsyncResult *result = NULL;
++ char *write_buffer = NULL;
++ char read_buffer[100];
++ ssize_t read_len;
++ size_t bytes_written;
++ GError *local_error = NULL;
++
++ g_test_summary ("Test that GDBusServer limits the lengths of reads it does during auth from a client");
++ g_test_bug ("https://gitlab.gnome.org/GNOME/glib/-/issues/3985");
++
++ server = server_new_for_mechanism (NULL);
++
++ new_connection_id = g_signal_connect (server,
++ "new-connection",
++ G_CALLBACK (server_new_connection_unexpected_cb),
++ NULL);
++ server_address = g_dbus_server_get_client_address (server);
++ g_dbus_server_start (server);
++
++ /* Start connecting as a client */
++ g_dbus_address_get_stream (server_address, NULL, async_result_cb, &result);
++
++ while (result == NULL)
++ g_main_context_iteration (NULL, TRUE);
++
++ client_stream = g_dbus_address_get_stream_finish (result, NULL, &local_error);
++ g_assert_no_error (local_error);
++ g_clear_object (&result);
++
++ /* Send an over-long AUTH line, maliciously */
++ client_output_stream = g_io_stream_get_output_stream (client_stream);
++ client_input_stream = g_io_stream_get_input_stream (client_stream);
++
++ write_buffer = g_strdup_printf ("AUTH DBUS_COOKIE_SHA1 context%0*d 123 456\r\n", 5000, 0);
++
++ g_output_stream_write_all_async (client_output_stream,
++ write_buffer,
++ strlen (write_buffer),
++ G_PRIORITY_DEFAULT,
++ NULL,
++ async_result_cb,
++ &result);
++
++ while (result == NULL)
++ g_main_context_iteration (NULL, TRUE);
++
++ g_output_stream_write_all_finish (client_output_stream, result, &bytes_written, &local_error);
++ g_assert_no_error (local_error);
++ g_assert_cmpuint (bytes_written, ==, strlen (write_buffer));
++ g_clear_object (&result);
++
++ g_clear_pointer (&write_buffer, g_free);
++
++ /* Authentication should have been rejected, so reading or writing the stream
++ * should now fail. */
++ read_len = g_input_stream_read (client_input_stream,
++ read_buffer,
++ sizeof (read_buffer),
++ NULL,
++ &local_error);
++ g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED);
++ g_assert_cmpint (read_len, <, 0);
++ g_clear_error (&local_error);
++
++ write_buffer = g_strdup_printf ("AUTH\r\n");
++
++ g_output_stream_write_all (client_output_stream,
++ write_buffer,
++ strlen (write_buffer),
++ &bytes_written,
++ NULL,
++ &local_error);
++ g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_CONNECTION_CLOSED);
++ g_assert_cmpuint (bytes_written, ==, 0);
++ g_clear_error (&local_error);
++
++ g_clear_pointer (&write_buffer, g_free);
++
++ /* Cleanup */
++ g_clear_object (&client_stream);
++ g_dbus_server_stop (server);
++
++ g_clear_signal_handler (&new_connection_id, server);
++ g_clear_object (&server);
++}
++
+ /* ---------------------------------------------------------------------------------------------------- */
+
+ int
+@@ -282,6 +400,7 @@ main (int argc,
+ g_test_add_func ("/gdbus/auth/server/ANONYMOUS", auth_server_anonymous);
+ g_test_add_func ("/gdbus/auth/server/EXTERNAL", auth_server_external);
+ g_test_add_func ("/gdbus/auth/server/DBUS_COOKIE_SHA1", auth_server_dbus_cookie_sha1);
++ g_test_add_func ("/gdbus/auth/server/read-limit", test_auth_server_read_limit);
+
+ /* TODO: we currently don't have tests for
+ *
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
index 70b0b74e881..62f173739cf 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
+++ b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
@@ -58,6 +58,7 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
file://CVE-2026-58015_p2.patch \
file://CVE-2026-58015_p3.patch \
file://CVE-2026-58015_p4.patch \
+ file://CVE-2026-15588.patch \
"
SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 15/55] glib-2.0: patch CVE-2026-16118
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (13 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 14/55] glib-2.0: patch CVE-2026-15588 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 16/55] libpng: patch CVE-2026-46675 Yoann Congal
` (39 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../glib-2.0/glib-2.0/CVE-2026-16118.patch | 48 +++++++++++++++++++
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 1 +
2 files changed, 49 insertions(+)
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch
new file mode 100644
index 00000000000..72a387079e0
--- /dev/null
+++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-16118.patch
@@ -0,0 +1,48 @@
+From ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5 Mon Sep 17 00:00:00 2001
+From: Kashyap Ekbote <kashyap.ekbote@gmail.com>
+Date: Wed, 5 Aug 2026 20:50:10 +0530
+Subject: [PATCH] Fix CVE-2026-16118: heap-buffer-overflow in xdgmimemagic.c
+
+Fix out-of-bounds write in the byte-swap routine of
+_xdg_mime_magic_parse_magic_line(). On little-endian systems, the
+write side of the swap casts the base pointer to a wider type before
+adding the byte offset, causing pointer arithmetic to scale by
+sizeof(type) instead of 1. With value_length=4 and word_size=2, the
+loop writes 2 bytes past the allocated matchlet->value buffer at i=2.
+
+Parenthesize (ptr + i) before the cast so both the read and write
+sides use byte offsets.
+
+Upstream: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41
+
+CVE: CVE-2026-16118
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/ca75aff83af9875ea2ad2bfbe48a85dfd99c2ce5]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ gio/xdgmime/xdgmimemagic.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/gio/xdgmime/xdgmimemagic.c b/gio/xdgmime/xdgmimemagic.c
+index 98a1274c8..fe374eb4e 100644
+--- a/gio/xdgmime/xdgmimemagic.c
++++ b/gio/xdgmime/xdgmimemagic.c
+@@ -483,15 +483,15 @@ _xdg_mime_magic_parse_magic_line (FILE *magic_file,
+ for (i = 0; i < matchlet->value_length; i = i + matchlet->word_size)
+ {
+ if (matchlet->word_size == 2)
+- *((xdg_uint16_t *) matchlet->value + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i)));
++ *((xdg_uint16_t *) (matchlet->value + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->value + i)));
+ else if (matchlet->word_size == 4)
+- *((xdg_uint32_t *) matchlet->value + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i)));
++ *((xdg_uint32_t *) (matchlet->value + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->value + i)));
+ if (matchlet->mask)
+ {
+ if (matchlet->word_size == 2)
+- *((xdg_uint16_t *) matchlet->mask + i) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i)));
++ *((xdg_uint16_t *) (matchlet->mask + i)) = SWAP_BE16_TO_LE16 (*((xdg_uint16_t *) (matchlet->mask + i)));
+ else if (matchlet->word_size == 4)
+- *((xdg_uint32_t *) matchlet->mask + i) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i)));
++ *((xdg_uint32_t *) (matchlet->mask + i)) = SWAP_BE32_TO_LE32 (*((xdg_uint32_t *) (matchlet->mask + i)));
+
+ }
+ }
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
index 62f173739cf..c63b276fd6b 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
+++ b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
@@ -59,6 +59,7 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
file://CVE-2026-58015_p3.patch \
file://CVE-2026-58015_p4.patch \
file://CVE-2026-15588.patch \
+ file://CVE-2026-16118.patch \
"
SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 16/55] libpng: patch CVE-2026-46675
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (14 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 15/55] glib-2.0: patch CVE-2026-16118 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 17/55] go: fix CVE-2026-56862 Yoann Congal
` (38 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-46675
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libpng/files/CVE-2026-46675.patch | 115 ++++++++++++++++++
.../libpng/libpng_1.6.42.bb | 1 +
2 files changed, 116 insertions(+)
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch
new file mode 100644
index 00000000000..3af0251c553
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2026-46675.patch
@@ -0,0 +1,115 @@
+From aa77ef38c17ab2fc1b41bec09fb973c6a386641d Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Wed, 23 Sep 2026 18:30:11 +0300
+Subject: [PATCH] fix: Clear stale zstream pointers when releasing the inflate
+ stream
+
+The zstream buffer pointers and counters are all cleared on acquisition
+in `png_inflate_claim`, but only `next_in` and `avail_in` were cleared
+on release in `png_read_finish_IDAT`, and none were cleared on release
+in the chunk decompression paths.
+
+If `png_read_end` is called before row reading starts, the IDAT stream
+is never claimed. Previously, a leftover non-zero `avail_in` caused the
+refill in `png_read_IDAT_data` to be skipped, and inflation continued
+through a stale `next_in` into an input buffer that may since have been
+deallocated.
+
+Introduce the function `png_inflate_detach_buffers` to clear the
+pointers and the counters of zstream input and output buffers on both
+acquisition and release. Although clearing `next_out` and `avail_out`
+is not currently necessary at any call site, it makes release mirror
+acquisition at a negligible cost paid once for each zlib stream.
+
+This is a cherry-pick of commit 6c7783b151377f591c83955e23da50991ad1a600
+from branch 'libpng18'.
+
+Reported-by: Ze Sheng <OwenSanzas@users.noreply.github.com>
+Reported-by: JasonHonKL <JasonHonKL@users.noreply.github.com>
+
+CVE: CVE-2026-46675
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/aa77ef38c17ab2fc1b41bec09fb973c6a386641d]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ pngrutil.c | 33 +++++++++++++++++++--------------
+ 1 file changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/pngrutil.c b/pngrutil.c
+index 551395168..482f0ae8d 100644
+--- a/pngrutil.c
++++ b/pngrutil.c
+@@ -332,6 +332,18 @@ png_read_buffer(png_structrp png_ptr, png_alloc_size_t new_size, int warn)
+ }
+ #endif /* READ_iCCP|iTXt|pCAL|sCAL|sPLT|tEXt|zTXt|SEQUENTIAL_READ */
+
++/* Detach the zstream from the input and output buffers left by
++ * the current or a previous owner, and possibly deallocated since.
++ */
++static void
++png_inflate_detach_buffers(png_structrp png_ptr)
++{
++ png_ptr->zstream.next_in = NULL;
++ png_ptr->zstream.avail_in = 0;
++ png_ptr->zstream.next_out = NULL;
++ png_ptr->zstream.avail_out = 0;
++}
++
+ /* png_inflate_claim: claim the zstream for some nefarious purpose that involves
+ * decompression. Returns Z_OK on success, else a zlib error code. It checks
+ * the owner but, in final release builds, just issues a warning if some other
+@@ -392,13 +404,7 @@ png_inflate_claim(png_structrp png_ptr, png_uint_32 owner)
+
+ #endif /* ZLIB_VERNUM >= 0x1240 */
+
+- /* Set this for safety, just in case the previous owner left pointers to
+- * memory allocations.
+- */
+- png_ptr->zstream.next_in = NULL;
+- png_ptr->zstream.avail_in = 0;
+- png_ptr->zstream.next_out = NULL;
+- png_ptr->zstream.avail_out = 0;
++ png_inflate_detach_buffers(png_ptr);
+
+ if ((png_ptr->flags & PNG_FLAG_ZSTREAM_INITIALIZED) != 0)
+ {
+@@ -744,7 +750,8 @@ png_decompress_chunk(png_structrp png_ptr,
+ else if (ret == Z_OK)
+ ret = PNG_UNEXPECTED_ZLIB_RETURN;
+
+- /* Release the claimed stream */
++ /* Release the claimed stream. */
++ png_inflate_detach_buffers(png_ptr);
+ png_ptr->zowner = 0;
+ }
+
+@@ -1569,6 +1576,7 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
+
+ if (errmsg == NULL)
+ {
++ png_inflate_detach_buffers(png_ptr);
+ png_ptr->zowner = 0;
+ return;
+ }
+@@ -1595,7 +1603,8 @@ png_handle_iCCP(png_structrp png_ptr, png_inforp info_ptr, png_uint_32 length)
+ else /* profile truncated */
+ errmsg = png_ptr->zstream.msg;
+
+- /* Release the stream */
++ /* Release the claimed stream. */
++ png_inflate_detach_buffers(png_ptr);
+ png_ptr->zowner = 0;
+ }
+
+@@ -4294,11 +4303,7 @@ png_read_finish_IDAT(png_structrp png_ptr)
+ */
+ if (png_ptr->zowner == png_IDAT)
+ {
+- /* Always do this; the pointers otherwise point into the read buffer. */
+- png_ptr->zstream.next_in = NULL;
+- png_ptr->zstream.avail_in = 0;
+-
+- /* Now we no longer own the zstream. */
++ png_inflate_detach_buffers(png_ptr);
+ png_ptr->zowner = 0;
+
+ /* The slightly weird semantics of the sequential IDAT reading is that we
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
index f375aa5f4e9..8e7f9d8f8ec 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
@@ -32,6 +32,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz
file://CVE-2026-34757_p1.patch \
file://CVE-2026-34757_p2.patch \
file://CVE-2026-33416-05.patch \
+ file://CVE-2026-46675.patch \
"
SRC_URI[sha256sum] = "c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 17/55] go: fix CVE-2026-56862
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (15 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 16/55] libpng: patch CVE-2026-46675 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 18/55] libpcre2: update to latest release branch hash 50b3c0d7ce Yoann Congal
` (37 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Benhur Tessele <benhur.tessele@est.tech>
A malicious TLS 1.3 peer could keep sending KeyUpdate messages after
the handshake completed, forcing the other side to perform key
derivation indefinitely, because handshake records were always treated
as state-advancing.
Backport the upstream fix [1]. The bogo_config.json hunk is dropped
since the BoGo test harness does not exist in Go 1.22, and the new test
is adapted to use testConfig.
[1] https://github.com/golang/go/commit/27420571845abc6a97e19e21542a3213a74f67f4
Signed-off-by: Benhur Tessele <benhur.tessele@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/go/go-1.22.12.inc | 1 +
.../go/go/CVE-2026-56862.patch | 98 +++++++++++++++++++
2 files changed, 99 insertions(+)
create mode 100644 meta/recipes-devtools/go/go/CVE-2026-56862.patch
diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc
index c8fb9ef450d..cec3bbbb4ee 100644
--- a/meta/recipes-devtools/go/go-1.22.12.inc
+++ b/meta/recipes-devtools/go/go-1.22.12.inc
@@ -63,6 +63,7 @@ SRC_URI += "\
file://CVE-2026-32288.patch \
file://CVE-2026-27145.patch \
file://CVE-2026-39823.patch \
+ file://CVE-2026-56862.patch \
"
SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71"
diff --git a/meta/recipes-devtools/go/go/CVE-2026-56862.patch b/meta/recipes-devtools/go/go/CVE-2026-56862.patch
new file mode 100644
index 00000000000..5fca5be4ce8
--- /dev/null
+++ b/meta/recipes-devtools/go/go/CVE-2026-56862.patch
@@ -0,0 +1,98 @@
+From 616c582eae27699513109445d5c177b42c3bb9fc Mon Sep 17 00:00:00 2001
+From: "Nicholas S. Husin" <nsh@golang.org>
+Date: Wed, 22 Jul 2026 12:27:12 -0400
+Subject: [PATCH] crypto/tls: do not count handshake messages as
+ state-advancing post-handshake
+
+Previously, we always counted handshake messages, such as KeyUpdate, as
+state-advancing, regardless of whether a handshake has been completed or
+not. As a result, a malicious client can keep sending KeyUpdate messages
+to force the server to keep performing key derivation operations
+indefinitely.
+
+Fix the issue by making it so that handshake messages are regarded
+as state-advancing only prior to handshake completion.
+
+Thank you to Qi Deng of Aurascape.ai for reporting this issue.
+
+Fixes #79866
+Fixes #80528
+Fixes CVE-2026-56862
+
+Change-Id: I37d27fd5f16227a9dde5f29bb5ae6c436a6a6964
+Reviewed-on: https://go-review.googlesource.com/c/go/+/804261
+Reviewed-by: Roland Shoemaker <roland@golang.org>
+Reviewed-by: Neal Patel <nealpatel@google.com>
+LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Reviewed-by: Neal Patel <neal@golang.org>
+
+CVE: CVE-2026-56862
+Upstream-Status: Backport [https://github.com/golang/go/commit/27420571845abc6a97e19e21542a3213a74f67f4]
+
+Backport notes for go1.22.12:
+- Dropped the src/crypto/tls/bogo_config.json hunk; the BoGo test
+ harness and its config do not exist in Go 1.22.
+- Test uses testConfig instead of testConfigClient/testConfigServer,
+ which were introduced after Go 1.22.
+
+Signed-off-by: Benhur Tessele <benhur.tessele@est.tech>
+---
+ src/crypto/tls/conn.go | 2 +-
+ src/crypto/tls/conn_test.go | 34 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/src/crypto/tls/conn.go b/src/crypto/tls/conn.go
+index 770d456f18..376b2dcd1e 100644
+--- a/src/crypto/tls/conn.go
++++ b/src/crypto/tls/conn.go
+@@ -699,7 +699,7 @@ func (c *Conn) readRecordOrCCS(expectChangeCipherSpec bool) error {
+ return c.in.setErrorLocked(c.sendAlert(alertUnexpectedMessage))
+ }
+
+- if typ != recordTypeAlert && typ != recordTypeChangeCipherSpec && len(data) > 0 {
++ if (typ == recordTypeApplicationData || (typ == recordTypeHandshake && !handshakeComplete)) && len(data) > 0 {
+ // This is a state-advancing message: reset the retry count.
+ c.retryCount = 0
+ }
+diff --git a/src/crypto/tls/conn_test.go b/src/crypto/tls/conn_test.go
+index 5e090a017d..303012ccc5 100644
+--- a/src/crypto/tls/conn_test.go
++++ b/src/crypto/tls/conn_test.go
+@@ -317,3 +317,37 @@ func TestRecordBadVersionTLS13(t *testing.T) {
+ t.Fatalf("unexpected error: got %q, want %q", err, expectedErr)
+ }
+ }
++
++// TestKeyUpdateSpamPostHandshakeTLS13 tests that TLS 1.3 KeyUpdate messages do
++// not count as a state-advancing message after a handshake has been completed.
++func TestKeyUpdateSpamPostHandshakeTLS13(t *testing.T) {
++ client, server := localPipe(t)
++ defer server.Close()
++ defer client.Close()
++
++ go func() {
++ c := Client(client, testConfig.Clone())
++ if err := c.Handshake(); err != nil {
++ t.Error(err)
++ return
++ }
++ ku, err := (&keyUpdateMsg{}).marshal()
++ if err != nil {
++ t.Error(err)
++ return
++ }
++ cs := cipherSuiteTLS13ByID(c.cipherSuite)
++ for i := 0; i <= maxUselessRecords; i++ {
++ c.writeRecordLocked(recordTypeHandshake, ku)
++ c.setWriteTrafficSecret(cs, QUICEncryptionLevelInitial, cs.nextTrafficSecret(c.out.trafficSecret))
++ }
++ }()
++ s := Server(server, testConfig.Clone())
++ if err := s.Handshake(); err != nil {
++ t.Fatal(err)
++ }
++ expectedErr := "tls: too many non-advancing records"
++ if _, err := s.Read(make([]byte, 1)); err == nil || err.Error() != expectedErr {
++ t.Fatalf("unexpected error: got %v, want %q", err, expectedErr)
++ }
++}
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 18/55] libpcre2: update to latest release branch hash 50b3c0d7ce
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (16 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 17/55] go: fix CVE-2026-56862 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 19/55] python3-urllib3: Fix CVE-2026-97689 Yoann Congal
` (36 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Handles CVE-2026-103111, CVE-2026-86145, CVE-2026-89158, CVE-2026-89160,
CVE-2026-89157, CVE-2026-89156 and CVE-2026-89161.
The project committed to have 5 year security support for each release
on a dedicated release branch.
Switch from release tarball to git fetcher to use this feature.
Git log with all changes and manually created CVE annotations:
$ git log --oneline pcre2-10.43..50b3c0d7ceaf23578d04e644c02781c322ef6cb0
50b3c0d7 Backport of pcre2-10.49-Fix-large-stack-allocation.patch [CVE-2026-103111]
b7d3ffd4 Backport of pcre2-10.48-Fix-DFA-workspace-overflows.patch [CVE-2026-86145]
9c11f0dc Backport of pcre2-10.48-Fix-compiler-integer-overflows.patch [CVE-2026-89158]
2866e543 Backport of pcre2-10.48-Fix-invalid-UTF-backwards-scans.patch [CVE-2026-89160]
714e1062 Backport of pcre2-10.48-Fix-allocation-byte-sizing.patch [CVE-2026-89157]
91759151 Backport of pcre2-10.48-Check-JIT-mode-before-validation.patch [CVE-2026-89156]
87f50503 Backport of pcre2-10.48-Fix-JIT-match-context-reuse.patch [CVE-2026-89161]
ed0e58f5 Backport of pcre2-10.48-Fix-JIT-STR_END.patch
dc733f56 Backport of pcre2-10.44-Fix-incorrect-compiling.patch
7f3e5400 Backport of pcre2-10.44-Fix-locking-region.patch
Diff of release tarball and git repository is:
Only in pcre2-10.43/: aclocal.m4
Only in pcre2-10.43/: ar-lib
Only in libpcre2-10.43+git/: autogen.sh
Only in libpcre2-10.43+git/: .bazelrc
Only in libpcre2-10.43+git/: BUILD.bazel
Only in libpcre2-10.43+git/: build.zig
Only in pcre2-10.43/: compile
Only in pcre2-10.43/: config.guess
Only in pcre2-10.43/: config.sub
Only in pcre2-10.43/: configure
Only in pcre2-10.43/: depcomp
Only in libpcre2-10.43+git/: .git
Only in libpcre2-10.43+git/: .github
Only in libpcre2-10.43+git/: .gitignore
Only in libpcre2-10.43+git/: index.md
Only in pcre2-10.43/: INSTALL
Only in pcre2-10.43/: install-sh
Only in pcre2-10.43/: ltmain.sh
Only in pcre2-10.43/m4: libtool.m4
Only in pcre2-10.43/m4: lt~obsolete.m4
Only in pcre2-10.43/m4: ltoptions.m4
Only in pcre2-10.43/m4: ltsugar.m4
Only in pcre2-10.43/m4: ltversion.m4
Only in libpcre2-10.43+git/: maint
Only in pcre2-10.43/: Makefile.in
Only in pcre2-10.43/: missing
Only in libpcre2-10.43+git/: MODULE.bazel
Only in libpcre2-10.43+git/: pcre2_fuzzer_16.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer_16.options
Only in libpcre2-10.43+git/: pcre2_fuzzer_32.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer_32.options
Only in libpcre2-10.43+git/: pcre2_fuzzer.dict
Only in libpcre2-10.43+git/: pcre2_fuzzer.options
Only in libpcre2-10.43+git/: README.md
Only in pcre2-10.43/: test-driver
Only in libpcre2-10.43+git/: WORKSPACE.bazel
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../recipes-support/libpcre/libpcre2_10.43.bb | 20 +++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/meta/recipes-support/libpcre/libpcre2_10.43.bb b/meta/recipes-support/libpcre/libpcre2_10.43.bb
index f744df88fad..743b0ec04e5 100644
--- a/meta/recipes-support/libpcre/libpcre2_10.43.bb
+++ b/meta/recipes-support/libpcre/libpcre2_10.43.bb
@@ -10,23 +10,27 @@ SECTION = "devel"
LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENCE;md5=321a5eb46acae6b6c1ff2c7a866d836a"
-SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2"
-
-GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"
-UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$"
-
-SRC_URI[sha256sum] = "e2a53984ff0b07dfdb5ae4486bbb9b21cca8e7df2434096cc9bf1b728c350bcb"
+BASE_VER = "${@d.getVar('PV').split('+')[0]}"
+SRC_URI = "git://github.com/PCRE2Project/pcre2;protocol=https;branch=release/pcre2-${BASE_VER}"
+SRCREV = "50b3c0d7ceaf23578d04e644c02781c322ef6cb0"
+PV .= "+git"
CVE_PRODUCT = "pcre2"
-S = "${WORKDIR}/pcre2-${PV}"
+CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
+CVE_STATUS_STABLE_BACKPORTS = "CVE-2026-103111 CVE-2026-86145 CVE-2026-89158 CVE-2026-89160 \
+ CVE-2026-89157 CVE-2026-89156 CVE-2026-89161 \
+"
+CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
+
+S = "${WORKDIR}/git"
PROVIDES += "pcre2"
DEPENDS += "bzip2 zlib"
BINCONFIG = "${bindir}/pcre2-config"
-inherit autotools binconfig-disabled github-releases
+inherit autotools binconfig-disabled
EXTRA_OECONF = "\
--enable-newline-is-lf \
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 19/55] python3-urllib3: Fix CVE-2026-97689
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (17 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 18/55] libpcre2: update to latest release branch hash 50b3c0d7ce Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 20/55] python3-pyelftools: add python3-logging to RDEPENDS Yoann Congal
` (35 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Backport the upstream fix [1] as mentioned in [2]
[1] https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed
[2] https://nvd.nist.gov/vuln/detail/cve-2026-97689
Testing:
- test_response.py::test_chunk_size_line_too_long - passed
- test_response.py::test_chunk_trailer_line_length (6 cases) - passed
- test_socketlevel.py::test_chunked_size_line_too_long_does_not_buffer - passed
- Full test_response.py: 161 passed, 45 skipped (no regressions)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python3-urllib3/CVE-2026-97689.patch | 251 ++++++++++++++++++
.../python/python3-urllib3_2.2.2.bb | 14 +-
2 files changed, 258 insertions(+), 7 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch
new file mode 100644
index 00000000000..98b007324cf
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-97689.patch
@@ -0,0 +1,251 @@
+From 5d5fac45ff18a8159c5a4aa973ed9fc2f5dd35ad Mon Sep 17 00:00:00 2001
+From: Quentin Pradet <quentin.pradet@gmail.com>
+Date: Tue, 15 Sep 2026 22:33:41 +0400
+Subject: [PATCH] Merge commit from fork
+
+* Bound chunk-size line reads to prevent memory exhaustion DoS
+
+The streaming chunked path (HTTPResponse.stream() / read_chunked()) read
+each chunk-size line with an unbounded readline(), unlike the plain read()
+path which delegates to http.client's _MAXLINE-capped reader. A malicious
+server could advertise Transfer-Encoding: chunked and then send a very long
+run of bytes with no newline, forcing the client to buffer the entire run
+before the chunk size could be rejected.
+
+This caps the chunk-size line (and the trailing CRLF line) at _MAXLINE,
+raising ProtocolError when exceeded, matching the behaviour read() already
+had. Only the size line is bounded; chunk bodies still go through the sized
+_safe_read(), so legitimate large chunks are unaffected.
+
+Verified with a local malicious server streaming a 200 MiB unterminated
+size line: stream() previously grew RSS by ~530 MB, now stays at ~1 MB and
+fails fast, matching read(). A 5 MiB chunk body still streams correctly.
+
+* Fix a black formatting issue
+
+* Test chunked response trailer length limits
+
+* Fix number in the changelog entry
+
+---------
+
+Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
+
+CVE: CVE-2026-97689
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed]
+
+Note:
+ - changeLog change is not backported
+ - Adjusted commit change as per current version
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ src/urllib3/response.py | 20 +++++-
+ test/test_response.py | 82 ++++++++++++++++++++++-
+ test/with_dummyserver/test_socketlevel.py | 34 ++++++++++
+ 3 files changed, 132 insertions(+), 4 deletions(-)
+
+diff --git a/src/urllib3/response.py b/src/urllib3/response.py
+index d52e37a..caeec0a 100644
+--- a/src/urllib3/response.py
++++ b/src/urllib3/response.py
+@@ -67,6 +67,13 @@ if typing.TYPE_CHECKING:
+
+ log = logging.getLogger(__name__)
+
++# Maximum length of a chunk-size line (and the trailing CRLF line) when reading a
++# chunked-transfer-encoded response. Matches ``http.client._MAXLINE`` so urllib3's
++# streaming path bounds these reads exactly like the stdlib ``.read()`` path does,
++# preventing a malicious server from forcing unbounded buffering (memory exhaustion)
++# via an unterminated chunk-size line.
++_MAX_CHUNK_LINE_LENGTH = 2**16
++
+
+ class ContentDecoder:
+ def decompress(self, data: bytes, max_length: int = -1) -> bytes:
+@@ -1333,7 +1340,12 @@ class HTTPResponse(BaseHTTPResponse):
+ # we'll try to read it from socket.
+ if self.chunk_left is not None:
+ return None
+- line = self._fp.fp.readline() # type: ignore[union-attr]
++ line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1) # type: ignore[union-attr]
++ if len(line) > _MAX_CHUNK_LINE_LENGTH:
++ self.close()
++ raise ProtocolError(
++ "Response chunk size line exceeded maximum allowed length"
++ ) from None
+ line = line.split(b";", 1)[0]
+ try:
+ self.chunk_left = int(line, 16)
+@@ -1437,7 +1449,11 @@ class HTTPResponse(BaseHTTPResponse):
+
+ # Chunk content ends with \r\n: discard it.
+ while self._fp is not None:
+- line = self._fp.fp.readline()
++ line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1)
++ if len(line) > _MAX_CHUNK_LINE_LENGTH:
++ raise ProtocolError(
++ "Response chunk trailer line exceeded maximum allowed length"
++ )
+ if not line:
+ # Some sites may not end with '\r\n'.
+ break
+diff --git a/test/test_response.py b/test/test_response.py
+index 0e8abd9..2871ac2 100644
+--- a/test/test_response.py
++++ b/test/test_response.py
+@@ -26,6 +26,7 @@ from urllib3.exceptions import (
+ SSLError,
+ )
+ from urllib3.response import ( # type: ignore[attr-defined]
++ _MAX_CHUNK_LINE_LENGTH,
+ BaseHTTPResponse,
+ BytesQueueBuffer,
+ HTTPResponse,
+@@ -1375,6 +1376,63 @@ class TestResponse:
+ assert isinstance(orig_ex, InvalidChunkLength)
+ assert orig_ex.length == fp.BAD_LENGTH_LINE.encode()
+
++ def test_chunk_size_line_too_long(self) -> None:
++ # A malicious server can send a chunk-size line with no newline. urllib3's
++ # streaming path must reject it with a bounded read rather than buffering
++ # the whole line (memory exhaustion). See GHSA / CVE for chunked DoS.
++ stream = [b"foooo"]
++ fp = MockChunkedEncodingLongChunkSizeLine(stream)
++ r = httplib.HTTPResponse(MockSock) # type: ignore[arg-type]
++ r.fp = fp # type: ignore[assignment]
++ r.chunked = True
++ r.chunk_left = None
++ resp = HTTPResponse(
++ r, preload_content=False, headers={"transfer-encoding": "chunked"}
++ )
++ with pytest.raises(ProtocolError) as ctx:
++ next(resp.read_chunked())
++
++ assert "chunk size line exceeded maximum allowed length" in str(ctx.value)
++
++ @pytest.mark.parametrize(
++ "trailer_length",
++ [
++ _MAX_CHUNK_LINE_LENGTH - 1,
++ _MAX_CHUNK_LINE_LENGTH,
++ _MAX_CHUNK_LINE_LENGTH + 1,
++ ],
++ )
++ @pytest.mark.parametrize("line_ending", [b"\r\n", b""])
++ def test_chunk_trailer_line_length(
++ self, trailer_length: int, line_ending: bytes
++ ) -> None:
++ # The line limit includes its CRLF, but not the final blank line.
++ trailer = b"X:" + b"x" * (trailer_length - 2 - len(line_ending)) + line_ending
++ fp = BytesIO(b"3\r\nfoo\r\n0\r\n" + trailer + (b"\r\n" if line_ending else b""))
++ r = httplib.HTTPResponse(MockSock, method="GET") # type: ignore[arg-type]
++ r.fp = fp # type: ignore[assignment]
++ resp = HTTPResponse(
++ r,
++ preload_content=False,
++ headers={"transfer-encoding": "chunked"},
++ original_response=r,
++ )
++ chunks = resp.read_chunked()
++ assert next(chunks) == b"foo"
++
++ if trailer_length > _MAX_CHUNK_LINE_LENGTH:
++ with pytest.raises(
++ ProtocolError,
++ match="Response chunk trailer line exceeded maximum allowed length",
++ ):
++ next(chunks)
++ else:
++ assert list(chunks) == []
++
++ assert fp.closed
++ assert r.isclosed()
++ assert resp.closed
++
+ def test_truncated_before_chunk(self) -> None:
+ stream = [b"foooo", b"bbbbaaaaar"]
+ fp = MockChunkedNoChunks(stream)
+@@ -1629,8 +1687,20 @@ class MockChunkedEncodingResponse:
+ self.cur_chunk = self.cur_chunk[amt:]
+ return chunk_part
+
+- def readline(self) -> bytes:
+- return self.pop_current_chunk(till_crlf=True)
++ def readline(self, amt: int = -1) -> bytes:
++ # Emulate a real file object's readline(size): return bytes up to and
++ # including the first newline, or at most ``amt`` bytes when ``amt >= 0``,
++ # whichever comes first.
++ if len(self.cur_chunk) <= 0:
++ self.cur_chunk = self._pop_new_chunk()
++ line = self.cur_chunk
++ newline_index = line.find(b"\n")
++ if newline_index != -1:
++ line = line[: newline_index + 1]
++ if 0 <= amt < len(line):
++ line = line[:amt]
++ self.cur_chunk = self.cur_chunk[len(line) :]
++ return line
+
+ def read(self, amt: int = -1) -> bytes:
+ return self.pop_current_chunk(amt)
+@@ -1658,6 +1728,14 @@ class MockChunkedInvalidChunkLength(MockChunkedEncodingResponse):
+ return f"{self.BAD_LENGTH_LINE}{chunk.decode()}\r\n".encode()
+
+
++class MockChunkedEncodingLongChunkSizeLine(MockChunkedEncodingResponse):
++ def _encode_chunk(self, chunk: bytes) -> bytes:
++ # A chunk-size line far longer than _MAX_CHUNK_LINE_LENGTH with no
++ # newline, simulating a malicious server that never terminates the
++ # size line (memory-exhaustion attack).
++ return b"f" * (2**16 + 1024)
++
++
+ class MockChunkedEncodingWithoutCRLFOnEnd(MockChunkedEncodingResponse):
+ def _encode_chunk(self, chunk: bytes) -> bytes:
+ return "{:X}\r\n{}{}".format(
+diff --git a/test/with_dummyserver/test_socketlevel.py b/test/with_dummyserver/test_socketlevel.py
+index dceb5ee..2b258ae 100644
+--- a/test/with_dummyserver/test_socketlevel.py
++++ b/test/with_dummyserver/test_socketlevel.py
+@@ -2055,6 +2055,40 @@ class TestStream(SocketDummyServerTestCase):
+
+ done_event.set()
+
++ def test_chunked_size_line_too_long_does_not_buffer(self) -> None:
++ # A malicious server can advertise chunked encoding and then send an
++ # unterminated chunk-size line (no newline). The streaming path must
++ # reject it with a bounded read instead of buffering the whole run,
++ # which would exhaust memory.
++ done_event = Event()
++ # Well above the 65536-byte cap, but small enough for a fast test.
++ run_length = 512 * 1024
++
++ def socket_handler(listener: socket.socket) -> None:
++ sock = listener.accept()[0]
++
++ buf = b""
++ while not buf.endswith(b"\r\n\r\n"):
++ buf += sock.recv(65536)
++
++ sock.sendall(b"HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n")
++ # A chunk-size line that never terminates with a newline.
++ with contextlib.suppress(OSError):
++ sock.sendall(b"f" * run_length)
++
++ done_event.wait(5)
++ sock.close()
++
++ self._start_server(socket_handler)
++
++ with HTTPConnectionPool(self.host, self.port, retries=False) as pool:
++ r = pool.request("GET", "/", timeout=LONG_TIMEOUT, preload_content=False)
++ with pytest.raises(ProtocolError) as ctx:
++ next(r.stream(65536))
++ assert "chunk size line exceeded maximum allowed length" in str(ctx.value)
++
++ done_event.set()
++
+ def test_large_compressed_stream(self) -> None:
+ done_event = Event()
+ expected_total_length = 296085
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb b/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb
index b77dd5297d3..7ca210429b7 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb
@@ -7,13 +7,13 @@ SRC_URI[sha256sum] = "dd505485549a7a552833da5e6063639d0d177c04f23bc3864e41e5dc5f
inherit pypi python_hatchling
-SRC_URI += " \
- file://CVE-2025-50181.patch \
- file://CVE-2025-66418.patch \
- file://CVE-2025-66471.patch \
- file://CVE-2026-21441.patch \
- file://CVE-2026-44431.patch \
-"
+SRC_URI += "file://CVE-2025-50181.patch \
+ file://CVE-2025-66418.patch \
+ file://CVE-2025-66471.patch \
+ file://CVE-2026-21441.patch \
+ file://CVE-2026-44431.patch \
+ file://CVE-2026-97689.patch \
+ "
RDEPENDS:${PN} += "\
python3-certifi \
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 20/55] python3-pyelftools: add python3-logging to RDEPENDS
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (18 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 19/55] python3-urllib3: Fix CVE-2026-97689 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 21/55] glibc: patch CVE-2026-5928 Yoann Congal
` (34 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Theo GAIGE <tgaige.opensource@witekio.com>
python3-logging is needed as a runtime dependency of python3-pyelftools
else the readelf.py script run into the following error :
```
Traceback (most recent call last):
File "/usr/bin/readelf.py", line 31, in <module>
from elftools.elf.elffile import ELFFile
File "/usr/lib/python3.12/site-packages/elftools/elf/elffile.py", line 29, in <module>
from ..dwarf.dwarfinfo import DWARFInfo, DebugSectionDescriptor, DwarfConfig
File "/usr/lib/python3.12/site-packages/elftools/dwarf/dwarfinfo.py", line 17, in <module>
from .structs import DWARFStructs
File "/usr/lib/python3.12/site-packages/elftools/dwarf/structs.py", line 10, in <module>
from logging.config import valid_ident
ModuleNotFoundError: No module named 'logging'
```
Signed-off-by: Theo GAIGE <tgaige.opensource@witekio.com>
Reviewed-by: Louis Rannou <louis.rannou@non.se.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 9b956f6b5a345bd3022a9e64fa70a0365bfac502)
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3-pyelftools_0.30.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-devtools/python/python3-pyelftools_0.30.bb b/meta/recipes-devtools/python/python3-pyelftools_0.30.bb
index 837edb71653..b799f5acf8a 100644
--- a/meta/recipes-devtools/python/python3-pyelftools_0.30.bb
+++ b/meta/recipes-devtools/python/python3-pyelftools_0.30.bb
@@ -12,4 +12,4 @@ inherit pypi setuptools3
BBCLASSEXTEND = "native"
-RDEPENDS:${PN} += "python3-debugger python3-pprint"
+RDEPENDS:${PN} += "python3-debugger python3-pprint python3-logging"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 21/55] glibc: patch CVE-2026-5928
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (19 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 20/55] python3-pyelftools: add python3-logging to RDEPENDS Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 22/55] glibc: patch CVE-2026-5450 Yoann Congal
` (33 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch [1] which is [2] backported to 2.41 (oldest release still
receiving security updates) which is mentioned in [3].
[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=8941538b92a574a24e9308e164869239d2b0d845
[2] https://sourceware.org/git/?p=glibc.git;a=commit;h=ef3bfb5f910011f3780cb06aa47e730035f53285
[3] https://security-tracker.debian.org/tracker/CVE-2026-5928
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0031-CVE-2026-5928.patch | 112 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 113 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch
diff --git a/meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch b/meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch
new file mode 100644
index 00000000000..60b81e74529
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0031-CVE-2026-5928.patch
@@ -0,0 +1,112 @@
+From 8941538b92a574a24e9308e164869239d2b0d845 Mon Sep 17 00:00:00 2001
+From: Rocket Ma <marocketbd@gmail.com>
+Date: Fri, 1 May 2026 20:39:07 -0700
+Subject: [PATCH] libio: Fix ungetwc operating on byte stream [BZ #33998]
+
+* libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one
+character, it accidently compare the wchar to push back with the last
+char from byte stream, instead of wide stream. Under specific coding,
+attacker may exploit this to leak information. This commit fix bug
+33998, or CVE-2026-5928.
+
+Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+(cherry picked from commit ef3bfb5f910011f3780cb06aa47e730035f53285)
+
+CVE: CVE-2026-5928
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=8941538b92a574a24e9308e164869239d2b0d845]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libio/Makefile | 1 +
+ libio/bug-wgenops-bz33998.c | 54 +++++++++++++++++++++++++++++++++++++
+ libio/wgenops.c | 4 +--
+ 3 files changed, 57 insertions(+), 2 deletions(-)
+ create mode 100644 libio/bug-wgenops-bz33998.c
+
+diff --git a/libio/Makefile b/libio/Makefile
+index e143ccdb2c..43ee8db06d 100644
+--- a/libio/Makefile
++++ b/libio/Makefile
+@@ -83,6 +83,7 @@ tests = \
+ bug-ungetwc1 \
+ bug-ungetwc2 \
+ bug-wfflush \
++ bug-wgenops-bz33998 \
+ bug-wmemstream1 \
+ bug-wsetpos \
+ test-fmemopen \
+diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c
+new file mode 100644
+index 0000000000..cc4067da99
+--- /dev/null
++++ b/libio/bug-wgenops-bz33998.c
+@@ -0,0 +1,54 @@
++/* Regression test for ungetwc operating on byte stream (BZ #33998)
++ Copyright (C) 2026 The GNU Toolchain Authors.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include "support/temp_file.h"
++#include "support/xstdio.h"
++#include "support/xunistd.h"
++#include <stdlib.h>
++#include <unistd.h>
++#include <sys/mman.h>
++#include <stdio.h>
++#include <wchar.h>
++#include <support/check.h>
++
++static int
++do_test (void)
++{
++ char *filename;
++ int fd = create_temp_file ("tst-bz33998-", &filename);
++ TEST_VERIFY (fd != -1);
++ xwrite (fd, "A", sizeof ("A")); // write "A\0" by design
++ xclose (fd);
++
++ FILE *fp = xfopen (filename, "r+");
++ TEST_COMPARE (getwc (fp), L'A');
++ /* If the bug is fixed, then ungetwc should not touch byte stream.
++ If the bug is not fixed, ungetwc firstly match last read char, L'A',
++ failed, then the pbackfail branch, matching last read char in byte
++ stream, that is, '\0' (initialized when setup wide stream). */
++ char *old_read_ptr = fp->_IO_read_ptr;
++ TEST_COMPARE (ungetwc (L'\0', fp), L'\0');
++ TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr);
++
++ xfclose (fp);
++ free (filename);
++
++ return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/libio/wgenops.c b/libio/wgenops.c
+index 0a11d1b1de..9e0b2c00ea 100644
+--- a/libio/wgenops.c
++++ b/libio/wgenops.c
+@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c)
+ {
+ if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base
+ && !_IO_in_backup (fp)
+- && (wint_t) fp->_IO_read_ptr[-1] == c)
+- --fp->_IO_read_ptr;
++ && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c)
++ --fp->_wide_data->_IO_read_ptr;
+ else
+ {
+ /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index d31c8656414..0a4f7ac3bd6 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -63,6 +63,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0028-CVE-2026-6238-0004.patch \
file://0029-CVE-2026-6238-0005.patch \
file://0030-CVE-2026-6238-0006.patch \
+ file://0031-CVE-2026-5928.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 22/55] glibc: patch CVE-2026-5450
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (20 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 21/55] glibc: patch CVE-2026-5928 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 23/55] glibc: patch CVE-2026-6791 Yoann Congal
` (32 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch [1] which is [2] backported to 2.41 (oldest release still
receiving security updates) which is mentioned in [3].
[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=1a74f82eedaf0987eda1f522121e6a48fac502e7
[2] https://sourceware.org/git/?p=glibc.git;a=commit;h=839898777226a3ed88c0859f25ffe712519b4ead
[3] https://security-tracker.debian.org/tracker/CVE-2026-5450
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0032-CVE-2026-5450.patch | 133 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 134 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch
diff --git a/meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch b/meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch
new file mode 100644
index 00000000000..631b63f4654
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0032-CVE-2026-5450.patch
@@ -0,0 +1,133 @@
+From 1a74f82eedaf0987eda1f522121e6a48fac502e7 Mon Sep 17 00:00:00 2001
+From: Rocket Ma <marocketbd@gmail.com>
+Date: Fri, 17 Apr 2026 23:48:41 -0700
+Subject: [PATCH] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
+
+* stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
+format %mc or %mC, glibc allocates one byte less, leading to
+user-controlled one byte overflow. This commit fixes BZ #34008, or
+CVE-2026-5450.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+(cherry picked from commit 839898777226a3ed88c0859f25ffe712519b4ead)
+
+CVE: CVE-2026-5450
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=1a74f82eedaf0987eda1f522121e6a48fac502e7]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ stdio-common/Makefile | 4 +++
+ stdio-common/tst-vfscanf-bz34008.c | 48 ++++++++++++++++++++++++++++++
+ stdio-common/vfscanf-internal.c | 7 ++---
+ 3 files changed, 55 insertions(+), 4 deletions(-)
+ create mode 100644 stdio-common/tst-vfscanf-bz34008.c
+
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index ac098dcd8a..72c18e5dc1 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -266,6 +266,7 @@ tests := \
+ tst-vfprintf-width-i18n \
+ tst-vfprintf-width-prec \
+ tst-vfprintf-width-prec-alloc \
++ tst-vfscanf-bz34008 \
+ tst-wc-printf \
+ tstdiomisc \
+ tstgetln \
+@@ -401,6 +402,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \
+ tst-vfprintf-width-prec-ENV = \
+ MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \
+ LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
++tst-vfscanf-bz34008-ENV = \
++ MALLOC_CHECK_=3 \
++ LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+ tst-printf-bz25691-ENV = \
+ MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \
+ LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf-bz34008.c
+new file mode 100644
+index 0000000000..48371c8a3d
+--- /dev/null
++++ b/stdio-common/tst-vfscanf-bz34008.c
+@@ -0,0 +1,48 @@
++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008)
++ Copyright (C) 2026 The GNU Toolchain Authors.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include "malloc/mcheck.h"
++#include <stddef.h>
++#include <stdio.h>
++#include <string.h>
++#include <wchar.h>
++#include <stdlib.h>
++#include <malloc.h>
++#include <support/check.h>
++
++#define WIDTH 0x410
++#define SCANFSTR "%1040mc"
++static int
++do_test (void)
++{
++ mcheck_pedantic (NULL);
++ char *input = malloc (WIDTH + 1);
++ TEST_VERIFY (input != NULL);
++ memset (input, 'A', WIDTH);
++ input[WIDTH] = '\0';
++
++ char *buf = NULL;
++ TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1);
++ TEST_VERIFY (buf != NULL);
++
++ free (buf);
++ free (input);
++ return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
+index 1ba034d961..fabb0ec874 100644
+--- a/stdio-common/vfscanf-internal.c
++++ b/stdio-common/vfscanf-internal.c
+@@ -853,8 +853,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ {
+ /* Enlarge the buffer. */
+ size_t newsize
+- = strsize
+- + (strsize >= width ? width - 1 : strsize);
++ = strsize + (strsize >= width ? width : strsize);
+
+ str = (char *) realloc (*strptr, newsize);
+ if (str == NULL)
+@@ -925,7 +924,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ && wstr == (wchar_t *) *strptr + strsize)
+ {
+ size_t newsize
+- = strsize + (strsize > width ? width - 1 : strsize);
++ = strsize + (strsize >= width ? width : strsize);
+ /* Enlarge the buffer. */
+ wstr = (wchar_t *) realloc (*strptr,
+ newsize * sizeof (wchar_t));
+@@ -980,7 +979,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ && wstr == (wchar_t *) *strptr + strsize)
+ {
+ size_t newsize
+- = strsize + (strsize > width ? width - 1 : strsize);
++ = strsize + (strsize >= width ? width : strsize);
+ /* Enlarge the buffer. */
+ wstr = (wchar_t *) realloc (*strptr,
+ newsize * sizeof (wchar_t));
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 0a4f7ac3bd6..e62d941fdde 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -64,6 +64,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0029-CVE-2026-6238-0005.patch \
file://0030-CVE-2026-6238-0006.patch \
file://0031-CVE-2026-5928.patch \
+ file://0032-CVE-2026-5450.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 23/55] glibc: patch CVE-2026-6791
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (21 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 22/55] glibc: patch CVE-2026-5450 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 24/55] glibc: patch CVE-2026-6368 Yoann Congal
` (31 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0033-CVE-2026-6791.patch | 364 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 365 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch
diff --git a/meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch b/meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch
new file mode 100644
index 00000000000..83294df46e8
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0033-CVE-2026-6791.patch
@@ -0,0 +1,364 @@
+From 965b580070b8184b0dd390800d9194291a600e67 Mon Sep 17 00:00:00 2001
+From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date: Tue, 14 Apr 2026 10:50:37 -0300
+Subject: [PATCH] posix: Fix stack overflow in wordexp tilde expansion (BZ
+ 34091, CVE-2026-6791)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The parse_tilde function previously used strndupa to allocate memory
+for the parsed username on the stack, and since the input is
+user-defined, this can lead to a stack overflow.
+
+This patch fixes the issue by replacing strndupa with scratch_buffer,
+by reusing the buffer used in the __getpwnam_r call.
+
+The new “tst-wordexp-tilde.c” test is a test-container to avoid using
+system-defined NSS modules.
+
+Checked on x86_64-linux-gnu and i686-linux-gnu.
+
+(cherry picked from commit 07c24f35392b727e6100d33edfdf811a6c68c218)
+
+CVE: CVE-2026-6791
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=965b580070b8184b0dd390800d9194291a600e67]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ posix/Makefile | 1 +
+ posix/tst-wordexp-tilde.c | 244 ++++++++++++++++++
+ posix/tst-wordexp-tilde.root/etc/group | 1 +
+ .../tst-wordexp-tilde.root/etc/nsswitch.conf | 3 +
+ posix/tst-wordexp-tilde.root/etc/passwd | 1 +
+ posix/wordexp.c | 24 +-
+ 6 files changed, 268 insertions(+), 6 deletions(-)
+ create mode 100644 posix/tst-wordexp-tilde.c
+ create mode 100644 posix/tst-wordexp-tilde.root/etc/group
+ create mode 100644 posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+ create mode 100644 posix/tst-wordexp-tilde.root/etc/passwd
+
+diff --git a/posix/Makefile b/posix/Makefile
+index 9360bc7ff8..c2c05b3973 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -354,6 +354,7 @@ tests-internal := \
+ tests-container := \
+ bug-ga2 \
+ tst-vfork3 \
++ tst-wordexp-tilde \
+ # tests-container
+
+ tests-time64 := \
+diff --git a/posix/tst-wordexp-tilde.c b/posix/tst-wordexp-tilde.c
+new file mode 100644
+index 0000000000..1661603681
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.c
+@@ -0,0 +1,244 @@
++/* Test wordexp tilde expansion with large usernames (BZ 34091).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include <pwd.h>
++#include <stdio.h>
++#include <string.h>
++#include <wordexp.h>
++#include <stdlib.h>
++#include <sys/resource.h>
++
++#include <support/check.h>
++#include <support/support.h>
++#include <support/xunistd.h>
++#include <support/namespace.h>
++
++typedef void (*func_callback_t)(void);
++
++static void
++subprocess_small_stack (void *closure)
++{
++ struct rlimit rl;
++ TEST_COMPARE (getrlimit (RLIMIT_STACK, &rl), 0);
++ rl.rlim_cur = 512 * 1024;
++ TEST_COMPARE (setrlimit (RLIMIT_STACK, &rl), 0);
++
++ func_callback_t func_test = closure;
++ func_test ();
++}
++
++/* Build a string "~<padding>/tail" where <padding> is LEN bytes of the
++ character CH. The caller must free the result. */
++static char *
++make_tilde_input (char ch, size_t len, const char *tail)
++{
++ /* ~ + len + / + tail + \0 */
++ size_t taillen = tail != NULL ? strlen (tail) : 0;
++ size_t total = 1 + len + 1 + taillen + 1;
++ char *buf = xmalloc (total);
++ buf[0] = '~';
++ memset (buf + 1, ch, len);
++ buf[1 + len] = '/';
++ if (tail != NULL)
++ memcpy (buf + 1 + len + 1, tail, taillen);
++ buf[total - 1] = '\0';
++ return buf;
++}
++
++/* Test 1: A very long username must not crash. The username will not match
++ any real user, so wordexp returns ~<long>/rest. */
++static void
++test_long_username (void)
++{
++ printf ("info: test_long_username_no_crash\n");
++
++ static const char REST[] = "rest";
++
++ /* 1 MiB username — well beyond any reasonable stack frame. */
++ const size_t long_len = 1024 * 1024;
++ char *input = make_tilde_input ('A', long_len, REST);
++
++ wordexp_t we = { 0 };
++ int ret = wordexp (input, &we, 0);
++ /* The (non-existent) username is invalid, so wordexp falls back to
++ literal output: ~AAA…/rest. */
++ TEST_COMPARE (ret, 0);
++ TEST_COMPARE (we.we_wordc, 1);
++
++ /* Verify prefix: '~' followed by long_len 'A's. */
++ const char *result = we.we_wordv[0];
++ TEST_COMPARE (result[0], '~');
++ TEST_COMPARE (strlen (result),
++ 1 /* ~ */ + long_len + sizeof (REST));
++ for (size_t j = 1; j <= long_len; j++)
++ if (result[j] != 'A')
++ {
++ printf (" mismatch at position %zu: expected 'A', got '%c'\n",
++ j, result[j]);
++ support_record_failure ();
++ break;
++ }
++ /* Verify the tail after the username. */
++ TEST_COMPARE_STRING (result + 1 + long_len, "/rest");
++
++ wordfree (&we);
++ free (input);
++}
++
++/* Test 2: A username that just exceeds the default scratch_buffer inline
++ size (1024 bytes) exercises the scratch_buffer_set_array_size growth path
++ without being excessively large. */
++static void
++test_scratch_buffer_growth (void)
++{
++ printf ("info: test_scratch_buffer_growth\n");
++
++ const size_t len = 2048;
++ char *input = make_tilde_input ('x', len, NULL);
++
++ wordexp_t we = { 0 };
++ int ret = wordexp (input, &we, 0);
++ TEST_COMPARE (ret, 0);
++ TEST_COMPARE (we.we_wordc, 1);
++
++ /* ~xxx…/ — the trailing slash makes a separate empty component, but
++ wordexp merges it into the single token ~xxx…/. */
++ const char *result = we.we_wordv[0];
++ TEST_COMPARE (result[0], '~');
++ for (size_t j = 1; j <= len; j++)
++ if (result[j] != 'x')
++ {
++ printf (" mismatch at position %zu\n", j);
++ support_record_failure ();
++ break;
++ }
++ TEST_COMPARE (result[1 + len], '/');
++
++ wordfree (&we);
++ free (input);
++}
++
++/* Test 3: ~root still resolves to the correct home directory through the
++ __getpwnam_r path. */
++static void
++test_known_user (void)
++{
++ printf ("info: test_known_user\n");
++
++ /* Look up root's home directory for comparison. */
++ struct passwd *pw = getpwnam ("root");
++ if (pw == NULL || pw->pw_dir == NULL)
++ {
++ printf (" SKIP: cannot look up root\n");
++ return;
++ }
++
++ char *expected = xasprintf ("%s/file", pw->pw_dir);
++
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("~root/file", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ TEST_COMPARE_STRING (we.we_wordv[0], expected);
++
++ wordfree (&we);
++ free (expected);
++}
++
++/* Test 4: Bare tilde expands to $HOME. */
++static void
++test_bare_tilde (void)
++{
++ printf ("info: test_bare_tilde\n");
++
++ const char *home = getenv ("HOME");
++ if (home == NULL)
++ {
++ printf (" SKIP: HOME is not set\n");
++ return;
++ }
++
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("~", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ TEST_COMPARE_STRING (we.we_wordv[0], home);
++
++ wordfree (&we);
++}
++
++/* Test 5: Short non-existent username falls back to literal ~username output,
++ exercising the invalid-login-name path. */
++static void
++test_unknown_user (void)
++{
++ printf ("info: test_unknown_user\n");
++
++ /* Pick a username that is extremely unlikely to exist. */
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("~no_such_user_xyzzy42", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ TEST_COMPARE_STRING (we.we_wordv[0], "~no_such_user_xyzzy42");
++
++ wordfree (&we);
++}
++
++/* Test 6: Tilde with username and WRDE_APPEND — exercises parse_tilde's
++ interaction with the WRDE_APPEND word list. */
++static void
++test_tilde_with_append (void)
++{
++ printf ("info: test_tilde_with_append\n");
++
++ const char *home = getenv ("HOME");
++ if (home == NULL)
++ {
++ printf (" SKIP: HOME is not set\n");
++ return;
++ }
++
++ wordexp_t we = { 0 };
++ TEST_COMPARE (wordexp ("first", &we, 0), 0);
++
++ TEST_COMPARE (wordexp ("~/path", &we, WRDE_APPEND), 0);
++ TEST_COMPARE (we.we_wordc, 2);
++ TEST_COMPARE_STRING (we.we_wordv[0], "first");
++
++ char *expected = xasprintf ("%s/path", home);
++ TEST_COMPARE_STRING (we.we_wordv[1], expected);
++
++ wordfree (&we);
++ free (expected);
++}
++
++static int
++do_test (void)
++{
++ test_known_user ();
++ test_bare_tilde ();
++ test_unknown_user ();
++ test_tilde_with_append ();
++
++ support_isolate_in_subprocess (subprocess_small_stack,
++ test_long_username);
++
++ support_isolate_in_subprocess (subprocess_small_stack,
++ test_scratch_buffer_growth);
++
++ return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/posix/tst-wordexp-tilde.root/etc/group b/posix/tst-wordexp-tilde.root/etc/group
+new file mode 100644
+index 0000000000..1dbf9013ee
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/group
+@@ -0,0 +1 @@
++root:x:0:
+diff --git a/posix/tst-wordexp-tilde.root/etc/nsswitch.conf b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+new file mode 100644
+index 0000000000..098a8d5938
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/nsswitch.conf
+@@ -0,0 +1,3 @@
++passwd: files
++group: files
++shadow: files
+diff --git a/posix/tst-wordexp-tilde.root/etc/passwd b/posix/tst-wordexp-tilde.root/etc/passwd
+new file mode 100644
+index 0000000000..eb85a552ad
+--- /dev/null
++++ b/posix/tst-wordexp-tilde.root/etc/passwd
+@@ -0,0 +1 @@
++root:x:0:0:root:/root:/bin/sh
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 9df4bb7424..731d1650e9 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -335,17 +335,29 @@ parse_tilde (char **word, size_t *word_length, size_t *max_length,
+ else
+ {
+ /* Look up user name in database to get home directory */
+- char *user = strndupa (&words[1 + *offset], i - (1 + *offset));
+- struct passwd pwd, *tpwd;
+- int result;
++ size_t userlen = i - (1 + *offset);
++ /* tmpbuf contains both the user and the __getpwnam_r working area. */
+ struct scratch_buffer tmpbuf;
+ scratch_buffer_init (&tmpbuf);
++ if (!scratch_buffer_set_array_size (&tmpbuf, userlen + 1, 1))
++ return WRDE_NOSPACE;
++ char *user = tmpbuf.data;
++ memcpy (user, &words[1 + *offset], userlen);
++ user[userlen] = '\0';
+
+- while ((result = __getpwnam_r (user, &pwd, tmpbuf.data, tmpbuf.length,
++ struct passwd pwd, *tpwd;
++ int result;
++ while ((result = __getpwnam_r (user,
++ &pwd,
++ tmpbuf.data + userlen + 1,
++ tmpbuf.length - userlen - 1,
+ &tpwd)) != 0
+ && errno == ERANGE)
+- if (!scratch_buffer_grow (&tmpbuf))
+- return WRDE_NOSPACE;
++ {
++ if (!scratch_buffer_grow_preserve (&tmpbuf))
++ return WRDE_NOSPACE;
++ user = tmpbuf.data;
++ }
+
+ if (result == 0 && tpwd != NULL && pwd.pw_dir)
+ *word = w_addstr (*word, word_length, max_length, pwd.pw_dir);
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index e62d941fdde..26aa6fb275e 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -65,6 +65,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0030-CVE-2026-6238-0006.patch \
file://0031-CVE-2026-5928.patch \
file://0032-CVE-2026-5450.patch \
+ file://0033-CVE-2026-6791.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 24/55] glibc: patch CVE-2026-6368
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (22 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 23/55] glibc: patch CVE-2026-6791 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 25/55] glibc: patch CVE-2026-19542 Yoann Congal
` (30 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name and backport URL]
---
.../glibc/glibc/0034-CVE-2026-6368.patch | 577 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 578 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch
diff --git a/meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch b/meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch
new file mode 100644
index 00000000000..982d10845bf
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0034-CVE-2026-6368.patch
@@ -0,0 +1,577 @@
+From dfc8ef388ef7856f318ade7dec501f92ce54f9e3 Mon Sep 17 00:00:00 2001
+From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date: Mon, 13 Apr 2026 16:33:30 -0300
+Subject: [PATCH] posix: Fix wordexp WRDE_APPEND to preserve state on
+ non-NOSPACE errors (BZ 34090, CVE-2026-6368)
+
+The previous implementation saved a copy of the wordexp_t struct at
+entry and blindly restored it on error via (*pwordexp = old_word).
+This is incorrect when WRDE_APPEND is set because w_addword may have
+called realloc on we_wordv during partial processing before the error
+was detected. If realloc relocated the buffer, the saved we_wordv
+pointer is dangling; restoring it causes a use-after-free in the
+caller (e.g. via wordfree), and the relocated buffer is leaked.
+
+Fix this by duplicating the we_wordv pointer array at entry when
+WRDE_APPEND is set, so that all subsequent realloc calls inside
+w_addword operate on the copy.
+
+This change also fixes a POSIX conformance issue: if the WRDE_APPEND
+flag is specified, pwordexp->we_wordc and pwordexp->we_wordv shall
+not be modified.
+
+Also fix two pre-existing error return paths in the '"' and '\'' cases
+that returned directly from w_addword failures instead of going through
+do_error, which would leak the saved array (and previously would also
+skip the word cleanup).
+
+Checked on x86_64-linux-gnu and i686-linux-gnu.
+
+Reviewed-by: DJ Delorie <dj@redhat.com>
+(cherry picked from commit e2cefe16c37a617df9f11407cb00a272a6098823)
+
+CVE: CVE-2026-6368
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=dfc8ef388ef7856f318ade7dec501f92ce54f9e3]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ posix/Makefile | 1 +
+ posix/tst-wordexp-append.c | 393 +++++++++++++++++++++++++++++++++++++
+ posix/wordexp.c | 69 ++++++-
+ 3 files changed, 454 insertions(+), 9 deletions(-)
+ create mode 100644 posix/tst-wordexp-append.c
+
+diff --git a/posix/Makefile b/posix/Makefile
+index c2c05b3973..5358a3f8c1 100644
+--- a/posix/Makefile
++++ b/posix/Makefile
+@@ -325,6 +325,7 @@ tests := \
+ tst-wait3 \
+ tst-wait4 \
+ tst-waitid \
++ tst-wordexp-append \
+ tst-wordexp-nocmd \
+ tst-wordexp-reuse \
+ tstgetopt \
+diff --git a/posix/tst-wordexp-append.c b/posix/tst-wordexp-append.c
+new file mode 100644
+index 0000000000..87f388f0a7
+--- /dev/null
++++ b/posix/tst-wordexp-append.c
+@@ -0,0 +1,393 @@
++/* Test for wordexp with WRDE_APPEND flag.
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include <wordexp.h>
++#include <string.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <malloc.h>
++
++#include <support/check.h>
++#include <support/support.h>
++
++static unsigned int relocating_reallocs;
++
++/* w_addword grows we_wordv with realloc, make every call guaranteed to
++ relocate the block. This makes BZ 34090 regression more deterministic. */
++void *
++realloc (void *ptr, size_t size)
++{
++ if (ptr == NULL)
++ return malloc (size);
++ if (size == 0)
++ {
++ free (ptr);
++ return NULL;
++ }
++
++ void *new = malloc (size);
++ if (new == NULL)
++ return NULL;
++
++ /* Copy only what is valid in the old block to avoid reading past it. */
++ size_t old = malloc_usable_size (ptr);
++ memcpy (new, ptr, old < size ? old : size);
++ /* Clobber the old block so that a stale we_wordv pointer restored on the
++ error path reads garbage instead of the old contents, which might
++ otherwise survive intact and mask the bug. */
++ memset (ptr, 0x5a, old);
++ free (ptr);
++ relocating_reallocs++;
++ return new;
++}
++
++/* Verify that all words in we match the expected NULL-terminated
++ array. */
++static void
++check_words (const wordexp_t *we, const char *const *expected)
++{
++ size_t i;
++ for (i = 0; expected[i] != NULL; i++)
++ {
++ TEST_VERIFY (i < we->we_wordc);
++ TEST_COMPARE_STRING (we->we_wordv[we->we_offs + i], expected[i]);
++ }
++ TEST_COMPARE (we->we_wordc, i);
++}
++
++#define CHECK_WORDS(we, ...) \
++ do { \
++ const char *const expected_[] = { __VA_ARGS__, NULL }; \
++ check_words (we, expected_); \
++ } while (0)
++
++/* Test 1: WRDE_APPEND + WRDE_BADCHAR preserves we_wordc. */
++static void
++test_append_badchar_preserves_count (void)
++{
++ printf ("info: test_append_badchar_preserves_count\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("one two three", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 3);
++
++ size_t saved_count = we.we_wordc;
++
++ /* ')' triggers WRDE_BADCHAR and "extra" would be a new word if the
++ expansion succeeded, exercising the w_addword path before the error
++ is detected. */
++ TEST_COMPARE (wordexp ("extra )", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (we.we_wordc, saved_count);
++
++ wordfree (&we);
++}
++
++/* Test 2: WRDE_APPEND + WRDE_BADCHAR preserves the we_wordv pointer even
++ when internal realloc would move the buffer. */
++static void
++test_append_badchar_preserves_pointer (void)
++{
++ printf ("info: test_append_badchar_preserves_pointer\n");
++ wordexp_t we = { 0 };
++
++ /* Use many words so that the initial we_wordv allocation is
++ non-trivial and a later realloc is more likely to move it. */
++ TEST_COMPARE (wordexp ("a b c d e f g h", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 8);
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++ unsigned int saved_reallocs = relocating_reallocs;
++
++ /* The interposed realloc guarantees the internal we_wordv buffer moves
++ during parsing, so the pointer-stability check below is meaningful. */
++ TEST_COMPARE (wordexp ("append )", &we, WRDE_APPEND), WRDE_BADCHAR);
++ /* Verify that a relocating realloc actually happened during the failed
++ call, otherwise the pointer-stability check is vacuous. */
++ TEST_VERIFY (relocating_reallocs > saved_reallocs);
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++
++ wordfree (&we);
++}
++
++/* Test 3: After a failed WRDE_APPEND the original words are still accessible
++ and correct. */
++static void
++test_append_badchar_words_intact (void)
++{
++ printf ("info: test_append_badchar_words_intact\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("alpha beta gamma", &we, 0), 0);
++ CHECK_WORDS (&we, "alpha", "beta", "gamma");
++
++ TEST_COMPARE (wordexp ("delta )", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++ /* Words must still be intact. */
++ CHECK_WORDS (&we, "alpha", "beta", "gamma");
++ /* The NULL terminator must still be present. */
++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++ wordfree (&we);
++}
++
++/* Test 4: Successful WRDE_APPEND still works (regression test). */
++static void
++test_append_success (void)
++{
++ printf ("info: test_append_success\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("hello", &we, 0), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++
++ char **saved_wordv = we.we_wordv;
++
++ TEST_COMPARE (wordexp ("world", &we, WRDE_APPEND), 0);
++ TEST_COMPARE (we.we_wordc, 2);
++ /* A successful append works on a fresh copy of the array, so the
++ caller-visible pointer must have changed. */
++ TEST_VERIFY (we.we_wordv != saved_wordv);
++ CHECK_WORDS (&we, "hello", "world");
++
++ wordfree (&we);
++}
++
++/* Test 5: Successful append after a failed append — the implementation must
++ recover and allow further use of the wordexp_t. */
++static void
++test_append_success_after_failure (void)
++{
++ printf ("info: test_append_success_after_failure\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("first", &we, 0), 0);
++ CHECK_WORDS (&we, "first");
++
++ TEST_COMPARE (wordexp ("bad |", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++ /* State must be exactly as before the failed call. */
++ CHECK_WORDS (&we, "first");
++
++ /* A subsequent successful append must work. */
++ TEST_COMPARE (wordexp ("second third", &we, WRDE_APPEND), 0);
++ CHECK_WORDS (&we, "first", "second", "third");
++
++ wordfree (&we);
++}
++
++/* Test 6: Multiple consecutive failed appends do not corrupt state. */
++static void
++test_append_multiple_failures (void)
++{
++ printf ("info: test_append_multiple_failures\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("keep this", &we, 0), 0);
++ CHECK_WORDS (&we, "keep", "this");
++
++ size_t saved_count = we.we_wordc;
++ char **saved_wordv = we.we_wordv;
++
++ /* Each of these bad characters must leave the state unchanged. */
++ TEST_COMPARE (wordexp ("x )", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x |", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x ;", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x &", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x <", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (wordexp ("x >", &we, WRDE_APPEND), WRDE_BADCHAR);
++
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++ CHECK_WORDS (&we, "keep", "this");
++
++ wordfree (&we);
++}
++
++/* Test 7: WRDE_APPEND with WRDE_SYNTAX error (unterminated quote) also
++ preserves state. */
++static void
++test_append_syntax_error (void)
++{
++ printf ("info: test_append_syntax_error\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("original", &we, 0), 0);
++ CHECK_WORDS (&we, "original");
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++
++ /* Unterminated double quote triggers WRDE_SYNTAX. */
++ TEST_COMPARE (wordexp ("\"unterminated", &we, WRDE_APPEND), WRDE_SYNTAX);
++
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++ CHECK_WORDS (&we, "original");
++
++ wordfree (&we);
++}
++
++/* Test 8: Error without WRDE_APPEND still works (regression test for the
++ non-APPEND code path in do_error). */
++static void
++test_no_append_error (void)
++{
++ printf ("info: test_no_append_error\n");
++ wordexp_t we = { 0 };
++
++ /* Simple failure without WRDE_APPEND. */
++ TEST_COMPARE (wordexp ("bad |", &we, 0), WRDE_BADCHAR);
++
++ /* After failure without WRDE_APPEND the struct should be safe to
++ reuse — start fresh. */
++ TEST_COMPARE (wordexp ("ok", &we, 0), 0);
++ CHECK_WORDS (&we, "ok");
++
++ wordfree (&we);
++}
++
++/* Test 9: WRDE_BADCHAR on the very first character (no partial words added
++ before the error). */
++static void
++test_append_badchar_immediate (void)
++{
++ printf ("info: test_append_badchar_immediate\n");
++ wordexp_t we = { 0 };
++
++ TEST_COMPARE (wordexp ("hello world", &we, 0), 0);
++ CHECK_WORDS (&we, "hello", "world");
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++
++ /* The bad character is the very first byte — no w_addword call happens
++ before the error. */
++ TEST_COMPARE (wordexp ("|", &we, WRDE_APPEND), WRDE_BADCHAR);
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++
++ wordfree (&we);
++}
++
++/* Test 10: WRDE_APPEND into an empty wordexp_t (initial call uses WRDE_APPEND
++ with a zeroed struct — unusual but allowed). */
++static void
++test_append_into_empty (void)
++{
++ printf ("info: test_append_into_empty\n");
++ wordexp_t we = { 0 };
++
++ /* First call with WRDE_APPEND on a zeroed struct. The implementation
++ must handle we_wordv == NULL gracefully. */
++ TEST_COMPARE (wordexp ("solo", &we, WRDE_APPEND), 0);
++ TEST_COMPARE (we.we_wordc, 1);
++ CHECK_WORDS (&we, "solo");
++
++ wordfree (&we);
++}
++
++/* Verify that the leading we_offs slots are all NULL. */
++static void
++check_offs_null (const wordexp_t *we)
++{
++ for (size_t i = 0; i < we->we_offs; i++)
++ TEST_VERIFY (we->we_wordv[i] == NULL);
++}
++
++/* Test 11: successful WRDE_APPEND with WRDE_DOOFFS and a non-zero we_offs.
++ The leading offset slots must stay NULL and words must land at
++ we_wordv[we_offs + i] across both the initial and the appended call. */
++static void
++test_dooffs_append_success (void)
++{
++ printf ("info: test_dooffs_append_success\n");
++ wordexp_t we = { 0 };
++ we.we_offs = 2;
++
++ TEST_COMPARE (wordexp ("one two", &we, WRDE_DOOFFS), 0);
++ TEST_COMPARE (we.we_offs, 2);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "one", "two");
++
++ TEST_COMPARE (wordexp ("three", &we, WRDE_APPEND | WRDE_DOOFFS), 0);
++ TEST_COMPARE (we.we_offs, 2);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "one", "two", "three");
++ /* The NULL terminator must sit right after the last word. */
++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++ wordfree (&we);
++}
++
++/* Test 12: failed WRDE_APPEND with WRDE_DOOFFS preserves we_wordc, the
++ we_wordv pointer, the words and the leading NULL offset slots. This
++ exercises the we_offs arithmetic in the array duplication and in the
++ error-path cleanup (we_wordv[we_offs + --we_wordc]). */
++static void
++test_dooffs_append_error_preserves_state (void)
++{
++ printf ("info: test_dooffs_append_error_preserves_state\n");
++ wordexp_t we = { 0 };
++ we.we_offs = 3;
++
++ TEST_COMPARE (wordexp ("alpha beta", &we, WRDE_DOOFFS), 0);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "alpha", "beta");
++
++ char **saved_wordv = we.we_wordv;
++ size_t saved_count = we.we_wordc;
++ unsigned int saved_reallocs = relocating_reallocs;
++
++ /* "gamma" is a partial word added via w_addword (forcing a relocating
++ realloc of we_wordv) before ')' triggers WRDE_BADCHAR. */
++ TEST_COMPARE (wordexp ("gamma )", &we, WRDE_APPEND | WRDE_DOOFFS),
++ WRDE_BADCHAR);
++ TEST_VERIFY (relocating_reallocs > saved_reallocs);
++
++ TEST_COMPARE (we.we_offs, 3);
++ TEST_COMPARE (we.we_wordc, saved_count);
++ TEST_VERIFY (we.we_wordv == saved_wordv);
++ check_offs_null (&we);
++ CHECK_WORDS (&we, "alpha", "beta");
++ TEST_VERIFY (we.we_wordv[we.we_offs + we.we_wordc] == NULL);
++
++ wordfree (&we);
++}
++
++static int
++do_test (void)
++{
++ test_append_badchar_preserves_count ();
++ test_append_badchar_preserves_pointer ();
++ test_append_badchar_words_intact ();
++ test_append_success ();
++ test_append_success_after_failure ();
++ test_append_multiple_failures ();
++ test_append_syntax_error ();
++ test_no_append_error ();
++ test_append_badchar_immediate ();
++ test_append_into_empty ();
++ test_dooffs_append_success ();
++ test_dooffs_append_error_preserves_state ();
++
++ return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index 731d1650e9..50b0d7a256 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -35,6 +35,7 @@
+ #include <scratch_buffer.h>
+ #include <_itoa.h>
+ #include <assert.h>
++#include <intprops.h>
+
+ /*
+ * This is a recursive-descent-style word expansion routine.
+@@ -2224,6 +2225,12 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ char ifs_white[4];
+ wordexp_t old_word = *pwordexp;
+
++ /* When WRDE_APPEND is set we work on a copy of the we_wordv array so that
++ the caller's original pointer is never invalidated by realloc inside
++ w_addword. The saved_wordv keeps the original; on success we free it,
++ on non-NOSPACE error we free the working copy and restore the original. */
++ char **saved_wordv = NULL;
++
+ if (flags & WRDE_REUSE)
+ {
+ /* Minimal implementation of WRDE_REUSE for now */
+@@ -2258,6 +2265,23 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ pwordexp->we_offs = 0;
+ }
+ }
++ else if (pwordexp->we_wordv != NULL)
++ {
++ /* WRDE_APPEND with an existing word list: duplicate the array so that
++ realloc during parsing does not invalidate the caller's pointer. The
++ strings themselves are shared. */
++ size_t num_p;
++ char **dup;
++ if (INT_ADD_WRAPV (pwordexp->we_offs, pwordexp->we_wordc, &num_p)
++ || INT_ADD_WRAPV (num_p, 1, &num_p))
++ return WRDE_NOSPACE;
++ dup = __libc_reallocarray (NULL, num_p, sizeof *dup);
++ if (dup == NULL)
++ return WRDE_NOSPACE;
++ memcpy (dup, pwordexp->we_wordv, num_p * sizeof *dup);
++ saved_wordv = pwordexp->we_wordv;
++ pwordexp->we_wordv = dup;
++ }
+
+ /* Find out what the field separators are.
+ * There are two types: whitespace and non-whitespace.
+@@ -2338,7 +2362,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ error = w_addword (pwordexp, NULL);
+
+ if (error)
+- return error;
++ goto do_error;
+ }
+
+ break;
+@@ -2356,7 +2380,7 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+ error = w_addword (pwordexp, NULL);
+
+ if (error)
+- return error;
++ goto do_error;
+ }
+
+ break;
+@@ -2422,10 +2446,18 @@ wordexp (const char *words, wordexp_t *pwordexp, int flags)
+
+ /* There was a word separator at the end */
+ if (word == NULL) /* i.e. w_newword */
+- return 0;
++ {
++ free (saved_wordv);
++ return 0;
++ }
+
+- /* There was no field separator at the end */
+- return w_addword (pwordexp, word);
++ /* There was no field separator at the end. The only possible error
++ from w_addword is WRDE_NOSPACE. */
++ error = w_addword (pwordexp, word);
++ if (error != 0)
++ goto do_error;
++ free (saved_wordv);
++ return 0;
+
+ do_error:
+ /* Error:
+@@ -2436,11 +2468,30 @@ do_error:
+ free (word);
+
+ if (error == WRDE_NOSPACE)
+- return WRDE_NOSPACE;
++ {
++ /* we_wordc and we_wordv are updated to reflect any words that were
++ successfully expanded. The old array is obsolete. */
++ free (saved_wordv);
++ return WRDE_NOSPACE;
++ }
+
+- if ((flags & WRDE_APPEND) == 0)
+- wordfree (pwordexp);
++ if (flags & WRDE_APPEND)
++ {
++ /* POSIX 2024 states that for in other error cases, if the WRDE_APPEND
++ flag was specified, we_wordc and we_wordv shall not be modified.
++
++ Free strings appended during this call, discard the working copy of
++ we_wordv, and restore the caller's original pointer. */
++ while (pwordexp->we_wordc > old_word.we_wordc)
++ free (pwordexp->we_wordv[pwordexp->we_offs + --pwordexp->we_wordc]);
++ free (pwordexp->we_wordv);
++ pwordexp->we_wordv = saved_wordv;
++ }
++ else
++ {
++ wordfree (pwordexp);
++ *pwordexp = old_word;
++ }
+
+- *pwordexp = old_word;
+ return error;
+ }
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 26aa6fb275e..b7f6278c95a 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -66,6 +66,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0031-CVE-2026-5928.patch \
file://0032-CVE-2026-5450.patch \
file://0033-CVE-2026-6791.patch \
+ file://0034-CVE-2026-6368.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 25/55] glibc: patch CVE-2026-19542
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (23 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 24/55] glibc: patch CVE-2026-6368 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 26/55] glibc: patch CVE-2026-19499 Yoann Congal
` (29 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch [1] which is [2] backported to 2.41 (oldest release still
receiving security updates) which is mentioned in [3].
[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=9318c2571576017d280a31b7b9ab576c9b696b1a
[2] https://sourceware.org/git/?p=glibc.git;a=commit;h=e2789c46e3bfdcd67a82bea9946b315c179e83d3
[3] https://security-tracker.debian.org/tracker/CVE-2026-19542
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0035-CVE-2026-19542.patch | 99 +++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 100 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch
diff --git a/meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch b/meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch
new file mode 100644
index 00000000000..5c82606792c
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0035-CVE-2026-19542.patch
@@ -0,0 +1,99 @@
+From 9318c2571576017d280a31b7b9ab576c9b696b1a Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 14 Aug 2026 13:41:16 +0200
+Subject: [PATCH] misc: Fix out-of-bounds array write in tdelete (bug 34506)
+
+Allocate the maximum array sizes directly, instead of resizing
+the arrays as needed. This eliminates alloca usage from the
+function, and fixes the out-of-bounds accesses. The asserts
+guard against the bug coming back if the balancing of the tree
+turns out not to work correctly.
+
+Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+(cherry picked from commit e2789c46e3bfdcd67a82bea9946b315c179e83d3)
+
+CVE: CVE-2026-19542
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=9318c2571576017d280a31b7b9ab576c9b696b1a]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ misc/tsearch.c | 31 +++++++++++--------------------
+ 1 file changed, 11 insertions(+), 20 deletions(-)
+
+diff --git a/misc/tsearch.c b/misc/tsearch.c
+index d15260baed..350fe15bf0 100644
+--- a/misc/tsearch.c
++++ b/misc/tsearch.c
+@@ -85,6 +85,7 @@
+ #include <assert.h>
+ #include <stdalign.h>
+ #include <stddef.h>
++#include <stdint.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <search.h>
+@@ -406,12 +407,13 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
+ int cmp;
+ node *rootp = (node *) vrootp;
+ node root, unchained;
+- /* Stack of nodes so we remember the parents without recursion. It's
+- _very_ unlikely that there are paths longer than 40 nodes. The tree
+- would need to have around 250.000 nodes. */
+- int stacksize = 40;
++ /* Stack of nodes so we remember the parents without recursion. The
++ stack size is a conservative approximation of the maximum height
++ of a red-black tree, based on size of the address space.
++ Actual numbers are closer to 57 (32 bit) and 117 (63 bit). */
++ enum { stacksize = 2 * UINTPTR_WIDTH };
+ int sp = 0;
+- node **nodestack = alloca (sizeof (node *) * stacksize);
++ node *nodestack[stacksize];
+
+ if (rootp == NULL)
+ return NULL;
+@@ -424,14 +426,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
+ root = DEREFNODEPTR(rootp);
+ while ((cmp = (*compar) (key, root->key)) != 0)
+ {
+- if (sp == stacksize)
+- {
+- node **newstack;
+- stacksize += 20;
+- newstack = alloca (sizeof (node *) * stacksize);
+- nodestack = memcpy (newstack, nodestack, sp * sizeof (node *));
+- }
+-
++ assert (sp < stacksize);
+ nodestack[sp++] = rootp;
+ p = DEREFNODEPTR(rootp);
+ if (cmp < 0)
+@@ -470,13 +465,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
+ node upn;
+ for (;;)
+ {
+- if (sp == stacksize)
+- {
+- node **newstack;
+- stacksize += 20;
+- newstack = alloca (sizeof (node *) * stacksize);
+- nodestack = memcpy (newstack, nodestack, sp * sizeof (node *));
+- }
++ assert (sp < stacksize);
+ nodestack[sp++] = parentp;
+ parentp = up;
+ upn = DEREFNODEPTR(up);
+@@ -541,6 +530,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
+ SETNODEPTR(pp,q);
+ /* Make sure pp is right if the case below tries to use
+ it. */
++ assert (sp < stacksize);
+ nodestack[sp++] = pp = LEFTPTR(q);
+ q = RIGHT(p);
+ }
+@@ -625,6 +615,7 @@ __tdelete (const void *key, void **vrootp, __compar_fn_t compar)
+ SETLEFT(p,RIGHT(q));
+ SETRIGHT(q,p);
+ SETNODEPTR(pp,q);
++ assert (sp < stacksize);
+ nodestack[sp++] = pp = RIGHTPTR(q);
+ q = LEFT(p);
+ }
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index b7f6278c95a..eb198427d1a 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -67,6 +67,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0032-CVE-2026-5450.patch \
file://0033-CVE-2026-6791.patch \
file://0034-CVE-2026-6368.patch \
+ file://0035-CVE-2026-19542.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 26/55] glibc: patch CVE-2026-19499
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (24 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 25/55] glibc: patch CVE-2026-19542 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 27/55] glibc: patch CVE-2026-77117 Yoann Congal
` (28 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0036-CVE-2026-19499.patch | 100 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 101 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch
diff --git a/meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch b/meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch
new file mode 100644
index 00000000000..792c5276d0b
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0036-CVE-2026-19499.patch
@@ -0,0 +1,100 @@
+From 5256941bc811248670eda4636dccd0a390d34dec Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Thu, 27 Aug 2026 13:34:54 +0200
+Subject: [PATCH] stdlib: Fix right-justification in strfmon (bug 34510,
+ CVE-2026-19499)
+
+The memmove call did not take into account that __printf_buffer_pad
+updated the buffer pointers.
+
+Fixes commit e88b9f0e5cc50cab57a299dc7efe1a4eb385161d
+("stdio-common: Convert vfprintf and related functions to buffers"),
+which went into glibc 2.37.
+
+Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+(cherry picked from commit b090cf226ff65b913e41536f1f573f500855615c)
+
+CVE: CVE-2026-19499
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=5256941bc811248670eda4636dccd0a390d34dec]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ stdlib/Makefile | 1 +
+ stdlib/strfmon_l.c | 5 +++--
+ stdlib/tst-strfmon-bug34510.c | 33 +++++++++++++++++++++++++++++++++
+ 3 files changed, 37 insertions(+), 2 deletions(-)
+ create mode 100644 stdlib/tst-strfmon-bug34510.c
+
+diff --git a/stdlib/Makefile b/stdlib/Makefile
+index c9c8f702a2..b655f0e5eb 100644
+--- a/stdlib/Makefile
++++ b/stdlib/Makefile
+@@ -324,6 +324,7 @@ tests := \
+ tst-stdc_leading_zeros \
+ tst-stdc_trailing_ones \
+ tst-stdc_trailing_zeros \
++ tst-strfmon-bug34510 \
+ tst-strfmon_l \
+ tst-strfrom \
+ tst-strfrom-locale \
+diff --git a/stdlib/strfmon_l.c b/stdlib/strfmon_l.c
+index 5e22aac750..bd849ff470 100644
+--- a/stdlib/strfmon_l.c
++++ b/stdlib/strfmon_l.c
+@@ -549,7 +549,8 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc,
+ /* Now test whether the output width is filled. */
+ if (buf->write_ptr - startp < width)
+ {
+- size_t pad_width = width - (buf->write_ptr - startp);
++ size_t written_width = buf->write_ptr - startp;
++ size_t pad_width = width - written_width;
+ __printf_buffer_pad (buf, ' ', pad_width);
+ if (__printf_buffer_has_failed (buf))
+ /* Implies length check. */
+@@ -558,7 +559,7 @@ __vstrfmon_l_buffer (struct __printf_buffer *buf, locale_t loc,
+ Otherwise move the field contents in place. */
+ if (!left)
+ {
+- memmove (startp + pad_width, startp, buf->write_ptr - startp);
++ memmove (startp + pad_width, startp, written_width);
+ memset (startp, ' ', pad_width);
+ }
+ }
+diff --git a/stdlib/tst-strfmon-bug34510.c b/stdlib/tst-strfmon-bug34510.c
+new file mode 100644
+index 0000000000..b187bde1f4
+--- /dev/null
++++ b/stdlib/tst-strfmon-bug34510.c
+@@ -0,0 +1,33 @@
++/* Test handling of right-padding in strfmon (bug 34510, CVE-2026-19499).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include <monetary.h>
++#include <errno.h>
++#include <support/check.h>
++#include <support/next_to_fault.h>
++
++static int
++do_test (void)
++{
++ struct support_next_to_fault ntf = support_next_to_fault_allocate (100);
++ TEST_COMPARE (strfmon (ntf.buffer, ntf.length, "%100n", 1.23), -1);
++ TEST_COMPARE (errno, E2BIG);
++ return 0;
++}
++
++#include <support/test-driver.c>
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index eb198427d1a..567d53dd6f6 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -68,6 +68,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0033-CVE-2026-6791.patch \
file://0034-CVE-2026-6368.patch \
file://0035-CVE-2026-19542.patch \
+ file://0036-CVE-2026-19499.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 27/55] glibc: patch CVE-2026-77117
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (25 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 26/55] glibc: patch CVE-2026-19499 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 28/55] glibc: patch CVE-2026-80489 Yoann Congal
` (27 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0037-CVE-2026-77117.patch | 32 +++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch
diff --git a/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch
new file mode 100644
index 00000000000..fa42a548c34
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch
@@ -0,0 +1,32 @@
+From e43e46f94398b3de446fec11da1e7633ea5202ec Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 28 Aug 2026 10:26:07 +0200
+Subject: [PATCH] iconvdata: SHIFT_JISX0213 decoding lacks pending character
+ reset (CVE-2026-77117)
+
+This fixes bug 34556.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+(cherry picked from commit 68d94bbe50b7577d48998107d632ef3a0df050e3)
+
+CVE: CVE-2026-77117
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=e43e46f94398b3de446fec11da1e7633ea5202ec]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ iconvdata/shift_jisx0213.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/iconvdata/shift_jisx0213.c b/iconvdata/shift_jisx0213.c
+index 364298dcff..834fa81322 100644
+--- a/iconvdata/shift_jisx0213.c
++++ b/iconvdata/shift_jisx0213.c
+@@ -226,6 +226,9 @@
+ STANDARD_FROM_LOOP_ERR_HANDLER (1); \
+ } \
+ } \
++ else \
++ /* There was a pending character. Clear it. */ \
++ *statep = 0; \
+ \
+ put32 (outptr, ch); \
+ outptr += 4; \
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 567d53dd6f6..3090b9cd277 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -69,6 +69,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0034-CVE-2026-6368.patch \
file://0035-CVE-2026-19542.patch \
file://0036-CVE-2026-19499.patch \
+ file://0037-CVE-2026-77117.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 28/55] glibc: patch CVE-2026-80489
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (26 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 27/55] glibc: patch CVE-2026-77117 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 29/55] glibc: add tests for CVE-2026-77117 and CVE-2026-80489 Yoann Congal
` (26 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0038-CVE-2026-80489.patch | 32 +++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch
diff --git a/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch b/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch
new file mode 100644
index 00000000000..3ca1c959bb2
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0038-CVE-2026-80489.patch
@@ -0,0 +1,32 @@
+From ec116a0fbedcc860631e525e70b409cf295f27da Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 28 Aug 2026 10:26:07 +0200
+Subject: [PATCH] iconvdata: EUC_JISX0213 decoding lacks pending character
+ reset (CVE-2026-80489)
+
+This fixes bug 34568.
+
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+(cherry picked from commit 4dafa087ff5fe7df45bd37dc727e988da6b8c935)
+
+CVE: CVE-2026-80489
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=ec116a0fbedcc860631e525e70b409cf295f27da]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ iconvdata/euc-jisx0213.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/iconvdata/euc-jisx0213.c b/iconvdata/euc-jisx0213.c
+index 9c3f28da2d..f0305c113a 100644
+--- a/iconvdata/euc-jisx0213.c
++++ b/iconvdata/euc-jisx0213.c
+@@ -224,6 +224,9 @@
+ STANDARD_FROM_LOOP_ERR_HANDLER (1); \
+ } \
+ } \
++ else \
++ /* There was a pending character. Clear it. */ \
++ *statep = 0; \
+ \
+ put32 (outptr, ch); \
+ outptr += 4; \
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 3090b9cd277..bd0b4f06190 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -70,6 +70,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0035-CVE-2026-19542.patch \
file://0036-CVE-2026-19499.patch \
file://0037-CVE-2026-77117.patch \
+ file://0038-CVE-2026-80489.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 29/55] glibc: add tests for CVE-2026-77117 and CVE-2026-80489.
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (27 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 28/55] glibc: patch CVE-2026-80489 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 30/55] glibc: patch CVE-2026-18374 Yoann Congal
` (25 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick commit referencing bug IDs from patches for these CVEs from 2.41
branch (oldest release still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../0039-CVE-2026-77117-CVE-2026-80489.patch | 172 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 173 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch
diff --git a/meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch b/meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch
new file mode 100644
index 00000000000..7e9141bd9f7
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0039-CVE-2026-77117-CVE-2026-80489.patch
@@ -0,0 +1,172 @@
+From 3d141c23899d90559741b5fe74db97ccf0ef5c29 Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Fri, 28 Aug 2026 10:26:07 +0200
+Subject: [PATCH] iconvdata: Test case for bug 34556, bug 34568
+
+Assisted-by: LLM
+Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+(cherry picked from commit 35efcffa97553df071bc37ab31fd7dc2c634e7da)
+
+CVE: CVE-2026-77117
+CVE: CVE-2026-80489
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=3d141c23899d90559741b5fe74db97ccf0ef5c29]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ iconvdata/Makefile | 5 +-
+ iconvdata/tst-jisx0213-progress.c | 124 ++++++++++++++++++++++++++++++
+ 2 files changed, 128 insertions(+), 1 deletion(-)
+ create mode 100644 iconvdata/tst-jisx0213-progress.c
+
+diff --git a/iconvdata/Makefile b/iconvdata/Makefile
+index cc689f63e9..36f48749d2 100644
+--- a/iconvdata/Makefile
++++ b/iconvdata/Makefile
+@@ -76,7 +76,8 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
+ tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
+ bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
+ bug-iconv13 bug-iconv14 bug-iconv15 \
+- tst-iconv-iso-2022-cn-ext tst-bug33980
++ tst-iconv-iso-2022-cn-ext tst-bug33980 \
++ tst-jisx0213-progress
+ ifeq ($(have-thread-library),yes)
+ tests += bug-iconv3
+ endif
+@@ -335,6 +336,8 @@ $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules))
+ $(addprefix $(objpfx),$(modules.so))
+ $(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ $(addprefix $(objpfx),$(modules.so))
++$(objpfx)tst-jisx0213-progress.out: \
++ $(addprefix $(objpfx), $(gconv-modules)) $(addprefix $(objpfx),$(modules.so))
+
+ $(objpfx)iconv-test.out: run-iconv-test.sh \
+ $(addprefix $(objpfx), $(gconv-modules)) \
+diff --git a/iconvdata/tst-jisx0213-progress.c b/iconvdata/tst-jisx0213-progress.c
+new file mode 100644
+index 0000000000..7b2073be1f
+--- /dev/null
++++ b/iconvdata/tst-jisx0213-progress.c
+@@ -0,0 +1,124 @@
++/* Test JISX0213 combining character conversion progress (bug 34556, bug 34568).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++/* Certain JISX0213 byte sequences map to a combining sequence, for
++ example U+304B (HIRAGANA LETTER KA) followed by U+309A (COMBINING
++ SEMI-VOICED SOUND MARK). When converting to internal encoding
++ (actually UTF-32) with a small output buffer, the first code point
++ is emitted and the second is queued in the converter state. This
++ test verifies that the queued code point is consumed exactly once
++ on retry, so that the conversion makes progress and terminates. */
++
++#include <errno.h>
++#include <iconv.h>
++#include <stdio.h>
++#include <string.h>
++
++#include <support/check.h>
++#include <support/support.h>
++
++static void
++test_one (const char *charset, const char *input, size_t outbufsize)
++{
++ printf ("info: %s: testing output buffer size %zu\n", charset, outbufsize);
++
++ /* Expected UTF-32 output. */
++ static const wchar_t expected[] = { 0x304b, 0x309a, 'A' };
++
++ /* Use WCHAR_T encoding to avoid the BOM. */
++ iconv_t cd = iconv_open ("WCHAR_T", charset);
++ TEST_VERIFY_EXIT (cd != (iconv_t) -1);
++
++ char result[64];
++ size_t result_len = 0;
++
++ char *inptr = (char *) input;
++ size_t inleft = strlen (input);
++
++ char outbuf[64];
++
++ int iterations = 0;
++ while (inleft > 0)
++ {
++ char *outptr = outbuf;
++ size_t outleft = outbufsize;
++ size_t inleft_before = inleft;
++
++ size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft);
++ size_t produced = outptr - outbuf;
++
++ TEST_VERIFY_EXIT (result_len + produced <= sizeof (result));
++ memcpy (result + result_len, outbuf, produced);
++ result_len += produced;
++
++ if (ret == (size_t) -1 && errno == E2BIG)
++ {
++ if (produced == 0 && inleft == inleft_before)
++ {
++ /* Output buffer too small for a single code point. */
++ TEST_VERIFY_EXIT (outbufsize < 4);
++ break;
++ }
++ /* Bound iterations to detect non-progress bugs. */
++ if (++iterations < 10)
++ continue;
++ else
++ {
++ FAIL ("%s: no progress", charset);
++ goto out;
++ }
++ }
++ if (ret == (size_t) -1)
++ FAIL_EXIT1 ("outbufsize %zu: iconv: %m", outbufsize);
++ break;
++ }
++
++ /* Flush pending converter state. */
++ {
++ char *outptr = outbuf;
++ size_t outleft = outbufsize;
++ size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft);
++ TEST_VERIFY (ret == 0);
++ size_t produced = outptr - outbuf;
++ memcpy (result + result_len, outbuf, produced);
++ result_len += produced;
++ }
++
++ if (outbufsize >= 4)
++ {
++ TEST_COMPARE (inleft, 0);
++ TEST_COMPARE_BLOB (result, result_len,
++ expected, sizeof (expected));
++ }
++
++ out:
++ TEST_VERIFY_EXIT (iconv_close (cd) == 0);
++}
++
++static int
++do_test (void)
++{
++ for (size_t outbufsize = 1; outbufsize <= 16; outbufsize++)
++ {
++ test_one ("EUC-JISX0213", "\244\367A", outbufsize);
++ test_one ("SHIFT_JISX0213", "\202\365A", outbufsize);
++ }
++ return 0;
++}
++
++#include <support/test-driver.c>
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index bd0b4f06190..144ce36ccc2 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -71,6 +71,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0036-CVE-2026-19499.patch \
file://0037-CVE-2026-77117.patch \
file://0038-CVE-2026-80489.patch \
+ file://0039-CVE-2026-77117-CVE-2026-80489.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 30/55] glibc: patch CVE-2026-18374
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (28 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 29/55] glibc: add tests for CVE-2026-77117 and CVE-2026-80489 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 31/55] glibc: patch CVE-2026-8674 Yoann Congal
` (24 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patches referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0040-CVE-2026-18374-01.patch | 53 +++++++++
.../glibc/glibc/0041-CVE-2026-18374-02.patch | 103 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 2 +
3 files changed, 158 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch
create mode 100644 meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch
diff --git a/meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch b/meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch
new file mode 100644
index 00000000000..a5a71473ab2
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0040-CVE-2026-18374-01.patch
@@ -0,0 +1,53 @@
+From f806c45178dbca3be08a25cc5dd6d5542ce84a59 Mon Sep 17 00:00:00 2001
+From: Dongkyun Son <dongkyun.s@samsung.com>
+Date: Fri, 4 Sep 2026 21:28:41 +0900
+Subject: [PATCH] libio: Fix CVE-2026-18374 heap buffer overflow in ccs=
+ handling
+
+When fopen() is called with a ,ccs= parameter whose value becomes empty
+after strip(), the code must reject it with EINVAL instead of attempting
+to use it. The original upstr() fallback could read past the ',' delimiter
+and cause a heap buffer overflow.
+
+The fix checks if the charset specification is empty after strip() and
+returns EINVAL immediately, preventing the overflow and following the
+approach described in BZ #34574.
+
+CVE-2026-18374 - CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
+
+Reported-by: AISLE in partnership with Red Hat
+Signed-off-by: Dongkyun Son <dongkyun.s@samsung.com>
+Reviewed-by: Florian Weimer <fweimer@redhat.com>
+(cherry picked from commit 9765a538ebf8661a6e5578e01e35a3dd30db7eb4)
+
+CVE: CVE-2026-18374
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=f806c45178dbca3be08a25cc5dd6d5542ce84a59]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libio/fileops.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/libio/fileops.c b/libio/fileops.c
+index 775999deb3..18efe8e0c0 100644
+--- a/libio/fileops.c
++++ b/libio/fileops.c
+@@ -305,12 +305,14 @@ _IO_new_file_fopen (FILE *fp, const char *filename, const char *mode,
+ *((char *) __mempcpy (ccs, cs + 5, endp - (cs + 5))) = '\0';
+ strip (ccs, ccs);
+
+- if (__wcsmbs_named_conv (&fcts, ccs[2] == '\0'
+- ? upstr (ccs, cs + 5) : ccs) != 0)
++ /* After stripping, ccs[2] == '\0' means the charset name is empty.
++ This is not a valid charset and would cause problems downstream.
++ Reject it with EINVAL (BZ #34574, CVE-2026-18374). */
++ if (ccs[2] == '\0' || __wcsmbs_named_conv (&fcts, ccs) != 0)
+ {
+- /* Something went wrong, we cannot load the conversion modules.
+- This means we cannot proceed since the user explicitly asked
+- for these. */
++ /* Either the charset name is empty after strip(), or conversion
++ modules cannot be loaded. This means we cannot proceed since
++ the user explicitly asked for character conversion. */
+ (void) _IO_file_close_it (fp);
+ free (ccs);
+ __set_errno (EINVAL);
diff --git a/meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch b/meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch
new file mode 100644
index 00000000000..d653d545f51
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0041-CVE-2026-18374-02.patch
@@ -0,0 +1,103 @@
+From 5dd252cf1d113644b3679f5a158e9ef20217865e Mon Sep 17 00:00:00 2001
+From: Shamil Abdulaev <ashamil435@gmail.com>
+Date: Thu, 3 Sep 2026 20:19:42 +0300
+Subject: [PATCH] libio: Add test for fopen with an empty ", ccs=" value [BZ
+ #34574]
+
+This goes on top of the fix for CVE-2026-18374. The test runs the
+reproducer from the bug report, plus "w,ccs=" and "w,ccs=,", and
+expects NULL with errno set to EINVAL.
+
+Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
+Reviewed-by: Florian Weimer <fweimer@redhat.com>
+(cherry picked from commit cca93e5d88d3d4ed073c03100467696f652269e7)
+
+CVE: CVE-2026-18374
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=5dd252cf1d113644b3679f5a158e9ef20217865e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libio/Makefile | 1 +
+ libio/tst-fopen-ccs-empty.c | 62 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 63 insertions(+)
+ create mode 100644 libio/tst-fopen-ccs-empty.c
+
+diff --git a/libio/Makefile b/libio/Makefile
+index 43ee8db06d..5b9929c3de 100644
+--- a/libio/Makefile
++++ b/libio/Makefile
+@@ -99,6 +99,7 @@ tests = \
+ tst-fgetc-after-eof \
+ tst-fgetwc \
+ tst-fgetws \
++ tst-fopen-ccs-empty \
+ tst-fopenloc2 \
+ tst-fputws \
+ tst-freopen \
+diff --git a/libio/tst-fopen-ccs-empty.c b/libio/tst-fopen-ccs-empty.c
+new file mode 100644
+index 0000000000..64723965e1
+--- /dev/null
++++ b/libio/tst-fopen-ccs-empty.c
+@@ -0,0 +1,62 @@
++/* Test fopen with an empty ",ccs=" value in the mode string (bug 34574).
++ Copyright (C) 2026 Free Software Foundation, Inc.
++ This file is part of the GNU C Library.
++
++ The GNU C Library is free software; you can redistribute it and/or
++ modify it under the terms of the GNU Lesser General Public
++ License as published by the Free Software Foundation; either
++ version 2.1 of the License, or (at your option) any later version.
++
++ The GNU C Library is distributed in the hope that it will be useful,
++ but WITHOUT ANY WARRANTY; without even the implied warranty of
++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
++ Lesser General Public License for more details.
++
++ You should have received a copy of the GNU Lesser General Public
++ License along with the GNU C Library; if not, see
++ <https://www.gnu.org/licenses/>. */
++
++#include <errno.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <support/check.h>
++#include <support/support.h>
++#include <support/temp_file.h>
++#include <support/xunistd.h>
++
++static void
++check_fopen_fails (const char *path, const char *mode)
++{
++ errno = 0;
++ FILE *fp = fopen (path, mode);
++ TEST_VERIFY (fp == NULL);
++ TEST_COMPARE (errno, EINVAL);
++ if (fp != NULL)
++ fclose (fp);
++}
++
++static int
++do_test (void)
++{
++ char *path;
++ xclose (create_temp_file ("tst-fopen-ccs-empty", &path));
++
++ /* The value is blank and the mode string continues well past it. */
++ enum { size = 1024 * 1024 };
++ char *mode = xmalloc (size);
++ memset (mode, 'X', size);
++ mode[size - 1] = '\0';
++ static const char prefix[] = "w,ccs= ,";
++ memcpy (mode, prefix, sizeof (prefix) - 1);
++ check_fopen_fails (path, mode);
++ free (mode);
++
++ check_fopen_fails (path, "w,ccs=");
++ check_fopen_fails (path, "w,ccs=,");
++
++ free (path);
++ return 0;
++}
++
++#include <support/test-driver.c>
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 144ce36ccc2..3e95792b359 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -72,6 +72,8 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0037-CVE-2026-77117.patch \
file://0038-CVE-2026-80489.patch \
file://0039-CVE-2026-77117-CVE-2026-80489.patch \
+ file://0040-CVE-2026-18374-01.patch \
+ file://0041-CVE-2026-18374-02.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 31/55] glibc: patch CVE-2026-8674
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (29 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 30/55] glibc: patch CVE-2026-18374 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 32/55] glibc: patch CVE-2026-89092 Yoann Congal
` (23 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0042-CVE-2026-8674.patch | 118 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 119 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch
diff --git a/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch b/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch
new file mode 100644
index 00000000000..bbdeafd5f38
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0042-CVE-2026-8674.patch
@@ -0,0 +1,118 @@
+From c97fdd483232a831829aaff458a212307f1bf4bc Mon Sep 17 00:00:00 2001
+From: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Date: Mon, 14 Sep 2026 17:08:03 -0300
+Subject: [PATCH] resolv: Fix assertion failure on search list truncation [BZ
+ 31026, CVE-2026-8674]
+
+update_from_conf copies the search list into the 256-byte
+resp->defdname and truncates it when an entry does not fit, then
+asserts that resolv_conf_matches accepts the result.
+
+The truncation check there compared the accumulated size against
+sizeof (resp->dnsrch) (the pointer array) instead of resp->defdname,
+and the empty-list case did not account for a first entry that does
+not fit at all. A long search domain in resolv.conf or LOCALDOMAIN
+thus aborts any process using the resolver.
+
+Check whether the entry fits in the remaining defdname space, matching
+alloc_buffer_copy_string, and also accept an empty resp->dnsrch when
+the first entry is too long. Add tests covering both cases through
+the search and domain directives.
+
+Checked on x86_64-linux-gnu and i686-linux-gnu.
+Reviewed-by: Florian Weimer <fweimer@redhat.com>
+
+(cherry picked from commit 506ea57086bfb9ce3daff1c14246a1cb532aba0a)
+(cherry picked from commit c0c8a45dee30c8089822d859575a3ad4324b15ff)
+
+CVE: CVE-2026-8674
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=c97fdd483232a831829aaff458a212307f1bf4bc]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ resolv/resolv_conf.c | 19 +++++++++------
+ resolv/tst-resolv-res_init-skeleton.c | 35 +++++++++++++++++++++++++++
+ 2 files changed, 47 insertions(+), 7 deletions(-)
+
+diff --git a/resolv/resolv_conf.c b/resolv/resolv_conf.c
+index dcf92ee90e..0418267044 100644
+--- a/resolv/resolv_conf.c
++++ b/resolv/resolv_conf.c
+@@ -281,8 +281,12 @@ resolv_conf_matches (const struct __res_state *resp,
+ {
+ if (resp->dnsrch[0] == NULL)
+ {
+- /* Empty search list. No default domain name. */
+- return conf->search_list_size == 0 && resp->defdname[0] == '\0';
++ /* Empty search list, or the first entry does not fit in
++ resp->defdname. No default domain name. */
++ return resp->defdname[0] == '\0'
++ && (conf->search_list_size == 0
++ || (strlen (conf->search_list[0]) + 1
++ > sizeof (resp->defdname)));
+ }
+
+ if (resp->dnsrch[0] != resp->defdname)
+@@ -309,11 +313,12 @@ resolv_conf_matches (const struct __res_state *resp,
+ }
+ else
+ {
+- /* resp->dnsrch is truncated if the number of elements
+- exceeds MAXDNSRCH, or if the combined storage space for
+- the search list exceeds what can be stored in
+- resp->defdname. */
+- if (i == MAXDNSRCH || search_list_size > sizeof (resp->dnsrch))
++ /* resp->dnsrch is truncated if the number of elements exceeds
++ MAXDNSRCH, or if conf->search_list[i] does not fit in the
++ remaining space of resp->defdname. */
++ if (i == MAXDNSRCH
++ || (search_list_size + strlen (conf->search_list[i]) + 1
++ > sizeof (resp->defdname)))
+ break;
+ /* Otherwise, a mismatch indicates a match failure. */
+ return false;
+diff --git a/resolv/tst-resolv-res_init-skeleton.c b/resolv/tst-resolv-res_init-skeleton.c
+index 3ccbe71db9..4e9c57f3cb 100644
+--- a/resolv/tst-resolv-res_init-skeleton.c
++++ b/resolv/tst-resolv-res_init-skeleton.c
+@@ -713,6 +713,41 @@ struct test_case test_cases[] =
+ "nameserver 192.0.2.1\n"
+ "; nameserver[0]: [192.0.2.1]:53\n"
+ },
++/* Search list entries which do not fit in the legacy 256-byte
++ resp->defdname buffer (bug 31026). LONG244 is 244 characters long,
++ so it does not fit after "example.com\0" (12 bytes). LONG256 is 256
++ characters long, so it does not fit even as the first entry. */
++#define LBL63 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++#define LONG244 LBL63 "." LBL63 "." LBL63 "." \
++ "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
++#define LONG256 LBL63 "." LBL63 "." LBL63 "." LBL63 "a"
++ {.name = "search list truncated at long entry after short entry",
++ .conf = "nameserver 192.0.2.1\n"
++ "search example.com " LONG244 "\n",
++ .expected = "search example.com\n"
++ "; search[0]: example.com\n"
++ "; search[1]: " LONG244 "\n"
++ "nameserver 192.0.2.1\n"
++ "; nameserver[0]: [192.0.2.1]:53\n"
++ },
++ {.name = "search list truncated at long first entry",
++ .conf = "nameserver 192.0.2.1\n"
++ "search " LONG256 " example.com\n",
++ .expected = "; search[0]: " LONG256 "\n"
++ "; search[1]: example.com\n"
++ "nameserver 192.0.2.1\n"
++ "; nameserver[0]: [192.0.2.1]:53\n"
++ },
++ {.name = "long first entry from the domain directive",
++ .conf = "nameserver 192.0.2.1\n"
++ "domain " LONG256 "\n",
++ .expected = "; search[0]: " LONG256 "\n"
++ "nameserver 192.0.2.1\n"
++ "; nameserver[0]: [192.0.2.1]:53\n"
++ },
++#undef LONG256
++#undef LONG244
++#undef LBL63
+ {.name = "trust-ad flag",
+ .conf = "options trust-ad\n"
+ "nameserver 192.0.2.1\n",
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 3e95792b359..3b27328c21a 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -74,6 +74,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0039-CVE-2026-77117-CVE-2026-80489.patch \
file://0040-CVE-2026-18374-01.patch \
file://0041-CVE-2026-18374-02.patch \
+ file://0042-CVE-2026-8674.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 32/55] glibc: patch CVE-2026-89092
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (30 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 31/55] glibc: patch CVE-2026-8674 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 33/55] glibc: patch CVE-2026-97399 Yoann Congal
` (22 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0047-CVE-2026-89092.patch | 245 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 246 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch
diff --git a/meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch b/meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch
new file mode 100644
index 00000000000..8df9dc904e4
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0047-CVE-2026-89092.patch
@@ -0,0 +1,245 @@
+From fa3ea0362354af7370abb5fe8c6f31a32a73af8e Mon Sep 17 00:00:00 2001
+From: DJ Delorie <dj@redhat.com>
+Date: Mon, 28 Sep 2026 14:27:16 +0200
+Subject: [PATCH] CVE-2026-89092: nscd: replace alloca with malloc in aicache,
+ hstcache
+
+This changes the alloca fallback to a malloc fallback
+in the addrinfo and host cache code.
+
+This fixes bug 34624.
+
+Co-authored-by: Florian Weimer <fweimer@redhat.com>
+Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+(cherry picked from commit cbf59b836645b6ac69ad8c47a560598bc4942ecc)
+
+CVE: CVE-2026-89092
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=fa3ea0362354af7370abb5fe8c6f31a32a73af8e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ nscd/aicache.c | 27 ++++++++++++++++++---------
+ nscd/hstcache.c | 47 ++++++++++++++++++++++++++++++++++-------------
+ 2 files changed, 52 insertions(+), 22 deletions(-)
+
+diff --git a/nscd/aicache.c b/nscd/aicache.c
+index 6f47236627..1ac86b86d8 100644
+--- a/nscd/aicache.c
++++ b/nscd/aicache.c
+@@ -93,7 +93,9 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,
+ int32_t ttl = INT32_MAX;
+ ssize_t total = 0;
+ char *key_copy = NULL;
+- bool alloca_used = false;
++ /* If not NULL, dataset is a temporary dataset not inserted into the
++ database, and needs to be free'd. */
++ void *dataset_alloc = NULL;
+ time_t timeout = MAX_TIMEOUT_VALUE;
+
+ while (!no_more)
+@@ -164,10 +166,12 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,
+ /* We cannot permanently add the result in the moment. But
+ we can provide the result as is. Store the data in some
+ temporary memory. */
+- dataset = (struct dataset *) alloca (total + req->key_len);
++ dataset = (struct dataset *) malloc (total + req->key_len);
++ if (dataset == NULL)
++ goto out;
+
+ /* We cannot add this record to the permanent database. */
+- alloca_used = true;
++ dataset_alloc = dataset;
+ }
+
+ /* Fill in the address and address families. */
+@@ -336,10 +340,12 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,
+ /* We cannot permanently add the result in the moment. But
+ we can provide the result as is. Store the data in some
+ temporary memory. */
+- dataset = (struct dataset *) alloca (total + req->key_len);
++ dataset = (struct dataset *) malloc (total + req->key_len);
++ if (dataset == NULL)
++ goto out;
+
+ /* We cannot add this record to the permanent database. */
+- alloca_used = true;
++ dataset_alloc = dataset;
+ }
+
+ /* Fill in the address and address families. */
+@@ -391,8 +397,7 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,
+ resp)) == 0)
+ {
+ /* The data has not changed. We will just bump the
+- timeout value. Note that the new record has been
+- allocated on the stack and need not be freed. */
++ timeout value. */
+ dh->timeout = dataset->head.timeout;
+ dh->ttl = dataset->head.ttl;
+ ++dh->nreloads;
+@@ -410,7 +415,9 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,
+ key_copy = (char *) newp + (key_copy - (char *) dataset);
+
+ dataset = memcpy (newp, dataset, total + req->key_len);
+- alloca_used = false;
++
++ free (dataset_alloc);
++ dataset_alloc = NULL;
+ }
+
+ /* Mark the old record as obsolete. */
+@@ -488,7 +495,7 @@ next_nip:
+ out:
+ __resolv_context_put (ctx);
+
+- if (dataset != NULL && !alloca_used)
++ if (dataset != NULL && dataset_alloc == NULL)
+ {
+ /* If necessary, we also propagate the data to disk. */
+ if (db->persistent)
+@@ -514,6 +521,8 @@ next_nip:
+ scratch_buffer_free (&tmpbuf4);
+ scratch_buffer_free (&canonbuf);
+
++ free (dataset_alloc);
++
+ return timeout;
+ }
+
+diff --git a/nscd/hstcache.c b/nscd/hstcache.c
+index 7b3a8ab1ea..11af5cb34a 100644
+--- a/nscd/hstcache.c
++++ b/nscd/hstcache.c
+@@ -15,7 +15,6 @@
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, see <https://www.gnu.org/licenses/>. */
+
+-#include <alloca.h>
+ #include <assert.h>
+ #include <errno.h>
+ #include <error.h>
+@@ -187,7 +186,7 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ /* Determine the I/O structure. */
+ size_t h_name_len = strlen (hst->h_name) + 1;
+ size_t h_aliases_cnt;
+- uint32_t *h_aliases_len;
++ uint32_t *h_aliases_len = NULL;
+ size_t h_addr_list_cnt;
+ char *addresses;
+ char *aliases;
+@@ -201,7 +200,13 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ for (cnt = 0; hst->h_aliases[cnt] != NULL; ++cnt)
+ ++h_aliases_cnt;
+ /* Determine the length of all aliases. */
+- h_aliases_len = (uint32_t *) alloca (h_aliases_cnt * sizeof (uint32_t));
++ if (h_aliases_cnt > 0)
++ {
++ h_aliases_len = (uint32_t *) reallocarray (NULL, h_aliases_cnt,
++ sizeof (uint32_t));
++ if (h_aliases_len == NULL)
++ return MAX_TIMEOUT_VALUE;
++ }
+ total = 0;
+ for (cnt = 0; cnt < h_aliases_cnt; ++cnt)
+ {
+@@ -215,8 +220,11 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ ++h_addr_list_cnt;
+
+ if (h_addr_list_cnt == 0)
+- /* Invalid entry. */
+- return MAX_TIMEOUT_VALUE;
++ {
++ /* Invalid entry. */
++ free (h_aliases_len);
++ return MAX_TIMEOUT_VALUE;
++ }
+
+ total += (sizeof (struct dataset)
+ + h_name_len
+@@ -227,8 +235,10 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ change. Allocate memory on the cache since it is likely
+ discarded anyway. If it turns out to be necessary to have a
+ new record we can still allocate real memory. */
+- bool alloca_used = false;
+ dataset = NULL;
++ /* If not NULL, dataset is a temporary dataset not inserted into
++ the database, and needs to be free'd. */
++ void *dataset_alloc = NULL;
+
+ /* If the record contains more than one IP address (used for
+ load balancing etc) don't cache the entry. This is something
+@@ -244,10 +254,15 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ /* We cannot permanently add the result in the moment. But
+ we can provide the result as is. Store the data in some
+ temporary memory. */
+- dataset = (struct dataset *) alloca (total + req->key_len);
++ dataset = (struct dataset *) malloc (total + req->key_len);
++ if (dataset == NULL)
++ {
++ free (h_aliases_len);
++ return MAX_TIMEOUT_VALUE;
++ }
+
+ /* We cannot add this record to the permanent database. */
+- alloca_used = true;
++ dataset_alloc = dataset;
+ }
+
+ timeout = datahead_init_pos (&dataset->head, total + req->key_len,
+@@ -270,7 +285,8 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ cp = dataset->strdata;
+
+ cp = mempcpy (cp, hst->h_name, h_name_len);
+- cp = mempcpy (cp, h_aliases_len, h_aliases_cnt * sizeof (uint32_t));
++ if (h_aliases_cnt > 0)
++ cp = mempcpy (cp, h_aliases_len, h_aliases_cnt * sizeof (uint32_t));
+
+ /* The normal addresses first. */
+ addresses = cp;
+@@ -282,6 +298,8 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ for (cnt = 0; cnt < h_aliases_cnt; ++cnt)
+ cp = mempcpy (cp, hst->h_aliases[cnt], h_aliases_len[cnt]);
+
++ free (h_aliases_len);
++
+ assert (cp
+ == dataset->strdata + total - offsetof (struct dataset,
+ strdata));
+@@ -307,8 +325,7 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ dh->allocsize - offsetof (struct dataset, resp)) == 0)
+ {
+ /* The data has not changed. We will just bump the
+- timeout value. Note that the new record has been
+- allocated on the stack and need not be freed. */
++ timeout value. */
+ assert (h_addr_list_cnt == 1);
+ dh->ttl = dataset->head.ttl;
+ dh->timeout = dataset->head.timeout;
+@@ -334,7 +351,9 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ key_copy = (char *) newp + (key_copy - (char *) dataset);
+
+ dataset = memcpy (newp, dataset, total + req->key_len);
+- alloca_used = false;
++
++ free (dataset_alloc);
++ dataset_alloc = NULL;
+ }
+ }
+
+@@ -362,7 +381,7 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+ the current cache handling cannot handle and it is more than
+ questionable whether it is worthwhile complicating the cache
+ handling just for handling such a special case. */
+- if (! alloca_used)
++ if (dataset_alloc == NULL)
+ {
+ /* If necessary, we also propagate the data to disk. */
+ if (db->persistent)
+@@ -393,6 +412,8 @@ cache_addhst (struct database_dyn *db, int fd, request_header *req,
+
+ pthread_rwlock_unlock (&db->lock);
+ }
++ free (dataset_alloc);
++ dataset_alloc = NULL;
+ }
+
+ if (__builtin_expect (!all_written, 0) && debug_level > 0)
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 3b27328c21a..0fe9c41662b 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -75,6 +75,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0040-CVE-2026-18374-01.patch \
file://0041-CVE-2026-18374-02.patch \
file://0042-CVE-2026-8674.patch \
+ file://0047-CVE-2026-89092.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 33/55] glibc: patch CVE-2026-97399
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (31 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 32/55] glibc: patch CVE-2026-89092 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 34/55] glibc: stable 2.39 branch updates to b7a0de2c8f Yoann Congal
` (21 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch referencing this CVE from 2.41 branch (oldest release
still receiving security updates).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 3.41 -> 2.41 typo in branch name]
---
.../glibc/glibc/0048-CVE-2026-97399.patch | 128 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.39.bb | 1 +
2 files changed, 129 insertions(+)
create mode 100644 meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch
diff --git a/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch b/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch
new file mode 100644
index 00000000000..c5aec0802c9
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0048-CVE-2026-97399.patch
@@ -0,0 +1,128 @@
+From f247c0a2fb5b3e48a771d2d23efc9a45c64e957d Mon Sep 17 00:00:00 2001
+From: Sachin Monga <smonga@linux.ibm.com>
+Date: Thu, 1 Oct 2026 00:51:23 +0530
+Subject: [PATCH] powerpc: Fix one byte overread in strncasecmp (bug 34683,
+ CVE-2026-97399)
+
+The Power8 strncasecmp (strcasecmp.S with USE_AS_STRNCASECMP) touches
+s1[n]/s2[n] in three places when the first n bytes compare equal and
+contain no NUL: L(loop) preloads the next byte before its bdnz;
+L(loop1) increments then loads before its bdnz; and L(bytebybyte) loads
+s1[0]/s2[0] before checking r5. A caller that maps exactly n readable bytes
+can get SIGSEGV if byte n falls on an unmapped page.
+
+The L(bytebybyte) site was identified by Florian Weimer; the
+original AISLE report covered only the two loops.
+
+Fix all three sites: guard L(bytebybyte) with a r5 == 0 check, split the
+bdnz/load pairs in L(loop) and L(loop1) so the load only runs when the
+count is still positive, and preload rCHAR1/rCHAR2 in L(lessthan4) after
+confirming r5 != 0. strcasecmp is unaffected; its generated code is
+unchanged.
+
+Add string/test-strncasecmp-nonarray.c, built on the test-Xncmp-nonarray.c
+skeleton: maps a PROT_NONE page past both buffers and sweeps all start
+offsets and lengths. Runs as an xtest.
+
+Reported-by: AISLE in partnership with Red Hat
+Suggested-by: Florian Weimer <fweimer@redhat.com>
+(cherry picked from commit e622f82ea8797704ac8f761f88ed3e429e97fedd)
+
+CVE: CVE-2026-97399
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=f247c0a2fb5b3e48a771d2d23efc9a45c64e957d]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ string/Makefile | 4 +--
+ string/test-strncasecmp-nonarray.c | 4 +++
+ sysdeps/powerpc/powerpc64/power8/strcasecmp.S | 25 +++++++++++++++----
+ 3 files changed, 26 insertions(+), 7 deletions(-)
+ create mode 100644 string/test-strncasecmp-nonarray.c
+
+diff --git a/string/Makefile b/string/Makefile
+index c83b195e2e..d7437cd915 100644
+--- a/string/Makefile
++++ b/string/Makefile
+@@ -238,8 +238,8 @@ endif
+ # This test allocates a lot of memory and can run for a long time.
+ xtests += tst-strcoll-overflow
+
+-# This test runs for a long time.
+-xtests += test-strncmp-nonarray
++# These tests run for a long time.
++xtests += test-strncasecmp-nonarray test-strncmp-nonarray
+
+ # This test needs libdl.
+ ifeq (yes,$(build-shared))
+diff --git a/string/test-strncasecmp-nonarray.c b/string/test-strncasecmp-nonarray.c
+new file mode 100644
+index 0000000000..d68e58d5ec
+--- /dev/null
++++ b/string/test-strncasecmp-nonarray.c
+@@ -0,0 +1,4 @@
++#define TEST_IDENTIFIER strncasecmp
++#define TEST_NAME "strncasecmp"
++typedef char CHAR;
++#include "test-Xncmp-nonarray.c"
+diff --git a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S
+index 7ce53407b8..838b8bf75f 100644
+--- a/sysdeps/powerpc/powerpc64/power8/strcasecmp.S
++++ b/sysdeps/powerpc/powerpc64/power8/strcasecmp.S
+@@ -355,6 +355,14 @@ L(bytebybyte):
+ offset and string descriptors are only updated in the end
+ of loop unrolling. */
+ ld rLOC, LOCALE_CTYPE_TOLOWER(rLOC)
++#ifdef USE_AS_STRNCASECMP
++ /* This entry point can be reached from the vector loop with
++ r5 == 0 (the last vector chunk ended exactly at the `n'
++ boundary). Do not read s1[0]/s2[0] in that case: those
++ bytes are s1[n]/s2[n], one past the caller's bound. */
++ cmpdi cr7, r5, 0
++ beq cr7, L(retnull)
++#endif
+ lbz rCHAR1, 0(rSTR1) /* Load char from s1 */
+ lbz rCHAR2, 0(rSTR2) /* Load char from s2 */
+ #ifdef USE_AS_STRNCASECMP
+@@ -405,19 +413,23 @@ L(loop):
+ cmpw cr1, rLWR1, rLWR2
+ crorc 4*cr1+eq,eq,4*cr1+eq
+ beq cr1, L(done)
++#ifdef USE_AS_STRNCASECMP
++ /* Test the remaining count before touching the next byte. */
++ bdnz L(loop_load)
++ b L(lessthan4)
++L(loop_load):
++#endif
+ lbz rCHAR1, 0(rSTR1) /* Load char from s1 */
+ lbz rCHAR2, 0(rSTR2) /* Load char from s2 */
+-#ifdef USE_AS_STRNCASECMP
+- bdnz L(loop)
+-#else
+ b L(loop)
+-#endif
+ #ifdef USE_AS_STRNCASECMP
+ L(lessthan4):
+ clrldi r5, r5, 62
+ cmpdi cr7, r5, 0
+ beq cr7, L(retnull)
+ mtctr r5
++ lbz rCHAR1, 0(rSTR1)
++ lbz rCHAR2, 0(rSTR2)
+ L(loop1):
+ cmpdi rCHAR1, 0
+ sldi rADDR1, rCHAR1, 2
+@@ -427,11 +439,14 @@ L(loop1):
+ cmpw cr1, rLWR1, rLWR2
+ crorc 4*cr1+eq,eq,4*cr1+eq
+ beq cr1, L(done)
++ bdnz L(loop1_load)
++ b L(retnull)
++L(loop1_load):
+ addi rSTR1, rSTR1, 1
+ addi rSTR2, rSTR2, 1
+ lbz rCHAR1, 0(rSTR1)
+ lbz rCHAR2, 0(rSTR2)
+- bdnz L(loop1)
++ b L(loop1)
+ #endif
+ L(done):
+ subf r0, rLWR2, rLWR1
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 0fe9c41662b..09ac0fc53f7 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -76,6 +76,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \
file://0041-CVE-2026-18374-02.patch \
file://0042-CVE-2026-8674.patch \
file://0047-CVE-2026-89092.patch \
+ file://0048-CVE-2026-97399.patch \
"
S = "${WORKDIR}/git"
B = "${WORKDIR}/build-${TARGET_SYS}"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 34/55] glibc: stable 2.39 branch updates to b7a0de2c8f
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (32 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 33/55] glibc: patch CVE-2026-97399 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 35/55] b4-config: Add configuration for scarthgap Yoann Congal
` (20 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Update SRCREV to pull the latest fixes from the upstream
release/2.39/master branch. This branch does not seem to receive
security fixes anymore, but still got two new commits during last
months.
Commits between the old SRCREV (be1e627cd7) and the new SRCREV (b7a0de2c8f):
b7a0de2c8f powerpc: Fix off-by-one in AT_HWCAP4 loop in _dl_procinfo
d9eaad3515 rtld: cache cpuid results on the stack for intel
Testing Results:
(note that the comparison is done against yocto-20.0.21, so includes
testing of last 14 CVE patches)
+--------------+--------+--------+------+
| Result | Before | After | Diff |
+--------------+--------+--------+------+
| PASS | 4933 | 4941 | +8 |
| FAIL | 221 | 223 | +2 |
| XFAIL | 16 | 16 | 0 |
| XPASS | 4 | 4 | 0 |
| UNSUPPORTED | 227 | 227 | 0 |
+--------------+--------+--------+------+
Changes in testcases: Before After Source
(no change in already existing tests, flaky test filtered by 3 runs)
elf/tst-dl-path-normalize --- PASS CVE-2026-86805/CVE-2026-95818
elf/tst-tunables-enable_secure --- PASS CVE-2026-86805/CVE-2026-95818 test harness
iconvdata/tst-jisx0213-progress --- PASS CVE-2026-77117/CVE-2026-80489
libio/bug-wgenops-bz33998.test-result --- PASS CVE-2026-5928
libio/tst-fopen-ccs-empty --- PASS CVE-2026-18374
posix/tst-wordexp-append --- PASS CVE-2026-6368
stdio-common/tst-vfscanf-bz34008 --- PASS CVE-2026-5450
stdlib/tst-strfmon-bug34510 --- PASS CVE-2026-19499
elf/tst-origin-secure --- FAIL CVE-2026-86805/CVE-2026-95818
posix/tst-wordexp-tilde --- FAIL CVE-2026-6791
The two new tests which do not pass when running glibc-testsuite will
pass under following conditions:
* FAIL -> UNSUPPORTED: removing patch 0022 fixes these tests
this fixes 41 FAIL -> 6 PASS + 35 UNSUPPORTED and can be sent as
separate patch if requested
see OE-Core rev: 5eb80f3c562f6e395562c52df67fab60ae0ff32b
* UNSUPPORTED -> PASS: running natively
qemu-user doesn't support the call test-container makes to create its
isolated environment (unshare(CLONE_NEWUSER))
running natively is possible when target arch equals to host arch
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed a 2.44 -> 2.39 typo in branch name]
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 5d57dafed0a..1f4f372c13b 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.39/master"
PV = "2.39+git"
-SRCREV_glibc ?= "be1e627cd72db31161a3b4ce1c8114674f0895eb"
+SRCREV_glibc ?= "b7a0de2c8f68722cfdfc735b8358a3a6559ec0eb"
SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 35/55] b4-config: Add configuration for scarthgap
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (33 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 34/55] glibc: stable 2.39 branch updates to b7a0de2c8f Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 36/55] dhcpcd: patch CVE-2025-70102 Yoann Congal
` (19 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Paul Barker <paul@pbarker.dev>
This should simplify sending patches for scarthgap using `b4`.
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.b4-config | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 .b4-config
diff --git a/.b4-config b/.b4-config
new file mode 100644
index 00000000000..5876a9f2691
--- /dev/null
+++ b/.b4-config
@@ -0,0 +1,4 @@
+[b4]
+ send-series-to = openembedded-core@lists.openembedded.org
+ prep-pre-flight-checks = disable-needs-auto-to-cc, disable-needs-checking
+ send-prefixes = scarthgap
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 36/55] dhcpcd: patch CVE-2025-70102
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (34 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 35/55] b4-config: Add configuration for scarthgap Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 37/55] python3: upgrade 3.12.15 -> 3.12.16 Yoann Congal
` (18 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2025-70102
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../dhcpcd/dhcpcd_10.0.6.bb | 1 +
.../dhcpcd/files/CVE-2025-70102.patch | 30 +++++++++++++++++++
2 files changed, 31 insertions(+)
create mode 100644 meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch
diff --git a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb
index c32db0adf5d..85f55611eaf 100644
--- a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb
+++ b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/NetworkConfiguration/dhcpcd;protocol=https;branch=ma
file://CVE-2026-56113.patch \
file://CVE-2026-56114.patch \
file://CVE-2026-56117.patch \
+ file://CVE-2025-70102.patch \
"
SRCREV = "1c8ae59836fa87b4c63c598087f0460ec20ed862"
diff --git a/meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch b/meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch
new file mode 100644
index 00000000000..e2b0e291f9c
--- /dev/null
+++ b/meta/recipes-connectivity/dhcpcd/files/CVE-2025-70102.patch
@@ -0,0 +1,30 @@
+From 117742d755b591764036dd4218f314f748a3d2b7 Mon Sep 17 00:00:00 2001
+From: Roy Marples <roy@marples.name>
+Date: Sun, 21 Dec 2025 08:31:52 +0000
+Subject: [PATCH] options: Ensure ldop is not NULL dereferenced (#568)
+
+ldop itself cannot be non NULL as it points to the location.
+but *ldop CAN be NULL.
+
+Fixes #567.
+
+CVE: CVE-2025-70102
+Upstream-Status: Backport [https://github.com/NetworkConfiguration/dhcpcd/commit/117742d755b591764036dd4218f314f748a3d2b7]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ src/if-options.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/if-options.c b/src/if-options.c
+index 083449b9..9ac9f0b8 100644
+--- a/src/if-options.c
++++ b/src/if-options.c
+@@ -1882,7 +1882,7 @@ err_sla:
+ if (*edop) {
+ dop = &(*edop)->embopts;
+ dop_len = &(*edop)->embopts_len;
+- } else if (ldop) {
++ } else if (*ldop) {
+ dop = &(*ldop)->embopts;
+ dop_len = &(*ldop)->embopts_len;
+ } else {
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 37/55] python3: upgrade 3.12.15 -> 3.12.16
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (35 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 36/55] dhcpcd: patch CVE-2025-70102 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:14 ` [OE-core][scarthgap 38/55] shadow-native: Disable syslog usage Yoann Congal
` (17 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This is a security release of Python 3.12
Release information: [1]
This is an expedited security release to address the compromised eMudhra
intermediate CA keys. These keys are now blocked by the ssl module as a
last resort against their use.
Normal uses of pip, including to upgrade pip itself, are now safe from
attacks based on those compromised keys, even if pip hasn't been updated
yet.
Security content in this release
* CVE-2026-115557 gh-160040: Distrust compromised eMudhra intermediate CA keys
* CVE-2026-77214 CVE-2026-102633 gh-158876: Update bundled Expat to 2.9.0
* CVE-2024-3220 gh-159428: Don't read mimetypes.knownfiles by default on Windows
* CVE-2026-114583 gh-160097: Reject links replacing the destination in tarfile.tar_filter
* gh-87720: Fix additional header refolding-quoting edge case
* gh-157579: Fix race condition in the cleanup of tempfile.TemporaryDirectory
* gh-160300: Reject cookies with a negative version in http.cookiejar
[1] https://www.python.org/downloads/release/python-31216/
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../0001-Avoid-shebang-overflow-on-python-config.py.patch | 2 +-
...1-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch | 2 +-
...1-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch | 2 +-
.../0001-test_ctypes.test_find-skip-without-tools-sdk.patch | 2 +-
meta/recipes-devtools/python/python3/makerace.patch | 2 +-
.../python/{python3_3.12.15.bb => python3_3.12.16.bb} | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
rename meta/recipes-devtools/python/{python3_3.12.15.bb => python3_3.12.16.bb} (99%)
diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
index 6c8b1bf6cd9..3da1b60f3bd 100644
--- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
+++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch
@@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index 2d235d2..1ac2263 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -2361,6 +2361,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh
+@@ -2366,6 +2366,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh
@ # Substitution happens here, as the completely-expanded BINDIR
@ # is not available in configure
sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py
diff --git a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
index 6066b26e38f..3cbde6c6cc5 100644
--- a/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
+++ b/meta/recipes-devtools/python/python3/0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch
@@ -13,7 +13,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index 083f4c7..dce36a5 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -663,8 +663,7 @@ profile-run-stamp:
+@@ -665,8 +665,7 @@ profile-run-stamp:
# enabled.
$(MAKE) profile-gen-stamp
# Next, run the profile task to generate the profile information.
diff --git a/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch b/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch
index 5fdf5f4514e..3f59d824054 100644
--- a/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch
+++ b/meta/recipes-devtools/python/python3/0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch
@@ -16,7 +16,7 @@ diff --git a/Lib/tarfile.py b/Lib/tarfile.py
index 0a0f31e..4dfb67d 100755
--- a/Lib/tarfile.py
+++ b/Lib/tarfile.py
-@@ -2721,7 +2721,8 @@ class TarFile(object):
+@@ -2735,7 +2735,8 @@ class TarFile(object):
os.lchown(targetpath, u, g)
else:
os.chown(targetpath, u, g)
diff --git a/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch b/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch
index 307e4bf3069..d820e37e601 100644
--- a/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch
+++ b/meta/recipes-devtools/python/python3/0001-test_ctypes.test_find-skip-without-tools-sdk.patch
@@ -18,7 +18,7 @@ diff --git a/Lib/test/test_ctypes/test_find.py b/Lib/test/test_ctypes/test_find.
index a41e949..eb5fe19 100644
--- a/Lib/test/test_ctypes/test_find.py
+++ b/Lib/test/test_ctypes/test_find.py
-@@ -113,10 +113,12 @@ class FindLibraryLinux(unittest.TestCase):
+@@ -133,10 +133,12 @@ class FindLibraryLinux(unittest.TestCase):
# LD_LIBRARY_PATH)
self.assertEqual(find_library(libname), 'lib%s.so' % libname)
diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch
index 4575a30bfcf..4fcf6468762 100644
--- a/meta/recipes-devtools/python/python3/makerace.patch
+++ b/meta/recipes-devtools/python/python3/makerace.patch
@@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in
index dce36a5..2d235d2 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
-@@ -2272,7 +2272,7 @@ COMPILEALL_OPTS=-j0
+@@ -2277,7 +2277,7 @@ COMPILEALL_OPTS=-j0
TEST_MODULES=@TEST_MODULES@
.PHONY: libinstall
diff --git a/meta/recipes-devtools/python/python3_3.12.15.bb b/meta/recipes-devtools/python/python3_3.12.16.bb
similarity index 99%
rename from meta/recipes-devtools/python/python3_3.12.15.bb
rename to meta/recipes-devtools/python/python3_3.12.16.bb
index 6c6289b0e69..9946bb075dd 100644
--- a/meta/recipes-devtools/python/python3_3.12.15.bb
+++ b/meta/recipes-devtools/python/python3_3.12.16.bb
@@ -42,7 +42,7 @@ SRC_URI:append:class-native = " \
file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \
"
-SRC_URI[sha256sum] = "c2c4321961fab0fb999d66e0cecf521c2ab3994c7992873ea99e306c1094fd5a"
+SRC_URI[sha256sum] = "b5796915dc45ff745cfb4e990a7e7c93d6f546328a102ce31448d69ebc37575c"
# exclude pre-releases for both python 2.x and 3.x
UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 38/55] shadow-native: Disable syslog usage
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (36 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 37/55] python3: upgrade 3.12.15 -> 3.12.16 Yoann Congal
@ 2026-10-31 0:14 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 39/55] gstreamer1.0: disable an intermittently failing test Yoann Congal
` (16 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:14 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Spamming the build host's syslog with useradd information during image creation
isn't great. Add a patch to disable that.
It may be possible to convince upstream to make it a configure option but for
now the patch is trivial and reduces host impact to the logs.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a52572886e60e4aff9d54b57bf45a301e1dec1ee)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../shadow/files/disable_syslog.patch | 22 +++++++++++++++++++
meta/recipes-extended/shadow/shadow.inc | 1 +
2 files changed, 23 insertions(+)
create mode 100644 meta/recipes-extended/shadow/files/disable_syslog.patch
diff --git a/meta/recipes-extended/shadow/files/disable_syslog.patch b/meta/recipes-extended/shadow/files/disable_syslog.patch
new file mode 100644
index 00000000000..7299a8e61cd
--- /dev/null
+++ b/meta/recipes-extended/shadow/files/disable_syslog.patch
@@ -0,0 +1,22 @@
+When building images using shadow-native, we shouldn't be spamming the host's
+log with lots of syslog messages which aren't relavent. Disable syslog use
+in the native case.
+
+Upstream-Status: Inappropriate [Would upstream accept a configure option?]
+Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
+
+Index: shadow-4.17.2/lib/defines.h
+===================================================================
+--- shadow-4.17.2.orig/lib/defines.h
++++ shadow-4.17.2/lib/defines.h
+@@ -88,7 +88,9 @@
+
+ /* cleaner than lots of #ifdefs everywhere - use this as follows:
+ SYSLOG((LOG_CRIT, "user %s cracked root", user)); */
+-#ifdef ENABLE_NLS
++#if 1
++#define SYSLOG(x)
++#elif ENABLE_NLS
+ /* Temporarily set LC_TIME to "C" to avoid strange dates in syslog.
+ This is a workaround for a more general syslog(d) design problem -
+ syslogd should log the current system time for each event, and not
diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc
index a308ea00d24..37aa7b1f17c 100644
--- a/meta/recipes-extended/shadow/shadow.inc
+++ b/meta/recipes-extended/shadow/shadow.inc
@@ -24,6 +24,7 @@ SRC_URI:append:class-target = " \
SRC_URI:append:class-native = " \
file://commonio.c-fix-unexpected-open-failure-in-chroot-env.patch \
+ file://disable_syslog.patch \
"
SRC_URI[sha256sum] = "a305edf5d19bddbdf5e836d2d609fa8bff2d35458819de4d9f06306a1cf24342"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 39/55] gstreamer1.0: disable an intermittently failing test
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (37 preceding siblings ...)
2026-10-31 0:14 ` [OE-core][scarthgap 38/55] shadow-native: Disable syslog usage Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 40/55] gstreamer: skip test_queue:test_leaky_downstream test as it's flakey Yoann Congal
` (15 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 79ec3a84acc65594942ca9352fddf93d90952d71)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
index 7fee5a3d09c..d6219ddcccb 100755
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
@@ -23,4 +23,8 @@ GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_pull_short_read"
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/3524
GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_convert_duration,parser_pull_frame_growth,parser_reverse_playback"
+# Intermittent fail
+# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5163
+GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,test_device_monitor"
+
gnome-desktop-testing-runner gstreamer
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 40/55] gstreamer: skip test_queue:test_leaky_downstream test as it's flakey
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (38 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 39/55] gstreamer1.0: disable an intermittently failing test Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 41/55] linux-yocto/6.6: update to v6.6.156 Yoann Congal
` (14 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Ross Burton <ross.burton@arm.com>
This test occasionally fails, so skip it. A bug has been filed upstream.
[ YOCTO #15408 ]
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ac8fa6ada2a0cf0ae27316837985dd57b01e727f)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
index d6219ddcccb..b0f2a3050b6 100755
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0/run-ptest
@@ -27,4 +27,7 @@ GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,parser_convert_duration,parser_pull_frame_
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5163
GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,test_device_monitor"
+# https://bugzilla.yoctoproject.org/show_bug.cgi?id=15408
+GST_CHECKS_IGNORE="$GST_CHECKS_IGNORE,test_leaky_downstream"
+
gnome-desktop-testing-runner gstreamer
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 41/55] linux-yocto/6.6: update to v6.6.156
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (39 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 40/55] gstreamer: skip test_queue:test_leaky_downstream test as it's flakey Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 42/55] linux-yocto/6.6: update to v6.6.157 Yoann Congal
` (13 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
8b73de7da85fd Linux 6.6.156
65879e0a452ca usb: usbfs: fix use-after-free of usb_device in usbdev_release()
62cd519ab74ca USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
8e987c4daf4f4 USB: serial: spcp8x5: drop broken carrier detect support
030e3a73d3c3a USB: serial: option: fix slab OOB read in interrupt URB callback
f1c05c41d07b8 ALSA: usb-audio: Complete cleanup after system-resume errors
94e4562fcc81b ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
656bd0ccb9006 usb: core: Strengthen error handling in hub_hub_status()
04ab260407972 usb: core: Add lock to usb_wakeup_notification()
087c19cc60a8c KVM: s390: vsie: zero stale crypto bits
fb8110b748b20 crypto: qce - Remove unsafe/deprecated algorithms
1537bd55b4f84 crypto: mxs-dcp - fix source scatterlist length access
cc56d2b0d77cf crypto: qce - fix CCM AAD buffer underallocation
4d35a92dd3da5 crypto: atmel-tdes - use scatterlist length before DMA mapping
da45847766b52 mm/swap: reject swapon() on filesystem-level encrypted files
f52f1e75716d2 ipv6: seg6: clear IPv4 control block on IPIP decapsulation
7c54fd8cfbcf3 net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
c8837bbe79225 xfrm: fix xfrm_state_construct() auth-trunc leak
f00df8500e5a3 xfrm: ah6: validate routing header segments_left
2dd1609cadff4 xfrm: drop ESP-in-TCP packets with no ingress device
ff8dd7a932f34 xfrm: espintcp: fix UAF during close
a622167351020 x86/CPU/AMD: Carve out a Zen5 models range
7287cc1211312 x86/CPU/AMD: Add models 0x60-0x6f to the Zen5 range
fa05e559102ec x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range
ed9cf952fdec3 x86/CPU/AMD: Add more models to X86_FEATURE_ZEN5
5953e7a89966f x86/CPU/AMD: Add X86_FEATURE_ZEN5
a832d7cb09da2 tls: device: fix out-of-bounds write in tls_append_frag()
ad6f0375d2e93 usb: gadget: f_tcm: keep port count until LUN teardown completes
f95e57b66195c usb: usbtest: disable dynamic ID support
dcf30a56624c2 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
92588d187ba46 fuse: fix invalidate lock leak on setattr writeback failure
c36e7e4eb83e9 xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
eaca2814f32b9 xhci: dbgtty: Fix unregister on tty_register_driver() failure
d27599347b691 usb: xhci: Handle USB3 port events when there is one roothub
daba8d1cd995c accessibility: speakup: unregister tty ldisc on later init failures
ba537c32de311 fpga: dfl: fme: add error handling
95f90c6029cae xfs: remove file_path tracepoint data
b5181516a9f5c Bluetooth: hci_sync: Fix accept list UAF during suspend
b95bc136fe541 Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
2e0471bf3ab2a HID: pidff: fix OOB write when hid->inputs is empty
e9f2ce45b311d HID: pidff: clang-format pass
1acff0590a447 HID: pidff: Support device error response from PID_BLOCK_LOAD
9d77ac82e57ea HID: uclogic: fix use-after-free of inrange_timer on remove
460514d46e889 HID: ft260: fix stack-use-after-return write in I2C read race
3a32b93cff2a3 HID: ft260: validate i2c input report length
c023443f0e6cf HID: nintendo: stop device IO before hid_hw_stop on probe failure
25ad03d5c0e85 nvmet-tcp: bound SGL data length before allocating command buffers
e4f43b3d85885 nvme: rename CDR/MORE/DNR to NVME_STATUS_*
cb8b78b34593b nvme: fix status magic numbers
59d4c2352e823 nvme: rename nvme_sc_to_pr_err to nvme_status_to_pr_err
d16df755b4493 HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
250cea475827f HID: magicmouse: re-enable multitouch after reset-resume
e25b44bd8b8cc nfc: nci: add data_len bound checks to activation parameter extractors
a5e776e293758 nilfs2: reject invalid block index in GC ioctl
df75b4d1656b5 nilfs2: correct return value kernel-doc descriptions for ioctl functions
267a15c4f994d ext4: propagate errors from fast commit range replay
0b34ea0dc2bb6 ext4: make some fast commit functions reuse extents path
e971a37c68cb5 ext4: make state in ext4_mb_mark_bb to be bool
4241e3b406c80 ksmbd: harden file lifetime during session teardown
bfd861dadd3a4 crypto: starfive - Do not free stack buffer
b300312562fd6 powerpc/hv-gpci: fix preempt count leak in sysfs show paths
2df9641e4b622 net/sched: initialize noop_qdisc owner
524323f52cbfb net/sched: Fix mirred deadlock on device recursion
4f15e7704c335 selinux: switch two allocations to use kzalloc_objs()
9a4d8e559c3c9 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
a698d43ce95b7 ASoC: nau8821: Cancel pending work before suspend
b671ba32c5638 Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
66dedb6028c3d riscv: Fix register corruption from uninitialized cregs on error
5662dac41a344 bpf: Fix use-after-free in offloaded map/prog info fill
36fb28fa033f6 ASoC: nau8821: Cancel delayed work on component remove
4f5f52a584293 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
80d1fd39f4e37 smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
7b854e68365a8 KVM: arm64: Prevent access to vCPU events before init
302dbed4760bc smc: Fix use-after-free in __pnet_find_base_ndev().
53ca5b78b69d3 can: j1939: make j1939_sk_bind() fail if device is no longer registered
fd8c807f8d5f1 can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
76957b618ce72 can: j1939: implement NETDEV_UNREGISTER notification handler
75194165e6501 mISDN: hfcpci: Fix warning when deleting uninitialized timer
71209954f1e8f media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
ac65f76db9b2f exfat: fix double free in delayed_free
a39f811a9f5ed jfs: Fix null-ptr-deref in jfs_ioc_trim
9bc078818ec76 ibmvnic: Use kernel helpers for hex dumps
47a99881ecc50 jfs: add check read-only before txBeginAnon() call
41da1715cd24e jfs: add check read-only before truncation in jfs_truncate_nolock()
e217492f6fa22 bpf: Remove tst_run from lwt_seg6local_prog_ops.
ce12e1170c0c7 perf: Reject exited events as group leaders
c1164f14c6366 bpf: Ensure reg is PTR_TO_STACK in process_iter_arg
ff3f428df00bc Revert "usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal"
eb1e94fee5e27 io_uring/io-wq: fix worker accounting when canceling creation callbacks
a13f61ba9b2a7 ext4: don't enable DAX on new encrypted files
429b6f43b4d8c KVM: x86/mmu: Check write tracking in all address spaces
f5e6580a3a16a RDMA/rxe: Fix OOB in free_rd_atomic_resources()
a4a971135a2ff Linux 6.6.155
3edf721bb4b99 inet: frags: strip GSO state from fragments before reassembly
93e0c9521fa8e Linux 6.6.154
e907bf694ed55 net: gro: properly validate BIG TCP aggregation criteria
26741d178f319 Bluetooth: hci_event: validate LE Set CIG Parameters response
0628cc9b2fa29 Bluetooth: hci_event: fix LE list UAF on reset
334271d3812ab HID: hyperv: validate initial device info bounds
2ce90cfc6646a HID: sensor: custom: Fix use-after-free in enable_sensor
abec577de5fc1 HID: core: fix number/pointer type confusion on long items
bd397c4123a4b HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
bb32e9a6a9a9f mptcp: pm: fix memory leak from alloc-during-teardown race
a5321b00b98ec Input: atkbd - skip deactivate for HONOR ZQC-P
346f0edba1d49 Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
c4cec575a6d6f Bluetooth: hci_sync: Fix advertising data UAFs
f0ab9a71167ba xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
c1d9c16af51cc HID: core: fix OOB read of field->usage in hid_set_field()
9b3469d162e3a HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID
3d7a7bac4c75f HID: magicmouse: do not keep a stale msc->input if no input is claimed
514a814c74277 HID: magicmouse: fix battery reporting for Bluetooth Magic Trackpad USB-C
13aa13ce3d653 mptcp: pm: fix data race in add_addr timer callback
48b76879f5bfc ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
4931c09d83877 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
74ec9c120e900 ASoC: SOF: pcm: Add snd_sof_pcm specific wrappers for dev_dbg() and dev_err()
5f291adb281ea ASoC: SOF: pcm: Move period/buffer configuration print after platform open
93c9bee226152 ASoC: SOF: Relocate and rework functionality for PCM stream freeing
925cb11b60c14 ASoC: sof: pcm: use snd_pcm_direction_name()
86cc450022473 nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
d094582cce9c0 nvmet-fc: fix invalid free in LS IOD error path
8f6363c8d54dd nvmet-auth: zero the AUTH_RECEIVE response buffer
087ee0d914aaa ipv6: fix use-after-free in ip6_finish_output2()
b0ea911453ce7 ipv4: reject undersized MTUs in ip_do_fragment()
eab3eeb68bfc6 libceph: fix OOB read in decode_watchers() via missing bounds check
28d984a66b9e1 Input: byd - synchronize timer deletion before freeing private data
3a398e09a6c15 ndisc: ndisc_send_redirect() cleanup
790576dc7ccc4 nfc: nci: free destination parameters when closing a connection
7489f59d1ea2d nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
24761d3a5f692 nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
9635507fe8294 nfc: st21nfca: validate ATR_REQ length against the received frame
4a52ec2457ff8 nfc: pn533: purge fragmented skbs during cleanup
3793d768b40f3 nfc: llcp: reject PDUs shorter than the LLCP header
a209334ed9299 nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
1964addc8dd53 nfc: llcp: bound the connect_sn TLV walk to the skb
18f02354ed229 nfc: microread: validate target discovery payload lengths
fc3c2bd5b1ec6 nfc: fdp: bound the device-reported read length and fix an skb leak
d0756a98277e3 nfc: digital: clamp SENSF_RES length to the destination buffer
77693fb8aec30 drm/amdgpu: check ASPM on the dGPU host link
b287812f88a1c drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
874d1bdda79bc drm/amd/display: Fix BT2020 YCbCr limited/full range input
3227cd5116751 drm/amd/amdgpu: disable ASPM in some situations
a3d60ae24183e s390/vfio_ccw: Implement a crw lock
f0d189d95eee0 s390/vfio_ccw: Calculate idal length based on idaw type
460b977a4e71c s390/vfio_ccw: Ensure first IDAW remains constant
152fcb74a2680 s390/vfio_ccw: Free all memory if cp_init() fails
b6505a4cea45d gpio: ml-ioh: use raw_spinlock_t for the register lock
e99120b5944a1 xfs: validate attr entry pointer before field access
46116f574be32 ext4: clear error before retrying inode xattr space fallback
a40c45268f435 ext4: stop retrying saturated xattr cache entries
a2fb8222cde23 kcov: fix data corruption and race conditions on PREEMPT_RT
075e52fd6d86c null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows
6a009f1e61b11 ocfs2: fix missing metadata reservation for large xattrs
b20eb7ecbdaa3 ALSA: dummy: Check card index validity at probe
b7528b42813f0 xfs: bounds-check buffer log item's dirty bitmap
2eca18dd026b2 xfs: don't use a xfs_log_iovec for ri_buf in log recovery
d3ffb89b29446 inet: frags: publish queues before arming timer
bb7488c797d0f inet: frags: save a pair of atomic operations in reassembly
32fa602b5dd6a inet: frags: change inet_frag_kill() to defer refcount updates
c69b3593aa735 ipv4: frags: remove ipq_put()
4d40d900ffb2d inet: frags: add inet_frag_putn() helper
4a8887dd3a8a9 serial: sc16is7xx: enable THRI before filling TX FIFO
811b44be278b2 serial: sc16is7xx: use guards for simple mutex locks
a289a78f13ab0 serial: sc16is7xx: rename EFR mutex with generic name
7047aa394d6ce serial: sc16is7xx: convert bitmask definitions to use BIT() macro
969e3867ef67e serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants
1606abb7ce8c0 serial: qcom-geni: fix TX DMA buffer flush
80c6054a4c40a perf/core: Fix group leader use-after-free after sibling detach
c4ab0d6888022 perf: Unify perf_event_free_task() / perf_event_exit_task_context()
c8c8e895f65fb serial: amba-pl011: synchronize DMA teardown
fcaf8ba7e56bb NTB: ntb_netdev: Preserve RX queue depth on allocation failure
10a6b99079697 rndis_host: add overflow check in rndis_rx_fixup()
362726c9c6e56 Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
8d08713ec83a1 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems
dc6160265ffc7 Linux 6.6.153
22709117d9ae9 ring-buffer: Use current_context for safe per-CPU buffer swap
cf0bc75d1ca9d ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
171f95d662863 net: harmonize tstats and dstats
2fdf8b07bee5e binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
1fc9f6d2c7c9f net/x25: fix use-after-free of the socket by its timers
74365aef5bf22 erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
ec5a552f4b2d8 net/sched: cls_bpf: reject dev-bound programs bound to a different device
551688b410d3f net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
f60c71deb17ea m68k: Define NR_CPUS to 1
2930f1b49133e m68k: use the coherent DMA code for coldfire without data cache
5904c758e0e95 dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol
19d114b93c94b net/sched: cls_u32: skip hash tables in u32_bind_class()
91d55fd1fdb85 net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
a857e3408be07 net: sched: Add initial TC error skb drop reasons
d54e7ec851664 net: sched: Move drop_reason to struct tc_skb_cb
14f679a8d2ddc packet: add a generic drop reason for receive
b72e44dc038f2 net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config
69c66cf557906 net, sched: Add tcf_set_drop_reason for {__,}tcf_classify
5599966042e05 net, sched: Make tc-related drop reason more flexible
1fc70b3d513ba af_packet: Don't send zero-byte data in tpacket_snd().
b4ef887bee4d3 ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
06c2a53604fa1 net/tls: Fail tls_sw_splice_read() after a failed async decrypt
e451e20adb869 net: packet: fix wrong transport_header when sending VLAN-tagged frame
28afc87bd8da0 macvlan: inherit needed_headroom and needed_tailroom from lowerdev
f3c17ff65f547 ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
ccc33e1b2edb4 netfilter: ipset: let destroy callbacks adjust ext mem size
eada630d0ae3e netfilter: ipset: fix list type element drift bug
d37917e7bebe0 netfilter: flowtable: publish GC-visible tuple last
17c132e18ca5d netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
b891e7a6bb06e netfilter: ipset: fix refcount race between list:set GC and swap
9f4a626420c71 crypto: ccm - Set rfc4309 maxauthsize from child
4f1dde17b1222 arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
f3a874a903053 mm/huge_memory: fix huge_zero_pfn race
28afde1edbd8b KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
76df4edf7d61e mm/ptdump: always stabilise against page table freeing using init_mm
8d7f560f4b048 mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
56a45fdbe5b25 mm/pagewalk: split walk_page_range_novma() into kernel/user parts
898a44d811cf0 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
9efc767335234 drm/amd/pm: fix pptable use-after-free
50cfece0b1c02 drm/amd/pm: fix torn gpu metrics reads
584a5d96b6ebf can: rcar_canfd: change the initializing flow for clocks and resets
441e9c33284c1 i2c: iproc: reset bus after timeout if START_BUSY is stuck
b95dd3225eea5 i2c: bcm-iproc: remove printout on handled timeouts
bb01c51950c3f vxlan: use pskb_network_may_pull() for transmit path header pulls
1db9041e91ac5 vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.
72496cf871aa2 vrf: Make pcpu_dstats update functions available to other modules.
7806ff0e8a4d9 net: core,vrf: Change pcpu_dstat fields to u64_stats_t
73e7998c3361c vxlan: Do not alloc tstats manually
bbd63ba7961c6 ice: fix VF interrupts cleanup
dd9ba32169e73 binfmt_misc: restore write access when removing an entry
bf5ed2ef5cdb7 fs: don't block write during exec on pre-content watched files
04958dba44dc7 veth: convert frag_list skbs before running XDP
577443530cb59 net: pktgen: fix proc entry use-after-free
b0a3d6d582ec2 net: pktgen: fix code style (WARNING: Block comments)
81e21cb7bd147 ksmbd: reject repeated SMB2 NEGOTIATE requests
5964d1f35402f ksmbd: conn lock to serialize smb2 negotiate
a0f16c3376918 igc: remove napi_synchronize() in igc_down()
1f389ecd0c35e ASoC: tas2562: Validate values for volume writes
5b948706f11a9 mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
94a15b8a8f5a9 btrfs: zoned: fix missing chunk metadata reservation
2c3bd3b6ba701 btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
76f70daebe757 btrfs: add space_info argument to btrfs_chunk_alloc()
17fe8f41c8c21 btrfs: add debug build only WARN
8b0a3a094f4ca tcp: challenge ACK for non-exact RST in SYN-RECEIVED
6eb6b1d172659 tcp: fast path functions later
6ad63d36f6c5f tcp: Pass flags to __tcp_send_ack
d8e5c5672724b ksmbd: validate minimum PDU size for transform requests
b9e4b3b9aadbb smb/server: fix minimum SMB2 PDU size
ecb45f5c8b0db smb/server: fix minimum SMB1 PDU size
618af5277dcb5 ksmbd: rename smb2_get_msg to smb_get_msg
45e3e87561b4a smb/server: rename include guard in smb_common.h
7964b9ab3baf9 smb: move get_rfc1002_len() to common/smbglob.h
bc73642ccd637 smb: move smb_version_values to common/smbglob.h
05536cad35f27 super: fix emergency thaw deadlock on frozen block devices
4131dd0b6f67a net/sched: serialize qdisc_rtab_list against concurrent get/put
db3e82da616f5 net: gro: fix double aggregation of flush-marked skbs
2cb6c8b12bda5 net: move skb_gro_receive_list from udp to core
02430f6f729b2 libceph: fix two unsafe bare decodes in decode_lockers()
d974b4b786214 userfaultfd: prevent registration of special VMAs
d97b01e78ce31 userfaultfd: move vma_can_userfault out of line
896e8884fc2cc mm: userfaultfd: add pgtable_supports_uffd_wp()
48829622212f6 iomap: fix out-of-bounds bitmap_set() with zero-length range
7439dc31f6781 iomap: hold state_lock over call to ifs_set_range_uptodate()
a155aa7a52c6f ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP
42bc06c67d94d libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
7cd7b483893b6 libceph: Amend checking to fix `make W=1` build breakage
34bb4c61948da ceph: Use a folio in ceph_page_mkwrite()
e05c315b4da0c ceph: fix hanging __ceph_get_caps() with stale mds_wanted
78af6441b8966 ceph: Remove ceph_writepage()
c8a21660c3b90 ceph: avoid fs reclaim while using current->journal_info
dbb90d8b21b94 RISC-V: Provide pgtable_l5_enabled on rv32
48552988925d9 xfs: check v5 superblock features early
5b756fbb60b5d xfs: don't swallow dquot recovery verification errors
ed8bfb43de712 xfs: fix ilock leak on error in xfs_dq_get_next_id
472cfa4ba2433 xfs: only check mergeability of bnobt records
070229262ede3 drm/amdgpu: disallow multiple FENCE chunks in one submit
60539d517e843 drm/amdgpu: Fix UVD decode image min size calculation
fa96c24485942 drm/amdgpu: Fix UVD dpb min size calculation for H264
7cff5d7870a11 drm/amdgpu: Fix UVD min buffer sizes
f0f5048d58dec drm/amdgpu: Implement insert_end for VCE 3
8435d41afcf2b drm/amdgpu: Reject UVD message with dimensions above 4096
ce5da474c3ddf drm/amdgpu: validate GEM_CREATE domain combinations
a930c54cb6720 drm/amdgpu: Reject UVD message with invalid number of h265 refs
f72a51810d494 s390/vfio_ccw: Selectively expand io_mutex
f98a9890ca42f s390/vfio_ccw: Move cp cleanup out of not operational
af3f80ca4c8b1 s390/vfio_ccw: Fix out of bounds check on CCW array
79ea5e0c4c8a9 s390/vfio_ccw: Ensure index for read/write regions are within range
e868ea8be0bc8 s390/vfio_ccw: Cancel existing workqueues
15fb4559a7fdf s390/vfio_ccw: Limit the number of channel program segments
2acbeace14672 drm/radeon: fix autosuspend cleanup during teardown
38d60f808b341 mmc: sdhci: make tuning_err a signed int
fc90985bd5d7e mmc: sdhci: unmap the bounce buffer before device release
2d481fc84b589 mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
762be85fadd97 libceph: tolerate addrvecs with multiple entries of the same type
54aff77ed44ac ceph: fix MDS random selection readiness predicate
e2ffeec85201b libceph: Avoid using invalid osd indices from primary_temp
28d9cd72827be Input: sur40 - fix V4L error path cleanup
3e8ed76a4f357 Input: sur40 - fix input device registration ordering
b4d73c3848bae openrisc: signal: do not restore privileged SR bits on sigreturn
82f4f07f3f040 ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
8c6ee5351b264 ftrace: Protect direct_functions in ftrace_find_rec_direct
fa4aa86fff0c5 libceph: fix multiple unsafe decodes in decode_locker()
de52c713d2180 crypto: qce - fix error path in devm_qce_register_algs
ec61ca4e31066 Input: hynitron_cstxxx - validate touch count and finger IDs
2b0403fb7e28f Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
1d718f1461766 Input: synaptics-rmi4 - block s_input when F54 queue is busy
12be3c6ca9589 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
77749685e55da Input: synaptics-rmi4 - zero report size on F54 work error
8e3e0f23f8fd4 powerpc/pseries: lparcfg - fix kbuf[] underflow
5232529eaf57f Input: iforce - validate input packet lengths
9094997f073e9 Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
da6b8b05db0cf Input: psxpad-spi - set driver data before use
81b07470cb293 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
0739c65e799d4 Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
e19b45d5e031a powerpc/pseries: pci - logic bug
142346822c700 Input: xpad - add support for ZENAIM LEVERLESS
e5cb281913621 drm/amdgpu: fix aperture iounmap skipped on device removal
42bc07b4e5a3c fbdev: core: Fix pointer desynchronization in fb_io_read()
891129df5de79 ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
ad8b255006580 ASoC: cs35l41: sort the register default table
673348de84471 ASoC: cs35l45: sort the register default table
c18fe394ddcce ASoC: cs4265: sort the register default table
b270ed3273804 ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
cc423f4105fe1 s390/qeth: validate user buffer length in SNMP and ARP query ioctls
f75f174edc865 mptcp: fastopen: only mark MPTFO subflows with SYN data
26dac5c9ffb20 mptcp: options: reset DSS fields in case of unexpected size
dc1d8d3eb345c mptcp: avoid combining some incoming suboptions
6e46970fc0001 selftests: mptcp: join: mark tests with data corruption as failed
e0285bb152211 selinux: reject an unclaimed class value in security_get_classes()
1acc317d67a75 selinux: do not cancel a policy conversion that never started
2b7ffd7921fcb selinux: reject a class permission count below its inherited common
3161daa3f1e3c selinux: require every boolean value to be defined
6515053335d9f net: mana: Fix EQ leak in mana_remove on NULL port
3e9d5f325e9ce ipvs: separate destination availability state
68e094232dfe5 f2fs: fix UAF issue in f2fs_merge_page_bio()
6f06dbe5012c1 block: stop the timeout timer when releasing a never added disk
c610b395b0a51 Linux 6.6.152
1a9e400a19df4 regulator: devres: fix devm_regulator_get_enable_read_voltage() return
2ee4194be09fc net/tcp_sigpool: Use kref_get_unless_zero()
0490d0b862ed5 net/tcp_sigpool: Fix some off by one bugs
7a6a6d2a12786 bpf: tcp: fix double sock release on batch realloc
50f0c8dd8c339 thunderbolt: Bound the DROM dual link port number before indexing sw->ports
31efa656cf6af sctp: clear new_transport when removing a peer
dc67d528c2fa9 sctp: fix use-after-free of cached ASCONF chunk
1adf929121e13 sctp: keep chunk->transport in step with the list it is queued on
ed935348a9a96 scsi: scsi_debug: Negate wrapped memcmp() result
d192cff2a37d5 bpf, sockmap: Fix sk_redir use-after-free in send verdict
310b5a537a78c sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
33b7e810ce099 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
64e41736a26f3 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
0b9e02f3bd31c ipv6: fix Route Information option length validation
3d965811be784 ptp: ocp: Fix board ID over-read
999e573212d5f Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
b77581b25e213 eventfs: Fix use-after-free in eventfs_remove_rec()
f33ecb89d3523 KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
c292d4686f717 smb: client: Fix use-after-free in cifs_try_adding_channels()
47ba70891b10b tipc: read le->link under the node lock in tipc_node_link_down()
aa8b14647721b tls: don't leave a full plaintext sk_msg ring unpushed
cf363a7a02ce1 vhost: reset the vring metadata cache on vring reconfiguration
2f2a7f3f8b9f1 veth: fix skb length accounting after XDP frag adjustment
9d80a04129a6c vsock/virtio: avoid refilling the RX queue after teardown
a1fb0c5b8a7c2 vsock/virtio: read virtqueues under worker locks
619dd29045e43 vxlan: do not arm the ageing timer on a device that is down
ba13763d667e0 xdp: reject clones that overrun skb_shared_info tailroom
7380f1bfe9d7e Revert "drm/amdgpu: fix aperture mapping leak"
513478092966d ovl: don't warn when the mount is completed from another user namespace
6bcb8839aa2d6 net/sched: act_gact, act_police: range check the fallback control action
737873a59905a net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
ff451bc4290b7 net: atlantic: free RX pages of consumed but not refilled buffers
7a3e1481f4ee6 net: atlantic: free stranded TX buffers on ring deinit
63853eb20bba4 netfilter: nf_conntrack: defer invalid log until after unlock
6ea88401e10e0 netfilter: bridge: release template ct on non-IP path
cc5bd568f9b76 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
af02c67ce6543 net: smc: fix splice entry lifetime imbalance in smc_rx_splice
94134d70abf92 fbdev: bitblit: bound-check glyph index in bit_cursor()
e5f1d301b4bda tracing: Fix race between update_event_fields and, event_define_fields
4208db2453e1e ALSA: usx2y: bound the hwdep mmap fault offset
d431941825d35 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
93e7044b548a7 ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
3ceec39788481 misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
3f265e405e5ef misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
97273624f7b35 misc: fastrpc: Remove buffer from list prior to unmap operation
a2f5efe0b6ccf misc: fastrpc: fix channel ctx ref leak when session alloc fails
c5e5d78743992 staging: rtl8723bs: validate monitor transmit frame lengths
4ba402fd47009 staging: rtl8723bs: fix missing shared-key auth challenge length check
1158b99312073 staging: rtl8723bs: fix OOB read in WMM_param_handler()
0d19f0600fbb6 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
e7a5d792cf64a serial: 8250_dma: Clear stale RX state on shutdown
201b6961f02c6 mei: pull kvfree out of spinlock
dfe388da13aa7 ipv4: fix use-after-free in fib_nhc_update_mtu()
7f80ad373ce4a ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
606612b75d16d selftests/bpf: Adapt sockmap update error handling
ce1418fec60e0 fscrypt: Replace mk_users keyring with simple list
401b84010a93a pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
41cd5a536b3b2 fortify: Disable -Wstringop-overread in tests
4d48c73b0a24b fortify: refactor test_fortify Makefile to fix some build problems
aa5c571901c6b futex: Prevent robust futex exit race some more
55a3e01f89480 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
eefd1214882fa KVM: s390: pci: Fix aisb calculation
0e75b02682188 KVM: s390: pci: Fix resource leak on IRQ registration failure
dea31682783ff KVM: s390: pci: Fix missing error codes and memory unaccounting
dc7465a364104 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
06d58b8d2f053 net: bridge: mrp: fix uninitialised bytes on the wire
9d8a94b48b393 netfilter: ebt_nflog: pin the NFLOG backend
fe820dcc1d8ff mac802154: fix netdev use-after-free in beacon worker
99df6b7a713f9 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
eff6343033f57 net: octeontx2-pf: Fix UB in shift operation
8ca8cdb749395 net/sched: reject overly deep qdisc hierarchies
87d0c0040b5d4 net: openvswitch: reallocate update replies for mismatched IDs
cf8189b82bb93 packet: synchronize pressure clearing with ring reconfiguration
b47ba8fe6e1d2 net/packet: reset the MAC header on the packet-socket transmit path
d85d2fd54e901 packet: use consistent hard_header_len in TX_RING send path
91f041451f967 packet: use consistent hard_header_len in non-ring send paths
ed246dd85ebf2 ipvs: clear IPv4 options after rebasing tunnel ICMP errors
2061525f3431d ipvs: properly update the overload flag on dest edit
bc2cba3662e23 ipvs: add totalconns for dest
d5122a2b26011 ipvs: stop estimator after disabled calc phase
b6cb134707a21 ima: fix out-of-bounds read in xattr_verify()
06a286b320236 Input: evdev - fix information leak in evdev_pass_values()
38a0aa593ebc2 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
d8ead5083b203 vt: add permission check for KDSKBMETA ioctl
1c63303659a22 net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
11413d7ed4217 usb: gadget: f_ncm: Use unsigned int for ndp_index
0f770d5edaca2 usb: cdnsp: fix incorrect endian conversions for APB timeout register
c81b71b737b47 thunderbolt: icm: Preserve USB4 proxy data-valid bit
993f7677949e3 usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
6607f85242577 ALSA: usb-audio: fix OOB write on Type II inbound URBs
5db341189bb7f Input: evdev - sanitize event type index when fetching event masks
a74a3bc424b75 spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers
1232fd8cc252f net: fec: do not release NULL pages when RX buffer allocation fails
83837e3e827dd hwmon: (ads7828) Fix external VREF regulator handling
4f2f4e9cfbb48 regulator: devres: add API for reference voltage supplies
6ae440fe5ff72 hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
73c1ff87b63b4 tls: don't abort the connection on signal-interrupted sends
8de65194a04d2 sctp: clear control chunk transport if it is being removed
35f258fee9ed3 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
8adedc923f821 net/tcp: Add TCP-AO config and structures
e2d44d24385a9 net/tcp: Prepare tcp_md5sig_pool for TCP-AO
fa0dca89b4fb0 ata: pata_sl82c105: fix bridge revision use-after-free
b5a21615f627c net: thunderbolt: Tear down DMA paths before stopping the rings
01865e1ddb126 net/smc: fix TOCTOU race between smc_listen_out() and listener close
d2adc4e80b29e net: remove WARN_ON_ONCE() from sk_mc_loop()
6fad06bb793d7 net: prestera: validate firmware header length
43c7d0a691775 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
585fc5247d149 tcp: fix TFO max_qlen accounting across reuseport migration
0de370f9bbf35 sctp: fix addip_serial increment on ASCONF_ACK allocation failure
dd5d6de4ca86a bnxt_en: Fix PTP PPS setting bug
b61c4911204a0 bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
b8b4950f331b3 bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
ca84302458977 selftests/ftrace: refactor eprobes test to fix argument checks
cbe7aaaa2ac91 hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
a3f598c0bfbed hwmon: (lm25066) Use i2c_get_match_data()
2b316608f521a hwmon: (nzxt-smart2) Check return value of init_device() in probe
34e77d8e3570f net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
69cba7b704400 net: sched: refine software bypass handling in tc_run
4d1fc1d990f81 net: sched: cls_api: fix slab-use-after-free in fl_dump_key
544cf4801b6cf net: sched: make skip_sw actually skip software
f236d51f9caf2 net: sched: cls_api: add filter counter
efd3ffa472d68 net: sched: cls_api: add skip_sw counter
d8bea341b1831 net/openvswitch: check Ethernet header length in key_extract()
0c4882bff3455 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
1ae134c012e10 udp: fix potential use-after-free in tunnel segmentation
7bcb21bead667 tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
893775f29af77 vhost/vdpa: reject overflowing PA map page counts on 32-bit
ddbe966b5d1fe bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
f9d22822720b7 bpf: tcp: Avoid socket skips and repeats during iteration
4e3eaa5dce352 bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
beb8ffae319b7 bpf: tcp: Get rid of st_bucket_done
1d7a82c1df5fc bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
524f2d0409706 bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
ccbbbca21ddda counter: microchip-tcb-capture: Fix DT channel validation
9a416f000285a net/mlx5: fw_tracer, return NULL on create error
7b6552e53426e devlink: fix net namespace reference leak in reload
0e6c8440aeb3e net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
b969984b2bdc8 net/sched: cls_route: fix fastmap use-after-free on filter
06734dfeaeba8 net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
8cb23101a3fcc bpf: Preserve pointer state for commuted arithmetic
e2c7e88815edd btrfs: fix memory leak in btrfs_do_encoded_write()
f40409265dcb6 ipvs: return the csum validation for forward hook
3c779b258c9c3 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
2dd0312392d07 netfilter: ipset: switch ext_size to atomic64_t
607adbda01053 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
dd148539fb474 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
5d59e549b9033 Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
51e32c5555b07 drm/bridge: ps8640: propagate AUX transfer register errors
eacc1a5838710 ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
4f7bb93a59082 ARM: npcm: Fix OF node refcount leaks in SMP setup
caee6a68ffaa5 NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
7dd6e556dbfc9 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
590d9aec777cb selftests/bpf: Fail unbound UDP on sockmap update
91baa89437961 mount: honour SB_NOUSER in the new mount API
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.6.bb | 6 ++--
.../linux/linux-yocto-tiny_6.6.bb | 6 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index 1d4f95e42c8..e8d1f9da078 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,13 +14,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "eaa4bfd4f99ab0f3cf46ec5a207b73e22fb1c3f9"
-SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2"
+SRCREV_machine ?= "f92c1779022032aac8134ccb9e75365b19f6c596"
+SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.6.151"
+LINUX_VERSION ?= "6.6.156"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index f2d6e5eef53..03889d329ec 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
# CVE exclusions
include recipes-kernel/linux/cve-exclusion_6.6.inc
-LINUX_VERSION ?= "6.6.151"
+LINUX_VERSION ?= "6.6.156"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "c51e01ecff210644b5d199a4edb30cb1a94a746f"
-SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2"
+SRCREV_machine ?= "d9da23dffd2dea6dcfa986e0aad77898a7b373da"
+SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index c1ac8e0a08f..2632a4ef2fc 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "ed7cf749dcade8ded9fda05be53c235a446dcbff"
-SRCREV_machine:qemuarm64 ?= "b96d2d770cab02b84c46606fa538ce027bee6b08"
-SRCREV_machine:qemuloongarch64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3"
-SRCREV_machine:qemumips ?= "fcfa6f13ad7894cedda5f59124e7a6f6f0100a67"
-SRCREV_machine:qemuppc ?= "89811e5148d2a4c925940684ad9126bd08de9799"
-SRCREV_machine:qemuriscv64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3"
-SRCREV_machine:qemuriscv32 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3"
-SRCREV_machine:qemux86 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3"
-SRCREV_machine:qemux86-64 ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3"
-SRCREV_machine:qemumips64 ?= "b6dc41bac21f990565fffb211d470fdc97533291"
-SRCREV_machine ?= "5ae544e1312ed5b4ed130d22ff1f44333494c4c3"
-SRCREV_meta ?= "dd201eb6ec53179f45836d41610ca68c725d28e2"
+SRCREV_machine:qemuarm ?= "f05eb652ce405932e2f47a78f721d1c2c5859e80"
+SRCREV_machine:qemuarm64 ?= "2f7ef6e4d70eadf8f8b110cd81cfcafb2bb038fb"
+SRCREV_machine:qemuloongarch64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
+SRCREV_machine:qemumips ?= "1434d63083252688215ad6f5f6af122ead5865ee"
+SRCREV_machine:qemuppc ?= "fc69e9d8f99c5c151415f6ba9f1e0428bb7e8e84"
+SRCREV_machine:qemuriscv64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
+SRCREV_machine:qemuriscv32 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
+SRCREV_machine:qemux86 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
+SRCREV_machine:qemux86-64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
+SRCREV_machine:qemumips64 ?= "7969f6574cf5b126fa6eb28f33d0f2bcd8e7da5e"
+SRCREV_machine ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
+SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "d27334b2888c10d2b60c954c59b186182d833107"
+SRCREV_machine:class-devupstream ?= "8b73de7da85fde281a385e0b26eda9bffd3ca477"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.6/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.6.151"
+LINUX_VERSION ?= "6.6.156"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 42/55] linux-yocto/6.6: update to v6.6.157
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (40 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 41/55] linux-yocto/6.6: update to v6.6.156 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 43/55] linux-yocto/6.6: update to v6.6.159 Yoann Congal
` (12 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
79643295eba17 Linux 6.6.157
32e598324edc3 nvmet-rdma: fix queue leak when connect backlog is exceeded
6536d707ed924 perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
a77a45fbadd9c net: hsr: must allocate more bytes for RedBox support
4cad6ecdfee8c pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
dfda4aabd3213 tools/build: Use SYSTEM_BPFTOOL for system bpftool
1fb06c7a5d307 ALSA: control: Fix unannotated kfree() cleanup
42ddedd71536d net: hsr: init prune_proxy_timer sooner
2ea73f9a1fe72 net: hsr: Use the seqnr lock for frames received via interlink port.
4cdb74d35b0e0 net: hsr: enable promiscuous mode on interlink port with fwd offload
7840a2c9c797c wifi: ath11k: Fix error handling in ath11k_wmi_p2p_noa_event()
7554d498e4283 wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
ee556d118b11c firmware: arm_scmi: Roll back partial protocol table registration
6f5fb111a0a72 irqdomain: Make build work for CONFIG_GENERIC_IRQ_CHIP=n
712f3268a62d0 nvme: target: rdma: fix ndev refcount leak on queue connect
b93f47d5c0288 kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c
6a22da9752591 kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings
08aaba219793b xsk: Fix offset calculation in unaligned mode
85316d624f565 nvme-apple: Reset q->sq_tail during queue init
073b9238fac4d nvme-apple: Prevent shared tags across queues on Apple A11
0f0a317dd9e66 ACPI: processor: Update cpuidle driver check in __acpi_processor_start()
a8adb672758fb ACPI: processor: Add cpuidle driver check in acpi_processor_register_idle_driver()
d607e038f1024 ACPI: processor: idle: Remove redundant static variable and rename cstate check function
6da7c7a29009f ACPI: processor: idle: Move max_cstate update out of the loop
60e5299f552d4 ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init
49457494d5d97 pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers
944b7b366ce5d pinctrl: mediatek: Fix new design debounce issue
d6ba3a2ca3c9d pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
010d05df52cec net/sched: sch_htb: limit htb_classify inner-class filter hops
4fd2ee4ac154c tcp: fix corruption of urgent data on multi-segment retransmit
7baa0c92be39e usb: atm: usbatm: fix invalid ci_range initialization
7566789664813 net: fec: only stop PTP if it was initialized
a2dbac3fb03b4 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
82fdbf49b9f75 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
e4570c6556d47 net: stmmac: selftests: Account for the UC filter list for filtering tests
556b55a209ea0 net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
ee22ca41efdcb net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
b7be75bb83add net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
6315e468ef7e6 net: stmmac: selftests: Check multiple MMC counters
81dd9ed216358 selftests/arm64: Treat KSM merge_across_nodes as optional
3e0e4275b4b12 selftests/arm64: Print missing MTE TAP headers
2c75d9087a8e7 selftests: arm64: add hugetlb mte tests
6030f45bd0656 netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
87f49ea98c88f netfilter: xt_HL: add pr_fmt and checkentry validation
4fc6882b18350 netfilter: xt_cgroup: Make it independent from net_cls
79eafe22ab0a6 netfilter: nf_tables: move hardware offload step after building the chain blob
339f47ae04dcc virtio-net: Ensure that TCP packets don't overflow gso_segs
ae7173188ab06 net: stmmac: selftests: Pass the IP proto mask in the TC selftest
96a4696f8b74c net: ethernet: sun4i-emac: Fix IRQ error handling
7a96b9f6d5ba2 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
1630774d81d06 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
3b2e62a7655d3 libceph: validate banner payload length
7a64106070d4b ceph: revalidate ki_pos for O_APPEND writes after cap acquisition
faf539af1a595 ASoC: dapm: Fix off-by-one check on the second enum channel
0664c75afe87a apparmor: policy_int make sure list heads are initialized before fail path
fc75c2c7001c6 apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
93c6fe34f22da tpm: st33zp24: Validate locality read result
1bfd5c54e4070 tpm: st33zp24: Return zero on status read failure
aa39a790d56b4 net/sched: sch_teql: restore skb->dev on the slave failure path
9d782c662879c net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
dea2789a9d5ff net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
435da3734a8e6 net/sched: fq_pie: clamp default quantum to avoid signed overflow
19bc715de421b net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
397e2b1f71d9f net/sched: fq_codel: clamp default quantum and mtu
0675cff3c2924 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
d9a8113a5c152 maple_tree: fix argument name in header
bc8be70fdeb94 selftests/mm: skip COW tmpfile cases when fallocate() is unsupported
4498f617a4948 selftests/mm: report unique test names for each cow test
328256478e9f3 selftests/mm/cow: modify the incorrect checking parameters
bdd5574a636f9 selftests: mm: cow: flag vmsplice() hugetlb tests as XFAIL
d10b6f53483bb selftests/mm/cow: generalize do_run_with_thp() helper
8086709b7f87e cifs: fix clearing stats for fastest execution of each smb2 command
42884bd8b8fd0 net/rds: use wq_has_sleeper() in rds_cong_map_updated()
573c088b6d479 octeontx2-af: Fix TL3/TL2 link config ENA clearing
4bcef54e4a335 net: qualcomm: rmnet: restore skb->dev on deaggregated frames
e3b9aa0773abd gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
fc4851ff8dfb5 Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
0b71a6caaf284 Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path
89d23a0fd43e7 Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
8765eb64f9deb Bluetooth: btmtk: Do not discard the subsystem reset timeout
7c7ac736b50fa Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
bbd262d2d750b Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
491e4c6001796 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
0911a5e777e3b erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
74e4a43e1b0ea scsi: qla2xxx: Fix an loop timeout test
d3c55dcc863f3 rtc: pcf85363: Add error checking to regmap calls in probe()
dd5bd091daa48 NFSv4/pnfs: key the data server cache on the NFS version
0faf682964678 nfs: move the nfs4_data_server_cache into struct nfs_net
5aca000630c0f NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
957dba2b8b5ae net/smc: free pending qentry in smc_llc_flow_stop() before memset
056395acb7041 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
5f127e3cc9647 inetpeer: randomize RB-tree node comparison using SipHash
9b0a36df7f443 net: add missing ref_tracker_dir_exit() to net_passive_dec()
be9ed08140dee net: ipa: balance runtime PM reference on remove error
c1ac60ad8c182 net: ipa: Convert to platform remove callback returning void
95428d7d2c712 forcedeth: stop the tx_timeout register dump past the requested window
93c413d953e19 net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
4b0f5b25f1146 net: bridge: Reject descending VLAN tunnel ranges
aaebce297efc3 xsk: fix NULL pointer dereference in __xsk_rcv()
b9d97ecb89576 xsk: avoid double checking against rx queue being full
ba95f77c98687 xsk: Get rid of xdp_buff_xsk::orig_addr
e4746c6e60ab1 RDMA/ucma: Allow path records to exactly fit the output buffer
c5c7c7b6cfae7 ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup
da3c2437df2c6 ALSA: core: Add scoped cleanup helper for card references
c2a2036209b37 ALSA: control: Use guard() for locking
478cfdb6844fe ALSA: control: Use automatic cleanup of kfree()
9f756f1965bad clk: visconti: Make sure clk_init_data is fully initialized
73f4671d68193 clk: ti: Make sure clk_init_data is fully initialized
5f74a6e9afc90 prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
6945acee8677b rtc: gamecube: check return value of devm_rtc_register_device()
68bf51c58479d i2c: ocores: Disable clock on failed resume
b5ba8b861b5d8 irqchip/renesas-rzg2l: Fix loss of interrupt
321ef4e8f74e6 rtc: zynqmp: Return optional clock lookup errors
58066940076b9 smb: client: fix request buffer leak in smb2_new_read_req()
7afb8db47c4f1 rtc: pcf8563: fix clock provider leak on unbind
eeac2ea4ad265 vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
feafa109f031e vdpa_sim: fix cleanup after worker creation failure
f20ade5e9739b virtio_balloon: disable indirect descriptors
ad22f0605c2d3 i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
fa47845df3626 i3c: mipi-i3c-hci: Refactor PIO register initialization
25c99c36760ec i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
31d1e6df88c0f i3c: mipi-i3c-hci: Quieten initialization messages
2011e714e5f99 i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
b5e40cceb591c i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes
18a4463528f09 bonding: initialize err for empty target lists
4c2ffe2bbfdb9 mlxbf-bootctl: fix the build error with FIELD_PREP()
c224759555a13 platform/x86: hp-bioscfg: fix password encoding bounds check
35364a037c2df vsock: use sock_error() to consume sk_err after a failed connect
93808d9572d40 platform/x86: dell-wmi-sysman: Fix instance ID bounds
48796058a5cd1 net/smc: hash socket only after full initialisation in smc_sk_init()
4944ed85a0e8a 8139cp: fix Rx and Tx not being disabled in cp_suspend
f8a9b988e7a7b vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
7c197d96f053f vxlan: mdb: Add MDB bulk deletion support
2e4fe6c423379 net: Add MDB bulk deletion device operation
94d8313ba1aaa bridge: add MDB state mask uAPI attribute
75ee201a1303f vxlan: mdb: Add MDB get support
88f464358411e net: Add MDB get device operation
c9a5c400dfc59 bridge: add MDB get uAPI attributes
c2a7f6064dfb5 vxlan: mdb: Factor out a helper for remote entry size calculation
8e4be8729f256 vxlan: mdb: Adjust function arguments
9cf0fc4bb6296 ALSA: hda: Fix connection list comparison in proc output
17120c5bfb168 fuse: check for NULL root inode in fuse_fill_super_submount
dc925f22df8ad fuse: check attributes staleness on fuse_iget()
051eaaa875f50 fuse: convert readdir to use folios
358640784ba10 fuse: support folios in struct fuse_args_pages and fuse_copy_pages()
a3713498429e4 fuse: use FUSE_ROOT_ID in fuse_get_root_inode()
be829860d1dbb fuse: convert to new timestamp accessors
d585ed0830890 fs/ntfs3: validate ef->size covers the record's name and value
700973cc65db4 fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
ac5c499413385 cuse: wait for pending RCU callbacks on module exit
9c59ee8d63c42 net: bridge: vlan: fix inverted default vlan notification
59f4ad9b3d1e8 tls: fix RX desync on overlapping skbs
7df3271df8678 net: dsa: mv88e6xxx: Fix PCS link check on CMODE read error
47bfcc871576e vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
deaa88fa010ba ipvs: fix integer overflow in ftp helper port/address parsing
0a340ffd96943 net: hsr: free learned nodes on device setup failure
d90e4f72e8d46 net: hsr: Provide RedBox support (HSR-SAN)
9baf4bf4763ce net: hsr: Use full string description when opening HSR network device
f3d74ab3f49ea pppox: drain queued packets on channel handoff
cbb0879aeaa13 net: dsa: b53: fix error propagation from b53_fdb_dump()
b0e94ea63dbdc net: kcm: Hold RCU read lock while running BPF parser
5d6c3f6e90d73 octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
642d3bc08c731 clk: ti: mux: resolve parent clocks by DT index, not by name
6b9aedc0b998b clk: ti: use kcalloc() instead of kzalloc()
fc95ca82d5ae5 NFSv4: remove callback IDR entry on client allocation failure
788b59a395434 nfs: refactor pNFS functions using clear_and_wake_up_bit
a49d54e6cb560 nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
a2051ffe452af ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
6bf378cfea2de ksmbd: disconnect on SMB3 decryption failure
e6fbf0eba87f5 bpf: Reject negative optlen in cgroup getsockopt hook
7d3f15a664d11 m68k: nfcon: Do not call console_is_registered() in nfcon_device()
de2b2004e16f2 lwt_bpf: Restore reserved headroom after xmit program
ca119d4a6b19e smb/server: preserve error status in smb2_handle_negotiate()
3f8651f6bb521 smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger()
effcf48d79d8a ksmbd: free preauth sessions on connection teardown
c3a8100dbf6bc ksmbd: do not advertise unimplemented CA support
17b7d1a2b4d54 ksmbd: validate ipc response length before dereferencing its fields
4d6fe49fa3e7f smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer
993e0158331d3 ksmbd: Do not skip lock checks for single-byte ranges
9281eb1e4ea31 hwmon: (emc1403) Drop hysteresis for low limit temperature
e43ba8be636ab hwmon: (emc1403) Rely on subsystem locking
5efc8eeb33183 hwmon: (emc1403) Add support for EMC1428 and EMC1438.
5eee537872d86 hwmon: (emc1403) Support 11 bit accuracy
e33dc202fb6f6 hwmon: (emc1403) Convert to with_info API
b92949bc1a099 hwmon: (emc1403) Add support for EMC1442
8283049aa5fcb block: mtip32xx: synchronize ioctls with device removal
7de792b4c48fb null_blk: serialize configfs attribute updates with device setup
88d806d0e1d36 null_blk: serialize configfs attribute stores with the lock
fcd53f3e8b758 null_blk: reject per-device queue resize for shared tag set
665c94554ff0d null_blk: free global tag_set on init error path
dbcedbe4819ae null_blk: register configfs subsystem after creating default devices
b6869f48ddec2 null_blk: add configfs variable shared_tags
349903f7ee72f null_blk: use DEFINE_MUTEX for the file-scope mutex
09372aa5774e3 mailbox: pcc: Fix command timeout due to missed interrupt
81e2b32d1d11d Revert "mailbox/pcc: support mailbox management of the shared buffer"
dc14620fe268d mailbox/pcc: support mailbox management of the shared buffer
871b0bf25cc7e mailbox: pcc: Always map the shared memory communication address
82aa56d548f68 mailbox: rockchip: disable pclk on probe failure and unbind
606cbd749ff33 perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
d3231c74c9a9f perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
4536ff6a67ea9 crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
595dd1c0e1c47 bpf: Fix pending_pos walk on 32-bit ring position wrap
f30379b8a4e24 ACPI: scan: fix bus ID cleanup on device_add() failures
cd63a1eb677e9 ASoC: SOF: validate topology volume range before allocation
60d98480caafc tracing: Have trace_event_update_all() only handle module that is loading
11755741ff074 tracing: Remove "__attribute__()" from the type field of event format
03c5dabc8f16b ALSA: core: Fix use-after-free in snd_card_do_free()
0441e34ce098c fs/ntfs3: reject out-of-range evcn in mi_enum_attr()
f77a8d9fdf58e fs/ntfs3: fix integer overflow in MFT cluster validation
b51535ca5eb90 scsi: ufs: core: Set task state before io_schedule_timeout()
5d602d4ebb58c scsi: ufs: core: Remove redundant host_lock calls around UTMRLDBR
7612b5d2c00aa scsi: ufs: core: Remove unnecessary wmb() after ringing doorbell
afedf35df054b scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
5b37a7c2270cb selftests/bpf: Fix for veristat file/prog filters processing
3d2f0cb66c909 Squashfs: check block offset is not negative
8d88f52fbbbcc ocfs2: fix circular locking dependency in ocfs2_init_acl()
340821bc169bc bpftool: Fix double close in map dump
23e5b485da229 x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
89d986897aff7 ALSA: seq: midi: Serialize input teardown with event_input
679087a7acdc4 ALSA: seq: midi: Optimize event_input locking with RCU
a3efa5d4eed38 clocksource/drivers/armada: Unwind timer clock on init failure
3cac7e8adb006 clocksource/drivers/clps711x: Do not unmap clocksource MMIO
a08b70ed2d1ec s390/debug: Fix deadlock during unregister
57ec8827f414b xenbus: Unregister reboot notifier on init failure
3a6b43ebc0c2e power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
c86a998bd46da power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
60e5d928081b7 power: supply: bq27xxx: bq27520g4: fix REG_TTES address
f1b4447402fca power: supply: bd99954: Drop bad register fields
49e717f3f3d20 spi: img-spfi: don't disable runtime PM on DMA deferred probe
6746ba44cd04d selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
a4e68a4f68c2a selftests/bpf: Add description for running vmtest on RV64
bfeb336e48a96 selftests/bpf: Support local rootfs image for vmtest
c4579f1b7fe17 selftests/bpf: Limit URLS parsing logic to actual scope in vmtest
47a7a4443c6e7 kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
620549b2775e5 UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
8c38ae4a46569 ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
552e565ed8846 ubi: Fix rollback for explicit UBI device numbers
3f617214c81a2 ubi: fastmap: Add module parameter to control reserving filling pool PEBs
d99591caca984 ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs
2d55fd6170613 ubi: fastmap: Wait until there are enough free PEBs before filling pools
087d820d4bc48 UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
3c5599d3cf1ab UBI: Preserve torture flag when rescheduling failed erasures
3996be3f5b8a9 ubi: Replace erase_block() with sync_erase()
d8307a8bc986b ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap
4e0ab4f291a76 ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash
2a623a56b513b ubi: fastmap: Fix missed ec updating after erasing old fastmap data block
eaaeabf566c3c ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
48cece7b287ec ASoC: pxa: Use devm_clk_get_optional() for extclk clock
30c48da114915 ice: clear the default forwarding VSI rule when releasing a VSI
2a63cb9ea862a RDMA/cma: Fix WARNING in res_to_rt
f98e894ec029a RDMA/cxgb4: Free debugfs on registration failure
8980385438975 dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
5487f04c1ccbf nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
c001abaaa35bc nfc: digital: Do not dump a NULL response in command completion
753bdaf3220fe nfc: pn533: hold a reference to the request skb during send_frame
02030f95820c4 nfc: llcp: bound SNL TLV parsing to the skb and add length checks
9030a1bbe2c6b nfc: nci: fix double completion race in nci_data_exchange_complete
fe65727a4a21b nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
35573c6cb081a nfc: llcp: avoid userspace overflow on invalid optlen
7084caabc0370 nvme: reject passthrough of driver-managed Set Features
c35cd98eed1a8 nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
ff28a93a89591 nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
ca6b14f01d099 nvme-apple: Drop the PRP null check chicken bit
7256eed48ce7d nvme: apple: Add Apple A11 support
eb86b1844a1b4 nvme-apple: Never set the opcode in the NVMMU TCB
5ce74613edd36 nvme-apple: Don't set a DMA direction for commands without a data transfer
5f6f4777b7a86 nvme-apple: Destroy the admin queue on removal
89ff11b72f389 nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
cefb177da32fe nvme: Add the DHCHAP maximum HD IDs
ac6c240e0f448 nvme: introduce change ptpl and iekey definition
cef6c15f8b54d nvme: add reservation command's defines
c26fa54201acb ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
cd12a36c77fdd spi: sprd-adi: Fix probe succeeding without registering the controller
d10e4173d8c2a phy: qcom: qmp-combo: Correct pre-emphasis table for QMP v4 DP PHYs
c653b97b9fefc powerpc/configs: enable CONFIG_RAS to fix EDAC support
ed80d009b154a sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
12bf3e0182ccd SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
3cee888393f6e arm64: Disable KCSAN instrumentation in delay.o
e3405bf334b02 m68k: Fix backtraces for non-running tasks
071ac1722fe2e iommu/vt-d: Fix UCTP context table slot when copying root entries
e8d4e4cf388da fbdev: kyro: Validate overlay viewport coordinates
f3222a7a5e65c fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
3d0f487661a69 perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
e7a3768a295a0 perf synthetic-events: Fix uninitialized pthread_join
ba7a7e1a41c8e perf stat: Fix evsel_list leak in cmd_stat
518c47e2c59f3 ARM: dts: helios4: add SATA regulator supplies
0fb9acbc7fbd3 ARM: dts: helios4: add vcc-supply to GPIO expander
9f8e9aa4b1231 ARM: dts: helios4: add vcc-supply to EEPROM
fb9043b5ce0c8 arm64: dts: turris-mox: fix usb3 phys
d9ea72c04a1df riscv: cpufeature: Clarify ISA spec version for canonical order
bee2208276c8e net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
83db3f0d7982e iio: light: gp2ap002: re-enable irq if runtime suspend fails
8e76ab8131985 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
e804d54a5a99d Bluetooth: MSFT: validate evt_prefix_len against the response length
416fabca9b723 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
193182c6467f5 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
9a2ba69cebe3f Bluetooth: hci_conn: fix the SCO setup context lifetime
50dae81942575 Bluetooth: btintel: Fix diagnostics event detection
0e388d805233a Bluetooth: virtio_bt: avoid OOB read of build info string
90e9eae1b5907 btrfs: retry verity reads for not-uptodate Merkle folios
a5add36fd9908 scsi: sd: Fix sd_done() sense handling condition
2cd80d83cc1a2 perf trace-event: Fix integer truncation in do_read() and skip()
5317d73c7876c Bluetooth: btusb: QCA: Fix populating devcoredump fields on unenabled devices
af6f77f20510d Bluetooth: btusb: Record matched usb_device_id into btusb_data
9b0b4fbb8c863 Bluetooth: btusb: refactor endpoint lookup
61df5d818baf3 Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
32be97642c514 Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
e60f304c65013 sched/fair: Check CPU capacity before comparing group types during load balance
7ac16ee2d3766 ACPI: video: Release PCI device reference after lookup
f1bea8cf618b3 regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
ea4fe6a450210 coresight: etm4x: fix leaked trace id
be7b2de5b9a96 coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
b822e5966d5a3 coresight: Change syncfreq to be a u8
885d831237337 coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
668d99ba47210 md/raid1: don't set array_frozen in raid1_takeover()
cfb75fae75c96 md: avoid stale clone I/O accounting timestamps
9d7490007707f md/raid5: round bitmap stripes with sector division
9b28287c5dea7 phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend
3ddf41938fee3 phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
602059c5128a7 phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend
9e7448bb0e2f0 phy: qcom: sgmii-eth: vote for both voltage rails with correct current loads
c9f829195f84a phy: qcom-sgmii-eth: relax order of .power_on() vs .set_mode*()
cf2f1cee7080e soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
5b7fc7a1ce2a5 hugetlbfs: release subpool on fill_super failure
e36eee4fc56cf pinctrl: rockchip: Reset the pin count when recalculating SoC data
5a250bff75a44 firmware_loader: do not queue completed sysfs fallback requests
9b6325fc58ab8 scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
b5d1d3e4519dc drm/amdgpu/gfx6: Use PFP on the compute queues too
0d567a5cb347e drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
d5f170189b07a perf trace-event: Fix buffer overflow in read_string()
dd9fee2b29e2f phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
1fce81a40e3b3 phy: sunplus: fix error handling in sp_uphy_init()
ba56017b0c04e arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
9e1efab410a4a ext4: fix spurious message about orphan cleanup on RO fs
4b7623e92545d drm/amdgpu/gfx6: Fixup emit_cntxcntl()
e92a83a9a7617 mfd: iqs62x: Reject zero-length firmware records
f943448aeae0a mfd: rave-sp: validate received frame payload lengths
ad3839fe2114b arm64: hibernate: Restore DAIF state on error
5370853041a3c arm64: hibernate: mask DAIF before restoring hibernated kernel
0ab5739f1f448 wifi: mac80211: skip default WMM setup for AP_VLAN links
f82e13c16da63 RDMA/erdma: restrict the driver to little-endian systems
b9e7d3d9fdb2b RDMA/siw: Fix use-after-free in siw_accept()
b8d5015db908a RDMA/siw: Introduce siw_free_cm_id
9c21a43302221 IB/isert: post the full-feature receive buffers after session registration
f84e9adf4d9f4 IB/isert: delay the final Login Response until the session is registered
55864b26c22cb cpufreq: imx6q: fix out-of-bounds write when probed more than once
92e53a5274276 cpufreq: imx6q: fix devres accumulation across driver rebind
53e08b89f7620 drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
0a3a149d5ac1d drm/sun4i: dw-hdmi: Drop TCON TOP port reference
543cc7dd263b9 drm/sun4i: tcon: Drop remote endpoint reference
1882112124a64 drm/sun4i: crtc: Propagate layer initialization error
4fa22218c2351 drm/sun4i: tcon: Drop TCON TOP device reference
539817f22063d drm/sun4i: tcon: Set output mux for DSI and LVDS
f0f5441126f31 of: property: add of_graph_get_next_port_endpoint()
afb9faa721d43 of: property: add of_graph_get_next_port()
89a89f7bb2fcc of: property: use unsigned int return on of_graph_get_endpoint_count()
217340d0ebd0f of: property: add missing kerneldoc for of_graph_get_endpoint_count()
24790c3b0d99a drm/sun4i: vi scaler: Fix coefficient selection
cbb4efc2f99d6 ocfs2: synchronize heartbeat callbacks with o2net teardown
63e3c958a602d ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
0e7ba61751490 RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
c0a83f29a24c7 RDMA/erdma: Hold CQ references when processing EQ events
d7ef87c7daa9e modpost: prevent leak when early return no suffix .o in read_symbols()
16667c8cabe18 scripts/tags.sh: Prevent binary files appearing in cscope.files
81e425fbd8115 arm64: dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
f54b00b223954 selftests/mm: fix ternary operator precedence in ksm_tests
1f53972a5bd40 selftests/mm: fix ksm NUMA merge test for systems with memoryless NUMA nodes
bdef4a404fab5 selftests/mm: ksm_tests: use kselftest framework
6b117e23481d9 ksm_tests: skip hugepage test when Transparent Hugepages are disabled
46f5382b4eeb9 selftests/mm: add new test cases to the migration test
7eb85d07c15ae selftests: mm: support shmem mTHP collapse testing
c2b8653d571e8 selftests/mm/khugepaged: enlighten for multi-size THP
7db5a1d597213 selftests/mm: support multi-size THP interface in thp_settings
750575653bd6c selftests/mm: factor out thp settings management
e1e07344d8e19 selftests/mm/kugepaged: restore thp settings at exit
e26db0d636e4c bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed
c82241a9454b2 remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
9ca46a1a3e510 remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
829c24afec9ce remoteproc: Move resource table data structure to its own header
542a6a3ec77cd drm/omap: dsi: Do not copy isr table
e38587d98d1ce fat: release buffer head after rebuilding parent
332591a245de9 rapidio: clear mport->net when rio_add_net() fails
a1b1ff469e573 pps-gpio: remove dead capture_clear code
c66eb07d65a26 pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
9ee5b718b2cbd pps: clients: gpio: Bypass edge's direction check when not needed
6bc73694cbee5 pps: don't try to wait for negative timeouts in PPS_FETCH
4957320f54311 lib/string: fix memchr_inv() for large ranges
43b18869f8c8f ublk: check for ublk_unmap_io() returning 0
364030e3eefce block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
92865833e8d81 block/blk-iocost: collect per-cpu latency stats over possible CPUs
28104b1636296 block/blk-stat: drain per-cpu callback stats over possible CPUs
1a267295b1ea6 blk-cgroup: skip dying blkg in blkcg_activate_policy()
056eea1a2068a phonet: pep: do not write beyond optlen in getsockopt
cf62dd07b08e9 iio: light: tsl2583: return zero in write_raw() on success
d7c5a80939e12 iio: light: isl29028: return zero in write_raw() on success
3f701835d082a iio: light: tsl2772: fix ALS calibscale readback
7ac69e177dffe perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
1bdb0e48e9d87 perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
2d31a6271975a perf auxtrace: Fix queue grow overflow and old array leak
aa3045fb5faa0 perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
6be9b1284d0c3 HID: lg4ff: validate report length before fixed offsets
178c369b465b5 HID: i2c-hid: goodix: Disable VDD on VDDIO enable failure
d3ccef6fb7133 HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
d9caf658694d9 HID: i2c-hid: Revert to await reset ACK before reading report descriptor
0cab98ab1f57a HID: i2c-hid: Move i2c_hid_finish_hwreset() to after reading the report-descriptor
a8a1892d18faf HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling
c1e5bbba94e16 HID: i2c-hid: Split i2c_hid_hwreset() in start() and finish() functions
69345da556293 HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset()
9a3da56aae28e HID: synchronize input before cleaning up a failed probe
f54c3219db759 HID: i2c-hid: Refactor _DSM helper and add i2c-hid-acpi-prp0001 driver
d331c63570af6 tty: clear cdev pointer after cdev_add() failure
8369acce013b1 serial: amba-pl011: unprepare console clock on unregister
0ef4365a01cf7 MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
dcc442a49c0f5 powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
f89cccf6f5f4f powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
88027241c1d2c firmware: coreboot: Validate table bounds
f8808b7440c72 firmware: google: Add bounds checks in coreboot_table_populate()
5fc32f53f8486 wifi: mac80211: skip unused probe response countdown offsets
a749ab2498238 wifi: zd1211rw: reject secondary interfaces to prevent conflicts
aa5ff84ca8c39 wifi: mac80211: send TWT teardown to peer after setup TX failure
11b75fc02d842 perf/cxlpmu: Fix 64-bit write to 32-bit HDM filter register
a6f2a2d867863 iommu/arm-smmu-v3: Convert to use atomic poll timeout
eb946595a58de wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
04d8fd716d0ee wifi: mt76: mt7915: report RX chain signal for all RX paths
6b3d02b422a5d wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
426825d50c700 wifi: mt76: mt7996: fix reg addr remap when addr is 0
2a434d2637b9c wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
ad706fcf62554 wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
927fe8c0eb8c1 wifi: mt76: mt7915: fix double hif2 init on the non-WED path
1bd5c4ed2b904 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
4f4fada2d3594 perf machine: Check snprintf truncation for guest kallsyms path
718773cdea4ac perf machine: Free scandir entries in guest kernel map creation
6c903f77f50f7 perf machine: Reset errno before strtol in guest kernel map creation
cae1adeb69b94 perf machine: Don't abort guest map creation on first inaccessible dir
ac436ad9d47dd perf machine: Check snprintf truncation in machines__findnew()
091cd722190cf perf machine: Use snprintf() for guestmount path construction
c8b41333e2c89 perf machine: Guard against NULL strlist in machines__findnew()
3d1f6a9f7f300 perf machine: Fix NULL parent dereference in fork event processing
6d0a2c5e210f2 regulator: core: use system_freezable_wq for init complete work
1296cae530528 wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
d3e8355a63cea drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
e52a884ecbf3c drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
78c2c2ae9a8f4 perf: arm_spe: Make wakeup range check overflow safe
ccee078503097 ACPI: processor: Unregister cpufreq notifier on init failure
0306624c843dd ACPI: processor: idle: Optimize ACPI idle driver registration
4052a0367fa92 wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
1d348f96623ec wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
3106f62809d45 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
a4587f1098c97 wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
953357433053a wifi: mt76: mt7996: don't report a zero TX bitrate
e63c6291ecddf wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
9fc7b406a7e5e wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
c2c7f16f2c62f wifi: mt76: mt792x: Fix memory leak in SDIO TX path
8eae5e5aa09da wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
b6e7958602bd1 wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
1f3e5f4b779d6 fanotify: report full event length for FIONREAD
adbdf4837c434 misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
5c3bff6cf26e6 locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
d22ad96f1a0c8 i3c: master: Fix device_register() error path
111f559e5b646 i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
68bf3ebd8e702 swiotlb: Preserve allocation virtual address for dynamic pools
06dffc9669308 iommu/dma: Check atomic pool allocation result directly
9a5a5eafbf168 clk: qcom: Return expected ENOMEM error on dynamic allocation failure
2636569ea7c19 lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
a5c936ac90476 bpf: Fix potential UAF when reading bpf link info
f4ce6803df409 bpf: Fix potential UAF in bpf_netns_link_update_prog
972d88069050d power: supply: sc2731_charger: cancel work on remove
dcc6995b17d11 power: supply: sc2731_charger: Convert to platform remove callback returning void
c22a9a539c761 power: supply: isp1704_charger: cancel work on remove
76c695d6e9236 arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries
5c28583f58a48 arm64: dts: qcom: sm8550: Fix the msi-map entries
28bfcbc9b7694 arm64: dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1
de01d783368c5 arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries
4a2efff1ebdbe arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries
9dedefe9d949a arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries
796fcf46d7551 arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries
3c9cbf39055fa arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries
31db9b8610e3f arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries
a331e43e9b78f arm64: dts: qcom: sc8180x: drop duplicated PCI iommus property
ab813e51988d6 arm64: dts: qcom: sm8250-xiaomi-elish: correct the board ID
bb7206ebdb1f5 arm64: dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
5a430485d1310 clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
ee4eb4b0db3de arm64: dts: qcom: sdm632-motorola-ocean: Fix LED default trigger property
1c3d2e50e7bc4 arm64: dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
29c9c4801f539 rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
d5ba53140ee78 rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs()
1d1903d64ba52 rcu: Remove unused function declaration rcu_eqs_special_set()
11d327f0911d3 selftests/zram: fix kernel_gte() for POSIX sh
590d690a9f668 tools/nolibc/powerpc: mark ctr and xer as clobbered by system call
e77c80670f2c2 md/raid5-ppl: fix use-after-free in ppl_do_flush()
3018d86da10b4 md/raid5: protect bitmap batch counters aka seq_flush/seq_write consistency
55ee71cb96bd3 bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
aef178ffae542 wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
56989e2a9c292 platform/chrome: cros_ec_debugfs: Unregister panic notifier
5ebfc68217b5a platform/chrome: cros_ec_debugfs: Clean up console log on probe failure
f760b7d7e4358 wifi: ath11k: fix overreads in ath11k_wmi_process_csa_switch_count_event()
1130f6f42f62b wifi: ath11k: implement handling of P2P NoA event
5ddc08ef072db wifi: ath11k: refactor ath11k_wmi_tlv_parse_alloc()
98e373dc08187 wifi: ath11k: add firmware-2.bin support
aff7ced31b937 wifi: ath11k: qmi: refactor ath11k_qmi_m3_load()
29e37f768f355 spi: davinci: switch to managed controller allocation
5db5c788048eb spi: davinci: Unset POWERDOWN bit when releasing resources
27b0a735ca9f8 spi: davinci: Use helper function devm_clk_get_enabled()
acc173608ca7a nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
44fe800ec1338 IB/isert: reject login PDUs declaring more data than was received
2a6b8f88fb7ee IB/isert: reject PDUs declaring more data than was received
5a21e5114cec4 RDMA/cxgb4: free STAG index when TPT entry write fails
08c4a0dede170 RDMA/mlx5: Send cong param changes to the resolved port mdev
0b0122fcc923a RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
f42f0cb6be2e8 scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
5166a21b12f54 nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
aaee7ff47a47a nilfs2: convert nilfs_page_bug() to nilfs_folio_bug()
25a07d5d97a19 nilfs2: convert nilfs_btnode_commit_change_key to use a folio
62cff5341dfde nilfs2: convert nilfs_btnode_prepare_change_key to use a folio
6fe7f8240fa83 nilfs2: convert to nilfs_folio_buffers_clean()
0787197a858dd nilfs2: convert nilfs_forget_buffer to use a folio
14b101d829fc1 nilfs2: add nilfs_end_folio_io()
7029e70cf86d5 nilfs2: prevent out-of-bounds read in super root block parsing
d7afca8e4efbf nilfs2: fix infinite loop in nilfs_clean_segments()
b9dd1e691cea8 clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs
d9057cb059a50 clk: mediatek: mt8135: Fix inverted gate control for devapc_ck
f7bf9b82c77fd clk/x86: pmc_atom: add kasprintf return value check
297b278cc4fd1 clk: palmas: Manage external-control prepare with devm
e86e11c11251a clk: tegra: tegra124-emc: put EMC node on register failure
5dbefaa1bbbb2 arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
aadf3f9b5edb7 RDMA/efa: Fix PBL chunk length computation
ecde45cd81dc2 fs/ntfs3: reject restart table growth beyond U16_MAX entries
aeb16d9686b35 staging: rtl8723bs: use kfree_sensitive() for key material
47de033918cd7 remoteproc: Prevent crash handling to race with rproc_del()
15673e7195681 remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
166bc60c8d1db remoteproc: Allow shutdown of crashed processors
48cba5968c148 remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
5f25e5c95117b w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
5677737c2cedf isofs: release zisofs block pointer buffer head
42fb8aefffff5 RDMA/mlx5: Fix integer overflow of user QP buffer size
0afd2a1d8fd3d crypto: keembay - publish OF module alias for OCS AES/SM4
d52a15c4559b6 crypto: keembay - Initialize completion before requesting IRQ
587be18e09356 scsi: ufs: debugfs: Reserve space for a string terminator
cd522340b777c power: supply: sbs-battery: Use a per-device serial number buffer
3b1fa32b00fbf tools/build: Allow versioning of all LLVM tools defined in Makefile.include
a241079c175c5 tools/build: Add bpftool-skeletons feature test
903a7cdf63a81 pinctrl: mediatek: free EINT resources on unbind
e578bbff98582 pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
e858183aa84e0 pinctrl: mediatek: Fix the invalid conditions
7586766229354 pinctrl: mediatek: Add EINT support for multiple addresses
d626407251868 pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP()
68edf359b0b45 cxl/region: Fix use-after-free in find_pos_and_ways() error path
dd60d57b1fe73 selftests/bpf: Fix memory leak on subtest_states reallocation
123d67513c828 selftests/bpf: Fix incorrect error checking for pthread_create
3f609fc97f22f ARM: lpc32xx: only run SoC init on LPC32xx hardware
cf2e767ba2693 arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
94fce1d3e74fe fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
810da5a635495 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
4f10b305da832 drm/tve200: add OF module alias for autoloading
72e12a20e2fe0 leds: pca9532: Fix phantom device registration on missing hardware
0f36ce5987d1f PM: hibernate: Fix memory leak in snapshot_write_next() error path
621871b696b10 xfrm: Fix skb double-free in xfrm_dev_direct_output()
795e59c83c97c perf cs-etm: Avoid truncating AUX buffer sizes to int
c2039be327081 perf cs-etm: Flush thread stacks after decoder reset
524e57035af2d firmware: arm_scmi: Unrequest devices if driver registration fails
41714150f3d14 firmware: arm_scmi: Add multiple protocols registration support
e75816535da42 ARM: dts: allwinner: a10: Fix PMU interrupt
e94676a08af63 ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
74637f7fef030 ext4: fix buffer_head leak in ext4_init_orphan_info
5361fb1e5bc24 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap
2677fc48dd10d wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
9784faa6afd26 wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx()
6ba901a05ca17 wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
a7918f70784a7 wifi: ath12k: Correctly copy the hint BSSID in WMI scan request
ea2a77682f9f9 wifi: ath6kl: avoid buffer overreads in WMI event handlers
74eee4ff9698a ext4: drain in-flight DIO before buffered write fallback
f82a4929d0ef7 ext4: clear stale xarray tags on folios skipped during writeback
08df725b92751 thermal: intel: int3400: clean up ODVP on probe failures
20068f9cce6d4 iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
4f408943e79c5 iommu/qcom: Remove sysfs device on probe failure path
2ff7713b7308c firmware: arm_scmi: Fix requested device removal race
7647363fa0204 RDMA/core: Fix potential use after free in ib_dealloc_pd_user()
76f2cb4f72181 RDMA/core: Fix potential use after free in ib_free_cq()
6318be2f1bdd1 RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()
d5cc211e8c39e RDMA/core: Fix potential use after free in counter_release()
d3d0eabe6e39b RDMA/core: Fix potential use after free in ib_destroy_srq_user()
253c2ed71a532 RDMA/core: Fix potential use after free in ib_destroy_cq_user()
a608af8cde3dd RDMA/core: Fix use after free in ib_query_qp()
2001cb7bf6864 RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
7a0cbb5721a1d RDMA/nldev: Fix locking when accessing mr->pd
e61ac671304bc RDMA/restrack: Fix typos in the comments
d08cfae802141 RDMA/core: Add an option to display driver-specific QPs in the rdmatool
7670a3a09cd1b RDMA/core: Add support to set privileged QKEY parameter
6e129c1310abf RDMA/erdma: Fix CEQ tasklet use-after-free on removal
7d90d2b7bd961 PCI: j721e: Fix incorrect max_lanes for J7200
74fc33e4fbe93 RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
b21c003c8a78b libbpf: Search /lib64 and /lib in resolve_full_path()
7ba09330d9ea6 ext4: skip extra isize expansion during mount to prevent deadlock
1a1dea633b724 ext4: fix out-of-bounds read in ext4_read_inline_dir()
452950461241d ext4: fix circular lock dependency in ext4_ext_migrate
6aaf6dbf54fdf ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
8e67b58c04990 ACPI: processor: validate MADT IOAPIC entry bounds
13a1ba508507a ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
f8e9315236c8b RDMA/nldev: validate dynamic counter attribute length
c4643bcb3bdda irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
47e59177bfcee selftests/bpf: Silence array bounds warning in global_map_resize
e967bde356a8a kcsan: avoid unintended access checking in NMIs
f65f45dfa1e6e RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
750bba6ce9bb0 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]
fd6dee13f3857 RDMA/hfi1: Propagate sdma_txinit_ahg() errors
7987dd37eaeae arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
afa5719047522 phy: starfive: Fix runtime PM cleanup in JH7110 DPHY RX probe
41e92e0caa1fe ASoC: meson: Keep link pointers valid on realloc failure
351eceec64355 dmaengine: dw-edma: Clear stale requests on termination
b6293a8a38f4d dmaengine: dw-edma: Serialize channel state checks
075de95d7a7cd dmaengine: dw-edma: Serialize abort state updates
65e387b95d385 dmaengine: dw-edma: Terminate all descriptors without callbacks
fe644b89b0a8e driver core: soc: Unregister bus on early device registration failure
4ebf96d5f834a software node: Fix software_node_get_reference_args() with index -1
b604d3f453c99 perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
a536eb57be584 mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
0ce48c6ddea1a mtd: mtdswap: Avoid freeing registered blktrans device twice
25cdd2a492d86 vfio/pci: clear vdev->msi_perm after freeing it on init failure
ce6c3dd9f1ce7 char: xilinx_hwicap: unregister class on init errors
c92ef8fd83452 ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove
5246bf384f74b tty: ipoctal: convert to u8 and size_t
f53e742743c46 ppdev: prevent overflow when setting port timeout
ec713896189fb cacheinfo: don't propagate DT/ACPI error when arch supplies info (arm64)
0394902df3827 misc: ad525x_dpot: use driver core groups for sysfs files
362f5e6f8edf3 misc: rtsx: add missing write register handling
f7a8f4cbc8ced misc: bcm-vk: Use acquire/release for msgq_inited
2e91ab73f9beb speakup: keyhelp: guard letter_offsets possible out-of-range indexing
c5e4c36df3e6a accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
15340b00e665a uio: Fix stale info pointer in failed registration path
57371e743398e UDF symlink pathComponent header OOB read
0b94b2d1ab3fa tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
fd43eae7d539e usb: gadget: f_uac1_legacy: remove broken string configfs attributes
f593c55e3c125 ACPI: processor: idle: Expand _LPI package sanity checks
22a5cf7a4b733 crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
079e64469bd21 drm/msm/a6xx: Fix stale rpmh votes after suspend
4f9f0afdbdf51 gpu: host1x: Avoid stack over-read in debug output helpers
cfe1b2fa40d24 gpu: host1x: Fix offset calculation in trace_write_gather
f22ad9d1077c8 wifi: iwlwifi: mei: pass correct argument to function
11dde137f1258 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments
b90ebae632318 wifi: iwlwifi: mei: check SAP message length before reading it
2541d4f165960 wifi: iwlwifi: mei: add support for SAP version 4
5bcc933c6d47d wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
8d74cb5fbb7a0 wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs
c862282b5f4c3 perf jevents: Add more components to the metric sorting order
489765bfa715e arm64: dts: qcom: sm8250: correct frequencies in the Iris OPP table
533a26a2d6b29 arm64: dts: qcom: sm8250: sort out Iris power domains
91b0528b4220a arm64: dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
982caa744fce7 drm/bridge: tc358767: clamp the reported AUX read size to the request
61b393c2de9d8 remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
63d929c6035ca cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
e9c60c62b3fa8 cpufreq: intel_pstate: Fix setting minimum P-state at init time
dbe2842194426 media: i2c: rdacm21: Fix missing media_entity_cleanup()
3d39757ef791f irqchip/renesas-irqc: Fix generic interrupt chip leak on remove
aafec4a897d54 irqdomain: Add support for generic irq chips creation before publishing a domain
917c6432f7272 genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()
b359b1fe21434 irqdomain: Introduce init() and exit() hooks
6e6a1e3f3c3f6 irqdomain: Handle domain hierarchy parent in irq_domain_instantiate()
c2a5d22b10f42 irqdomain: Handle additional domain flags in irq_domain_instantiate()
2a8a3c8867f08 irqdomain: Introduce irq_domain_instantiate()
804e2374b4cc2 irqdomain: Introduce irq_domain_free()
572624cc59dc4 PCI: xgene: Drop unnecessary OF node reference
bff8e14aa442f PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN
dc40f9f4f21c6 cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
0a42180d5410c dax: read holder_ops once in dax_holder_notify_failure()
1c94430cab25f libnvdimm/labels: Bound the on-media label size before the shift
0f860db24ee95 firmware: arm_scmi: Drop handle on protocol bind failures
0f4edd93d7089 firmware: arm_scmi: Protect device request lookup with RCU
fe2aeb5c50683 firmware: arm_scmi: Use channel ID for transport teardown
8eb2ab2095705 firmware: arm_scmi: Reject out of range DT protocol IDs
aed24a3c63920 firmware: arm_scmi: Avoid IDR updates while cleaning channels
ae7980c9af698 firmware: arm_scmi: Free transport channel on IDR failure
70a26b3738984 firmware: arm_scmi: Unregister device notifier before IDR teardown
fb7b9a7209f83 wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
e20f3b749ad24 hfsplus: validate thread record before delete key rebuild
7e9aee7e4d976 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
1083c7dca912a fs/ntfs3: fix KMSAN uninit-value in ni_create_attr_list
4ff4b6b9e85cf fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
e3256df116f0a fs/ntfs3: Add more checks in mi_enum_attr (part 2)
5b8d40df72c55 cxl/pci: Honor -EPROBE_DEFER from component register setup
4347681957c55 cxl/pci: Store the endpoint's Component Register mappings in struct cxl_dev_state
86771c105293c cxl/mbox: Break poison list loop on an empty payload
48f55b90f0d71 rpmsg: glink: fix deadlock in endpoint destroy during driver detach
db196a8962a53 rpmsg: glink: remove duplicate code for rpmsg device remove
c7201bd08cad7 media: v4l2-async: Unregister sub-device if asc_list is empty
601eb7f556810 media: v4l: async: Drop useless list move operation
85904076cece7 isofs: fix out-of-bounds page array access on empty zisofs block
648cdd16d633d ASoC: apple: mca: increase SERDES reset delay
554261c9858a4 RDMA/hfi1: Initialize debugfs after probe completes
506e333b1410c RDMA/hfi1: Stop flushing the global IB workqueue
3f5e501f1ac47 RDMA/hfi1: Create workqueues before device initialization
3471c19584d0d RDMA/hfi1: Remove redundant PCI device ID validation
10e5e37495096 RDMA/hfi1: Free RX data on late probe failure
3f1e196eb66b8 RDMA/hfi1: Preserve unit 0 on allocation failure
695562587466d misc: rtsx_usb: avoid USB I/O in runtime autosuspend
b0c8786242a77 pmdomain: bcm: bcm2835: handle genpd provider registration errors
0f34ac40201e8 ALSA: hpi: Check transport errors during HPI6000 adapter initialization
bdcda866c89f9 xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
9e76202a1befe hwrng: ks-sa - Fix runtime PM cleanup on registration failure
2016f01404c7d hwrng: ks-sa - access private data via struct hwrng
c319b986a88ce RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state
7bc08d7f9338c RDMA/ipoib: Drain RCU callbacks during module teardown
2f946e7839f67 RDMA/mlx5: Drain RCU callbacks during module teardown
7853af5f15738 RDMA/core: Wait for RCU callbacks before unloading ib_core
39bb722b7e2c9 iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
682cb826b1ec5 bus: qcom-ebi2: use managed resources for clocks and children
fb9738bf09514 soc: qcom: rpmh-rsc: manage PM notifiers with devres
a8e5a6cff427c perf metricgroup: Fix metric expression copy leaks
c582d79c8559a drm/panel: samsung-s6d16d0: Power off on prepare failure
02e4a3088f21a usb: renesas_usbhs: Fix power-off ordering on unbind
b76061c76d8c6 usb: mtu3: allow system suspend during active gadget connection
f276b62f2ce1c platform/surface: acpi-notify: Check ACPI companion before use
bf1e0cc5cc1d4 platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
44904468e58d3 usb: fix UAF when probe runs concurrent to dyn ID removal
767ccd38e02eb USB: make to_usb_driver() use container_of_const()
6ee22ab55856e USB: make single lock for all usb dynamic id lists
85c8cb5c0be4a USB: core: Use device_driver directly in struct usb_driver and usb_device_driver
4aaad88f85749 usb: gadget: aspeed_udc: check endpoint DMA allocation
bdac0e8594a0c usb: gadget: aspeed_udc: Convert to platform remove callback returning void
a28c486434634 usb: gadget: configfs: fix out-of-bounds read of qw_sign
52c423309d461 serial: ma35d1: Fix OF node reference leaks in console init
84a286a72228f hwspinlock: propagate errno when registering single lock
a73cfa80f1ec6 remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
62b24e1c338f5 platform/x86: dell-wmi-base: Fix resource leak on module load failure
a22beeb90475b platform/x86: dell-privacy: Fix race condition
374e8007ba86c leds: pca9532: Fix inverted GPIO output polarity
6347259f70172 iommu/amd: Fix false positive in SB IOAPIC IVRS validation
9f06a7264aeda iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
ae2acdee5f8cf iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
c9dfb82df6fee iommu/msm: Return -ENOMEM on memory allocation failure in probe
b201d43112589 iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
51ddb831a3610 bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
8e1101fc41180 bpf: Fix use-after-free on mm_struct in bpf_find_vma()
68f2007738db7 efi: fix stale reference to efi_recover_from_page_fault()
978524ecfc1c5 bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
8034ddf4751d9 udf: Mark LVID buffer as uptodate before marking it dirty
150d3f3c46134 usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
fb7393519908b usb: typec: ucsi: unregister debugfs entries on teardown
810875c5996f7 thermal/drivers/rcar: Fix error checking in probe()
78c5da6150ded perf data convert json: Fix trace_seq memory leak in process_sample_event()
4f65a8939518d arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodes
30dfa367086be arm64: dts: qcom: sc8180x: Enable the power key
574a1124ab6fd arm64: dts: qcom: sc8180x-lenovo-flex-5g: move pinctrl to appropriate nodes
f43f9bd3ece31 arm64: dts: qcom: sc8180x-primus: Rename regulator nodes
0f4733f5fc6b6 clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
3b110cd72a534 clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
ed07e0adfed4a clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
0c3104e7ada4d timekeeping: Account for monotonicity adjustment in ntp_error
dd29cd572958e y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
4d76e99010940 clocksource: Unregister subsystem on device registration failure
98ea7a6cffa01 selftests: timers: leap-a-day: Fix -w option and update usage comment
8aa8e8f5e236d irqchip/gic-v3-its: Fix its node leak in gic_acpi_parse_madt_its()
8c701506a3896 irqchip/gic-v3-its: Fix memleak in its_probe_one()
36d2cf0a9044d selftests/bpf: Fix memory leak in msg_alloc_iov
fb17bee6b42c6 selftests/bpf: Fix memory leak in msg_alloc_iov error path
dd4454dbe038d ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
4520d673d49da staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
98f9036b2254c staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
65374d46e5507 staging: octeon: replace pr_warn with dev_warn in fill and rx paths
a082526531f19 staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
03725a114fb42 staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
b6365e4186322 staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
b631de4efcc17 staging: fbtft: Use sysfs_emit_at() to print to sysfs file
52daf9de692eb greybus: audio: bound the topology section sizes against the fetched size
6ddc6239b80de staging: sm750fb: gate dualview dataflow using g_dualview
7b34f757e63c9 staging: greybus: audio: correct sscanf() return value check
c40ba47f2ba19 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain
c2d446de9c7d0 bus: qcom-ebi2: Fix clock leak on probe failure
aca12925ca316 bus: qcom-ebi2: Simplify with scoped for each OF child loop
c75aed7464f63 arm64: dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
8d89d53927ca2 PM: sleep: Fix off-by-one in wakelocks number limit check
9118429571290 bus: ti-sysc: Fix /chosen node reference leak
9584b3c30e4ee nvmet-rdma: fix response resource leak on queue teardown
3220b338d5c79 nvmet-rdma: factor out response resource cleanup
d130a12a80ca8 nvmet-rdma: use sbitmap to replace rsp free list
85a79da286b65 nvmet-rdma: avoid circular locking dependency on install_queue()
86782a72c6d8c nvme-apple: Use acquire/release for queue enabled state
27ec91c29ee15 crypto: keembay - Fix AEAD unregister count in error path
a22dc48d58ef4 crypto: rk3288 - fail ahash requests on HASH idle timeout
04c46784ec249 crypto: sa2ul - stop probe if context pool creation fails
28cc179252347 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
6457162f74f45 crypto: atmel-ecc - reject hardware ECDH without a public key
70933a1cac1fc crypto: atmel-ecc - clean up and improve ECDH comments
c0615c85eabf9 crypto: atmel-ecc - replace min_t with min
892f34dc1819c crypto: qat - clear AES key schedule from stack
a8aa89686e705 perf/x86/amd/uncore: Add group validation
e0e7c57c8f654 perf/x86/amd/uncore: Refactor uncore management
64463f1901d33 perf cs-etm: Fix thread leaks on trace queue init failure
99d3245941659 perf cs-etm: Queue context packets for frontend
8e5df43a45788 perf cs-etm: Create decoders after both AUX and HW_ID search passes
96d80b8319b3d perf cs-etm: Fix incorrect or missing decoder for raw trace
655c4401c18d7 wifi: rtw89: fix HE extended capability length check
7780d93ae28f3 platform/chrome: sensorhub: Fix memory overread in ring handler
c3d0e87485242 selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
e71a3dc5b8d2e csky: Fix a4/a5 restoration in syscall trace path
8d32795f0a49f iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
f80c31231f85e soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
aaff22cc321a3 dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
fdaf297ab275c dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
2c6bb2f286369 dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
953e85da53541 bpf: Copy per-CPU map value padding in copy_map_value_long()
9004fc411a4c5 tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
c2dae438fe530 tools/bpf/bpftool: Reset vmlinux BTF after map commands
b349dcf061a6d drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
745297208d312 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
28f70e0aa767a regulator: tps6594: Fix device node reference leaks in multiphase loop
017cee438fff6 regulator: tps6594-regulator: refactor variant descriptions
e8d3e15b9dd68 regulator: tps6594-regulator: remove hardcoded buck config
23a18b7506a10 regulator: tps6594-regulator: remove interrupt_count
75ab28f275538 regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type
ac25127d2f353 regulator: tps6594-regulator: Fix the number of irqs for TPS65224 and TPS6594
54308f24ce510 regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators
d9c48f4e68615 mfd: tps6594: Add register definitions for TI TPS65224 PMIC
1f27602b20119 perf tests: Fix flakiness in BPF counters test on hybrid systems
a223216745ed4 perf test: Fix perf stat --bpf-counters on hybrid machines
c292f2c183254 perf test: Use sqrtloop workload to test bperf event
ff43d641b3bfb perf test stat_bpf_counter.sh: Stabilize the test results
30db36f6e1503 perf test bpf-counters: Add test for BPF event modifier
a04531eb40eb9 perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test
203514384ea3c perf tests: Skip metrics validation if system-wide recording lacks permission
6ccaa141be258 perf test: Do not skip when some metrics tests succeeded
db1ce7949a1cc perf test all metrics: Fully ignore Default metric failures
ce09d02a597cb perf test metrics: Update all metrics for possibly failing default metrics
e386dedc41094 perf tests metrics: Permission related fixes
1437d124d2ede perf test stat_all_metrics: Ensure missing events fail test
a379a49b88d14 perf test: Update all metrics test like metricgroups test
361c06583eb3b perf test: Simplify metric value validation test final report
3db8b4f7f4eaf media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
68f283e4d2202 media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
3b978fd0a3092 pinctrl: bcm2835: Don't remove an unregistered GPIO chip
ff48a41a242f2 perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
69fafae4eb2c9 sched/fair: Fix overflow in update_tg_cfs_runnable()
f5ec164e733b9 mm/mm_init: fix incorrect node_spanned_pages
788917ba77f5d drm/lima: call drm_mm_init() with a valid allocation range
0c90fe8d8039f clk: imx: scu: drop redundant init.ops variable assignment
3f0ebe8f8ae31 ARM: imx: fix device_node refcount leaks in imx7_src_init()
01a854226f5d1 ARM: imx: fix device_node refcount leak in imx_src_init()
d3d51e874f7c0 clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
1bb23c9d68312 ASoC: rt700-sdw: always drain jack work on remove
b550b77f34f19 clk: nuvoton: ma35d1: fix ma35d1_clk_pll_determine_rate logic
25f46d2536332 clk: nuvoton: ma35d1-pll: convert from round_rate() to determine_rate()
418401f2a872d clk: nuvoton: ma35d1: fix PLL_CTL1_FRAC bit field width and fractional calc
828a90dadda6c clk: nuvoton: ma35d1: fix ignored div_u64 return values in PLL freq calculation
6956464d233a7 clk: moxart: remove unused variables, fix refcount leak
909f1b54d5a09 clk: versaclock7: Fix APLL clock leak on probe failure
b37e82a046e73 media: cec-pin: Fix event FIFO ordering
111f1311bbdbe soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
4b29be4b23bc2 HID: roccat: bound device-supplied profile index
e45631bf607fa HID: nintendo: Fix imu_timestamp_us double increment per report
92cca302a4eaf HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
4e37371cb4e3b platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count
c0e090bd67085 x86/cfi: Use symmetric SYM_START and SYM_END in __CFI_TYPE()
02e095247f0a9 smack: restrict smackfs/{direct,mapped} values to 0-255
c7bb74fa9c382 smack: deduplicate smackfs/{direct,mapped} file_operations
6d4addf839b94 smack: simplify write handlers of sysfs entries
ec47f4177046d smack: fix incorrect task context in smack_msg_queue_msgrcv
139460b7723ca drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
a008506e55e33 drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
8504b0e1acef9 drm: lcdif: Wait for vblank before disabling DMA
9ed9a94c1a41d drm: Remove unused header in drm_dumb_buffers.c
6d79a939e284e mm/damon/core: skip aging from repeated aggressive merging
a886ad5f6348f usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
404079d124d75 clk: meson: align gxbb_32k_clk_sel number of parents with actual count
29639f00bfa49 perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
a3e07db74f22a batman-adv: bla: avoid CRC corruption due to parallel claim add
1674855a5b6ea batman-adv: dat: atomically update mac addresses
d161c4456672f ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
5e641e4ee0bc1 ksmbd: fix durable reconnect error path file lifetime
f0ff7f12398e8 ksmbd: fix use-after-free in smb2_open during durable reconnect
64eaf4ecda007 bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
2120bd8546cd6 bridge: mrp: reject zero test interval to avoid OOM panic
de6601f1374fa netfilter: nft_counter: serialize reset with spinlock
e2e9599f3503d bpf: Reject narrower access to pointer ctx fields
c9a129c82ddf8 ceph: fix oops due to invalid pointer for kfree() in parse_longname()
4b9aee707c458 parse_longname(): strrchr() expects NUL-terminated string
0afd48b173beb net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
97aabdbf7ba82 ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
73f074fb5e139 ksmbd: fix overflow in dacloffset bounds check
9c6c85ae77efb net: libwx: fix Tx L4 checksum
5eaf57fdfa37c md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb
7493b9baf0e54 wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path
9d213ca0cb49e net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
7f1fe43907a63 net: hns3: don't auto enable misc vector
2b844d952e23d mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
1acb6d1ece3bc mm/damon/core-kunit: handle region split failure in filter_out()
9b7cf02158d93 mm/damon/vaddr-kunit: check region count in three_regions test
072d538e9d8c5 mm/damon/paddr: drop last same folio access check reuse optimization
2b48a84d31dc3 mm/damon/vaddr: drop last same folio access check optimization
94c4828bee3da mm/damon/core-kunit: check region count before testing in split_at()
c3c126a6142a1 nvmet-auth: Synchronize timeout work during SQ teardown
f3d8c2fd591bb net/mlx5e: xsk: Fix unlocked writing to ICOSQ
9fffa6465851a tcp: clear sock_ops cb flags before force-closing a child socket
43239fc6dfb62 xhci: fix lost bounce buffers on TDs spanning several ring segments
a129b2b875c14 drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
ba42d8a1c2c76 drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
f02aefbc43bd7 drm/nouveau: Use write-combined maps for coherent
0f47c47b45738 drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
b4c90c78f420c drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
5d501f7279451 drm/amdgpu: fix autosuspend cleanup during removal
84a8012601b9a drm/amdgpu: check thunderbolt before switcheroo registration
e2f27b5ed9084 drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
4f966558c188b drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
082e378886547 drm/gud: validate TV mode names before creating enum property
89210cb5ff8fd drm/gud: NUL-terminate TV mode names read from the device
6dceaeceaa7c8 drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
4d5ee095a5846 drm/amd/display: avoid divide-by-zero in __is_lut_linear()
6fa33b32783e9 drm/hibmc: Use drm_atomic_helper_check_plane_state()
1f0b71afd81de drm/hibmc: Fix list of formats on the primary plane
5296c567cbacc drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
4a0236fe97732 drm/i915: Guard against NULL driver_data in i915_pci_probe()
a0a7e2e177f2f drm: fix race between partial drm_dev_register() failure and ioctl
8d9e6dffaea9b drm/panel-edp: fix i2c adapter leak on probe failure
c0cbdb43e0c65 drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
6882d458d2e40 f2fs: fix to zero post-EOF data when extending file size
d7a07c9ac1e71 f2fs: fix to off-by-one issue in f2fs_zero_post_eof_page()
e601926015e03 f2fs: fix i_size when pinned fallocate partially fails
694565c0c14c9 f2fs: return writeback error from collapse range
4c0c610b480cf f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set()
ca1a602d4f73c f2fs: reject overlapping move range after len expansion
4aa12ba10cbff f2fs: return symlink writeback errors
2935b730211c5 scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started
947c6bfcf7f5e scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
9c00b89160406 scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
e8f1b0cb97823 scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition
e72c9eb93c5f1 scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
af8650037eec2 scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort
d79376fbd2a07 scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
be75ab791c9b3 scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
6e217a9482eab scsi: qla2xxx: Avoid double completion in async IOCB timeout
7ac5be2a86096 scsi: qla2xxx: Quiesce response IRQ before freeing request queue
6e3f129538c32 scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
8f0e31e7a4137 scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
b6a30baa29695 scsi: qla2xxx: Don't query firmware state while chip is down
5762d992dddaf scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
2f847f06bb223 scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
6003e79148eca scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
ae09260be7454 scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
9cef42a073a0b scsi: qla2xxx: Serialize flash version read in reset handler
e80adfeac61b4 scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
7eb618877503e scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
047f1f7ee6f85 scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
5b8ed910c392c scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
b403700ac62fb scsi: qla2xxx: Initialize NVMe abort_work once at submission
f8d2eb510c063 scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
55f8698a6caf8 scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
de0c8ef3b900c scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
9a756f277eb89 scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
84bde5ce4038d scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
c4acac8cdc005 media: zoran: Avoid freeing a registered video_device twice
ca87a19381ae6 media: vimc: fix pixel format lookup in enum_framesizes
3d1b10d81fe54 media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
7c0212041fab2 media: venus: fix payload size calculation in parse_raw_formats()
fdf1eb47a60db media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
ef609b3ce456f media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
ea5a921d4d277 media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
d273571e53140 media: v4l2-async: avoid deleting unlinked ASC entry on link error
593b1172e5d54 media: tda18250: fix possible integer overflow
77f216f8de622 media: saa7164: fix cleanup on resource allocation failure
5626785b0e466 media: s2255: check firmware size before reading trailing marker
79f58f900dd22 media: s2255: bound JPEG frame size before copying into the buffer
c91e8ae2b39c6 media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
053581d4657c6 media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
826763adbd8bd media: rc: sunxi-cir: Unregister rc device on probe failure
c817f24410626 media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks
e9fe8e3f758f8 media: nxp: imx8-isi: Correct color map between V4L2 and ISI
94666ec4ae770 media: nxp: imx8-isi: Fix stream ID validation bypass in crossbar routing
680a89683197c media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
7512838a19af0 media: i2c: ov7740: fix use-after-destroy in remove
4c2988bf1ad27 media: i2c: ov02a10: fix endpoint parsing use-after-free
1c9fdd9465211 media: go7007: defer the ALSA v4l2 put until card release
20aacd87550be media: em28xx: fix use-after-free of dev_next->devlist on disconnect
4e11c45dfdc72 media: em28xx: defer audio-only extension registration
ec82b0cf7f75f media: cx23885: cancel NetUP CI work before teardown
54ac6df8b8d97 media: cx231xx: reject geometry changes while the VBI queue is busy
42e00371f83c3 media: cobalt: Avoid freeing ALSA private data twice
22441be29ec27 media: cedrus: fix memory leak in cedrus_init_ctrls()
271e57a936dcd media: cec: Serialize exclusive follower delivery
cf3bf86f32371 media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
954ee95a03b4d media: cec: core: Fix kmemleak due to missed rc_free_device() call
6e4ea90fdc660 media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
ff40e597d5d98 LoongArch: Avoid preempt count underflow without probe
a03b5e7483ad2 LoongArch: Do not save/restore percpu base register in rethook trampoline
9c55a7d4e521c KVM: s390: Restore sigset on error path
1914499556464 KVM: s390: pv: Fix rc/rrc offset for PVM_DUMP
934b7b2b76d34 KVM: s390: Zero initialize irq in reinject_machine_check
f8e3a9997d5ec KVM: s390: Take srcu when importing watchpoint data
544a5a665019c KVM: s390: Free guest debug data on vcpu destroy
5fbf319137735 KVM: s390: Fix old_data leak in guest debug error path
5940418e4232a KVM: s390: Fix memory leak in guest debug handling
fec89d327d9b2 KVM: s390: Fix length check __import_wp_info()
8e19ded843368 KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
312cdb6d89408 KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
62604376c3131 KVM: nVMX: Always flush vpid02 on first use
ee2d20a386668 iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
7a1be6e7a857e iio: light: opt4001: Reject integration times with a non-zero seconds part
0f9f6d0ee5a59 iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
170904917dc8d iio: light: opt4001: Fix power down clearing bits of the wrong register
9b75d89fd1e3d iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
e44b2af0c14e2 iio: srf04: fix pm_runtime handling on probe error path
d97f4e012ba37 iio: pressure: mpl115: Fix runtime PM cleanup
a32a39da18e01 iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
da41c3e0e67a3 iio: light: gp2ap002: Disable regulators on resume failure
82c27dabc391b iio: light: cm32181: return zero after writing calibscale
7dfbbb2f219fd iio: gyro: mpu3050: fix sign of raw angular velocity readings
f5acb824277a9 iio: dac: m62332: Fix regulator reference count imbalance
3462c13bb0f50 iio: chemical: sgp30: Handle IAQ thread creation failure
f64b437641b5a iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
72daa7eb7fc62 iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
ed43e34f431d1 ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
4dc91d0dadfe2 AsoC: intel: sst: fix PCI device reference leak on probe failure
6150b04ce8474 ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
f4bfd755c52df ASoC: cs35l34: drain threaded IRQ before runtime suspend
614c2616ea677 ASoC: cs35l33: drain threaded IRQ before runtime suspend
52f7ce8896d6e i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
0c4c642b4d03e clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
ad3436ad31b83 clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
c93a8c7064b33 clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
0c0609c1da0df clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
0944e2cd198f6 clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
1e2465ee57a3a clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
ce6f40f8dc66b clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
a2c156d22c3db clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
b89701e1fae14 batman-adv: bla: prevent CRC corruptions after claim flush
76aedcde5a248 batman-adv: bla: fix freeing of claims on meshif deletion
c74a4acf41d19 batman-adv: dat: avoid unaligned fault in IP extraction
6df64825f8b19 batman-adv: fix stale receive device on merged fragments
ddb6ddf5be742 mtd: rawnand: validate ONFI extended parameter page sections
f25c804947e0a mtd: mtdoops: free page bitmap when the backing MTD is removed
da740539e8f37 mtd: afs: validate v2 image info bounds
58f6f9125e74d s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
4ba8a08f5f26e s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
31fa0a8a3c337 s390/vfio-ap: Fix NULL deref in status_show() during queue probe
3a9b049bbdc40 s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
5e932abfcce61 s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
02e72909453de s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
1f54efd800320 s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
eb6cc898501a0 s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
114b6ce2cf864 powerpc/crash: stop watchdogs before booting kdump kernel
9c8e0e526b769 powerpc/pseries: Move H_WATCHDOG definitions to a common header
b0cf5aceafb4b powerpc/pseries: Handle and log pseries-wdt registration failures
b96be860673f9 powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
f5e9bea0d7c15 parisc: Fix alignment of asm statements in head.S
62d88e93ef5e1 parisc: eisa: Fix infinite loop when parsing invalid IRQ value
f9bf05c63b77d nvdimm/btt: reject an arena whose nfree is below the lane count
6eddedb1a3009 mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
0fb7c549357c1 Revert "irqchip/mbigen: Fix mbigen node address layout"
9fb527103e53f nvmet-tcp: reject unsolicited H2CData PDUs
cf5f39d2b58f9 nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
0673a2affe45c nvme-tcp: check the data direction of a C2HData PDU
ad29779736cfd ALSA: pcm: Fix race between non-atomic ops and trigger-start
7dc239edb6d58 ALSA: harmony: initialize locks before requesting IRQ
08d931a0a850a arm64: mm: Fix the lockless page-table walk in show_pte()
0927153f2abf4 i2c: mux: Fix channel node leak on adapter add failure
f9094ace03e0a i2c: core: fix debugfs UAF on adapter removal
ca19a175e89b7 perf/x86/intel: Fix kernel address leakages in LBR stack
341ec28243f16 rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
5548f41e2f8dc rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
a098e2cecd9d2 Input: aiptek - validate raw macro indices before updating state
630ed8734a02b kprobes: Protect kprobe_blacklist with RCU
30b5c0e17dcad ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
23a969a2df8de ata: ahci: work around lost interrupts on Marvell 88SE61xx
642b76f92bc42 block: flag zoned disks with GENHD_FL_NO_PART
a38caa9ed0d5c cpuidle: dt_idle_genpd: kfree() the original name allocation
17ef63843c0fc dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
8bc87a50fd0ea dmaengine: dw-edma: Complete descriptors before pausing
718ee263a60d5 dmaengine: dw-edma: Fix HDMA channel status register access
94f3d399c1ddb dm: fix resume-vs-remove race
0ea6e5ad4a581 dm: fix race when loading and unloading a table
96dd0af7597ab HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
a8be8bbf0952b HID: rmi: fix OOB access with undersized RMI reports
81aadbd09bf1d futex: Prevent rcuwait use-after-free during requeue PI
2bf705699fd72 mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
c97ded32334d9 mm/damon/sysfs: kobject_del() region and target (error) dirs
ffab414fc5e06 mm/damon/sysfs-schemes: kobject_del() scheme region dirs
0e4aa31ab32a3 mm/damon/sysfs-schemes: kobject_del() scheme filter dirs
b33f9b0184159 mm/damon/sysfs-schemes: kobject_del() scheme dirs
2853ce9c88e0e scsi: pm8001: Use rollback index when freeing MSI-X vectors
6b589ef9d5f6c scsi: target: iscsi: Reserve a terminator byte for the login payload
635b2bddea565 spi: bcmbca-hsspi: disable clocks on resume failure
d45f27903f945 spi: bcm63xx: disable clock on resume failure
5597b4ffd0bec spi: bcm63xx-hsspi: disable clocks on resume failure
be41733c24be5 ublk: clear VM_MAYWRITE on read-only ublk char device mmap
d3018aaa5e3b1 thermal/drivers/qoriq: Disable clock on resume failure
03ff03e5c95a5 thermal/drivers/imx: Disable clock on runtime resume failure
0b7f64c7bb966 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
fd5e24ea83733 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
7a4f4ca7ff32a usb: gadget: fix null pointer dereference in usb_put_function_instance()
162178ca83c3d USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
f9bdf4c4f6410 usb: gadget: f_midi2: fix use-after-free in string attribute show path
51ddc55c75087 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
58e0ee293ec5e usb: typec: ucsi: displayport: Fix OOB altmode array index
0b69b166852db usb: typec: qcom-pmic: cancel reset_work on stop
dbbb3bb0bf2f3 usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
9481bc04a8c35 usb-storage: ene_ub6250: fix race between scan work and probe
67374e3a00814 media: usbtv: keep device alive while ALSA card exists
d91993f4c7635 clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
1d4add2b832b5 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
553c375e86a49 usb: image: mdc800: change kmalloc() to kzalloc()
4c5b61b9df6ab drm/amd/display: fix division by zero in get_estimated_bw()
28ed5343666ff scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
2df964d141270 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
517ed2f9ea7d9 tracing/mmiotrace: Remove reference to unused per CPU data pointer
7ab40f7577d88 net: ntb_netdev: Fix TX busy and drop handling
23001ee5d8631 entry: Fix seccomp bypass after ptrace with TSYNC
cd644e6dc72ee tcp: fix potential race in tcp_v6_syn_recv_sock()
343ae18e960f6 fsnotify: Fix stale object mask after concurrent mark updates
b4bf67cc0871b wifi: mt76: mt7996: validate default EEPROM firmware size
dfb10d9890561 landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
680f20d5937fa openvswitch: Fix CT limit teardown use-after-free
d7c2b66bc5527 net: openvswitch: fix kernel-doc warnings in internal headers
8069643ae64df net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
e34ff3f882292 platform/chrome: sensorhub: Fix dropped timestamp events and log spam
8395cff0b286d udf: Fix i_lenExtents truncation on 32-bit kernels
51e368f723aa5 timer: Keep debugobjects state consistent in migrate_timer_list()
2252f8ccc3085 taskstats: fix cpumask parsing cutting off the last character
f9c7b1f2b9d8f smack: fix cred UAF in smack_file_send_sigiotask()
6b1de022304ef signal: avoid shared siginfo namespace rewrites
262b805219157 sticon/parisc: Detect default STI graphics card for console output
b0dc3f18af01b tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
6c1a8685be6a7 xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
0f6496b34cc29 w1: ds28e17: reject an oversize length on an I2C block read
b9cb4e8ba71c9 vsock/virtio: flush works in dependency order
ef2ec8b537c3a wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
c86199357a93b wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
2610885f70861 wifi: rtl818x: initialize eeprom_93cx6 struct to zero
f2134d6ff30cd wifi: mwifiex: Detach sync cmd buffer on interrupted wait
7704f6ba2a8c4 wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
35aa6730b8c56 i3c: master: svc: bound IBI payload to the requested max_payload_len
ef72ff6650c4e i3c: master: Fix info leak and UAF in device unregister path
42ea423a50ae1 dm-switch: use WRITE_ONCE() in switch_region_table_write()
389a50d094e13 dm-stats: fix a crash if allocation of per-cpu data fails
d1361d4a42bbd arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
d18bbf8262516 x86/tdx: Fix zero-extension for 32-bit port I/O
0444f2803b963 PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
342d8d63f653c cgroup/cpuset: Fix misplaced DL migration reset
368c521503e38 ALSA: virmidi: Check card index validity at probe
487ede9b648fc ALSA: serial-u16550: Check card index validity at probe
64898e9bd8b7b ALSA: portman2x4: Check card index validity at probe
ede25b7fea0d7 ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
9cd7c59a106e7 ALSA: mts64: Check card index validity at probe
26a25fb4ef4ba ALSA: mpu401: Check card index validity at probe
6c07aad8a7c9e ALSA: bcd2000: clear the URB pointers on disconnect
6fe7d13608a9d ALSA: aloop: Check card index validity at probe
00e84a9ff2d43 ALSA: 6fire: bound the MIDI event length from the device
96c74420ac929 seg6: reset IP6CB after IPv6 decapsulation
6ec22afc82a3c net: skbuff: don't touch shared zerocopy state in skb_tx_error()
bfb1c9e6297b4 net: fix spurious TX timeout after dev_activate()
84783961cb8bd net: cap advertised IP tunnel headroom
b6b6ac713ee82 net/smc: unregister the connection before draining the rx tasklet
df441f3efbb50 net/smc: fix use-after-free in smc_rx_pipe_buf_release()
09d7a9e162ee1 net/smc: fix socket refcount leak in smc_switch_conns()
ab26e12dd5d2f net/smc: do not dereference an unset send buffer on the SMC-D teardown path
746681f9e8773 net: ntb_netdev: Count packets dropped on RX refill failure
965c4452bfe34 net: ntb_netdev: Avoid double-accounting netif_rx() drops
b6db88cde0fb5 NTB: ntb_transport: Reject oversized TX buffers
e6cc541fab010 NTB: ntb_transport: Fail TX enqueue when the QP link is down
81fbd4021ca93 NTB: ntb_transport: Recycle TX entries before client callbacks
e0d4a17afde5a net: thunderbolt: Mark the connection down when bringing it up fails
47981eb66461b net: thunderbolt: Release the Rx HopID that was handed out on mismatch
bf3308416a2be net: ravb: avoid dereferencing an invalid PTP clock
06323666c4e2b net: openvswitch: fix nf_connlabels leak in ovs_ct_init
64051fe200c7c net: openvswitch: fix flow mask use-after-free on flow deletion
010eee265d6bd net: tun: bound receive headroom
98610769784d0 net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
70e20456bcbf7 slip: fix use-after-free in sl_sync()
6de17275b3ccd xdp: fix zero-copy frame layout
0a5af67e7184c net/iucv: filter frames in afiucv_hs_rcv() by ingress device
d377bf743f29b ipmi: si: Fix NULL pointer dereference after failed registration
7d66d54b974cf ipmi: ipmb: validate write message length
fedea72e8f312 interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
dfdee7ceff6a5 platform/x86: hp-bioscfg: warn on element type mismatch instead of failing
467e53f231f77 platform/x86: hp-bioscfg: pass validated element count to package parsers
fe837a99e4e31 platform/x86: hp-bioscfg: fix ORD_LIST_ELEMENTS never being parsed
8f5aa1506cddd platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer()
62f6f04abc64a platform/x86: hp-bioscfg: fix new_password_store() overwriting current_password
21243c15e1d31 platform/x86: hp-bioscfg: fix heap OOB read on empty password write
81db79fed1156 platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store()
1bf0a07a2ea4b platform/x86: hp-bioscfg: bound ordered-list parsing by the package count
27a93d0fe2398 platform/x86: hp-bioscfg: advance elem past consumed array elements
d8690d44f1b0d platform/x86: hp-bioscfg: accept reduced ACPI packages from older HP BIOS
d1b4add68dabf platform/chrome: sensorhub: Bound the EC-reported sensor number
f2a9289a65d35 platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
0d601126c7afd platform/x86: ISST: Validate logical CPU id and clos id
649024043d23f platform/x86: ISST: Just allow 2 bits for SST feature enable
dde5b9c91e9fc mmc: via-sdmmc: stop card-detect handling on probe failure
c847ea4851ecf platform/x86: ISST: Validate socket ID in clos_assoc ioctl
beb22ebf76c04 platform/x86: ISST: Validate level in perf mask ioctls
44ec7f1113309 platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
579eb867d3da6 iommu/vt-d: Force requesting ACS when tboot is enabled
d5db80b68ee5c iommu/vt-d: Fix no_iommu to disable platform opt-in
a6a4cee09b154 PCI/proc: Warn on writes to kernel-exclusive config space regions
e7730acd6a01c PCI/proc: Use file_ns_capable() when checking config space read access
d6895710703ea PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
d0631a0ab18ad PCI/MSI: Enable memory decoding before restoring MSI-X messages
131900a246137 PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
838e146ae4cd8 PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
5a072fc80a753 PCI: meson: Fix GPIO state while requesting PERST#
dcaf13f2f4688 PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
f735b9710f0c8 s390/dasd: Propagate partial completion length across ERP recovery
57db27ccc162a s390/dasd: Guard sysfs discipline callbacks against unallocated private data
55f4df40178cd s390/dasd: Do not complete a failed ESE read as successful
991be92489bc7 s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
23783db5642a7 power: supply: max17040: synchronize work cancellation on suspend
f46465aefa911 power: supply: max17040: drop incorrect I2C functionality check
2ec4d203ecb06 power: supply: ucs1002: fix use-after-free on remove
c46c205bab0df power: supply: twl4030_charger: cancel workers via devm
442c60c08ec23 power: supply: rt9455: quiesce delayed work before teardown
c06028db62085 power: supply: qcom_battmgr: terminate the strings from firmware
6f0ce09d60a0e power: supply: lp8727: fix use-after-free in lp8727_release_irq()
3262977a05b23 power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
2746d502b12b3 power: supply: cros_usbpd-charger: bound the EC-reported port count
976c10d883a02 power: supply: bq25890: Fix power_supply reference leak
2cfb59dc9df8b power: supply: bq256xx: drain usb_work before freeing the charger
6d2eb93975c07 power: supply: bq24257: fix use-after-free on remove
092acd3c55a40 sctp: fix stream->outcnt underflow on duplicate RECONF responses
b55c2561d3fec sctp: distinguish sequence zero from wildcard in reconf lookup
b2d6d873b4dfb sctp: fix NULL deref on untransmitted RECONF completion
928fd7920ba37 sctp: drop a chunk if its transport was removed
5c0b2dbbdafc9 sctp: stop processing a packet once its association is deleted
fca3ebb63e5c8 nvme-tcp: reject a read that transferred too few bytes
bc4013c7cce58 nvme-tcp: fix host memory disclosure on R2T for a read command
b96e1ff75e5c0 nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
313b05de246a1 nvme-pci: disable controller on admin queue IRQ setup failure
66b5af23b6f95 nvme: zero the discard fallback page
da7555248e9bb nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
350087f231c11 lockd: pin next file across nlm_inspect_file lock-drop
697d946853e7e hwmon: (max6621) fix temperature clamp range
7d69a2747441f hwmon: (max6621) fix negative temperature offset and crit readings
213a32146337d ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
9df45b83d6f68 arm64: compat: Fix decrementing LDM/STM alignment emulation
8a2ec0eb2c5b3 ALSA: ump: Fix corrupted data bytes at MIDI 1.0 SysEx to UMP conversion
4d5c460ef8754 openvswitch: only skb_tx_error() a packet we are about to drop
574ae2ac2b314 openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
f9dd5cad8d091 ocfs2: fix readdir position truncation on 32-bit kernels
1507c5586ebd3 ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
da279037473ae ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
c9be4de77f97f ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
97584e93fc49a ocfs2: validate rl_used against rl_count in refcount block validator
77686fa5bba13 ocfs2: validate lengths in dlm_mig_lockres_handler
24989909d3413 ocfs2: bound namelen in dlm_migrate_request_handler
a4adaa722977f ocfs2: always run deallocs on copy-on-write completion
ce748ae1181d0 orangefs: skip leading spaces before parsing client debug masks
9c9eacc47c618 orangefs: fix double-free of trailer_buf on readdir copy failure
c4c338dcd38b9 regulator: qcom-refgen: correct the regulator type to CURRENT
c998890091065 regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
eda08b6bd64f0 regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
71dc206f2e2a6 RDMA/ucma: Lock the handler in ucma_set_ib_path()
3265d558dfafa RDMA/cxgb4: Cancel reg_work before freeing device on remove
a5e1fdc126ab3 qede: Fix NULL pointer dereference in TPA fragment processing
6ca338cf2d386 remoteproc: scp: Fix device reference leak on failed lookup
a2e0e01a7fbf0 arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audio
bfc3e5fe778c9 arm64: dts: rockchip: fix eMMC reset polarity on PX30 Ringneck
28cf91db44ce1 rpmsg: glink: smem: order FIFO read after availability check
46101fb96aff2 staging: media: tegra-video: vi: fix probe failure on skipped last port
a3783800c9475 staging: media: tegra-video: fix of_node_put() on VIP parse errors
6deb4d7a0c3d9 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
b77b83f5529a2 udf: reject VAT indexes equal to the entry count
06d0390c37fa6 svcrdma: Fix pcl_for_each_segment for empty chunks
cba8543c18cf4 svcrdma: Fix offset arithmetic in read_chunk_range
fb43997407bc1 SUNRPC: wait for in-flight client TLS handshake callback
4abb44a29bb51 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
89c8e0733e8c4 sunrpc: init gssp_lock before publishing proc entry
81fd7654a8429 SUNRPC: harden gss_unwrap_resp_priv length checks
f2591660e0eb2 SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
ef948257d1211 SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
57ac7d899409b SUNRPC: Check svc pool percpu counter allocation
6d74ecc2be120 SUNRPC: always drain cache_cleaner before destroying a cache_detail
edb20e8c03aeb sunrpc: route to a populated pool in svc_pool_for_cpu()
0ea5b0c7f212c SUNRPC: svcauth_gss: enforce krb5 token minimum length
56b29d62017c7 SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
4bf59cb0ea5b0 SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
e05c28bd6043d nouveau/gem: reserve the bo in the info ioctl around the vma lookup
9df36a4846375 mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
d9640239827d6 mpls: reload header after pskb_may_pull()
0a03f9541c06f md: do overflow check for sb->bblog_shift in super_1_load()
792515b2b77cc mailbox: qcom-ipcc: fix duplicate channel allocation across holes
93967bfb17dab libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
3665abc3d2ae8 ipv6: use RCU iterator to dump route exceptions
c3457a5aae5fb ip6_gre: fix hardware header length for NBMA tunnels
defa0adeff132 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
c4dc23de4cc75 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
7cd164f0e1bab kasan: fix cache shrink race with CPU hotplug
d90a166ac55c1 Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request
faf331d3f2145 Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
7df825df95cf9 Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
6ebb6d1756820 Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
d5eef07470719 Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb
ff76a63e9524b Bluetooth: hci_conn: re-enable advertising only for peripheral role
82425b14f0fb2 Bluetooth: RFCOMM: serialize security confirmation handling
d47b8f8c02a3d Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready
1a7196c4fffb3 Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
1c4b02a810329 Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
1353679268b3c cxl/pmem: Format the nvdimm serial number as unsigned decimal
aa436b021e505 cpufreq: schedutil: Fix rate limit overflow
522fa26da24cc dm array: reject an array block whose value size is not the caller's
01a0276706c7b dm raid1: reserve space for NUL-terminator in build_constructor_string()
dc731d7fddfd6 dm-era: fix shadowed superblock leak on take-snap failure
80551bf8912c4 bpf: Harden bloom filter sizing and indexing on 32-bit kernels
ac280f6872e75 bnx2x: fix double free in bnx2x_init_firmware() error path
1a28aae7f1fc8 Bluetooth: eir: Fix OOB read in eir_get_service_data()
0725f93b395f7 Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
1b5fb9c40e301 Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
958cfdc655f7c block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead()
6eaed64a32e55 auxdisplay: charlcd: cancel backlight work on registration failure
977554ed91b54 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
3a6f8d3adbd6f ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
1712e99ddeb19 alpha: marvel: Fix lock ordering in init_io7_irqs()
748d3e1dcecf5 alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
a12408ff9a948 alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
c5a31b4e7e37c ACPI: pfr_update: fix stack buffer overflow in query_capability()
9963a65be2bef hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
827ded884dbd6 fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
c4d5953582463 forcedeth: fix off-by-one when saving/restoring non-PCI config space
9eb7b3cbe99c9 fbdev: uvesafb: unregister connector callback on init failure
237924f5b9afc fbdev: ssd1307fb: defer I2C transfers from damage callbacks
74de052b4399d fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
302d19fbc7dc7 fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
35b3334800103 fat: restore original value when fat_ent_write failed
3cd611c9f1dbc efivarfs: Rate limit statfs() handler
a980ac04ada51 ecryptfs: show filename encryption options
30845ed227475 ecryptfs: release message context on send failure
414a0f04feb06 ecryptfs: reject too-small tag 70 packets
33e050cac8414 ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
749fa08d8f1b3 ecryptfs: pass packet set buffer size to parser
ec1627bcb5b51 ecryptfs: hold msg ctx list lock when cleaning daemon queue
7abf2992c61e8 ecryptfs: fix tag 11 packet exact-fit size check
70fa0cf82e435 eCryptfs: bound the packet-length peek to the user buffer
61ca8cbbf68f7 fs/ntfs3: bound page_lcns[] index by the log record
77d8efd04745c fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
d23155634a4bc fs/ntfs3: validate dirty page table on log replay
069729282fbec eventfs: Initialize ei->children and ei->list in init_ei()
c1c508e892391 HID: mcp2221: validate report size in mcp2221_raw_event()
85d963499f1fe HID: mcp2221: stop device IO before hid_hw_stop
2409779f3096f HID: sensor: custom: Fix field sysfs group cleanup on failure
4cb3ff31d237a HID: roccat: free buffered reports when destroying device
4daf432c94a42 HID: picolcd: clamp eeprom debugfs read to bytes actually received
6cb7f9fed8f40 smb: client: harden DFS cache against invalid target hints
735abe4932355 smb: client: fix copy-paste error in WSL EA length accounting for $LXDEV
b89d678f9eafc smb: client: fix ALIGN() overflow in symlink_data() error context loop
3ff9462bb7a06 smb: client: clear ce->tgthint in free_tgts()
7f62817fe049b cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
01b0ec8c397be audit: avoid dropping live tree ref on fsnotify rule autoremove
61f085cb8976c ceph: bound xattr value length in __build_xattrs()
eb3e1a1cb1634 ceph: bound num_export_targets array for mds info v2/v3
a294064e0e0f8 ceph: bound copied dentry name length in NFS export get_name
c4addccd05bac ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
19f16f04c2b01 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
6e5c6ce252b1e libceph: reject buckets with mismatched CRUSH ids
94ae5145c5206 libceph: validate OSD extent maps before cursor advance
1ce74d1b7770e NFSD: Prevent lock owner use-after-free during client teardown
caddbeffab1ea nfsd: revoke copy-notify stateids before dropping their reference
70290db6c9802 nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
1db456ffc22e0 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
9caad13b7cfe9 nfsd: initialize copy-notify stateid before publishing it
3be1d8611dae4 nfsd: gate nfs3 setacl by argp->mask
8e4422b05f410 nfsd: gate nfs2 setacl by argp->mask
88bce7e326c36 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
bee826c00ac90 nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
59416992d1f58 nfsd: fix version mismatch loops in nfsd_acl_init_request()
bfeac42d9074e nfsd: fix cpntf publish race in nfs4_init_cp_state
75268f6cfe26b nfsd: check client ownership when cancelling a copy-notify stateid
977e6f006a7a3 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
9e8924bef5b50 nfsd: add filehandle match check to nfsd4_delegreturn()
d823bf9285cdf nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
3ef5e7a01a4d7 nfsd: validate symlink target length in NFSv4 CREATE
322422d66d1a0 nfsd: sample writeback error cursor before async COPY loop
f8914ba102d7e nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
6b13d26cc21b6 nfsd: Reset write verifier when async COPY writeback fails
085cfde7c2186 nfsd: release path refs on follow_down() error
a080bb69d30f1 NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
2ef1313239995 NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
60680ae7243b2 NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
bfd1004ab1237 NFSD: Fix off-by-one in DRC bucket pruning limit
07615c1eb1d00 NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
37a9d25a563f5 ubifs: fix out-of-bounds read in signature length check
da7a80ddc610a of: fix out-of-bounds read in of_alias_scan() stem parser
b313edfbc0c2a nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
e21cccc29b840 media: vicodec: fix out-of-bounds write in FWHT encoder
1b4fdefd788db media: cec: stm32: prevent out-of-bounds write on RX overflow
60c74f42f5abd lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
c5c60260a07e6 HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
8f3365ed2a5db fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
b0a6bfac0c3c3 usb: gadget: f_fs: Prevent deadlock during ep0 read loop
bec7708eb3b52 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
eef3e62f90d86 usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
79dbedf40ad93 usb: gadget: midi2: remove default configfs groups on teardown
95cf1b50ba6b7 usb: gadget: snps_udc_plat: clean up PHY on probe deferral
891a8d11f4d5e usb: gadget: u_audio: Fix use-after-free on sound card disconnect
d82cfb853c5d4 USB: phy: fsl-usb: fix missing static keywords
f09b3f48ff650 usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
c881f5b175fdb staging: greybus: hid: fix SET_REPORT return value
2ac009a65d238 Revert "media: v4l2-dev: fix error handling in __video_register_device()"
bd8881c24a952 rapidio: mport_cdev: fix use-after-free in dma_req_free()
261c958b6acb1 powerpc/powermac: fix OF node refcount
f4ae79b5f0013 device property: fix infinite loop in fwnode_for_each_child_node()
3a8534664426c tracing: Fix use-after-free with same-name named triggers
ceb1707aef582 tracing: Fix crash passing ERR_PTR to kthread_stop()
33ce55b368b64 tracing/user_events: Clear copied tracing state before fork duplication
3eaf78e6571d2 hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
f3ed36a608d8b x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
220011fe95fc7 x86/tdx: Fix off-by-one in port I/O handling
f668affa147a5 tools/compiler: match glibc 2.42 definition of __attribute_const__
8bf21ad365730 mm: memcg: stop reclaim when a limit update is superseded
029c9408049f7 mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
4757542649af5 mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
f93f15541f224 include/linux/list.h: mark list_add and __list_add as __always_inline
bdfda99c57638 timers/itimer: Zero-init old itimerval before copy to userspace
da268a44d773a powerpc/pseries/iommu: switch to Default DMA window during kdump
ebba4d0aeba0e clocksource/drivers/timer-sun4i: Advertise a real minimum delta
7b5771d0bf176 alpha: don't leak hardware-fabricated FP exception bits to user space
e5038d7f36037 alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
184870af0e73f perf/x86/intel/uncore: Fix die ID init and look up bugs
d258cdce50ff3 ALSA: aloop: Fix peer runtime UAF during format-change stop
0e6245b2424d1 ALSA: aloop: Fix racy access at PCM trigger
e150f273cd8ed ipv4: start using dst_dev_rcu()
40acb0537963f net: dst: introduce dst->dev_rcu
49b02a9d11c73 ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
19ccd78a4e7c0 net: dst: add four helpers to annotate data-races around dst->dev
73b7a11814838 Revert "arm64: mm: Don't remap pgtables for allocate vs populate"
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.6.bb | 6 ++--
.../linux/linux-yocto-tiny_6.6.bb | 6 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index e8d1f9da078..8a31bbfd09a 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,13 +14,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "f92c1779022032aac8134ccb9e75365b19f6c596"
-SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a"
+SRCREV_machine ?= "9b87590f4fb1e0d54ae9153f9e4fe84cec61f13e"
+SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.6.156"
+LINUX_VERSION ?= "6.6.157"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index 03889d329ec..3904ba1d1c6 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
# CVE exclusions
include recipes-kernel/linux/cve-exclusion_6.6.inc
-LINUX_VERSION ?= "6.6.156"
+LINUX_VERSION ?= "6.6.157"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "d9da23dffd2dea6dcfa986e0aad77898a7b373da"
-SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a"
+SRCREV_machine ?= "a56c1dbe33dcd7b71df3b2703ceb95692edd9579"
+SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index 2632a4ef2fc..da3c5dd6ea6 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "f05eb652ce405932e2f47a78f721d1c2c5859e80"
-SRCREV_machine:qemuarm64 ?= "2f7ef6e4d70eadf8f8b110cd81cfcafb2bb038fb"
-SRCREV_machine:qemuloongarch64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
-SRCREV_machine:qemumips ?= "1434d63083252688215ad6f5f6af122ead5865ee"
-SRCREV_machine:qemuppc ?= "fc69e9d8f99c5c151415f6ba9f1e0428bb7e8e84"
-SRCREV_machine:qemuriscv64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
-SRCREV_machine:qemuriscv32 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
-SRCREV_machine:qemux86 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
-SRCREV_machine:qemux86-64 ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
-SRCREV_machine:qemumips64 ?= "7969f6574cf5b126fa6eb28f33d0f2bcd8e7da5e"
-SRCREV_machine ?= "64e13e9d84c0eb6c16b39081300b49b9862b64f5"
-SRCREV_meta ?= "be02dc16fd11e7575782a0e13db080d122a8989a"
+SRCREV_machine:qemuarm ?= "f762f9a437240aebfb663b9f08166b6978411ad3"
+SRCREV_machine:qemuarm64 ?= "efde6579b1968f396f4718ad939aeb6859f17012"
+SRCREV_machine:qemuloongarch64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
+SRCREV_machine:qemumips ?= "d7bc8d3db82714ebe46bde3e69f9dcbef7ae6e48"
+SRCREV_machine:qemuppc ?= "b8bafdf6f040163a1fe0eb91c7b419452e3590b4"
+SRCREV_machine:qemuriscv64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
+SRCREV_machine:qemuriscv32 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
+SRCREV_machine:qemux86 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
+SRCREV_machine:qemux86-64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
+SRCREV_machine:qemumips64 ?= "fa48e020815730c4ff228c0e8d42836d68ac4b4b"
+SRCREV_machine ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
+SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "8b73de7da85fde281a385e0b26eda9bffd3ca477"
+SRCREV_machine:class-devupstream ?= "79643295eba17affbd16ca97f3ef04c90266b28c"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.6/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.6.156"
+LINUX_VERSION ?= "6.6.157"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 43/55] linux-yocto/6.6: update to v6.6.159
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (41 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 42/55] linux-yocto/6.6: update to v6.6.157 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 44/55] linux-yocto/6.6: update to v6.6.160 Yoann Congal
` (11 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
cecd39af8a1ab Linux 6.6.159
742f73df544e0 ipv4: free inet_opt and ireq_opt after an RCU grace period
a65f69e0f38ff ipv4: validate checksum_start before completing checksum
33aa3b7f4afbd netfilter: nfnetlink_queue: unbreak SCTP traffic
a91a6aa9253c6 Linux 6.6.158
81e82340170ae net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling
3c83e90204359 crypto: atmel-ecc - avoid stale fallback key after set_secret failure
6989f298103f5 netfilter: nf_tables: don't queue packet path object notifications
f268099fc0e38 netfilter: nf_tables: place base_seq in struct net
7b74a4f71ca50 netfilter: nft_set_rbtree: Remove unused variable nft_net
bd33cb19bcb43 crypto: virtio - bound the akcipher result length
ca84bef594538 crypto: virtio - Drop superfluous [as]kcipher_req pointer
895ab908ade68 crypto: virtio - Drop superfluous [as]kcipher_ctx pointer
ba7b5b5e35407 crypto: virtio - Drop sign/verify operations
9efc6119bfbe1 crypto: virtio - Less function calls in __virtio_crypto_akcipher_do_req() after error detection
b38d7a4bc9c17 vlan: fix skb_under_panic and races when toggling HW VLAN offload
7eca6b809c1d4 vlan: defer real device state propagation to netdev_work
debf9f50140b3 net/packet: defer vmalloc TX_RING free until skbs finish
b4ac2a5ce5a96 gtp: serialize PDP context updates
301f4a3303b21 usb: xhci: bail out of setup if the controller is inaccessible
9e85ecc77ffa0 usb: xhci: simplify handling of Structural Parameters 1 values
608efac1ba6fb usb: xhci: use cached HCSPARAMS1 value
aa709b4f370e0 usb: xhci: implement USB Port Register Set struct
4687b927c6ab5 usb: xhci: add USB Port Register Set struct
c02a85ecd92db usb: xhci: add helper to read PORTSC register
ade5ca589d2f5 usb: xhci: add tracing for PORTSC register writes
1c3f4b15eb185 ALSA: hda: Fix missing pointer check in hda_component_manager_init function
73853208a497a drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
6b38ca1c9dd47 lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
0c5b7a12e1751 lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
b4a3e1bb94091 tools/thermal/tmon: Fix compilation warning for wrong format
cc91c461cf390 nvme-fabrics: use reserved tag for reg read/write command
a99d4f0c43eaa perf test: Change all remaining #!/bin/sh to #!/bin/bash
fb05e973698f4 drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
e2379b2e343e3 drm/amd/display: Validate function returns
336bc3461b1c7 drm/amd/display: Check null pointers before using them
15403445b873a drm/amd/display: Ensure array index tg_inst won't be -1
3218df42ff3b1 drm/amd/display: Add a dc_state NULL check in dc_state_release
9a38ba5561d96 wifi: ath12k: check M3 buffer size as well whey trying to reuse it
7e323cb557053 wifi: ath12k: fix kernel crash during resume
8c78593cf1229 net: tls: fix silent data drop under pipe back-pressure
bc262c6d32b6c cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
5eaa11c500ed0 bpf: Defer work in bpf_timer_cancel_and_free
4b48228eebce2 bpf: Fail verification for sign-extension of packet data/data_end/data_meta
5be32f1ca915c xfs: fix blockgc group quota scanning when usrquota isn't enforced
a40671025e915 smb: client: validate POSIX create context length
e4c49012708c9 smb: client: fix create context out-of-bounds reads
84ae3cfd7d3a6 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
524e0450dd9a3 Bluetooth: mgmt: fix race in read_unconf_index_list()
8c7556c7cd17e Bluetooth: L2CAP: validate frame length before control and FCS access
ff28e6c67143c Bluetooth: ISO: balance the parent hold in hci_bind_bis()
68f0bcc4e16e3 Bluetooth: hci_sock: reject out-of-range OCF values
dca25c204f71b Bluetooth: hci_sock: validate event length before filtering
10f959cb43521 Bluetooth: hci_conn: fix CIS hold ownership on reuse
c5efcbf06d648 RISC-V: KVM: Fix HSM hart status error propagation
2af03b606aada RISC-V: KVM: Synchronize hrtimer callback during teardown
dbf30e661ceb9 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
c0ba61180d153 pinctrl: single: free the IRQ on domain creation failure
de96dc11aee0d scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
144ad477c381e nfc: port100: reject frames whose declared length exceeds the received data
066205553a010 nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
19bcfc2a56d0b nfc: fix use-after-free in nfc_get_local_general_bytes
b89249819a7d6 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
f49da48bd679c netfilter: ip6t_rpfilter: reject routes without inet6_dev
b895bd3267e5a net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
9a7140ea89a09 net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
1d8c85359b507 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
57b55367b6e3a net: atl1c: fix soft lockup on out-of-range tpd_cons read
de41ee24f77b0 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
2f57cef1a17cb net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
632cd7b81cb7b net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
1b08c5c3ac27c net: arp: terminate device name before lookup
6c9f07bf88001 net/sched: reject IDR error pointers when deleting actions
ff384b1bd7228 net/mlx5e: advertise MACsec offload only when supported
288721013605b net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
65e7c4b5366b7 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
f4c21a259b4f3 HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
5a8ad63158165 HID: alps: fix use-after-free on input2 registration failure
ccd32fa3489cb PCI: of_property: Omit bus properties without a subordinate bus
822e8a473391e gpio: tps65219: Fix GPIO input value reads
9571ab7493561 drm/virtio: fix NULL pointer dereference on fence allocation failure
43bfe2b60c149 drm/virtio: fix memory leak of fence event on execbuffer failure
9924c1d64405b drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
74485cdc34306 drm/nouveau: Fix gem reference leak in validate_init()
f09f4a536935b drm/nouveau: fix double-free in nvif_vmm_dtor
ac4f1d28498b9 drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
1971720e6a979 drm/nouveau: fix autosuspend cleanup during teardown
5c857b2e6e755 drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
2c1a643942caa drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
96833fbf28c03 drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
daeac72644124 drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
c53db9cc24521 drm/i915: fix incorrect RCU teardown order
49ba5ed012990 rds: ib: Clear the sg list when mapping an MR fails
1937222c2511a llc: reserve device headroom for allocated frames
25c08be2a5e77 gpio: zynq: fix runtime PM leak on request error path
9d8d6cddcb7c0 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
66bf65fa10932 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
dc92cb972e867 ipv6: do not let ipv6_find_hdr() return an offset past the packet end
e560bdf62b11d fsl/fman: Fix clk reference leak in read_dts_node()
ebf1555ad2821 writeback: report a Tasks-RCU quiescent state per cgwb drain pass
513121e693886 workqueue: Fix NULL current_pwq deref in flush dependency check
c96b4d1628868 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
3bcc1624cc1cd fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
c698f6deabf68 ata: libata-scsi: bound the ATA passthru sense descriptor writes
be1aacff399d5 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
1cd246b214dc9 sctp: discard the rest of the packet on a stale-cookie error
80a9ccfc24d37 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
fc8df272af64f x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
301bdc558a5eb af_unix: Drop all SCM attributes for SOCKMAP.
00e370627f2e1 netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
3c5a6fa3fa004 rculist: add list_splice_rcu() for private lists
d989c14cd70ab mptcp: return sk_wait_data() errors from recvmsg()
a8f50c545ea5f perf/x86/intel: Make @data a mandatory param for intel_guest_get_msrs()
599491e83e459 perf/x86/intel: Don't pointlessly context switch DS_AREA (and PEBS config) if PEBS is unused
ed7ba11ed0859 perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
5bce700da0580 perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
a58593b501b7b autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
ca797491f0ae4 vlan: ensure sufficient headroom in vlan_dev_hard_header()
f623fe69f210d net/sched: sch_teql: fix shadowed err in __teql_resolve()
1f4ac6ef54579 bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
d360b31f1a366 llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
b7d285a28a6dd net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
c691d78c33da5 tipc: Fix a data race on mon->peer_cnt in mon_timeout()
00a59600ae72d net/smc: fix UAF on lgr list traversal in smcr_port_err()
c1b1639fb138d nfp: hold IPsec RX state under the XArray lock
71d45049b0d63 tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
bd172580e624b net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
90464d595eb95 bonding: crypto offload enabled, non-offload slave failover, rekey failed
9e841723ba482 net: xps: reject an out of range traffic class
45a67662bf8ce vxlan: use one headroom snapshot for neighbour replies
da2e0cfbb620b ip_gre: Reject enabling collect metadata through changelink
97bb73b5a4672 net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
075dca2b60dae net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
f1fd173aea9b7 net: bcmgenet: do not skip WoL power up on GENET V1
8055a4c6b9e38 net: bcmgenet: allow return of power up status
b086fb2c4952e net: bcmgenet: move bcmgenet_power_up into resume_noirq
ad0660587da4f net: bcmgenet: initialize u64 stats seq counter for all queues
a61c0324e6187 net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
f187490352414 tg3: use random MAC address when tg3_get_device_address fails
4092f59d1ce47 driver core: Add device probe log helper dev_warn_probe()
7a527c6b27ba9 driver core: Make dev_err_probe() silent for -ENOMEM
65451eb5a4599 driver core: Better advertise dev_err_probe()
edf51b8dea6e9 bpf: Fix BSWAP 32 and 16 on MIPS64
beeae92e70e70 bpf: Fix immediate JMP JEQ/JNE on MIPS32
7d20eab09eb43 vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
b2da5ed3d8c75 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
f0e8dba8c2249 veth: manage XDP program pointers during channel resize
290c4a021dd59 net/sched: act_gate: budget the per-entry list in get_fill_size
ea82b75767932 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
75bfd9ef4da2f nfc: llcp: fix slab-out-of-bounds reads when logging service names
6fad2c34d451d nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
6295a085cb91d nfc: llcp: fix -ENOMEM on connect with zero-length service name
9fa21b0f78adb nfc: st21nfca: validate ISO15693 inventory length
e43ec0191c163 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
f3083512a5bb5 nfc: virtual_ncidev: Add missing ioctl compat handler
9ba32ddb1cf91 selftests/nci: Fix out-of-bounds store on thread join
3b52335611593 selftests: nci: Fix uninitialized family ID on missing attribute
41256821762a7 nfc: llcp: Fix race condition in accept_queue lifecycle
f2550d8a37878 selftests: nci: Correct pthread_create return value check
c1e9ed52a6697 nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
d4008c3499dba nfc: st21nfca: validate received frame size
a4e56f57dd04d nfc: nfcmrvl: validate helper command length before pull
e57f041943615 bpf: Reject dev-bound-only programs on other devices
ad5b7fd1434a2 net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
1d1d9e4f9541e net: stmmac: selftests: Capture all packets for vlan checks
27bd3b0ce2001 net: stmmac: selftests: Check the dev->features for S-TAG offload testing
ddcc8b626b08d net: stmmac: selftests: Support running selftests on DSA conduits
9d3d39da05447 sctp: hold asoc or transport before mod_timer() in timer handlers
66ae85e15f1c6 net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
6020d85204742 net/mlx5: Bridge, don't fail switchdev events of sibling eswitch ports
909f761868fda bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
ea4dc96c902cc bpf: Fix bpf_sock context code generation
1b923538598be bpf: Fix bounds check for skb-backed dynptrs
062849d19dd31 genetlink: report the real command id for dump-only ops in policy dumps
91be8331501f1 net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
33f706884821d s390/debug: Fix NULL pointer dereference in debug_info_copy()
34cf1535a78b9 s390/debug: Do not register views for failed static debug areas
e766321288b50 tg3: clean up PHYLIB resources on probe failure
e1f5b74edccf4 net: usb: sr9700: include receive overhead in the length check
c25587fa26761 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
035f9b1809861 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
77a43e00c5748 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
a9bb8f8fd5694 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
88c60c06a2a52 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
77dee8e9106d6 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
e2edd2d78d2cf drm/virtio: fix object leak when drm_gem_handle_create() fails
e8f9979286f70 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
21e206dd88b3d net: usb: catc: bound the RX packet length in catc_rx_done()
83b1a7f9e7188 sctp: avoid livelock while updating retransmit path
2731601ad277a ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
245bea0c7ab27 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
d5d57501f543f net: mediatek: mtk_eth_sock: allocate dummy net_device dynamically
34c6214d0df49 net: create a dummy net_device allocator
88530b58fe0b3 net: core: Fix documentation
9767e57504739 net: Do not return value from init_dummy_netdev()
1d664be4ca49d net: gue: reject invalid REMCSUM offsets
d512c484bd93a net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
999a6c71a6aa0 drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
a867abcfa85ab drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
15f52cbc35d4c ocfs2: make ocfs2_calc_xattr_init() return void
fddc90d4af455 arm64: io: Reject non-user protection in ioremap_prot()
5128b8b0bdb24 netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
2c23d95517547 ipvs: revalidate ihl before icmp_send
d52caee4f0fcd netfilter: nft_synproxy: use the family-aware checksum helper
d559e06a5ab7c netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
caa82500e231e netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
e20701843032c netfilter: flowtable: publish HW_DEAD after worker is done
e87687b967dcd libbpf: Reject truncated ldimm64 CO-RE relocations
a0b79cdfcf34b bpf: Restrict CO-RE poisoning to relocatable instructions
0fac292d93fdb net/sched: cls_u32: fix manual hash table handle IDR aliasing
c251ed48bd906 bpf: Skip unsettled links in link iterator
123f90f394ca4 xsk: Use a 32-bit compare in xsk_map_gen_lookup
937cbeca0554a s390/cio: Guard PMCW field accesses with dnv check
e364f5c677e81 s390/cio: Check pmcw.dnv before pmcw.ena in I/O entry points
0f0e459ccf390 s390/cio: Fix cio_update_schib() to not cache invalid schib
396d4b0be238a s390/pci/docs: Fix sriov_numvfs attribute name
5cf766c9cca44 docs: s390/pci: Improve and update PCI documentation
77d5f05ef79be scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
f8174bd3822c5 selftests: cgroup: give the O_TMPFILE open in get_temp_fd() a mode
8fd91aa0cf78a cgroup: selftests: Move memcontrol specific helpers out of common cgroup_util.c
718a8ffa180d4 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
5b467087928c5 Bluetooth: SMP: reject Security Request over BR/EDR
c68e0068a236f squashfs: Add dictionary size range check to prevent shift-out-of-bounds
144d60ed22735 KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0
62cdbb3e096f9 KVM: arm64: vgic-its: Skip unreachable devices instead of failing the save
2df1bc50a6633 KVM: arm64: vgic-its: Add stronger type-checking to the ITS entry sizes
5ff24aa7af0bc HID: amd_sfh: Validate PCI BAR size before mapping
a78414ede1dc6 pinctrl: meson: Fix typo in s4 group name
dc98def81e3c6 bpf, sockmap: Fix self-redirect copied_seq double-counting
a8a9becbac93a bpf: Fix out-of-bounds read of rtt_min in sock_ops
77a3b52b4455e bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
911818b449196 HID: elecom: fix bus type for M-XGL20DLBK
23da88d1597ee tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
5b4eb82475ae1 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
934e9ba9f8d05 bpf: Fix divide-by-zero in btf_struct_walk()
f831c7bf53e91 selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc
df0072be6fc37 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
7e748e6e007b5 bpf: Fix bpf_skb_change_tail wrt csum partial skbs
1572c4a24120f remoteproc: qcom_q6v5_adsp: Fix iommu_unmap() usage
670fb8b0dbe0f netfilter: nf_tables: Simplify chain netdev notifier
becc1f5adc77c netfilter: nf_tables: Tolerate chains with no remaining hooks
0c415aaaffbf8 apparmor: Fix 8-byte alignment for initial dfa blob streams
662e391e85af5 apparmor: Fix memory leak in unpack_profile()
7e3717466403b apparmor: free the allocated pdb objects
0b895b8faca11 erofs: fix large folio race in erofs_fscache_req_complete
17309187f12d7 spi: zynqmp-gqspi: Use devm_spi_alloc_host()
1ba2ffa759c5b selftests/landlock: Add layout1.refer_mount_root
8706e18922fb9 spi: spi-zynqmp-gqspi: stop the controller on shutdown
57230a74cf07d ksmbd: fix partial normalized name responses
c3343cd7ec870 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
ac51321d3b239 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
5b24c8f815a44 ipv6: mcast: Don't hold RTNL for MCAST_ socket options.
776668d3424c3 ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP.
7157a0865debe ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP.
8355220e6166a ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec().
d91b9a3b2b38e smb: client: fix missing iov bounds check in parse_posix_sids()
6f5f4785b98c9 smb: client: fix missing lower-bound check on DFS referral string offsets
e78fc1d240b27 smb: client: fix server->total_read for compound encrypted PDUs
74995ee8305a7 smb: client: fix potential OOB read in smb3_enum_snapshots()
491e33144dee8 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
e3344bb0ff5ec smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
53d82794f890a smb: client: reject short Next offsets in parse_server_interfaces()
b5f924ffbfa97 smb: client: fix rlist race and missing initialization
180380272f116 smb: client: cancel reconnect work in clean_demultiplex_info()
c46c47aef4982 drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
48e46ea9b2c6a drm/msm/adreno: fix autosuspend cleanup during teardown
5f5e565410b49 drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
0d1700394e9f5 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
16abf3f5d727a wifi: mwifiex: validate action frame fixed fields
c4943323fda22 wifi: mwifiex: validate scan response extents
2402c9e2644b7 wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
bc83c04be042f wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
42f4b03971f9d wifi: p54: validate curve data length in the calibration curve converters
612ed9224eae7 wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
491df93b10d76 wifi: wilc1000: fix out-of-bounds read in P2P public action frames
05b5e297bbf46 wifi: wlcore: release runtime PM ref on regdomain config failure
00bea35892556 wifi: rsi: fix heap OOB write on key removal
41b1a4d545ec3 wifi: libertas_tf: fix UAF in lbtf_free_adapter()
85d847ff71fe7 wifi: iwlegacy: fix broadcast stations deallocation
856dabd5f2617 wifi: brcmsmac: fix UAF in brcms_free_timer()
ef3c2aef001a6 watchdog: starfive-wdt: Fix runtime PM leak in starfive_wdt_pm_start()
135cf929db55d watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
757c721545b9f watchdog: rtd119x: Avoid division by zero
c52ba8375ff9c watchdog: msc313e: Propagate error code in resume()
1c4aabc88fee1 watchdog: msc313e: Fix premature reset during timeout update
08c58739c9984 watchdog: digicolor: Avoid division by zero
c30b419c7e6fb watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
b81989ecf97d1 hwmon: (w83793) release probe data through kref
f6e2ab72f32d1 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
3040bfd935599 hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
1209d2330bab3 hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
66368f682a53f hwmon: (pmbus/core) increase number of phases and add new mask
b6b2a638aa36c hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
c5e573bb095d5 Input: zero ff_effect before compat copy in input_ff_effect_from_user
e2b6703465c1c Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
d06f72350d5d5 Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
42c7afc0e5f5b Input: soc_button_array - check btns_desc->package.count
fd9bc6c1e5c0d Input: soc_button_array - fix MS Surface Pro 11 probe failure
50dd585bee766 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
84f863866adb0 Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
af5f7130cbf39 Input: evdev - zero absinfo before partial copy in EVIOCSABS
b172c69e67bc7 Input: cyttsp5 - clamp the HID report size before memcpy
e08c459870a65 Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
b266cbbad1a7a Input: adp5588-keys - cache GPIO state before registering the gpiochip
7e1c98cb7249e mmc: sdhci_am654: Reset command and data lines on failed tuning
da4929ee78ee7 mmc: spi: reset bytes_xfered before retrying CRC failures
4adbd609686d5 mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
72f4c2b7a4842 mmc: sdio_uart: fix xmit_fifo leak when the port table is full
b84d29f2541c8 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
cd19ae28eb545 mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
ae10838a7cdf0 mmc: mxcmmc: cancel data work and watchdog on remove
c50d6515bffb1 mmc: hsq: Fix use-after-free in retry work
ee47e50011c20 mmc: core: Fix OF node reference leak on card add failure
0bf3d168a2cc2 mmc: core: Cancel SDIO IRQ work before freeing host
e77461af13eab selinux: always fill AVC decision in avc_has_perm_noaudit()
4d50ebe5a2772 selinux: recheck intermediate backing files on mprotect()
caa1b913d90d5 selinux: preserve user SID across nested backing files
535530bb2ea52 IB/hfi1: Fix the PIO_CRED credit-return mmap
1b352c95a49a3 IB/hfi1: Resolve the credit-return buffer through the send context's node
cf20d7476754c IB/mlx4: Fix use-after-free on pkey sysfs registration failure
bf0252e908448 i2c: imx: disable autosuspend on remove
ad793059a419f i2c: imx: release DMA channels on probe error
2f5e42edbd232 i2c: atr: fix dangling adapter pointer on add failure
3cb8ae257292f i2c: at91: release DMA channels on remove and probe error
3fd487c69ad31 KEYS: trusted: Fix tpm2_load_cmd() boundary check
6ecc3fef3db53 keys: translate request_key_auth pid for the reading procfs instance
ce6009f753485 mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
19c3da6621a25 memstick: ms_block: destroy io_queue workqueue on removal
937108dc0258d xfrm: serialize state GC with device state flush
39491a1ae9305 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
6106fb1246ead net/packet: avoid truncating TPACKET_V3 private size
23cd30498891d net/packet: clear RX owner on VNET header error
d8e2f1f0263b7 net/sched: hhf: cap hh_flows_limit at change time
dd136f1fdd105 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
19b5e8dd884a5 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
fba45070e25ab net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
a58024835c704 net: lan743x: fix RX checksum use-after-free
60459c670329d ipv6: xfrm: use full sockets in local error paths
89f5414660724 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
aacd1c4cbe06a dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
b4025915131c6 dmaengine: sun6i: fix non-atomic read of DMA position registers
560ed4373c06a Bluetooth: hci_sync: Serialize local codec list cleanup
a6da782fefae6 Bluetooth: hci_codec: validate vendor codec count length
3a640fee27ce4 Bluetooth: eir: validate service data length before reading UUID
063d409c54703 Bluetooth: btusb: fix NXP IW610 composite device handling
df4920b133343 arm64: percpu: Fix this_cpu_and() mask generation
9397a97eba3d5 arm64: percpu: Fix this_cpu_write() casting
0b2144175502d arm64: dts: renesas: r8a779f0: Set UFS lane count
909e92423db72 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
a8b826076a41e kselftest/arm64: Fix size of thread_data values for pthread_join()
8f282d12550e3 HID: logitech-hidpp: fix race condition when accessing stale stack pointer
b2b84e73e0386 net: xfrm: reject unrepresentable espintcp transport headers
579d87ec1e1e8 openvswitch: avoid reallocating confirmed conntrack labels
2fbac8a56004b RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
ae805d204cf1f RDMA/ucma: Serialize join and leave on copy_to_user failure
1c8448db5cf35 tcp: exclude old ACKs from tcp fast path
b5c9f2951d330 rds: ib: use rds_conn_drop() on protocol version mismatch
6f1977cea3e85 exec: Cleanup POSIX timers right after de_thread()
0338489960dda cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
a5a8b4737f68b ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
6507055733a9d ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
830012feadc22 ALSA: virtio: reset device before deleting virtqueues
5658739b54f5e Input: xpad - fix PDP Marvel Xbox 360 controller
1fb92056c8fcc Input: xpad - add support for Azeron devices
2e74f1f22a0e3 Input: xpad - add support for Victrix Pro BFG Controller
93e3eb481be0f wifi: rtw88: Fix the random "error beacon valid" messages for USB
f689260c48fb4 wifi: rtw88: TX QOS Null data the same way as Null data
fa252fe7dc329 net: cpsw: Execute ndo_set_rx_mode callback in a work queue
74852715757d9 net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue
7e22e5bcbfacf mm/huge_memory: use folio's memcg inside __folio_split()
2605eb9ba3bbd btrfs: abort transaction on failure to update inode for hole punching and reflinking
71d45a04ea99c btrfs: remove redundant root argument from btrfs_update_inode()
a66b626d3b4b7 btrfs: simplify error check condition at btrfs_dirty_inode()
b7c7f07a40037 drm/amdgpu: check ras and obj before dereference
6569fd85b0ef9 net: mvpp2: prevent buffer overflow in page_pool allocation
afaddc3fbf2ae net: macb: fix ordering around PTP timestamp read
472493d1d3334 net: ethernet: cortina: Ack RX overrun interrupt correctly
17b2a1eb97fdb net: lock the socket in sock_gettstamp()
c10101baba9d3 net: netsec: fix device_node reference leak on phy_np
aeec38e773c66 ASoC: hdmi-codec: Report a change when the channel status moves
9cc2fae796b79 ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
d6a1779129d93 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
c41088b2765af KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
e37fba1ba6938 KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
d54a044136b12 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
86f1151aa6ac3 drop_monitor: synchronize tracepoint unregistration on error path
ffc448eb54f5b pppoatm: ensure a writable skb header and linear data
c741977e413f5 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
3b00027c71345 Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
ad13c739dedcc Bluetooth: btmtk: fix wrong status for short WMT FUNC_CTRL events
ea8a262662be6 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
4a33886057e6d dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
a444c0115665a ksmbd: keep compound responses on query info errors
2107d60053c88 ksmbd: fix partial file information responses
39685131e5bda ksmbd: return buffer overflow for partial filesystem info
9a4f49bf8d2da tcp: do not let tcp_rmem be set below 4096
b727e3d58cb90 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
6b431b6321985 net: bridge: mst: move switchdev call outside rcu
50b1adbb39fc0 wifi: brcmfmac: fix lost 802.1x TX completion wakeup
822903ed99197 net: fddi: skfp: fix NULL deref when setting the MAC address while down
83aa83f81a8fe ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
5130afa025c95 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
35cbe34c3704c drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL
a7cd161e4ba2b btrfs: tree-checker: print dev extent offset in error message
0a52ba6d3b268 ALSA: hda: trace PCM open only after assigning a stream
b6beee927e7f4 drm/vc4: Use managed KMS polling to fix UAF on unbind
f1a232fdc1012 drm/ast: Automatically clean up poll helper
e8304e25c6dab wifi: virt_wifi: don't transfer operstate before register
246de677552fe ALSA: 6fire: fix OOB write from device-reported iso length
8b8559aeaba2e ALSA: usb: 6fire: Avoid embedded URBs
910bde5a7f188 ALSA: 6fire: Clean ups with guard()
aff058605007c Input: trackpoint - fix the inertia attribute name in the ABI document
686c7a6af1eea ALSA: pcm: set timer->private_data before registering the PCM timer
d54a90f2b9376 phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting
5d6c7370d515e phy: mediatek: phy-mtk-hdmi-mt8195: Fix PLL calc divisor overflow
c83d6b0a65f7b ALSA: bcd2000: Fix race between rawmidi and disconnect
3d5f7e77b2e1b keys: fix lost wakeup when reaping a dead key type
780716e2e0191 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
136cb27bf8f5b perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
a43cd2b67b91e netfilter: flowtable: hold reference on ct until flow is released
e4982c489ee35 netfilter: nft_nat: fully initialise new_addr in netmap setup
eb4d7a9469704 RDMA/siw: Bound fragmented header copies by the remaining length
c767e2812cac8 RDMA/efa: Keep EQ resources alive while IRQ is registered
00f7df59543cc RDMA/efa: Keep admin queues alive while IRQ is registered
87793933dc54f dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
209cf79a4f8a6 dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
aaf4ae1730d40 scsi: qla2xxx: Fix the ql2xfc2target parameter description
7343f2575868f mm: memblock: show all region flags in debugfs
420fcc2fdeae6 wifi: mac80211: set up the TX info early to fix failure paths
7e32c6ed25548 wifi: mac80211: rework ack_frame_id handling a bit
b51f5a310bd68 wifi: mac80211: mesh: release the channel if start fails
be7bfdea1ec9b wifi: mac80211: add HE 6 GHz capability in the scan elems len
f17a3fb26beca wifi: mac80211: don't access the TSF of a down interface
e4bb995f61e23 wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
ed8d5f5b74d0f wifi: mac80211: don't allow link changes when iface is down
d0afa5395c46d wifi: mac80211: require a peer station for TDLS setup confirm
7775759e3cb35 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
c4e4fe330294e wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
20a56e96a6f7b wifi: mac80211: unlist vifs when their netdev is unregistered
06f1c819700db wifi: mac80211: suppress chanctx warning for debugfs reset
790221efbfece wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
65fdb973bd905 wifi: cfg80211: don't filter by BSS type when removing stale entries
73365b81630b5 wifi: cfg80211: only group hidden BSSes with beacon entries
8577a5ec4f7e0 dmaengine: wait for RCU readers before releasing dma_device
07eb075b60d56 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
7c3f4ce651d43 dmaengine: Fix device kref underflow in dma_chan_put()
cee7e641245c3 dma-coherent: report a failed reserved memory assignment
c9cee0989b55d dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
dd579fd27593d MIPS: Octeon: apply USB FDT fixups also when USB is modular
c58a21667bd5e soundwire: cadence_master: wait and cancel cdns->work before clock stop
12c0abd4d1c1b wifi: cfg80211: check IP header size in cfg80211_classify8021d()
326f7d34bd7e6 IB/IPoIB: Avoid restoring OPER_UP after multicast flush
46aa75291056b wifi: libipw: reject too-short association responses
14ae269c13060 wifi: libipw: reject too-short beacon and probe responses
2761b21cb896b wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
36727a702cf8e wifi: virt_wifi: free skb when disconnected
3eff16074d061 dmaengine: sprd: Fix runtime PM reference leak in probe
6f8020fe7465f RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
aacfef2480876 RDMA/irdma: Enforce local fence for IB_WR_REG_MR
752b30e9d3390 RDMA/mad: Fix receive buffer leak when PKey enforcement fails
505b242d93516 IB/isert: wait for deferred control PDU completions before releasing the connection
9d145a2d8d6f8 IB/iser: reject a remote invalidation of an unregistered direction
45c60ffc79771 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
1c4cc9f0d8f45 net: convert dev->reg_state to u8
c79a789aa1518 RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
56b7a9d89c679 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
f17865332cc4c firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
b7d2118660545 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
08f12745cb729 RDMA/rxe: validate access flags before swapping the MR's PD
030306bbb9273 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
70d509b6bdf74 RDMA/siw: Cleanup siw_accept
0b6ac53b6bd5f RDMA/siw: Introduce siw_cep_set_free_and_put
5219c5652b2f3 ARM: socfpga: select the PL310 erratum 753970 workaround
69a768c12398c esp: downgrade zerocopy managed frags before mutating skb frags
0cda8273265d3 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
2b63341e2ebc9 xfrm: fix compat ALLOCSPI request use-after-free
60610a5dab6ed xfrm: avoid RCU warnings around the per-netns netlink socket
f1fde49cabc90 ipv6: Honor oif when choosing nexthop for locally generated traffic
8a13003b50b97 ipv6: Select best matching nexthop object in fib6_table_lookup()
4bc97d3bf5d72 media: video-i2c: fix buffer queue ordering
04317f3fb8be2 sunvdc: fix -EIO issue due to lack of retries
9a622ea3662c8 selftests/landlock: Add tests for whiteout object creation
b6e45216aecc8 Revert "alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally"
f5d1ea9bb08d9 Revert "alpha: don't leak hardware-fabricated FP exception bits to user space"
c337c14afcf7e selftests/landlock: Add disconnected leafs and branch test suites
b15ec9fef1b16 selftests/landlock: Add tests for access through disconnected paths
82e198df9c252 Revert "hwmon: (emc1403) Rely on subsystem locking"
e08063fb0d02f Revert "hwmon: (emc1403) Drop hysteresis for low limit temperature"
0a926b5df8efd mptcp: close race between scheduler and state change
1962841387087 mptcp: avoid unneeded actions on subflow reset
ddbf9f03c1cc7 mptcp: fix bad accounting in __mptcp_subflow_push_pending()
cf6e04377bdde Bluetooth: btintel: Fix compiler warning for multi_v7_defconfig config
9107e43ba1e03 workqueue: Update documentation as per system_percpu_wq naming
1100e075a0e09 netfilter: nft_set_pipapo_avx2: add missing vzeroupper
2c8fa22997892 crypto: sun8i-ce - Remove crypto_rng interface
a41e4ba94ad45 crypto: sun8i-ss - Remove crypto_rng interface
99f4d3120b244 fou: Fix use-after-free in fou_create()
542c1dd41e1b0 net: appletalk: fix NULL pointer dereference in aarp_send_ddp()
df077253f6405 i2c: smbus: reject oversized block transfers in the common path
938e8d6cee8d3 ALSA: us122l: Prevent write upgrades for read mappings
05d47f540d85c net: usb: pegasus: don't rely on id table pointer arithmetic
be5996349328b media: as102: do not rely on id table address comparison
0bbcbe9f7cfce usb: serial: spcp8x5: don't store usb_device_id
367af2b4d5168 usb: usbtmc: don't store usb_device_id
8cb99d4a71593 wifi: ath9k_htc: don't store usb_device_id
5086f5639197f usb: xusbatm: don't rely on id table pointer arithmetic
8f4422c14d6a2 perf evsel: Add per-thread warning for EOPNOTSUPP open failues
44441aa9630fa Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems"
a3ca496b63fb9 Revert "selftests/mm: report unique test names for each cow test"
289dfa824fb24 Revert "selftests/mm: skip COW tmpfile cases when fallocate() is unsupported"
ad1be9fe255b4 Revert "nvme: apple: Add Apple A11 support"
187187eea3441 Revert "nvme-apple: Drop the PRP null check chicken bit"
eb51cbf1b091c Revert "nvme-apple: Prevent shared tags across queues on Apple A11"
b66ef13b72f4f Revert "nvme-apple: Reset q->sq_tail during queue init"
f91df9f3ed6ca Revert "arm64: dts: qcom: sc8180x: Fix the PCIe iommu-map entries"
bddd4544e80b2 Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries"
492c1a89a5c94 Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries"
a0441be048ddd Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries"
654a2e749883b Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries"
91d04c96ef14b Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries"
6805046d2db02 Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries"
c2bf1299aeff6 xfs: bail out on bitmap errors in xrep_agfl_fill
2cc0af2204070 xfs: count escaped corruption errors in scrub stats
201995b1e9839 xfs: signal inode btree xref error if get_rec returns an error
6e55aac5a1008 xfs: snapshot old AGFL before rewriting it
e0873cce0e132 xfs: snapshot scrub stats when rendering them
d5cea6766ae18 smb: client: fix heap overflow in DACL owner/group rewrite
e9c5bcc88b833 smb: client: avoid leaking refcount when cifs_sb_tlink() fails
de2a6bcff2659 smb: client: avoid leaking refcount in cifs_queue_oplock_break()
f73341e1ef134 smb: client: fix file type corruption in wsl_to_fattr()
0f723c20d2ced smb: client: fix file type corruption in cifs_reparse_point_to_fattr()
ff411fcbfc55e smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
3c9acc9835c30 smb: client: pin DFS superblock in iterator callback
17c93bcd17755 smb: client: reject userspace cifs.idmap descriptions
f00c31be52f5c selftests: mptcp: fix an UAF in mptcp_connect.c
360d99258a640 mptcp: syncookies: remember the request backup flag
a2431bea521ef mptcp: subflow: no need to copy thmac during ulp_clone
654381b0b176e mptcp: options: handle MPC data + csum reqd + no csum
c3eb07e78e628 bnxt_en: Propagate RX ring init failures in bnxt_init_nic()
cfec9e7f15a56 bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()
aae9a450af63e bnxt_en: Only restore LRO if the device supports TPA
1afaf85c4990f media: v4l2-ctrls: validate AV1 tile counts
724915535558b media: v4l2-ctrls: validate HEVC tile counts
95ee48eb17c91 media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity
8659e5fc21a82 media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer
279fb47254f37 media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
f19acf00818a9 media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity
2887a98c03d97 media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity
98018ea5a682a media: hevc: add bounded tile-count helpers
137c1b88507a4 hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
e9fc7d53b2eb3 hwmon: (gpio-fan) Fix use-after-free in alarm work
716beceaf70c1 hwmon: (applesmc) fix key backlight workqueue leak on register failure
991c875310254 s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm
b3f8200ec5285 s390/qeth: allow bridgeport queries despite OS_MISMATCH
5f33ae947f52f KVM: PPC: Book3S HV: Set irqfd->producer only on success
4826fd8373f68 mac802154: fix use-after-free of sdata via queued RX frames
652d9caa5ac92 ipvs: reject invalid states in connection template sync records
3080f9e653d8c ipv4: fib: bound automatic table ID allocation
e3b4681197aa0 ieee802154: hwsim: serialize pib updates to fix double-free
543994fa03c36 ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink
ff83367cda8ee inet: frags: invalidate queues before flushing them
de5a0eda59fe4 fbdev: vfb: defer cleanup until the last reference
b534dca2db93c scripts/sorttable: Mark long_size as __maybe_unused
f464fde4fd880 vdpa: solidrun: Free IRQs after request failure
123acfd63d767 vdpa: ifcvf: Put device on unsupported feature error
b6204011c79eb netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
90166834b7dc6 netfilter: nf_log: unregister loggers before per-net teardown
76678217cdabc net: openvswitch: fix use-after-free of the flow table mask array
0b3425fd0ecd5 net: mpls: clear inner_protocol when the last label is popped
f7d76b84b9206 net: mana: Reserve extra CQ slot for the fence completion CQE
84ba968d7b35c net: hso: fix TIOCMIWAIT race
9e28471d22a49 ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
362c42720259f drm/i915: Fix memory leak in query_perf_config_list()
506cfed91e50c drm/drm_exec: fix up contended obj when num_objects is 0
3feb4020bfb7c exec: do_close_on_exec() before taking exec_update_lock
b22193eea2ce3 cpufreq: initialize policy rwsem before sysfs publication
06f273d29e5e0 cpufreq: zero-initialize policy cpumask before sysfs publication
ba96047bba4a6 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
45021eb562114 ASoC: sti: initialize IRQ lock before requesting IRQ
1467e3989c6ed ASoC: sprd: validate compress buffer sizes against fixed allocations
fe05eeed27128 tracing: Keep the entry count when the histogram stats allocation fails
01966c9569230 tracing: Let histogram values keep the percent and graph modifiers
3d42fed18b2c5 tracing: Free histogram the field rejected for a bad modifier
b513a4c60a7aa tracing: Free histogram var refs regardless of how often they are referenced
4924328d6991f tracing: Free histogram the var ref when its initialization fails
a3d9b8b7c8f36 tracing/user_events: Don't destroy fields when event removal fails
757aa9f548c18 tick/broadcast: Plug clockevents replacement race
7cd398799eeb6 tunnels: Drop stale dst when building an ICMP error for PMTUD
58c0c414b2b8d ufs: validate cylinder group metadata before caching it
cd21f1ff74b1c ufs: create the root dentry after loading cylinder metadata
c9e4a2c11ff61 watchdog: sunxi_wdt: preserve boot-enabled watchdog
c42eadbcf68ca dm/amdgpu: fix malformed link_settings debugfs output
d170cfbe38c88 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
3570468cc34e7 ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
98da3379cdee3 tracing: Fix memory corruption from the histogram stacktrace modifier
14fdaba201fdf ipv6: fix fib6 walker UAF on seq stop
b5dec6dfb593d x86/mm: Fix user-space data loss with MADV_FREE and THP
b0c201a596816 crypto: x86/aria - add missing vzeroupper in AVX-512 code
3dee28df79cb7 crypto: x86/aria - add missing vzeroupper in AVX2 code
460fab22b6513 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
e52bf7c4f2b2e powerpc/ps3: Fix repository.c build failure
fd636a87161de ksmbd: prevent out-of-bounds reads in share config responses
9c777f8e0cb04 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
b0de6463667e9 sunvdc: unmap LDC cookies when the descriptor send fails
4cd165b5f3eae openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
348492de88bc6 net/rds: fix tcp stream corruption with large pages
5c353c5a76e30 octeontx2-af: fix PF/CGX debugfs PCI bus lookup
c622bbc212207 net: hinic: fix mailbox segment buffer overflow
5aab3e8d71644 net: sun4i-emac: fix missing of_node_put() for phy_node
96c2fc5daf983 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
2cad4a521942d net/sched: cls_route: Fix in-place replace
3d4c403aa780b net/sched: cls_route: make netlink errors meaningful
cec2052fcecc2 net/sched: cls_route: Reject handle aliasing
41e94079200aa net/sched: cls_route: free emptied bucket on filter move
7fd4a45ee721d perf/x86/intel: Correct pt_regs->flags update for PEBS path
82e79fdbf68ca perf/x86/intel/ds: Factor out PEBS group processing code to functions
e2e2ca292449e perf/x86/intel/ds: Remove redundant assignments to sample.period
421bc24582a36 perf/x86/intel/ds: Clarify adaptive PEBS processing
85382012bbc33 perf/core: Check sample_type in perf_sample_save_callchain
b799264c7b1f7 selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
79fb5bcc50996 net: stmmac: initialize ptp_lock at probe time
7953946f68262 ppp_synctty: ensure a writeable skb header
16c5c8ea50179 octeontx2-pf: reset HTB scheduler topology before freeing queues
3b90136e3df4f hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
4a641ec4a73a6 hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
ce3479e4a647b net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down
01a3ec43ad635 net/micrel: Fix typos in micrel driver code comments
4afef977f36da watchdog: msc313e: Sync timeout value if WDT was running at boot
079c8c2891d35 watchdog: msc313e: Fix undefined behavior
aea1af21e3028 watchdog: msc313e: Fix spurious reset on suspend
b4f3a54fd1949 watchdog: msc313e: Enable clock before accessing hardware registers
a1dd0817776ea watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
660571b082331 watchdog: msc313e: Avoid division by zero
0a1c1f26c68b1 watchdog: fix hrtimer start when pretimeout is zero
c1de1e7b51ab2 net: macb: destroy the phylink instance on the probe error path
5242050195a71 Bluetooth: btusb: Fix UAF of btusb_data by rx_work
c075a91fe5762 ice: add missing xa_destroy for sched_node_ids
e56a339e3de5e ALSA: hda: Report a change when only the channel status bytes move
621a4bb3ec3c2 ALSA: hda/common: Use guard() for mutex locks
934b404b6063d ALSA: hda/common: Use cleanup macros for PM controls
3fe9102ae0a82 ALSA: hda: Introduce auto cleanup macros for PM
4bc6df61a100a drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
f2de9df262c47 net: ethernet: cortina: Count RX descriptors for freeq refill
742f06928960c net: ethernet: cortina: Count RX drops once per frame
dd792f4154b69 net: ethernet: cortina: No mapping is a dropped rx
e858b9b1ea3cb net: ethernet: cortina: Count dropped frames as NAPI work
d2541cfbd41cd net: ethernet: cortina: Finish RX updates before NAPI completion
4ca84049c6428 net: ethernet: cortina: Fix budget accounting
565be2ffa33fe net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
1dd562f301901 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
550aa32d46f2a ipv6: lockless IPV6_MTU implementation
20c41165e8efd ipv6: lockless IPV6_MULTICAST_HOPS implementation
c79c67de42d6e ipv6: lockless IPV6_MULTICAST_LOOP implementation
e6c6b0059d624 ipv6: lockless IPV6_UNICAST_HOPS implementation
81073bca2062c virtio_input: stop callbacks before unregistering input device
16c90260ae7ae virtio_input: reset device if input_register_device() fails
fa2ec3f48a679 virtio-pci: return IRQ_HANDLED after non-zero ISR
1b803d382cde6 vdpa_sim_net: check TX pull result before RX copy
000c6300776ce vdpa_sim_blk: reject out-of-range sector starts
59fc7c1c6b4d3 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
4875c65ca5379 vhost/vdpa: reject VRING_NUM larger than device max
bd94e2ba56d02 vhost-vdpa: clean iotlb map during reset for older userspace
b46594205234a vdpa: introduce .compat_reset operation callback
dc74887a56e58 vhost-vdpa: introduce IOTLB_PERSIST backend feature bit
fde77a9a589f3 vdpa: introduce .reset_map operation callback
c147d62316ce0 vhost-vdpa: introduce descriptor group backend feature
d76182012a5df vdpa: introduce dedicated descriptor group for virtqueue
2e40c69b9c344 virtio_console: do not free control-out buffers on remove
74bdd312e78d0 ASoC: mt6351: Publish the OF module alias
0f7dcaaff3b24 netfilter: ip6_tables: set F_PROTO when proto value is nonzero
3161186a2ff81 netfilter: nfnetlink_log: cope with concurrent instance destruction
79d93d8b49f05 ASoC: Intel: SST: Publish the PCI module aliases
ebae165ad8352 ASoC: bcm: bcm63xx: Publish the OF module aliases
671037b282eb7 ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
2ff38b3552af5 bpf: Reject non-scalar bpf_loop iteration counts
054ad8e66025e net: macb: fix NULL pointer dereference on unbind with fixed-link
2efc0d08fda24 net: macb: rename bp->sgmii_phy field to bp->phy
94b12a42cf8e8 workqueue: Introduce from_work() helper for cleaner callback declarations
226d2702e74a5 net/sched: ets: clamp quantum in parse and fallback paths
b464affe9f9df net/sched: drr: clamp quantum in change class
3685934a0620f net/sched: pie: clamp psched_mtu in pie_drop_early
6570f326a6a96 net/sched: hhf: clamp quantum in change and init paths
e4192bcf83aaa net/sched: sfq: clamp quantum in change path
215df1e953ae7 net/sched: fq_pie: clamp quantum in change path
439a3dc17964e net_sched: sch_fq_pie: implement lockless fq_pie_dump()
5a2b87dfceccf net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
a5833fdf53350 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
8267e46d14e84 net/mlx5e: Fix use-after-free race in sample_restore_put()
1886540daeaff net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
874e90f3d8806 net/mlx5e: Fix setting RS FEC after remapping
6a1b49bb9fdf9 net/sched: defer qdisc freeing after failed creation
04a6cdb3fd13e powerpc/kexec_file: Use inclusive range checks in add_usable_mem()
0bf9f3bae3c4b pds_core: fix cmd_regs access racing BAR unmap on reset
c2362c500931e net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations
b2a8e165ddb6c vxlan: reject dynamic fdb entries that reference a nexthop id
90f6f5cb331af s390/ism: folio_put() after error
59bf9e94bdc49 net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow
e5f4a054b9dc4 octeontx2-af: mcs: Clear stale X2P calibration state before calibration
37cb9a81600da net: bridge: mcast: properly convert mglist to rcu
c5b5c52b6524c net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
f5e93162b3dd1 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
f24eb5bd870ca bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
17acbcd4c5a6c nexthop: Initialize extack in remove_nh_grp_entry()
8d282b2703899 selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0
0ba57948dc23a selftests/bpf: Update tests for new ct zone opts for nf_conntrack kfuncs
b843ab43ac9d2 bpf: Mark bpf_btf_find_by_name_kind() as sleepable
990df1ba4d080 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times
1e213ba7cb3b9 net: bcmasp: clear txcb->last before writing each descriptor
a16ca1987ce86 ASoC: Intel: avs: Clean up the bus when fetching ML caps fails
aec0a9c1579eb bpf: Fix NULL-ptr-deref in btf_var_show()
86d86f9fcf62d bpf: Fix NULL-ptr-deref when showing a void BTF type
75b20534d7a37 ALSA: caiaq: Fix potential double-free at error path
401aedb4632ae selftests/alsa: Fix the step check for INTEGER controls
92748cdff7388 net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
0ec75c69918b7 net/rds: don't let rds_conn_shutdown() consume a concurrent drop
2e46248e375a5 net/rds: acquire the fastpath locks in rds_conn_shutdown()
d184e6dd4b8f3 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
51164c0597405 net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
b8a8b6d25e742 net/rds: clear cp_flags bits individually in rds_conn_path_reset()
14d0a842e1696 net/rds: use clear_bit_unlock() in release_refill()
3d401934b7edb net/rds: use wq_has_sleeper() in release_in_xmit()
7b435c69a30b4 bonding: do not clear curr_active_slave prematurely when releasing all slaves
8cb75f7ada25b bpf: reject BPF_PSEUDO_FUNC reference to the main program
9379e193826f2 tracing/probes: Fix use-after-free on field name/type of events with multiple probes
c6beb08b1a9fd netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
677ff8ab30a66 ipvs: fix reversed sequence option serialization
7caaae233a55e btrfs: do not force reloc root creation during qgroup_account_snapshot()
02ebc4d4e5d73 btrfs: send: fix lost error return value in will_overwrite_ref()
d043c43d2b4eb btrfs: fix the possible bioc_list memory leak during error
81116d3c6b27d btrfs: directly return 0 on no error code in btrfs_insert_raid_extent()
089d9c45ea49f btrfs: fix transaction use-after-free in raid stripe insertion
77a771b5083c7 ASoC: ux500: Program the MSP FIFO watermarks
507f239aacedd ASoC: ux500: Request the MSP MMIO resource
737e29e7dbf6e mfd: db8500-prcmu: Fold dbx500 header into db8500
f30aae1a465f2 arm: Handle KCOV __init vs inline mismatches
3f87eece1edde mfd: db8500-prcmu: Remove needless return in three void APIs
2e5e878e321f1 ASoC: ux500: Validate MSP DAI configuration
054396ce4a4eb ASoC: ux500: Correct MSP frame and bit clock setup
3b2d65cadf1f6 ASoC: ux500: Propagate MSP setup errors
80c65fbc57d21 ASoC: ux500: Fix MSP stream lifecycle handling
d6f9af093dc91 ALSA: ump: do not touch legacy_rmidi before it exists
d2baaf94766e2 ALSA: ump: Update rawmidi name per EP name update
b8ca1a95e9c52 ALSA: ump: Copy safe string name to rawmidi
ee432ab0658c8 ALSA: ump: Copy FB name string more safely
5447926ddbe75 ALSA: rawmidi: Show substream activity in info ioctl
210a9fc6678ce ALSA: rawmidi: Expose the tied device number in info ioctl
6bc345f6d81eb locking/lockdep: Invalidate stale class_cache entries for zapped classes
c049f114bcb9e perf/core: Skip empty AUX records with only format flags
7bcce856c79c1 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
7adb1bf25b0c5 bonding: alb: fix uninitialized transport header access in alb_determine_nd()
0a0ee38ad6324 btrfs: restore active device pointers after failed sprout
7fe9dfbca4346 btrfs: detach failed sprout device from transaction update list
d356c188a653d ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()
d744a26619bc9 ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
65736547074cb s390/boot: Fix physical memory search range
68e920cb06ddd ALSA: hda: restore MFG widget enumeration after core split
02f8dcb5c9be4 ALSA: hda/core: Use guard() for mutex locks
10cc145b87367 staging: fbtft: make dirty_lock IRQ-safe
2b9fa12fbdbfc af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().
af08f62b5a5a4 ipv6: sr: restore network header before routing and forwarding
b5344e459996a tipc: fix NULL deref in tipc_named_node_up() on empty publication list
f614c83fd7664 ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
faaa80fad1f5d ppp: ppp_async: simplify tty disc_data access
84223baf21bc9 net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted
6245425c04be5 ASoC: ab8500: Validate and program TDM slots correctly
780e00c41886a ASoC: ab8500: Correct digital interface format setup
84ce73fefeb17 ASoC: ab8500: Repair the DAPM capture graph
a2db840c01162 ASoC: ab8500: Reset the audio block before configuring it
b67584161b7f9 Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
a8841f6653164 Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
0e1fc7cab95ad Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
593e64f64a20b Bluetooth: hci_core: Fix race condition during device registration
e9cf7f175c00d Bluetooth: btintel: validate version TLV value lengths
17b61f59914b5 Bluetooth: btintel: Export few static functions
b9b36a0e3d77a Bluetooth: btintel: Print firmware SHA1
abf3623af5d67 workqueue: reject watchdog thresholds that overflow jiffies
198734bee7945 workqueue: replace use of system_wq with system_percpu_wq
41647864e62b2 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
030e88812435f s390/ipl: Fix NULL deref in kdump without re-IPL parm block
948d0090e7250 s390/os_info: Introduce value entries
b0fc13ff74a13 s390/checksum: provide and use cksm() inline assembly
581896f229b39 s390/checksum: call instrument_read() instead of kasan_check_read()
486876f957456 ksmbd: rate limit unmapped SID errors
cbadf2575d25e ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
dcaa77d10ea19 OPP: of: Fix potential multiplication overflow when calculating freq
a135415be5683 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
069d5527bb0f2 vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
c60066fa5e2fe net: amd-xgbe: discard rx packets with bad FCS
e3f4ffbde379c raw: annotate disconnect-side IPv4 match writers
4548d843e7b29 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
377e01e4f3104 smb: client: transport: Fix debug printing in __release_mid()
60a93d9f0fa06 smb/client: mark file sparse before emulating insert range
58e3d2fbc8c91 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
c848a1bbe1104 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
09e7f9290d631 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
1ea521961c110 net/sched: act_api: fix skb sizing and action leak on reoffload delete
5fe7f53543e85 net/sched: act_api: conditional notification of events
4587ff1844ebb net/sched: act_api: don't open code max()
8611126b2637d rtnl: add helper to send if skb is not null
52a6bb47ef80d net/sched: act_api: size the RTM_GETACTION reply from the actions
606c29451264d net/sched: act_api: budget all shared attributes in notify skbs
99654b651c6d5 net: icmp: avoid invalid transport header access in icmp_send tracepoint
2a0e7bcff3fa6 drm/cirrus-qemu: Validate BAR0 size during probe
6a8aa0068d476 drm/cirrus: Use video aperture helpers
5b269f6682a7f ufs: do not treat unreadable directory blocks as empty
364e65b2e81ed ufs: Convert ufs_get_page() to ufs_get_folio()
1ca5c166deeac ufs: Convert ufs_get_page() to use a folio
f8f3d946fe4b0 ufs: convert to new timestamp accessors
23d2429aecd6f selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter
965804b20c0f0 nvme-rdma: fix -EIO cleanup order in queue_rq
5807a65f301b6 accel/qaic: Address potential out-of-bounds read in resp_worker()
3fe8a33715265 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
541fc6f733b32 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
9a5b471f95dd4 EDAC/igen6: Fix channel address decode for non-hash mode
c359c9c9c9f8a EDAC/igen6: Fix channel selection hash
149df8bf827f3 EDAC/igen6: Fix interleave boundary condition
d019542ed3324 ARM: ensure interrupts are enabled in __do_user_fault()
ec9f166e6573c ARM: 9484/1: enable interrupts when unhandled user faults are triggered
881c5b1faf110 Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"
8a69620b23e7b Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"
5b0953f86d658 mm/damon/core: avoid infinite kdamond_merge_regions() internal loop
258d54030481f of: dynamic: Fix overlayed devices not probing because of fw_devlink
6fda5c51b8e43 af_unix: Unlink scc_entry in unix_del_edge().
5a0367bf5ce42 ksmbd: use memcmp() to compare ClientGUIDs
90703664dbc5a ASoC: meson: aiu: Validate written enum values
c405b07246bf1 ASoC: topology: Check PCM and DAI name strings before use
7907a395701b3 ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
ff6c5ee77dcc9 bpf: Guard __get_user acesss with access_ok for uprobe_multi data
00444baa8f74d RDMA/bnxt_re: Proper rollback if the ioremap fails
dd3c9e1c9858c coresight: platform: defer connection counter increment until alloc succeeds
43ddbcdc0ed74 sctp: fix err_chunk memory leaks in INIT handling
6181239115e19 bpf: Mask pseudo pointer values in verifier logs
7250b6b5ba9b7 Bluetooth: ISO: fix malformed ISO_END/CONT handling
93580911f02d1 tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
3c0bc7dcc5f92 net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
0da8f531336b2 drop_monitor: fix size calculations for 64-bit attributes
3454c729ee8aa drop_monitor: perform u64_stats updates under IRQ-disabled section
c4bb894362d22 ppp_async: drop the errored frame instead of resetting its headroom
16110d1a0e95a wifi: mt76: mt7921: skip unknown CLC firmware records
740272d46ffc8 wifi: mt76: mt7921: validate CLC firmware records
5ffe08b81a74d tracing/histograms: Simplify last_cmd_set()
9cd6d714d3ca0 ksmbd: remove stale channels from all sessions on teardown
a2ac6a057409d firmware: stratix10-svc: fix FCS SMC call kernel-doc
3b9aa62d78ce8 netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
8138a6951111d ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
6b450c277c106 scsi: core: Do not block on tag allocation in scsi_eh_lock_door()
7c8b6b4d6f9de ASoC: rt5645: Perform the initial jack detect at probe
64f3ffba03b37 spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
0737441d20b34 hwmon: (corsair-psu) Fix linear11 calculation
be2636e1b21fe vhost-scsi: flush backend after device ioctls
37d743def9b6b ASoC: amd: yc: Add DMI quirk for HP Victus Laptop 16-e1xxx
887c8a9635dcb Drivers: hv: vmbus: add VTL2 redirect connection ID
b44293b1598fa ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
30d1d9f349546 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame
d01f1600e8b07 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
3a4a34a732e8a cifs: validate idmap key payload length
cf8497dc74b3c powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
07c121859d49e ice: pass the return value of skb_checksum_help()
ce1b98bfe0cdb ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
b0cd3daf4710e ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4
f4e8477e7af81 phonet: check register_netdevice_notifier() error in phonet_device_init()
8add43887cca1 drm/gma500: return errors from Oaktrail HDMI I2C reads
4a19bb1c45667 ksmbd: preserve VFS inherited POSIX ACL mask
6f6368b20f8c9 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
97aa48806d90e regulator: core: clamp voltage constraints before applying apply_uV
cf87ef1e62ed3 smb: client: bound dirent name against end of SMB response in cifs_filldir
063b26637dcb2 wifi: mwifiex: replace one-element arrays with flexible array members
a273c0336699e ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
9096509e63ddd wifi: iwlwifi: acpi: validate WGDS table revision index
a5af3b3e76760 ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
4cfadb2e01566 wifi: iwlwifi: bound aligned TLV advance in FW parser
e9b2633918c73 ALSA: hda/realtek: Add quirk for HP Pavilion x360
2750f52b58d92 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
c8e84e292ed4c arm64: kprobes: Allow reentering kprobes while single-stepping
35f991d685fea wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
0f690fd3b5535 wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
861bd61732148 arm64: fixmap: Allow 256K early_ioremap() at any offset
3ea815f401652 wifi: iwlwifi: mvm: fix a possible underflow
216e469586057 smb/client: flush dirty data before punching a hole
c3650be82ef6e blk-cgroup: fix leaks and online flag on radix_tree_insert failure
7e307cbae23d9 ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
05f79cea3b15c wifi: iwlwifi: mvm: fix sched scan IE sizing
7a2d4efea2c41 wifi: iwlwifi: mvm: fix an off-by-1 boundary check
0bc25f0a2d1b3 btrfs: fix reloc root cleanup in merge_reloc_roots()
f9938eb95e2dd wifi: iwlwifi: mvm: validate sta_id in BA window status notif
091e097c2f829 spi: dw-dma: Wait for controller idle before completing Tx
a01837ae174a2 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
6d04872f36e83 btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
8db6d96ac93f4 ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
631b292f93a3d smb/client: reduce fallocate zero buffer allocation
f08d7f3c91633 wifi: rsi: validate beacon length before fixed buffer copy
ecb48c6b9edc7 netfilter: ipset: mark the rcu locked areas properly
0b61c465ea620 wifi: libipw: fix key index receive bound checks
fbbdda4753ec3 gpio: dwapb: Mask interrupts at hardware initialization
6bdf4dcff98df wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
9c4ace62a7511 ksmbd: validate SID namespace before mapping IDs
e790f72f2c99e ksmbd: mark invalid session responses as signed
47b018dba6ec7 ksmbd: find bound sessions during reauthentication
71be658246c90 wifi: cfg80211: validate assoc response length before status and IE access
b657cc98d7936 wifi: libertas: reject short monitor TX frames
5207727e53fba wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
a78689e2beed2 wifi: mac80211: validate deauth frame length before reason access
6acaf2d10ad1c wifi: ralink: RT2X00: init EEPROM properly
319393151367e ALSA: usb-audio: caiaq: validate EP1 reply lengths
58b767c74930a ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
717db0d436875 drm/amdgpu: flush pending RCU callbacks on module unload
4a69504f5d691 ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
246098a2b8e88 cachefiles: Fix double fput
720554c04acba xen/gntalloc: validate grant count before allocation
7ada9807e3710 freevxfs: don't BUG() on unknown typed-extent type
ac97b55d9e989 xen/front-pgdir-shbuf: free grant reference head on errors
edc17db830856 ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling
aa9bd2c8513e4 ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
43658ba7f701e drm/arm/komeda: fix error handling for clk_prepare_enable() and callers
c866c3314a685 ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr
b7f3ee925aee9 netfilter: nf_conntrack_expect: zero at allocation time
223bf70736b49 drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
4cb41f07685f8 btrfs: tree-checker: validate INODE_REF's namelen
1cc84ca8599b8 spi: core: Abort active target transfer on controller suspend
2b3c4c381fb23 fbdev: pm2fb: unwind WC setup on probe failure
69aea5ee498fb eth: mlx5: fix macsec dependency
42a37f4a89665 rtc: bq32000: add delay between RTC reads
e6a404ac2a1e8 blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()
e1b5a13249975 net: au1000: move free_irq out of the close-time spinlocked section
8efa52abbff2e regulator: da9121: Use subvariant ids in the I2C table
249be9b5704d4 PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
aa1ad3c1f3976 PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
4114c357386d7 ksmbd: treat read-control opens as stat opens only for leases
3df8918da4630 ksmbd: break RH leases before delete-on-close
9e2cccbbf3b63 ksmbd: start file id allocation at 1
5c37c7275d757 ksmbd: deny renaming directory with open children
52bceb4629bf4 ksmbd: apply create security descriptor first
58a0a1c399a08 ksmbd: treat unnamed DATA stream as base file
3b64cae18fd79 ksmbd: use connection ClientGUID for lease lookup
3281d27b4d974 ksmbd: align SMB2 oplock break ack handling
223a923582afa ksmbd: validate SMB2 lease create contexts
17699905a3816 ksmbd: fix lease break and ack state handling
52fa4ba4268ce rtc: aspeed: add AST2700 compatible
aee4e6de71ca7 f2fs: validate inline dentry name lengths before conversion
2fdc51228d9a8 md/raid5: let stripe batch bm_seq comparison wrap-safe
fc0fab337d554 md/raid5: account discard IO
31e33dcc89652 PCI: mediatek: Protect root bus removal with rescan lock
5d566ac3a055f PCI: rockchip: Protect root bus removal with rescan lock
4b69c63cc247f PCI: altera: Protect root bus removal with rescan lock
aaf4153caed9f PCI: iproc: Protect root bus removal with rescan lock
53da3557621a3 ALSA: usb-audio: Add quirk for YAMAHA CDS3000
67a5885f846b0 drm/amdgpu: Use system unbound workqueue for soft IH ring
89ed4a0ce8beb drm/amdkfd: check find_first_zero_bit before __set_bit on kfd->doorbell_bitmap
d51841bb5ceee drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl
af84fb6ac0cb7 mfd: rsmu: Add 8a34002 support
9e54c47bc8407 mfd: tps65219: Make poweroff handler conditional on system-power-controller
31aab1e3d0f3a leds: pca9532: Don't stop blinking for non-zero brightness
9f0d6bb71a6bc leds: uleds: Return -EFAULT on copy_to_user() failure
804302aca977b ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
e26aa709454d4 tls: reject the combination of TLS and sockmap
1d8050de0ca2a ALSA: usb-audio: Add quirk flags for SC13A
359b3442e66c5 spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()
12e4118b5b4f8 gpio: pisosr: Read "ngpios" as u32
111b36e7b6dc6 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
f58daade5963a fuse: set ff->flock only on success
5d7637f4d050d HID: hidpp: fix potential UAF in hidpp_connect_event()
97313af1820db ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT
71fcc902af9c2 sparc: Disable compat support with LLD
737a90fcd99d1 i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
cfa09f63e75cf smb: client: fix races in cifsd thread creation
ea0af96a1b939 net/sched: act_csum: don't mangle UDP tunnel GSO packets
f948534a042fa e1000e: limit endianness conversion to boundary words
76e678bdc5170 vsock: use sk_acceptq_is_full() helper in all transports
af16e8f97c622 ptp: ocp: add shutdown callback
74dbb85a6a254 net: stmmac: xgmac2: disable RBUE in default RX interrupt mask
665089ff4f8a2 sparc64: uprobes: add missing break
01e350c0641f5 Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
98deaf6117195 ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
1994a4bdaa7fc ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
7f0fd754c7087 ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt
72e26293a231f Bluetooth: L2CAP: validate connectionless PSM length
c8d249de9e97d Bluetooth: btusb: Add support for TP-Link TL-UB250
e86071156ea99 Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV
fa9d74b9bb0cd spi: xilinx: let transfers timeout in case of no IRQ
23f05d42f189d hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
3c8c0c786f3f0 dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc
58d882c723ae9 PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
f2db152beb06c sctp: Unwind address notifier registration on failure
5488e2706c584 nvme-fc: Do not cancel requests in io target before it is initialized
8cd46f24e8411 platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
4ecbe6a5ac28e ata: libata-pmp: add JMicron JMS562 quirk
58ae36b6f20c7 ALSA: hda/realtek: Add quirk for Lenovo Yoga Pro 7 14IRH8
21730289e0af9 ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
ba180821a4e23 vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()
a432bf58906b7 net: dsa: qca8k: Add support for force mode for fixed link topology
86ace5b321108 hwmon: (adt7462) Add of_match_table to support devicetree
1a6c92aa7242a btrfs: protect sb_write_pointer() with invalidate lock
d51ba5fe3459b wifi: mt76: transform aspm_conf for pci_disable_link_state
466e727a3481b platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
7521c2e260855 tls: Flush backlog before waiting for a new record
f0399b3e21274 net: ibm: emac: mal: fix potential system hang in mal_remove()
f38f5acb4942f configfs_depend_prep(): pass configfs_dirent instead of dentry
0d099caebc3e0 xprtrdma: Add request-pool slack for delayed recycling
b042b4947752d RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
f556c3d4d64dc NFS: fix eof updates after NFSv4.2 fallocate/zero-range
ba6c4fc662853 btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF
81a664ed8b1a4 btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()
0d5ad732e4fdc netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
91c97a7969dae ALSA: es18xx: check control allocation before private data setup
a7625d408f7f0 net: microchip: sparx5: clean up PSFP resources on flower setup failure
016b8eaca53bf hsr: broadcast netlink notifications in the device's net namespace
8af61d5bd87fd net: cpsw_new: unregister devlink on port registration failure
31377675c3d75 bpf: NUL-terminate replaced sysctl value
b1e111f93deef RDMA/mlx5: Fix state and counter desync on loopback enable failure
e9bbb5f5349ef RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
2095eceaedddf wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
641be20110cdf drm/amdkfd: Unwind debug trap enable on copy_to_user failure
5eade80288a03 ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
3b389d479f831 ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
fd36e829eb3c1 clk: keystone: don't cache clock rate
0e646d3912ff5 net/mlx5: E-Switch, align disable sequence with switchdev-to-legacy transition
025293b9d0cf6 RDMA/irdma: Fix typo in SQ completions generation
4a1b0a4c5acbe drm/amdgpu: fix buffer overflow during vBIOS update
9b5cb2e4eb297 drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
090b51e2dabf8 drm/amdkfd: fix UAF race in destroy_queue_cpsch
fec259e46d443 xhci: Prevent queuing new commands if xhci is inaccessible
97c2c0b1233b3 thermal/drivers/qcom/tsens: Atomic temperature read with hardware-guided retries
c996faba71fc4 dpaa2-switch: fix handling of NAPI on the remove path
d0e54098c072b net: dsa: sja1105: flower: reject cross-chip redirect
259ad6093204b dpaa2-switch: fix the error path in dpaa2_switch_rx()
dc626f2abb305 dpaa2-switch: rework FDB management on the bridge leave path
2922cf2583e59 ALSA: seq: oss: Reject reads that cannot fit the next event
a92d497bc768e ASoC: codecs: rk3328: Use managed GPIO and clock helpers
2f7d0ec8c10dc ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()
d564a885219a6 fs/ntfs3: validate index entry key bounds
fdc9f65aa6631 fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib
fce90e41601e3 iommu/rockchip: disable fetch dte time limit
356a4983340df net: wwan: t7xx: Add delay between MD and SAP suspend
f76a39c45182d net: qrtr: fix node refcount leak on ctrl packet alloc failure
6b6be7328f2b2 ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach
6d29b91164424 ata: ahci: fail probe if BAR too small for claimed ports
0ccf0d4dddbe5 ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
43cb6295c3a6d ASoC: qcom: q6apm: return error code to consumers on failures
b4ef30f1d107a wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
b511b56f63daa net: ibm: emac: Reserve VLAN header in MJS limit
bc6e3444a6d7a libbpf: Also reset {insn,data}_cur on realloc failure
da92b1a8560a5 iio: accel: mma8452: switch to non-devm request_threaded_irq()
d85b5591ea459 perf/ftrace: Fix WARNING in __unregister_ftrace_function
2c2d63f410557 iio: light: stk3310: Deal with the ps interrupt issue in PM
b5fa000eaf6bb mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
3657383a477ab tracing: Disable KCOV instrumentation for trace_irqsoff.o
345b1dfa73be0 mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
cfc0b65a29b41 mmc: davinci: fix mmc_add_host order in probe
86ac37d42a8b1 soundwire: only handle alert events when the peripheral is attached
c8abef7c07c10 gfs2: page poisoning fix
26532163b3cef soundwire: dmi-quirks: Disable ghost Realtek devices
5cdfd851fa205 libbpf: Add __NR_bpf definition for LoongArch
1bdf84bbe14a7 ASoC: Intel: catpt: Complete coredump handling
feb1ad41281ae drm/nouveau/gsp: add SEC2 to GA100 chip table
c6ad6451f88f0 scripts: modpost: detect and report truncated buf_printf() output
74bd1f05d9ba2 host1x: bus: Fix missing ops null check in error teardown
37acac6d2d6d3 pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
1ca2411d90c85 hfs: rework hfsplus_readdir() logic
38ee32a9ace6f ACPICA: add boundary checks in two places
50a11e2f3dc8a ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()
08c5dee5da1d8 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()
e301b6132be06 ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
26dd27000e954 ACPICA: Add validation for node in acpi_ns_build_normalized_path()
2442772fd79a4 ACPICA: Add package limit checks in parser functions
254e304f68dc0 ACPICA: validate handler object type in two places
72d75287bc6d6 ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
4532c9cf006bb ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
c2cf936b07b0a ACPICA: Prevent adding invalid references
6e0d26e6ec903 ACPICA: validate byte_count in acpi_ps_get_next_package_length()
7d97ecf2a4c7a ACPICA: add boundary checks in acpi_ps_get_next_field()
63ca6f67816a2 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
4c22c9842c53b ACPICA: Fix condition check in acpi_ps_parse_loop()
121352772b326 drm/amd/pm/si: Fix updating clock limits from power states
c8bc44a1d86d5 net: thunderx: fix PTP device ref leak in nicvf_probe()
f601ec5c92b32 ipv6: addrconf: fix temp address generation after prefix deprecation
f5d3088e1a9f3 net: hsr: require valid EOT supervision TLV
52c61420923e4 ALSA: usb-audio: Add quirk for Novation Mininova
4761493dd6634 irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
566b1fc9a4fb8 iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
df904e01b710f mips: cps: Assemble jr.hb with an R2 ISA level
cf82a9d15ae69 drm/panel: simple: Add AM-1280800W8TZQW-T00H
a643ce49ddcdb thermal/drivers/tegra/soctherma: Switch to devm cooling device registration
99a1ae9c1e058 clk: socfpga: agilex: implement l3_main_free_clk
ff8e9b793effc s390/zcore: Removed unused variables
2e6b5c4b59351 rds: annotate data-race around rs_seen_congestion
65fae4b42269d rds: filter RDS_INFO_* getsockopt by caller's netns
4892962af7896 netlabel: fix IPv6 unlabeled address add error handling
4cf3a3f61c88c wifi: rtw89: pci: enable LTR based on pcie control register
df2f6c977a94a rcu-tasks: Fix possible boot-time tests failed for the call_rcu_tasks()
47850643464ba char/nvram: Remove redundant nvram_mutex
cd4f278f30021 usb: host: add ARCH_AIROHA in XHCI MTK dependency
03ed804a0ddc3 serial: 8250: fix possible ISR soft lockup
99fcf2d8daf24 usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
c055449f384b1 USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
a018d4195114c usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
d0291fb4d9198 usb: core: hcd: fix possible deadlock in rh control transfers
517c353e5358b usbip: vhci_hcd: fix NULL deref in status_show_vhci
28d1f6aa14f59 isofs: handle set_blocksize failures
29186cd17bb5f omfs: handle set_blocksize failures
0451927f42b02 hpfs: handle set_blocksize failures
87d6852f06c5a jfs: handle set_blocksize failures
f83e416c2242f qnx4: handle set_blocksize failures
8e788c14b72d6 minix: handle set_blocksize failures
8a96010d230a8 bfs: handle set_blocksize failures
ea8a4a9f3cc10 affs: handle set_blocksize failures
df9dac4dbe557 ntfs3: handle set_blocksize failures
ceb89faa8ead6 befs: handle set_blocksize failures
07a348d48e589 net/rds: Don't sleep inside rds_ib_conn_path_shutdown
4fc0430de152f net/sched: sch_drr: make cl->quantum lockless
f0018acf0b66f net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
513cab0e49ebe net: usb: qmi_wwan: add MeiG SRM813Q
ac8cc00c0fb60 nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl
b4d8264ca70f3 bitfield: wire __bf_shf to __builtin_ctzll
85cbb946b9c59 thunderbolt: Verify Router Ready bit is set after router enumeration
5428342dd66ed thunderbolt: Increase timeout for Configuration Ready bit
c0742f23ec13f firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
1bbe431fc5970 firmware: arm_scmi: Validate SENSOR_UPDATE payload size
7496466121155 thunderbolt: Improve multi-display DisplayPort tunnel allocation
a13e408c554be thunderbolt: Don't access path config space on Lane 1 adapters in tb_switch_reset_host()
de4b7f9bfee2c bridge: Add missing READ_ONCE() annotations around FDB destination port
4904370513ad6 9p: use kvzalloc for readdir buffer
c2319e1cfb78c arm64/daifflags: Make local_daif_*() helpers __always_inline
b6b5175b4da92 9p: invalidate readdir buffer on seek
3167b620815c4 sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity
d04cff45c9d2a ALSA: usx2y: Drain pending US-428 pipe-4 output commands
3d2ddfc9b361b drm/amdkfd: Check bounds on allocate_doorbell
e2bef0f168be4 drm/amdkfd: Fix OOB memory exposure in get_wave_state()
25e1b29ecc8da drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
c1797a31c5fe8 PCI: Wait for device readiness after D3hot -> D0uninitialized transition
bb42eed92e401 mailbox: Make mbox_send_message() return error code when tx fails
91c6fdcdf22bd RDMA/mlx5: Use QP port when decoding responder CQEs
0a996ad14fbbb media: imon: Add iMON VFD HID OEM v1.2 key mappings
c4f2d6c924263 crypto: atmel-ecc - add support for atecc608b
bec33e03d2244 crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
3b3ae5517658a scsi: pm8001: Reject non-fatal dump when controller is crashed
cb789c65aa703 scsi: pm8001: Reject firmware update in fatal error state
e4fe7a56992ee clk: samsung: exynos850: mark APM I3C clocks as critical
959913c0d51e1 soundwire: intel: Move suspend tracking from trigger to pm suspend
c0cbb58df7d21 drivers/of: validate status properties in reconfig state changes
a6ce8632fbdc0 integrity: Check for NULL returned by asymmetric_key_public_key
32ff92cc9f91e net: dsa: realtek: rtl8365mb: add support for RTL8367SB
72bf6944e336d wifi: rtw89: phy: check length before parsing PHY status IE
b7afb0c24a761 media: video-i2c: use vb2_video_unregister_device on driver removal
3d2ac2f6ed2e2 drm/gud: Add RCade Display Adapter VID/PID pair
9eb4ca55f5b61 net: phy: motorcomm: use device properties for firmware tuning
bfdb4d0fab516 hfsplus: rework hfsplus_readdir() logic
03505f0c7c277 PCI: intel-gw: Enable clock before PHY init
dc4fd6c0d9323 drm/amd/display: Fix CRC open failure during active rendering
3c5e3e5badbf0 mmc: davinci: avoid NULL deref of host->data in IRQ handler
a8283f7d93f0d mmc: core: Add validation for host-provided max_segs
120c4c6e07f94 ASoC: ti: omap3pandora: update board check to use DT compatible
38570c33dc367 drm/bridge: tc358768: Set pre_enable_prev_first for reverse order
1b793329699b5 clk: renesas: cpg-mssr: Add number of clock cells check
827c30511b02a crypto: omap - add omap_des_unregister_algs helper
8c37bc8d6a6f7 crypto: ixp4xx - fix buffer chain unwind on allocation failure
c75237294a70d media: em28xx-video: fix missing res_free() on init_usb_xfer failure
0d252fe2012d9 net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
2381e99226b53 net: dsa: mv88e6xxx: define .pot_clear() for 6321
c43bc7bd2e68a PCI: switchtec: Add Gen6 Device IDs
d2c97bf5b1ff2 net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
b6327023dcc74 media: dm1105: fix missing error check for dma_alloc_coherent
bed89ef877c9e thunderbolt: Don't create multiple DMA tunnels on firmware connection manager
83d1af5b1b6e6 thunderbolt: Set tb->root_switch to NULL when domain is stopped
b61a4ae2ec6a0 thunderbolt: Keep the domain reference while processing hotplug
57359bb31526c thunderbolt: Keep XDomain reference during the lifetime of a service
9d6657674919b thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
f5e6286350c86 media: rc: mceusb: Add support for 04eb:e033
d9fa79ccd0920 spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM
71ab6046cb940 soundwire: validate DT compatible before parsing it
827d1eebd5f24 bridge: Do not suppress ARP probes and DAD NS unconditionally
b9efc7bdadca8 firmware: stratix10-svc: change get provision data to async SMC call
ad65a12f6a0a4 kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access()
0b58a5ac9170a wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
adf23deb60387 wifi: mac80211: always allow transmitting null-data on TXQs
8fe5eb7b68d76 wifi: nl80211: reject beacons with bad HE operation
5a46a1b5dcbae hfsplus: fix issue of direct writes beyond end-of-file
0f8a92c198893 PCI: Stop setting cached power state to 'unknown' on unbind
5a99d68c32927 tools/nolibc: avoid call to wcslen() in _start_c() inserted by clang
e9260bc729335 tee: optee: Allow MT_NORMAL_TAGGED shared memory
11c633d24780a usb: gadget: udc: skip pullup() if already connected
8c77312728d07 ima: return error early if file xattr cannot be changed
c6dfcaea6d3ae ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
5a7c355f83c63 drm/amd/pm: Check SMUv13.0.6/12 metrics integrity
e0ae7248bae11 drm/panel: jadard-jd9365da-h3: set prepare_prev_first
3ad0c3cf4a163 drm/amd/display: Fix DPMS using partially updated pipe context
82f51c4addcac bus: fsl-mc: wait for the MC firmware to complete its boot
30cd0f44e983e drm/gem: Consider GEM object reclaimable if shrinking fails
892f643b141ae ksmbd: fix use-after-free in oplock break notification
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.6.bb | 6 ++--
.../linux/linux-yocto-tiny_6.6.bb | 6 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index 8a31bbfd09a..3c91a4ba7a5 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,13 +14,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "9b87590f4fb1e0d54ae9153f9e4fe84cec61f13e"
-SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8"
+SRCREV_machine ?= "aafd2f2dba2b549d89a66f79826d770742d968ab"
+SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.6.157"
+LINUX_VERSION ?= "6.6.159"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index 3904ba1d1c6..1b06d1e35fb 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
# CVE exclusions
include recipes-kernel/linux/cve-exclusion_6.6.inc
-LINUX_VERSION ?= "6.6.157"
+LINUX_VERSION ?= "6.6.159"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "a56c1dbe33dcd7b71df3b2703ceb95692edd9579"
-SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8"
+SRCREV_machine ?= "7d022d231f699d2c767d88bb1fa305550ca68e01"
+SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index da3c5dd6ea6..601eb925955 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "f762f9a437240aebfb663b9f08166b6978411ad3"
-SRCREV_machine:qemuarm64 ?= "efde6579b1968f396f4718ad939aeb6859f17012"
-SRCREV_machine:qemuloongarch64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
-SRCREV_machine:qemumips ?= "d7bc8d3db82714ebe46bde3e69f9dcbef7ae6e48"
-SRCREV_machine:qemuppc ?= "b8bafdf6f040163a1fe0eb91c7b419452e3590b4"
-SRCREV_machine:qemuriscv64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
-SRCREV_machine:qemuriscv32 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
-SRCREV_machine:qemux86 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
-SRCREV_machine:qemux86-64 ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
-SRCREV_machine:qemumips64 ?= "fa48e020815730c4ff228c0e8d42836d68ac4b4b"
-SRCREV_machine ?= "a353a9563cf1625b98d7f33ec845d25cbdef12b6"
-SRCREV_meta ?= "0d175695cbfd92999ee910a0535f01cbcbe7a0f8"
+SRCREV_machine:qemuarm ?= "9d17d5c9ac32b38ca5186199ed824b43f3d4308b"
+SRCREV_machine:qemuarm64 ?= "857114866d2445d49024c9ef1ec710a7ef291a5b"
+SRCREV_machine:qemuloongarch64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
+SRCREV_machine:qemumips ?= "2349f4c462400a8fb6f95c6bc0fbbdf959b2cb18"
+SRCREV_machine:qemuppc ?= "47e791b3b9f786f926e66a672c524c1e858c76c1"
+SRCREV_machine:qemuriscv64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
+SRCREV_machine:qemuriscv32 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
+SRCREV_machine:qemux86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
+SRCREV_machine:qemux86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
+SRCREV_machine:qemumips64 ?= "a77a45b7cea3e691d2dafca4d9bdbaa60d134617"
+SRCREV_machine ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
+SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "79643295eba17affbd16ca97f3ef04c90266b28c"
+SRCREV_machine:class-devupstream ?= "cecd39af8a1ab81373fd9fa765b2f7ab73becaad"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.6/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.6.157"
+LINUX_VERSION ?= "6.6.159"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 44/55] linux-yocto/6.6: update to v6.6.160
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (42 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 43/55] linux-yocto/6.6: update to v6.6.159 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 45/55] linux-yocto/6.6: aufs: refresh to upstream aufs6.6.84 Yoann Congal
` (10 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Updating linux-yocto/6.6 to the latest korg -stable release that comprises
the following commits:
0aebf2870d53a Linux 6.6.160
a63f79d9da946 KVM: x86: Use active memslots for the per-vCPU MMIO cache
59c6dcc5dd9da ksmbd: fix heap out-of-bounds write in krb5_authenticate()
db00b8cc243f1 bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
cec182231e528 xfs: fix unmount hang with unflushable inodes stuck in the AIL
a72b0af5610ce xfs: factor out stale buffer item completion
be1999582bd10 xfs: rearrange code in xfs_buf_item.c
67f0af99e2905 xfs: catch stale AGF/AGF metadata
dda32083f6393 xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock
fb2cc53273997 bpf: abort verification if env->cur_state->loop_entry != NULL
8010212197d4a Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
dbea82c4c81db Revert "mm/filemap: avoid buffered read/write race to read inconsistent data"
791f7e65d6299 Revert "ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev()"
a102a92462b97 ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14
f2d8e2e64fb2b r8169: remove original workaround for RTL8125 broken rx issue
fa0c45986fc60 smb/server: fix tree connection leak in smb2_tree_connect()
22d1f4dcdc9c6 nvdimm: pmem: keep PREFLUSH before data writes
32e999ccf5f64 drm/virtio: use the DMA API for resource backing on Xen
ce7da178f1af4 drm/gud: validate GUD_ROTATION_0 is present in supported rotations
d51cd486930f5 bpf: check_cond_jmp_op(): properly infer if register is null
b7f2e33d9f5db smb/client: validate new EOF for insert range
5fbd8848f2e25 smb/client: validate new EOF for zero range
52dd721b3de57 smb/client: fix stale page cache in insert/collapse range
cc7202a51b877 smb/client: invalidate fscache for fallocate range operations
99ae165acf633 ksmbd: propagate DACL parsing errors
fabc5e04f1232 Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
01131daffc4b6 igmp: convert struct ip_sf_list to RCU
0e3e3cec28c4d ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
3dbb628cfc592 tipc: Dont send random pad bytes in RESET/ACTIVATE messages
19cca7c360559 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
1ac58dab0a83d bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
433d52b196a68 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails
14d982762945d btrfs: zstd: fix lost wakeup when waiting for a workspace
54772bf503dd0 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
4c85e4a0e8b07 net: plumb extack in __dev_change_net_namespace()
dcc5e6c9e4d06 erofs: disable LZ4 rolling decompression for now
9496d857205e6 bpf: Mark syscall helpers as sleepable
e6a94b2c4c80a nvme: remove stale namespaces by NSID range during scan
c57506918b078 nvme_core: scan namespaces asynchronously
8b414dbe97fce bpf: Don't infer non-NULL from a pointer with an unbounded offset
6e15449865367 bpf: Don't predict JMP32 pointer vs zero comparisons
53ab1d12e52aa bpf: generalize is_scalar_branch_taken() logic
ca7ade93a622c bpf: unify 32-bit and 64-bit is_branch_taken logic
4ea5273a22e47 bpf: generalize is_branch_taken to handle all conditional jumps in one place
e3991f2c54e7f bpf: move is_branch_taken() down
82798ed5889f0 bpf: generalize is_branch_taken() to work with two registers
e97cb20239d10 bpf: rename is_branch_taken reg arguments to prepare for the second one
f5b2c23341b79 bpf: Improve JEQ/JNE branch taken logic
86a3171c90bfc bpf: Mark NULL kptr stores precise
cf85e4f94d7fe bpf: Preserve inner map identity in callback frames
26ee5f99ffe7a net: reject oversized tx_queue_len at netlink parse time
febbb66e682d8 bpf: mark a NULL call argument precise
8b95269d7a43b iommu/amd: Do not reallocate GA log buffers on resume
5ad081761a1f0 virtio_ring: fix stale descriptor flags after a failed packed add
914c7cc2e3d10 vhost-vdpa: protect config_ctx from being freed under the config callback
582fec8ebce99 eventfd: simplify eventfd_signal()
650bac9c73d3b vduse: validate virtqueue alignment
021bf73731f7a vhost: invalidate vring access on IOTLB transitions
bd91dc313afe2 af_unix: Update last skb marker in manage_oob().
385aa7dbc6af1 eth: ice: don't dereference pointers from TP_printk()
55b76500546e5 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
fb78beb64e0e7 vxlan: initialize _md in vxlan_xmit_one()
d552beb9d278a net/mlx5e: Move representor vnic reporter to eswitch devlink port
9882068ed242f perf/x86/intel: Prevent drain_pebs() reentry
09c30547da2c4 net: stmmac: fix TX descriptor availability check for TSO traffic
a44744454eafb configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
bc5f32f36724b configfs:get_target() - release path as soon as we grab configfs_item reference
db6d0b2f307f0 path: add cleanup helper
b315d86566076 configfs: unhash the dentry before dropping the item in rmdir
0c1a966bc047a reboot: fix cad_pid use-after-free race
61894ea0d2a1a tracing: Take trace_array reference when opening a tracer options file
c3576cb77b527 ALSA: usbusx2y: validate URB actual_length in interrupt callback
4d87cf94eba53 ALSA: usx2y: Use standard print API
e5c5dad169fb5 tracing: Take the reference before publishing the named histogram trigger
880712b6f4810 tracing: Undo the registration when enabling the histogram trigger fails
962e565f45dbe accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
07d4190d75021 accel/ivpu: Validate firmware log buffer metadata
3d9365093f16b accel/ivpu: Limit firmware log name prints to field size
97be05f33f793 bootconfig: Fix integer overflow in initrd size check
f664e06699829 netfilter: cttimeout: prevent UAF during module unload
0159f716d8adb ipv6: flowlabel: cap duplicate leases per socket
5a1b6379eed5b perf: RISC-V: store available counter mask as bitmap
189d60057e5f3 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
be6eccccec867 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
284877c6189fd smb: client: fail DACL rewrite when the new DACL exceeds 64K
604feb3e8141b smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
674d783f2e80d scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
64a7ed42e9766 f2fs: accurately adjust free_sections during free_segment_range
40dcd4a71a524 scsi: qla2xxx: Skip vport under deletion in report ID acquisition
6c71726cdfda9 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
925a9129a514b scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
d12e92e72db91 wifi: cfg80211: reject duplicate wiphy cipher suite entries
971b40e3ca127 fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()
493a029c205a9 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
dc5778dbd0b6c ocfs2: validate external xattr entries when reading metadata
45c534c5bf43a firewire: core: fix memory leak in error path of build_tree()
e6c3a43d0a41f nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
3861eeabaebe2 svcrdma: Validate Read chunk positions before reconstruction
c4c71368bc5c5 iommu/sva: Set handle->dev before the SVA handle is visible
6e5333ec3bd8f iommu: Pass domain to remove_dev_pasid() op
80eaeae0e4b1e md/raid1,raid10: fix error-path detection with md_cloned_bio()
91d0fc000d8cc md/raid1,raid10: fix bio accounting for split md cloned bios
50d1a47fb3c4f btrfs: fix deadlock cloning inline extent when using flushoncommit
bce2eec05bce5 Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
441250eea8460 cxl/region: Resolve region deletion races
b869e3e4ce199 net/handshake: hand off the pinned file reference to accept_doit
59db5d8bcc65e erofs: fix use-after-free on sbi->sync_decompress
98cc0403f546c netfilter: revalidate bridge ports
966b941ca469f greybus: raw: fix use-after-free if write is called after disconnect
f65a96fe2467a ceph: fix num_ops off-by-one when crypto allocation fails
bca0597272f97 KVM: SVM: Add missing save/restore handling of LBR MSRs
1cde96d5d53b9 hwrng: core - use RCU and work_struct to fix race condition
aead84bdacd77 netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
f988fbf0536b4 media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC
690145822dd73 media: v4l2-mem2mem: Add a kref to the v4l2_m2m_dev structure
0870f10cbdaa7 media: hantro: Disable multicore support
414396c42ef20 ASoC: qcom: q6asm: drop DSP responses for closed data streams
253523cd4dd7d ASoC: qcom: q6asm: handle the responses after closing
8c24b5179af26 RDMA/efa: Fix use of completion ctx after free
127c5e6e2d6fa ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
d4bee74b7cb93 drm/msm: Recover HW before retire hung submit
a75e5de593ef1 ACPI: platform: Use acpi_bus_get_primary_device()
c4672bdc4730d net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work
ba8bc644f1685 xen: fix UAF in dmabuf_exp_from_pages()
d3c8519f85b78 HID: nintendo: avoid bluetooth suspend/resume stalls
155bc8f94d52c net: dsa: b53: do not enable EEE on bcm63xx
b101fc9ac18d1 scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set
41168ed90f98e bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
d02dd7ce8e52b PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
bb2b3e6047163 PCI/sysfs: Demacrofy pci_dev_resource_resize_attr(n) functions
a8adf64fe7fd5 genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
482ba972f9638 pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
8ddda06ae356f drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw
0786b38af822f drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
445835710fd0e drm/amdgpu: rework i2c init and fini
5db7d4e7c980f drm/amdgpu/atombios: drop empty function
079ec13f481cc drm/amdgpu: Remove unused amdgpu_i2c functions
d2ea99884793c wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
68059b6e9f729 tty: serial: 8250: protect against NULL uart->port.dev in register
59442ba701d3a serial: 8250: invert serial8250_register_8250_port() CIR condition
d5eb39d6178ca driver core: Avoid warning when removing a device while its supplier is unbinding
6e9e007ee1dfb virt: acrn: Fix irqfd use-after-free during eventfd shutdown
7c9fee40fc8d8 RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
50bf37362362c wifi: iwlwifi: mvm: fix P2P-Device binding handling
567d7c3f93f8d drm/amdgpu: harden FRU PIA parsing with bounded helpers
cf1dadc5d24ee drm/amdgpu: Refactor FRU product information
c1f2f34d681a0 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq
6fc7ab7fcd7ee drm/amdkfd: fix SMI event cross-process information leak
84fc3f30b87e0 pds_core: quiesce DMA before freeing resources
29723256fccf4 exfat: fix handling of damaged volume in exfat_create_upcase_table()
af3c9c0bf8542 exfat: resolve memory leak from exfat_create_upcase_table()
1d8e1e99b063d perf: Fix addr_filter_ranges lifetime
8e4a07ed82bae wifi: mac80211: ibss: wait for in-flight TX on disconnect
2c5db82778f56 smb/client: zero-initialize stack-allocated cifs_open_info_data
c422d5d53f135 wifi: iwlwifi: pcie: null RX pointers after free
5e871c03506c5 wifi: iwlwifi: mvm: validate TX_CMD response layout
88767bf9fd2e7 wifi: iwlwifi: mvm: remove mvm prefix from iwl_mvm_tx_resp*
7c293e83d86cf ksmbd: fix maximum allowed access checks
d46b67c245229 ksmbd: remove redundant DACL check in smb_check_perm_dacl
190f3bdfaef8d perf/x86/intel/pt: Fix stop/start with no update
7abab59d6c99b remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
e36b1c2eafcaa powerpc/xive: propagate IPI init errors to prevent use-after-free
d929980d771f8 powerpc/xive: add error return value to xive_smp_probe()
50ddd82b88b1d ACPI: bus: Introduce acpi_bus_get_primary_device()
bf75f14d755f9 memcg: make the v1 soft limit knob inert
28c5a3a572f6c svcrdma: Reject Write/Reply chunks with segcount 0
94b450977c602 nfsd: convert nfsd_net boolean flags to unsigned long flags word
e7c1923c5f30a mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
64b1a9384db9c iommu/arm-smmu-v3: Manage teardown with devm
6640f778aa3d4 i3c: master: Fix recursive locking during device registration
41b2025709ec1 nvdimm: virtio_pmem: refcount requests for token lifetime
1f661f42beb55 drm/v3d: Clear queue->active_job when v3d_fence_create() fails
d2d40574b9b27 cxl/mbox: Clamp mailbox output allocation to the payload size
cda8af27b787d drm/amd/display: Fix dangling pointer in plane reset function
ef3293c87a79f drm/amd/display: Fix dangling pointer in CRTC reset function
4dda09e7ca0bf mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
06bdccd50bb9a mm: name the anonymous MMOP enum as enum mmop
5b1ebdc12131e mm: change type of state in struct memory_block
2ba67aa183a3c dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout
e37c67f768234 hwrng: core - fix rng list on registration error
642648fa75952 cgroup/cpuset: Make nr_deadline_tasks an atomic_t
f048044ad2e5f cgroup/cpuset: move common code to cpuset-internal.h
2294a8302bacb cgroup/cpuset: introduce cpuset-v1.c
94033c193bc38 bpf: Reject MEM_ALLOC BTF accesses past object bounds
5b8a40de738b7 time/namespace: Validate nanosecond field in proc_timens_set_offset()
56f92fecd8041 bpf: Reject writes through untrusted BTF pointers
30674a7bbf203 platform/x86: dell-wmi-base: Fix handling of ultra performance key
fc45f6e4b86c2 platform/x86: lg-laptop: Fix LED resource handling
2147065d3a4e1 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
72888d54bae36 usb: gadget: uac: validate rate list length before storing
959ed35f8c8f0 platform/x86: asus-wmi: fix resource leaks on probe failure
0c57c1aede122 platform/x86: asus-wmi: disable USB0 hub on ROG Ally before suspend
201bdf10ae92e esp: do not unref managed frag pages in esp_ssg_unref()
b7129930d1ec4 RDMA/rvt: Return NULL after port allocation failure
e835bd88ce9dd firmware: arm_scmi: Clean up channels on setup failure
d8ecdceeb90cd firmware: arm_scmi: Fix SCMI device destroy lifetimes
bd2a5a876904e drm/msm: Only fini scheduler after successful init
f3eddc7913e14 drm/sched: Use struct for drm_sched_init() params
a6090eeb289c5 bpf: Zero queue and stack outputs on lock failure
7285f004293e7 riscv, bpf: Fix memory leak in bpf_jit_free
28dbc73272283 bpf: remove unused parameter in bpf_jit_binary_pack_finalize
0ee638956cc08 powerpc/bpf: rename powerpc64_jit_data to powerpc_jit_data
29a2a166450a3 ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()
3886d944b506e RDMA/erdma: complete object teardown when the destroy command fails
a5c6316052f0f bpf: Fix WARNING in bpf_tracing_link_release
dc6e5d802c884 pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip
566109f1ee4e3 scsi: ufs: core: Validate string descriptors
dc884df788e60 scsi: ufs: core: Convert string descriptor format macros to enum
9265fa8190312 spi: oc-tiny: switch to managed controller allocation
6e3e93bc718c4 clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error path
d867db0a26029 PCI: Fix UAF when probe runs concurrent to dyn ID removal
ec023f18ace20 PCI: Fix dyn_id add TOCTOU
65b1fb5670e46 PCI: Make pci_match_one_device() match on ID instead of device
e1b23f264f360 PCI: Initialize temporary device in new_id_store()
68c1d2c085f20 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
d4aec20f3a846 wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()
79c6f4f7d16ee wifi: ath12k: fix stride mismatch in mac_phy_caps_parse()
b2ecd548f89a4 wifi: ath11k: fix stride mismatch in mac_phy_caps_parse()
c9c1e3da0a206 firmware: qcom: scm: Fix NULL dereference in IRQ handler before __scm is published
0b187e14dab45 md/raid1: create serial pool adding rdev to array with serialize_policy=1
5a540ced720b4 misc: sgi-gru: remove interrupt-context page-table walks
e086ef5a0e310 mm/treewide: replace pmd_large() with pmd_leaf()
2c321f86846ea wifi: mt76: fix non-AQL packet accounting for MLO stations
7198d8fcfdd3e wifi: mt76: mt7915: unwind state on add_interface failure
3d079589add6e wifi: mt76: mt7915: Fix an error handling path in mt7915_add_interface()
a582b1d54313d wifi: mt76: mt7915: allocate vif wcid in the same range as stations
bc4f4389f439e wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
5dd845c6388c6 wifi: mt76: cancel reset and rc work on device unregister
7f96bf0d24b2a bpf, x86: Fix trampoline stack size for 128-bit arguments
332c9c1a148d0 arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry
5f47c9bc4a62e wifi: nl80211: clean up color-change beacon data on errors
51423d370739a wifi: nl80211: check link is beaconing for color change
66b89c6a7da47 wifi: brcmfmac: fix P2P action frame handling without device vif
9374943fc5a45 wifi: cfg80211: stop PMSR before P2P and NAN teardown
e2ddbfd826836 serial: core: do fallible allocations before the console can be registered
a9c0ffe5930c9 serial: core: clear freed pointers on uart_register_driver() failure
ea3d2fae7c1d6 tty: skip cdev_del() when no cdev is registered
360a49fc53acd HID: logitech-hidpp: Fix FF device cleanup on init failure
37cb84b992718 HID: steam: Reject short reads
17c18a0df70c2 blk-cgroup: fix race between policy activation and blkg destruction
7f97c762b5f6e ublk: check import_ubuf() return value
7dec19f6bafe4 ocfs2: validate inline xattrs during inode block validation
df002834cfd88 thermal: hwmon: Remove hwmon class device along with its parent
233f1b7fe2980 RDMA/erdma: Hold QP references for AE and CM processing
b672d4de13247 ocfs2: o2hb: quiesce negotiate handlers and timeout work
d64708cc119db ocfs2/cluster: keep heartbeat local node stable
c0da108b346db ocfs2/heartbeat: fix slot mapping rollback leaks on error paths
4acc761b4e3fe bpf: Clear buf on error in __bpf_get_task_stack
a3205bd1f2180 module/dups: Fix use-after-free in kmod_dup_req lifetime handling
decea8279bec5 drm/amd/display: Resize MST HDCP per-connector arrays to 32
ba63c62d4252f coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable
710a2448a06a8 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
c97277aa6ce8a btrfs: defrag: fix deadlock between defrag and delalloc space reservation
043b6fd9706e4 btrfs: always wait for ordered extents to avoid OE races
20b2c2f3316e8 btrfs: check if root is readonly when setting posix acl
202ac9e469b78 btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()
0fa448369c87e Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
98666d8feb514 Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
16c8321ee40c4 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
b6c9daf6097f9 bpf: Fix mmap_lock leak in irq_work path
9e71e332fa2c7 NFS: Return a delegation the client fails to record
a457ff1189f22 amt: Don't support cross-netns setup.
8f823b47eb889 clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
af811970da4f0 nvmet: fix max_qid race between configfs and controller allocation
f535a34831f83 ocfs2: validate orphan slot during inode read
eacdd27ca8297 ocfs2: validate DIO orphan slot during inode read
08a31a2cc3d1c null_blk: free zones array on device power-off
53ccb4b967edc blk-iolatency: clear delay state when freeing policy data
6b59f976db5de blk-iocost: clear delay state when freeing policy data
7166d3d60606e blk-cgroup: delay freeing policy data after rcu grace period
5f1fedccf3f7a apparmor: fix deadlock in complain-mode change_hat
67223b1150a9e ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()
7148a6c06ddf1 ksmbd: serialize oplock close with pending break ownership
5ffd180307a5e smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request()
b68d4bb6b03a6 ksmbd: defer publishing granted locks to prevent UAF/double-free race
795dca34a4154 erofs: fix interlaced ztailpacking pclusters
ecdcfa15b3d79 ksmbd: safely discard unregistered deferred locks
d20d3f6ad8b0b ksmbd: detach blocked lock requests before freeing
3deefd5fb1368 ksmbd: scope session state changes to bound connections
988f99bfddda4 smb/server: fix session leak in ksmbd_session_register()
51d162dfb618f pnfs/blocklayout: Fix device leaks on parse failure
336b6da10021c NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers
e25e5b4a76463 NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease()
742d0884a1c95 filelock: add some new helper functions
64348c55dd759 vsock: don't check the listener's sk_err in vsock_accept()
45be87c5195f3 net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
793163e134028 ALSA: mtpav: shut down output timer before card teardown
43451ec94fb67 net: qlcnic: validate unified ROM sections before loading
7f8287f606c8c ip6mr: do not clone dst in ip6mr_cache_report()
c5ca770248125 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
a23a464fb58eb net_sched: sch_fifo: implement lockless __fifo_dump()
490c72868443f net: bridge: arp/nd proxy: fix reading neigh ha
6093baf2b2c57 vxlan: fix reading neigh ha
ed54460caf5b5 NFSv4.1: zero referring call lists before decoding
5fbb06d4f3d4c net/sched: account classifier filter allocations to memcg
4cc1ba2b31065 Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
19e154d794eb4 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
a78d16530c153 Bluetooth: do not leak an hci_conn when a second LE connect is rejected
bdc530baf079e octeontx2-vf: fix workqueue and netdev race in probe/remove
b951dd2fd5ede net/sched: act_ife: Only operate on Ethernet frames
fd63409b669f9 net/sched: fq: add overflow bounds to quantum and initial quantum
e85f039cf271c net_sched: export pfifo_fast prio2band[]
87ec1c55104a1 net_sched: sch_fq: change how @inactive is tracked
3e613afdc2c0c net_sched: sch_fq: struct sched_data reorg
9cbf6da967ec8 netfilter: nf_tables: skip double clone set expressions on element insert
7ee50d42a6d5c HID: sony: clean up device list on probe failure
adc34b5df5c5d NFSD: Prevent client use-after-free during close_lru reaping
0d53a47c913d0 NFSD: Prevent client use-after-free during blocked-lock reaping
7a50e138fa28e usb: dwc3: clear forceRM when issuing EndTransfer
5212f8f452b87 usb: dwc3: gadget: Reinitiate stream for all host NoStream behavior
13e9f5a913609 usb: gadget: f_midi: initialize work in f_midi_alloc()
0729ac4976410 usb: gadget: f_midi: Annotate struct f_midi with __counted_by
8cc9c5a8c559d tracing: Take trace_array reference when opening options file
ad61defb3e66a dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
6e904f9e8cb0e mm/huge_memory: transfer the pmd dirty bit to the folio on zap
ffbdc2a3834a3 powerpc/kexec_file: Prevent kexec range truncation
22dc712c170ef s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
4bf5525c6ff4a iio: light: ltrf216a: fix runtime PM reference leak in error path
49ab1dd9051d4 iio: light: ltrf216a: Return floating point values
1759a565a25c8 KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU
5c63e2ed840c8 KVM: s390: Fix memory corruption by not reinjecting CK machine checks
50fbc294e4e96 LoongArch: BPF: Refactor jump offset calculation in tail call
22760e3e9cecb f2fs: avoid NULL checkpoint thread access in sysfs
ac1284f16d560 f2fs: use new ioprio Macro to get ckpt thread ioprio level
d358d2fc6be11 f2fs: fix to migrate all curseg types during free_segment_range
58ca9f0648045 f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
21b7f66716b4f f2fs: fix to clear dirty flag on folio in error path
668cfb8ab3e22 drm/amdgpu: avoid force-completing uninitialized UVD rings
11adb2bae30a3 drm/amdgpu: force complete the KIQ ring fences on reset
5bbd7f283312d drm/amdkfd: Add TLB flush after MES queue eviction/suspension
44cad7ea3532f drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
6e1a6f3ddb87d drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
5db663fbff7b8 drm/nouveau: unsubscribe the channel-kill event before the fence context
42085d8ff5bbf drm/nouveau: remove chan->drm
5362be1dc65e4 drm/nouveau: remove nouveau_chan.device
2549b61ea1a32 drm/gpuvm: rename struct drm_gpuva_manager to struct drm_gpuvm
e79a70c2e97ae bpf: Disable preemption in bpf_get_stackid
b4a80e9e639cf PCI: Allow per function PCI slots to fix slot reset on s390
76ca11e31884b PCI: Introduce PCI_SLOT_PLACEHOLDER constant for slot_nr placeholder value
134d980491b43 ksmbd: zero pipe read compound padding
ca3a3984bf445 ksmbd: fix tree connection use-after-free in smb2_tree_connect()
f1cd6c4c35243 mm/kmemleak: avoid soft lockup when scanning task stacks
b1d7c69e6c7d3 mm/mglru: fix and remove redundant unevictable folio handling
92db780dd6445 mm/migrate_device: clear stale mapping after freeing swapcache
c2745e657f097 zram: fix out-of-bounds access in writeback_store()
a5fda7def04d9 zram: set default primary compressor in zram_destroy_comps()
52d0c5bdfe232 NFSD: check truncate permission under inode lock
64b3baebaf945 nfsd: Pass 'cred' instead of 'rqstp' to some functions.
43943532c105e lockd, nfsd: RCU-protect nlmsvc_ops dispatch
d12af460df278 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
172d038b7c4d3 nfsd: split sc_status out of sc_type
02b0532d4e5a6 NFSD: Clean up nfsd4_encode_layoutreturn()
ec55ebe19a4b1 NFSD: Clean up nfsd4_encode_stateid()
2d4f845dffca7 NFSD: Add simple u32, u64, and bool encoders
bdce362f49410 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
98fc1d21a7b80 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
94f0c73797c30 NFSD: Prevent client use-after-free during delegation revoke
352a278d5a196 ceph: fix UAF in check_new_map() on session freed during unlock
8194d8e61ef0b ceph: cap delegated inode count in ceph_parse_deleg_inos()
dd2e9824e5e7d ceph: do not repeat ceph_trim_dentries() if no progress possible
7b8c6af172878 btrfs: drop recovered reloc root refs on recovery failure
772d39c658543 btrfs: rename err to ret in btrfs_recover_relocation()
152610f284de4 btrfs: rename ret to ret2 in btrfs_recover_relocation()
64b870dff9fed btrfs: rename ret to err in btrfs_recover_relocation()
cb732d302245b btrfs: fix extent map leak in NOCOW direct I/O write
5463d96cd2e46 cifs: call pagecache_isize_extended() in cifs_setsize() when extending
b70bc592afd19 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
d837645a71915 smb: client: reject a tree connect response whose byte count is too small
bd146a8ff107c HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
61f7f4fdc0a83 HID: mcp2221: fix OOB write in mcp2221_raw_event()
b879565effd88 ext2: Fix lost inode updates for IS_SYNC inodes
719e69421de28 bpf: Disable preemption in __bpf_get_stack
0e3b8f371c385 dm array: validate array block headers on read
de932ab28a17c jbd2: use shrink_type type instead of bool type for __jbd2_journal_clean_checkpoint_list()
882212d317a7c ip: orphan prefetched skbs before multicast forwarding
62b63a505c10e ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
fe3746b41d491 ipv6: annotate data-races around devconf->rpl_seg_enabled
f99fedfd1dbff sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
b2e9e10f5a536 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
5bf47bbea3c22 svcrdma: Reject connection when transport allocation fails
5cd069ad1cf7f svcrdma: Handle ADDR_CHANGE CM event properly
8068358f445a1 svcrdma: Reject inline replies that overflow the pull-up buffer
beb4e9801f636 svcrdma: Reject Read lists that exceed the page budget
2e35ec558b8ce svcrdma: Use svc_xprt_put to free listener on create failure
38bd18764b766 sunrpc: xprtrdma: Use ERR_CAST() to return
45746d4536ce1 svcrdma: Refactor the creation of listener CMA ID
a2a16896ed530 sched/core: Make core-sched flips wait for in-flight selections
6db5af172ccc3 lockd: fix NULL dereference on lockowner allocation failure
e5e213ddd69e3 lockd: adapt to breakup of struct file_lock
977ab74712aec filelock: split common fields into struct file_lock_core
6e1645a6ee85d power: supply: charger-manager: register regulators before exposing sysfs
3cda6fe44ec6a power: supply: charger-manager: Convert to platform remove callback returning void
4e3d3923976a9 power: supply: lp8788-charger: fix use-after-free on remove
5625c186f4088 power: supply: lp8788: Use devm_power_supply_register() helper
fee7e9a801d1d power: supply: lp8788-charger: Convert to platform remove callback returning void
bcdcbef9c5e69 power: supply: max17040: propagate register read errors
6a1ae47211376 iommu/msm: Unwind probe state on registration failure
f7c9370dd1d3c platform/x86: ISST: Add a NULL check for sst_inst[]
d680ce2b39f9a platform/x86: int1092: Fix potential memory leak in sar_probe()
380b305ad7e34 platform/x86: intel_sar: Check ACPI_HANDLE() against NULL
85ef9d4c384c1 platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
7efe1c31e0903 net: l2tp: do not propagate multicast notification errors
b917f37bfcce9 net: ravb: serialize PTP clock teardown
297e96f38d3e4 net/smc: stop killed, freed and out_of_sync sharing a byte
5fa0e71d66636 net/smc: Address spelling errors
b78e34ed7e977 mfd: sm501: Fix potential memory leaks during remove
b0b8ddaf15110 mfd: sm501: Convert to platform remove callback returning void
7be73911d979b wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
ab403b9db6f71 wifi: iwlwifi: dvm: pair transport op-mode enter/leave
d6774f6af3711 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
3a2d2115ed890 wifi: mt76: mt7915: set correct background radar capability
d0c240f25e654 io_uring: defer eventfd signaling when queued from a wakeup handler
c0376820922d2 net: tap: fix wrong transport_header when sending VLAN-tagged frame
11ff7642740e6 tap: Keep hdr_len in tap_get_user()
2b9ddb7311c79 ntb: Store original DMA address for future release
4a62c07dd7c15 NTB: ntb_transport: Use ntb_get_dma_dev() for DMA buffers
e85074045bab5 NTB: core: Add .get_dma_dev() callback to ntb_dev_ops
99b82c8452887 tipc: avoid busy looping in tipc_exit_net()
82257379061c0 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
0464d55734f85 RDMA/rxe: Merge request and complete tasks
603e0ae0bea60 RDMA/rxe: Remove redundant scheduling of rxe_completer
788fbbf7d61f9 tcp: clamp route advmss to TCP_MIN_MSS
3130e7bf43ecf fbdev: Wrap user-invoked calls to fb_set_var() in helper
90be10604936c Bluetooth: ISO: zero the sockaddr before returning it in getname
9a1bd9fd13266 selinux: reject a permission value exceeding the class permission count
fef8c8afcb85d drm/amdkfd: Add bounds check for CRAT subtype length
2cbc1fbfc57b1 drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
5702e4c259809 bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
07b52a4176572 drm/amd/display: use proper context for logging
84cf00b1376c7 dmaengine: idxd: fix double free of wq, engine, and group structs
c41fa44be44e4 hwmon: (sht3x) Fix unaligned accesses
a9133c4d335e4 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
f0a544ef6e38e Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
a1656234a4a2d Drivers: hv: vmbus: use generic driver_override infrastructure
3d7b808ec3529 netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
d031617045dc7 cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
75ed49f973d79 soc: xilinx: Shutdown and free rx mailbox channel
b447688f492b8 soc/xilinx: zynqmp_power: Convert to platform remove callback returning void
c305853027c04 scsi: hisi_sas: Add slave_destroy interface for v3 hw
592a0e78ab08f media: atomisp: gc2235: fix UAF and memory leak
fa9560b6d3f66 EDAC/igen6: Fix call trace due to missing release()
95cda0446f510 netfilter: synproxy: fix unaligned memory access in timestamp adjustment
370c79e93f0f0 netfilter: synproxy: adjust duplicate timestamp options
1c6cb2838f82e netfilter: synproxy: drop packets if timestamp adjustment fails
f03312dad6abe netfilter: make nftables drops visible in net dropmonitor
1b52aeb40c9f0 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
d9b17f9ce67d0 btrfs: lzo: reject compressed segment that overflows the compressed input
30e5ee98e86ad octeontx2-af: npc: Fix size of entry2cntr_map
bf862fdee4831 ALSA: seq: oss: Serialize readq reset state with q->lock
31633ba13cc49 coresight: ete: Always save state on power down
c67e70202cfd6 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
24a753a49d068 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
67a5d905c17a5 drm/amdgpu: reject oversized IBs with per-ring packet limits
1ec5f6aa38ea9 scsi: core: pair EH runtime PM get and put
4a4410de8dc69 sctp: validate cookie AUTH state before use
2512289cbf587 ipvs: revalidate ihl to prevent out-of-bounds access
bd897e414451f l2tp: fix tunnel and session refcount leak on seq_file release
3770a4794a143 firewire: ohci: fix NULL pointer dereference in ar_context_release
5d05c4252c09c gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock
b87c0d24386ed soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
5d00c9c1c951a btrfs: lzo: reject inline extents without valid headers
fb22bedf0c4f4 bpf: Fix netns reference imbalance in conntrack kfuncs
96da3e1439e7d vhost_iotlb: bound map allocation in add_range
ce443f6827b97 hwmon: (pmbus) Fix type confusion in notification logic
4db3b48a966ed netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
950dac9e8c4e3 s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
a9e0efcb1125e watchdog: at91sam9_wdt: prevent timer rearm during teardown
61dd022c55c73 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
cc325ce1c40a1 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
c71bacacd5916 tls: rx: restore msg_iter before TLS 1.3 optimistic retry
e3738530ad9c9 selftests: tls: add rekey tests
bea345a8d2f02 selftests: tls: add test with a partially invalid iov
25d27d5fa8645 eventfs: Use children field for rcu head and add memory barriers
f6cf9832e677e mm/page_table_check: skip special zero mappings
ca05d9abde219 btrfs: skip global block reserve accounting for rescue mounts
71714a2cec6c6 netfilter: nf_tables: make nft_object rhltable per table
c24b3379c0ff0 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
724c8edbacf12 net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds
52c753b462652 net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
44590dc53c9e9 Bluetooth: ISO: hold sk properly in iso_conn_ready
1106b26e86ac1 octeontx2-af: Block VFs from clobbering special CGX PKIND state
dd1a334523ba5 s390/zcrypt: Close speculative mem read possibility
f82d42577ee4a wifi: ath11k: cancel SSR work items during PCI shutdown
932ebfad767be OPP: Fix race between OPP addition and lookup
a6c5f5d98719e RDMA/hns: Fix log flood after cmd_mbox failure
bc963e193b314 ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
fc11e3f0daaad nvmet-tcp: fix page fragment cache leak in error path
3f5e8fa9ae290 net: introduce page_frag_cache_drain()
bc53b85adb103 nvmet-tcp: allocate socket file
cc1c1682fa593 nvmet-tcp: make nvmet_tcp_alloc_queue() a void function
923a6f3172a36 md/raid1,raid10: fix deadlock in read error recovery path
d960cd5dbcc6a wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
0fe5ca2d56f01 vhost: fix vhost_get_avail_idx for a non empty ring
578a4ee936b40 vhost: move smp_rmb() into vhost_get_avail_idx()
9cb2db3791df9 vhost: correct misleading printing information
dcabbf7da4382 ocfs2: validate fast symlink target during inode read
394317e96702a ocfs2: add extra consistency checks for chain allocator dinodes
1241e459a1bd1 netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
ff584d3735b13 RDMA/siw: Fix endpoint/socket association handling
7b17fdbfb5c9e RDMA/siw: Introduce siw_destroy_cep_sock
628a469d2a73e bpf: Clear rb node linkage when freeing bpf_rb_root
f0a49d16804d3 bpf: Reject sleepable BPF_LSM_CGROUP programs at load time
ec485257ccbc7 ixgbe: do not configure xps for XDP queues
663f184b51492 ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
eae296065ede4 ALSA: seq: Fix kernel heap address leak in bounce_error_event()
7d07df8a200ca ALSA: seq: Drop superfluous filter argument of get_event_dest_client()
8efa9fcc1d31b cxl/region: Block region delete during region creation
3e8f3959a7fd2 bnxt: fix head underflow on XDP head-grow
2fc2c92320272 net: watchdog: fix refcount tracking races
ae429220c7f97 ALSA: seq: avoid stale FIFO cells during resize
348a52e50a462 ALSA: seq: Clean up fifo locking with guard
a0024ab97592a ALSA: seq: fifo: Use guard() for locking
6b59007d95aee sockmap: Fix use-after-free in udp_bpf_recvmsg()
88baaa8ca3731 RDMA/bnxt_re: Initialize dpi variable to zero
8e59bd37d6d63 RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
7d89bff21c12e RDMA/irdma: Replace waitqueue and flag with completion
a2275dce05e6d soundwire: fix bug in sdw_add_element_group_count found by syzkaller
a562485c359d0 xprtrdma: Fix ep kref imbalance on ADDR_CHANGE
921e2baa626d1 md/raid1: fix writes_pending and barrier reference leaks on write failures
f076460c5205c md/raid10: fix writes_pending leak on write request failures
6d21a3fed9be4 md/raid10: Handle bio_split() errors
80ac31cce5543 md/raid10: fix writes_pending and barrier reference leaks on discard failures
669bc3b345712 bpf: Guard conntrack opts error writes
d0282a1546e75 bpf: net: netfilter: drop dead NULL checks
158a5480d5196 md/raid5: avoid R5_Overlap races while breaking stripe batches
f49ed02fd8c98 net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync
6aeb4ba4fb098 tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
81892d83cc897 sctp: add INIT verification after cookie unpacking
cd0e037130806 hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
5098308ad72f8 sctp: fix addr_wq_timer race in sctp_free_addr_wq()
72e27ef70a202 xen/pvcalls: bound backend response req_id before indexing rsp[]
2e7888bb635d9 afs: Fix reinitialisation of the inode, in particular ->lock_work
f72176bde0cc0 HID: bpf: Fix hid_bpf_get_data() range check
268869794170a net/mlx5e: Fix publication race for priv->channel_stats[]
333a39f134dd0 Bluetooth: 6lowpan: avoid untracked enable work
e3b20de8d7c06 net/liquidio: drop cached VF pci_dev LUT
3b0aa139ba09a perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
db2b40dc12cd6 gpio: mvebu: free generic chips on unbind
2d0effadf8d2c ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
65d35cb555f40 netfilter: nft_lookup: fix catchall element handling with inverted lookups
eb74f3feb68e6 KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
043c509f24880 mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
6626fb859f4c4 fs: Remove NTFS classic
1dc6653c47147 mtd: maps: vmu-flash: fix fault in unaligned fixup
c286319746cef ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
df99ca9b5b8e2 ocfs2: validate i_refcount_loc when refcount flag is set
b8fa4d063e3b0 ocfs2: add suballoc slot check in ocfs2_validate_inode_block()
f4cd214883d77 ocfs2: correct l_next_free_rec in online check
584d7d14d9b40 nvmet-auth: reject short AUTH_RECEIVE buffers
0bdb510cd7c4b nvmet: Introduce nvmet_req_transfer_len()
374775626c327 dm-verity: fix buffer overflow in FEC calculation
face65f80c694 mmc: vub300: fix use-after-free on probe failure
181b46e76a218 wifi: ieee80211: validate MLE common info length
d0951ed366710 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
7e13e5b087375 ovl: check access to copy_file_range source with src mounter creds
98ca831065c4d net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
3b71f51fa3a24 LoongArch: Fix address space mismatch in kexec command line lookup
aa24049ce2fc9 loongarch, kexec: change dependency of object files
4927ab8a8acc8 xfrm: fix stale skb->prev after async crypto steals a GSO segment
d52ff592abfcd RDMA/irdma: Prevent user-triggered null deref on QP create
a5afc00280986 wifi: mac80211: defer link RX stats percpu free to RCU
88f31eac74b9d wifi: cfg80211: add link_station_info structure to support MLO statistics
0246df249c04e wifi: mac80211: refactor populating mesh related fields in sinfo
30c67926d41c4 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
c55590e4c69e0 wifi: cfg80211: use wiphy work for socket owner autodisconnect
d312a71b19bb8 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
f6814814b3bdd bpf: Fix UAF in sock clone early bailouts
95ddf04135a78 bpf: Use rcu_read_lock_dont_migrate in bpf_sk_storage.c
8faa3deda8d06 rcu: add rcu_read_lock_dont_migrate()
c0131f007dd29 bpf: Disable migration when cloning sock storage
bba24ce0e5299 bpf: Disable migration when destroying sock storage
4827c824a203e scsi: core: wake eh reliably when using scsi_schedule_eh
3ff6b534d2082 tipc: serialize udp bearer replicast list updates
bac237c2aedb8 pds_core: fix use-after-free on workqueue during remove
895b3f83f030c pds_core: Clean up init/uninit flows to be more readable
c004f1985c570 pds_core: Don't assign interrupt index/bound_intr to notifyq
c968b2417f6a1 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths
9e904b3608444 cifs: prevent readdir from changing file size due to stale directory metadata
3be8dcc1a5854 drm/vc4: hvs/v3d: Fix null dereference in unbind
c8a4acc19dcdc net/mlx5: Fix MCIA register buffer overflow on 32 dword reads
3531910845165 drm/amdgpu: Fix context pstate override handling
2b817c0dfc653 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
dc30139679354 drm/i915/bios: range check LFP Data Block panel_type2
bedeee4612afc drm/i915/gt: Fix NULL deref on sched_engine alloc failure
fae63319ad397 drm/i915/mst: limit DP MST ESI service loop
1748043b5114c drm/amdgpu: Release VFCT ACPI table reference
8151bfd641384 drm/amdgpu: Add wrapper for freeing vbios memory
9ed82f9cb1d6c drm/amdgpu: Use dbg level for VBIOS check messages
cf55c6f1b62a8 drm/vc4: Shut down BO cache timer before teardown
ae6ccae32f51f media: vivid: fix cleanup bugs in vivid_init()
1d0b99ef7fcb6 LoongArch: Move jump_label_init() before parse_early_param()
a2516be690488 ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
3350acfa72b2e vfs: make LAST_XXX private to fs/namei.c
3100f7fc873bb ksmbd_vfs_rename(): vfs_path_parent_lookup() accepts ERR_PTR() as name
a7bf4f5b19965 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
9174992ee1045 Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
22e371a93563c net/handshake: Take a long-lived file reference at submit
3e339c88b8c30 ALSA: hda/cs35l41: Fix firmware load work teardown
eec1dd2586c40 ksmbd: prevent path traversal bypass by restricting caseless retry
2ad5509dd576a ksmbd: use opener credentials for ADS I/O
a6a951416b55e ksmbd: validate NTLMv2 response before updating session key
6825a45f6b8ef smb/client: fix chown/chgrp with SMB3 POSIX Extensions
0f012938f2130 cpufreq: qcom-cpufreq-hw: Fix possible double free
203016396f00b cpufreq: Make cpufreq_driver->exit() return void
41401e2f4c175 cpufreq: pcc: Remove empty exit() callback
4e7d3c98fed73 USB: iowarrior: fix use-after-free on disconnect race
8ae9bb92fc9a7 nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
11d48f777cf8f crypto: qat - protect service table iterations with service_lock
02b88fa993582 hwmon: (lm90) Add lock protection to lm90_alert
bdad77438cc2b drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
3812cfe6cb0a5 erofs: fix metabuf leak in inode xattr initialization
8efbea0253b7f ksmbd: validate SID in parent security descriptor during ACL inheritance
5fe97797412aa wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
55b170713aa54 wifi: mac80211: fix missing RX bitrate update for mesh forwarding path
5ea15e7823225 netfilter: x_tables: allocate hook ops while under mutex
2a5defedd154a netfilter: x_tables: allow initial table replace without emitting audit log message
124f5187c3dd5 netfilter: Use kmemdup_array instead of kmemdup for multiple allocation
ff9ecefd488a4 mm/util: Introduce kmemdup_array()
6fe4c808b6cdb netfilter: ebtables: move to two-stage removal scheme
5fc488f46086d netfilter: bridge: eb_tables: close module init race
1fe96176636cb hwmon: (lm90) Stop work before releasing hwmon device
b28b862b07257 cgroup/rstat: validate cpu before css_rstat_cpu() access
14dbf22c397b7 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
ee4b2ba9d3015 net/handshake: Drain pending requests at net namespace exit
7b81c1378b79c Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
6bacd22e1eae7 usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
816c6251409db usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
bbd3a27e4f99f KVM: SEV: Ignore Port I/O requests of length '0'
e35cf322897dd drm/amdgpu: fix amdgpu_hmm_range_get_pages
525cc9df65436 drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring
b0f7bd5eeb903 gcov: use atomic counter updates to fix concurrent access crashes
bcc9df992f3cb f2fs: read COW data with the original inode during atomic write
5e10b1747547c fbdev: omap2: fix use-after-free in omapfb_mmap
2d60e3b176a4b fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
01930f94b8b13 drm/msm: always recover the gpu
a632474c793b7 drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
9d63dd026644f wifi: mt76: mt7921: Place upper limit on station AID
1cad9afbb2d55 drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
793bf1f4e469c net: mana: Guard mana_remove against double invocation
4255c8f756b78 net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind
7107b047e709a btrfs: only release the dirty pages io tree after successful writes
312ecea13b677 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
87484866cae91 wifi: fix leak if split 6 GHz scanning fails
3bad189a31eb7 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
f51a7b611bd97 tools: ynl: extend netdev sample to dump xdp-rx-metadata-features
8cb3a5ecef999 bpf: make it easier to add new metadata kfunc
dd75066882ecc sctp: validate embedded INIT chunk and address list lengths in cookie
d95edbbf7830d staging: rtl8723bs: fix buffer over-read in rtw_update_protection
94ea9dc65fae4 staging: rtl8723bs: clean up redundant & parentheses
f90cda7f7ae75 Staging: rtl8723bs: Delete dead code from update_current_network()
890083673a623 Staging: rtl8723bs: Remove dead code from _rtw_free_network()
18143799ad51a staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
6cdcf0d16c809 nvmem: core: fix use-after-free bugs in error paths
38434334a32c6 nvmem: core: Rework layouts to become regular devices
cc7ce6736b237 nvmem: Move of_nvmem_layout_get_container() in another header
18ca42f07ad00 of: device: Export of_device_make_bus_id()
cbdd6f0fb19a0 fs/mbcache: cancel shrink work before destroying the cache
1034251715a34 btrfs: fix deadlock between reflink and transaction commit when using flushoncommit
fdfa287956d00 PCI: use generic driver_override infrastructure
4005cb89139f7 vdpa: use generic driver_override infrastructure
dbba371b19129 bus: fsl-mc: use generic driver_override infrastructure
7bedc489611f0 wifi: ath11k: fix memory leaks in beacon template setup
e9d197c248e70 powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy
6f571bf37da84 powerpc/64s: Fix unmap race with PMD migration entries
a2af91af95369 wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req()
533b1a9fa0128 wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
5895cfc76924a net: pull headers in qdisc_pkt_len_segs_init()
7f0062c40781f sctp: disable BH before calling udp_tunnel_xmit_skb()
166a08644aa50 iommu/amd: Fix clone_alias() to use the original device's devid
e4d07fd4e3002 greybus: raw: fix use-after-free on cdev close
c260c874a6d57 f2fs: avoid reading already updated pages during GC
0645fa4d48e9b f2fs: fix data loss caused by incorrect use of nat_entry flag
359906450690a ice: fix double-free of tx_buf skb
ede973d62d26d netfilter: nat: use kfree_rcu to release ops
d8ddbc3330fa6 sched/psi: fix race between file release and pressure write
926ec3937b28d fsnotify: fix inode reference leak in fsnotify_recalc_mask()
759053333a40c libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
37d028a473b08 tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR
74d33525db50d Revert "net/smc: Introduce TCP ULP support"
e327021bd73b1 RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE
2405730fde96f netfilter: nf_tables: use list_del_rcu for netlink hooks
d8cafd0226d5d selinux: allow multiple opens of /sys/fs/selinux/policy
ef8b71a0fc692 iio: frequency: admv1013: fix NULL pointer dereference on str
7afabc08721ec iio: frequency: admv1013: add dev variable
f1f4cac657f86 iio: frequency: admv1013: Use devm_regulator_get_enable_read_voltage()
58f9d54a8109f device property: Add fwnode_property_match_property_string()
3e8cdf184646c coresight: tmc-etr: Fix race condition between sysfs and perf mode
d772e8570f19a drm/amd/display: Fix dc_link NULL handling in HPD init
dd74a790818eb spi: mpc52xx: fix use-after-free on registration failure
c6e3b9f5dcb80 spi: mpc52xx: fix controller deregistration
125a7eb177a94 spi: mpc52xx: switch to use modern name
2d8b30b496bc5 RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
d1820a5814ead f2fs: fix fsck inconsistency caused by FGGC of node block
8f3a5dc4055e1 riscv: kvm: fix vector context allocation leak
783dc000b8be6 spi: microchip-core-qspi: control built-in cs manually
03348b440f694 dm-verity-fec: fix reading parity bytes split across blocks (take 3)
fcef67506c023 KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
165b08d2d1346 KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
b1a45e8a59bcf KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
2e661773890e6 KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT
33deba9bf5c34 RDMA/mlx5: Fix UMR hang in LAG error state unload
4db5e4c8f1103 gfs2: fix memory leaks in gfs2_fill_super error path
ab4aeab2d630e iommu/vt-d: Clear Present bit before tearing down context entry
237e0524a5381 erofs: fix inline data read failure for ztailpacking pclusters
107e169f96392 net: stmmac: fix oops when split header is enabled
12addb8ab5eec btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation
8e1623e7d61fa bpf: Fix tcx/netkit detach permissions when prog fd isn't given
11d35b1101344 ipvs: do not keep dest_dst if dev is going down
b0dd8637fbaae netfilter: nf_tables: revert commit_mutex usage in reset path
c36b0515c6445 iommu/vt-d: Clear Present bit before tearing down PASID entry
cde7f709d1025 HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
63f67e525be21 HID: Intel-ish-hid: Ishtp: Fix sensor reads after ACPI S3 suspend
53aaf083de197 gfs2: Fix slab-use-after-free in qd_put
32d7120a499d4 list_lru: allow explicit memcg and NUMA node selection
60310ed5d3d3a mm: list_lru: Update kernel documentation to follow the requirements
6451ea47d60a8 net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
1106412414dc3 net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ
a71ce398347fe ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
baabbd2919151 scsi: qla2xxx: Completely fix fcport double free
73bb6b15f1fd7 i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
04b2853fdbb2e i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
320942ce316a1 btrfs: reserve enough transaction items for qgroup ioctls
0e77f1c8ebf5b btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()
a35b38cb4b0dd btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()
87fc584a72bc4 drm/amdgpu: Skip vcn poison irq release on VF
3cd7a71958c9f drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
5593c9b255ae7 alpha: fix user-space corruption during memory compaction
a91476c7b4091 arch: turn off -Werror for architectures with known warnings
aad97c92119cb usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()
480aa6ffd4ac7 9p/xen: protect xen_9pfs_front_free against concurrent calls
566899af05324 vhost: move vdpa group bound check to vhost_vdpa
6f129a251c279 kcm: fix zero-frag skb in frag_list on partial sendmsg error
1cf0ef7399188 team: avoid NETDEV_CHANGEMTU event when unregistering slave
c0da84e308a0b wifi: rtw89: pci: validate sequence number of TX release report
5efde07521309 net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
68fe91df6ea82 netconsole: avoid OOB reads, msg is not nul-terminated
56eab82fa6fb5 ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
5cc021586420c wifi: iwlwifi: fix 22000 series SMEM parsing
759e44a6cba8e xfs: remove xfs_attr_leaf_hasname
d60f09d2d16c4 ntfs3: fix circular locking dependency in run_unpack_ex
bd5e7ba28a49b fs/ntfs3: Accumulated refactoring changes
c939bfa67d221 btrfs: fix zero size inode with non-zero size after log replay
cff22dd364b24 btrfs: tree-log: don't use token set/get accessors in fill_inode_item()
f03cd10a3513e btrfs: convert to new timestamp accessors
20b98d9ffb097 srcu: Use irq_work to start GP in tiny SRCU
3ff29beb3b82e irqwork: Move data struct to a types header
94ad192f7b9b5 types: move struct rcuwait into types.h
f8f3bb89ab677 xfrm: account XFRMA_IF_ID in aevent size calculation
34b8390ac0ba5 ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
a05a85779c257 net: ioam6: fix OOB and missing lock
73c2dc2c14d6a x86-64: rename misleadingly named '__copy_user_nocache()' function
3d6de8467236c Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
df966f0def875 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
218b93b7e284d HID: core: Mitigate potential OOB by removing bogus memset()
ca27733152dbd HID: rate-limit hid_warn to prevent log flooding
556a757847aed HID: core: Add reserved item tag for main items
0d377825548fe mpls: add seqcount to protect the platform_label{,s} pair
5057502630fbc net: use skb_header_pointer() for TCPv4 GSO frag_off check
dfee8da127baf Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
1aac6b271e0a8 bpf: Fix incorrect pruning due to atomic fetch precision tracking
1e4b738dd0d0f Bluetooth: hci_event: move wake reason storage into validated event handlers
481f7a463ae4b drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
fdc3aa4c23d3e usb: gadget: f_ecm: Fix net_device lifecycle with device_move
b1d854462510f usb: gadget: f_eem: Fix net_device lifecycle with device_move
edb0804705188 usb: gadget: f_subset: Fix net_device lifecycle with device_move
9701a98f4459b usb: gadget: f_rndis: Fix net_device lifecycle with device_move
ad7d18df7423c ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()
7e345de2e6947 crypto: af_alg - limit RX SG extraction by receive buffer budget
94439cbe478b5 xfrm: hold dev ref until after transport_finish NF_HOOK
adc2fe90827e0 xfrm: hold device only for the asynchronous decryption
a516594c502fd net: adopt skb_network_offset() and similar helpers
a229a4dc87302 net: lan966x: fix page pool leak in error paths
808a34cdbe8ce rxrpc: proc: size address buffers for %pISpc output
3aa77f5da0ecb usb: gadget: f_hid: don't call cdev_init while cdev in use
777a8ebd2da35 KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock
f554953cf4fab KVM: SEV: Use long-term pin when registering encrypted memory regions
1eb35c54cd81c s390/mm: Add missing secure storage access fixups for donated memory
bac13309339b6 spi: spi-dw-dma: fix print error log when wait finish transaction
a8a3fb2888e2c nvmet: move async event work off nvmet-wq
18a4543c1750f ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
b1f62588ab1be cxl/port: Fix use after free of parent_port in cxl_detach_ep()
c5e2de193831a net: bcmasp: fix double free of WoL irq
d5dcca707f56c iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
6e8eb467bed6a spi: use generic driver_override infrastructure
f69491478e3de drm/amdgpu: prevent immediate PASID reuse case
6ea2a79faed97 drm/amdgpu: Remove usage of the deprecated ida_simple_xx() API
1df0123f96f37 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
3bba71395ad45 fs: super_set_uuid()
c9e845014723d serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
f5a41b61b5faa bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
44f6b01693b87 bpf, arm64: Enable the inline of bpf_kptr_xchg()
f2b29bbe35522 ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz
ce6253fe71881 sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting
5e2fc90018635 PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
3555e41737c0f cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
da5f0166cef3d net: add xmit recursion limit to tunnel xmit functions
e873e8c16b2fb tcp: secure_seq: add back ports to TS offset
43ad494ac6e94 ksmbd: add chann_lock to protect ksmbd_chann_list xarray
34614f5dd26c8 btrfs: reject new transactions if the fs is fully read-only
b2b9ac2bb2c5b drm/amd/pm: Disable MMIO access during SMU Mode 1 reset
152fc4f7b4a8a ALSA: usb-audio: Prevent excessive number of frames
513587caec66b spi: tegra210-quad: Protect curr_xfer check in IRQ handler
4c7ad40c285ab of: unittest: Fix memory leak in unittest_data_add()
17260b5215d4c staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
015f9fbcf3382 bpf: Mark bpf_refcount field as unique
11e78304b0113 PCI: endpoint: Add missing NULL check for alloc_workqueue()
ab0bdaf7a7f4f net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels
d57e31c8df7b8 wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
13f96c3b73a84 wifi: rtw88: debugfs: support multiple adapters debugging
c02b1d244a5d7 wifi: mac80211: don't WARN for connections on invalid channels
863b9b7be824a md: suspend array while updating raid_disks via sysfs
2ad6c244d65a8 md: add new helpers to suspend/resume and lock/unlock array
2284eab166f2d md: add new helpers to suspend/resume array
f150854e9a0bc mips: unhide uasm_in_compat_space_p() declaration
9cfda98cf02ea MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
585a656283c95 functionfs: fix the open/removal races
f68515eb8f3cf functionfs, gadgetfs: use simple_recursive_removal()
9aa31e353d9f4 usb: gadget: functionfs: Factorize wait-for-endpoint code
61c3f32b425ab usb: gadget: Support already-mapped DMA SGs
8cf889d45bbc8 Input: lkkbd - disable pending work before freeing device
8fdbc6f9a994e shmem: fix recovery on rename failures
b9d8cfd6d77f5 Input: alps - fix use-after-free bugs caused by dev3_register_work
0d0a1a267c1ee scsi: qla2xxx: Clear cmds after chip reset
abfbceda0d239 wifi: ath12k: Fix MSDU buffer types handling in RX error path
d6028caa0ee39 bpf: Fix stackmap overflow check in __bpf_get_stackid()
5d5d130835b41 coresight: ETR: Fix ETR buffer use-after-free issue
dc6d1249ee35c md: fix rcu protection in md_wakeup_thread
a17d1bca5aba1 md: fix stopping sync thread
66eb53cecc5f8 gfs2: Prevent recursive memory reclaim
9a8e531543535 scsi: imm: Fix use-after-free bug caused by unfinished delayed work
2eb6a5f6adb7d tty: serial: ip22zilog: Use platform device for probing
79693f738680d serial: ip22zilog: Use port lock wrappers
1c963811b0824 scsi: ufs: ufs-qcom: Fix UFS OCP issue during UFS power down (PC=3)
51713b285096a scsi: ufs: qcom : Refactor phy_power_on/off calls
f0ee42f47cc1b drm/amdgpu: fix gpu page fault after hibernation on PF passthrough
1e00721013ff9 drm/amdgpu: Restore partition mode after reset
1a7865e3e4de2 mlx5: Fix default values in create CQ
b68d1f321119b drm/amdgpu: remove two invalid BUG_ON()s
e61dfd906ad02 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
6776866cffbc2 media: nxp: imx8-isi: Fix streaming cleanup on release
0a187ea7a5b4e ASoC: Intel: avs: Do not share the name pointer between components
29c742ff222dd md/raid10: wait barrier before returning discard request with REQ_NOWAIT
3d608e67b966c drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM
8a0fc82502321 drm/amdgpu: Show vram vendor only if available
31d6c9216aa1b Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete
47a92030422d0 mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop
69f35d8d17b31 mailbox: zynqmp: Move buffered IPI setup to of_match selected routine
5db5e21b6cd58 mailbox: zynqmp: Move of_match structure closer to usage
daa680de4eb91 mailbox: zynqmp-ipi: fix an Excess struct member kernel-doc warning
9f22b5f7f1a32 net: use dst_dev_rcu() in sk_setup_caps()
423895685f367 ipv6: use RCU in ip6_output()
5f75857ed634d crypto: hisilicon/qm - request reserved interrupt for virtual function
7012bea562239 tcp_metrics: use dst_dev_net_rcu()
8b6e327736db0 RISC-V: KVM: Write hgatp register with valid mode bits
da513f2ad1b1b ptp: Add a upper bound on max_vclocks
dfbff47f120e4 bpf: Check the helper function is valid in get_helper_proto
145b8f1776e5b bpf: add a get_helper_proto() utility function
b467ebabf16c9 bpf: improve error message for unsupported helper
3b32cf6e27959 iommu/s390: Make attach succeed when the device was surprise removed
8729dc4eeb502 ice: fix Rx page leak on multi-buffer frames
891ab8c695419 dm-stripe: fix a possible integer overflow
53707bc68fdc7 dm-stripe: limit chunk_sectors to the stripe size
fd677c1f51c57 dm: stop using blk_limits_io_{min,opt}
fea5d52f89f4f dm-verity: provide dma_alignment limit in io_hints
f23d5c6b7540e smb: client: let recv_done verify data_offset, data_length and remaining_data_length
dc5aad078abc4 ceph: fix race condition validating r_parent before applying state
9598c83a50a5f mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()
6d40c15d70c2d wifi: mt76: mt7915: fix list corruption after hardware restart
e2a6eabe5304a ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog
18e4b315e359f vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
8ba034c41b20d vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
aa977309397fe trace/fgraph: Fix the warning caused by missing unregister notifier
dc797a4bbbcac bnxt_en: Fix memory corruption when FW resources change during ifdown
74d3b91f1598e crypto: x86/aegis - Add missing error checks
6758b816ffed5 crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
cbab09ae85675 crypto: x86/aegis128 - improve assembly function prototypes
3223bb62918e5 crypto: x86/aegis128 - optimize length block preparation using SSE4.1
67ddb169e1528 crypto: x86/aegis128 - eliminate some indirect calls
f76089018b34d mm/smaps: fix race between smaps_hugetlb_range and migration
1f45a710c82b2 wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
f6510c2eae93e wifi: ath11k: mac: fix struct ieee80211_sband_iftype_data handling
0d9f4f202de15 drm/amd/display: fix a Null pointer dereference vulnerability
7874179a229af drm/amd/display: switch DC over to the new DRM logging macros
dcfed7251e23c net/sched: Fix backlog accounting in qdisc_dequeue_internal
d26058c2349d7 habanalabs: fix UAF in export_dmabuf()
29a15e06a3d41 drm/amd/pm: fix null pointer access
5c432da1ee191 wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()
3bf99140d7b77 wifi: iwlwifi: return ERR_PTR from opmode start()
dcae71222c8b9 rv: Use strings in da monitors tracepoints
be27a11a42b21 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()
45be183b9944f drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port
067ca15be8b83 RDMA/hns: Fix double destruction of rsv_qp
ea2e6c1503800 wifi: ath12k: fix GCC_GCC_PCIE_HOT_RST definition for WCN7850
9bcfbd58fc5a0 s390/mm: Fix in_atomic() handling in do_secure_storage_access()
e98ce4b70beab Bluetooth: eir: Fix possible crashes on eir_create_adv_data
920c2db46ca44 wifi: ath12k: fix invalid access to memory
2d9a8022009d2 bpf: Do not include stack ptr register in precision backtracking bookkeeping
1b63cdc0d63ae riscv: save the SR_SUM status over switches
1cd09aaf47a57 coresight: holding cscfg_csdev_lock while removing cscfg from csdev
20d00e9b53091 wifi: iwlwifi: don't warn when if there is a FW error
761db4ca3a469 PCI: endpoint: pci-epf-test: Fix double free that causes kernel to oops
acdfe206be6c7 virtio: break and reset virtio devices on device_shutdown()
3dfbbf72de6b6 virtio: hookup irq_get_affinity callback
9f71fb768d55e driver core: bus: add irq_get_affinity callback to bus_type
fc3f1cbf8b1ec virtio: make virtio_bus const
b7867e55cbcba bpf: copy_verifier_state() should copy 'loop_entry' field
40d66e0adde4b dmaengine: ti: k3-udma-glue: Drop skip_fdq argument from k3_udma_glue_reset_rx_chn
47a0da0c80749 clk: sunxi-ng: h616: Reparent GPU clock during frequency changes
8f1b0a4f1ad15 clk: sunxi-ng: h616: Reparent CPU clock during frequency changes
c33a7fe6dda59 kasan: avoid sleepable page allocation from atomic context
1c320f6ccc884 um: fix time-travel syscall scheduling hack
52cdc47cf6519 drm/amd/display: prevent hang on link training fail
31dad8d385953 scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
cf3bf87aba2a2 scsi: mpi3mr: Debug ability improvements
ae9909d12735b scsi: mpi3mr: Split off bus_reset function from host_reset
a9703b006a475 sfc: fix NULL dereferences in ef100_process_design_param()
455a0ba90d0d9 sfc: rip out MDIO support
df8a35e8bcea2 sfc: Implement ndo_hwtstamp_(get|set)
9039afe6240ae btrfs: harden block_group::bg_list against list_del() races
53ac3b8ac1d88 btrfs: stop reserving excessive space for block group item insertions
716e065e74f8b btrfs: stop reserving excessive space for block group item updates
9e025844756fd btrfs: remove pointless loop from btrfs_update_block_group()
f8f0873dd8975 btrfs: stop doing excessive space reservation for csum deletion
210493962d0ae btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release()
3e8a465bf1ae4 btrfs: reserve space for delayed refs on a per ref basis
85abb0e726cc0 btrfs: allow to run delayed refs by bytes to be released instead of count
25014e3dfa6d2 bpf: Fix kmemleak warning for percpu hashmap
7af81befc0428 fs/ntfs3: Keep write operations atomic
457a034fcb04b fs/ntfs3: Separete common code for file_read/write iter/splice
2bb0e21c84f20 fs/ntfs3: Use function file_inode to get inode from file
ab41bf5a211fb ublk: fix handling recovery & reissue in ublk_abort_queue()
08160de2a6522 smb: client: fix UAF in decryption with multichannel
c8c6af46286a5 smb: client: allocate crypto only for primary server
aae58a39ac4c6 perf: Fix hang while freeing sigtrap event
0554373bc9acc wifi: ath12k: Avoid memory leak while enabling statistics
47297d133eea9 wifi: ath12k: Avoid explicit type cast in monitor status parse handler
2f129230ac7d6 wifi: ath12k: fix incorrect TID updation in DP monitor status path
90c782bc9e8d0 wifi: ath12k: fix struct hal_rx_phyrx_rssi_legacy_info
ccb4eaf078697 wifi: ath12k: refactor DP Rxdma ring structure
731e0d5dcbafd wifi: ath12k: avoid explicit HW conversion argument in Rxdma replenish
e976114d81746 wifi: ath12k: avoid explicit RBM id argument in Rxdma replenish
27d472b86c19b wifi: ath12k: avoid explicit mac id argument in Rxdma replenish
e762406e13446 wifi: ath12k: Remove unnecessary (void*) conversions
ce906c4ae5725 RISC-V: KVM: Teardown riscv specific bits after kvm_exit
ddfb25dfb16d8 RISC-V: KVM: Add kvm_vcpu_config
ec97bd5378c59 wifi: ath11k: update channel list in reg notifier instead reg worker
e2f45bfeef5ff wifi: ath11k: fix misspelling of "dma" in num_rxmda_per_pdev
8b7c9c5fec37c wifi: ath11k: add support to select 6 GHz regulatory type
4513843d58d8f f2fs: fix potential deadloop in prepare_compress_overwrite()
9b5e2f1ade251 f2fs: convert f2fs_handle_page_eio() to use folio
77fd40b7ed0c3 btrfs: fix block group refcount race in btrfs_create_pending_block_groups()
b6d27f4869c9c ext4: avoid journaling sb update on error if journal is destroying
735c0e603cf25 ext4: define ext4_journal_destroy wrapper
f364eb60987a5 ax25: Remove broken autobind
b17edabd91714 fs/9p: fix NULL pointer dereference on mkdir
616b4f2d1556c fs/9p: convert mkdir to use get_new_inode
3d0281d071395 net: mctp: unshare packets when reassembling
924ef5959b7cf eth: bnxt: fix truesize for mb-xdp-pass case
9d22cf5cc94cd nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
6088e11c9aed1 RDMA/mlx5: Fix the recovery flow of the UMR QP
6e59f56161ccc RDMA/mlx5: Fix a WARN during dereg_mr for DM type
d63d73d045e48 RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
50e44aa5f9905 bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT
4ace6fb49c8be btrfs: do proper folio cleanup when cow_file_range() failed
545d6893d3a34 btrfs: do proper folio cleanup when run_delalloc_nocow() failed
6105f0d9cc7be net: ravb: Fix missing rtnl lock in suspend/resume path
e2ef3fa31353b net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels
7368f88b2e62d wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
bf66ec718e687 scsi: mpi3mr: Fix possible crash when setting up bsg fails
8458c686d50a8 nilfs2: do not force clear folio if buffer is referenced
a306dfff6b76a RDMA/mlx5: Fix implicit ODP use after free
8e2f6ba256dd1 mm: clear uffd-wp PTE/PMD state on mremap()
a852466354667 net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
33b3e09a489a3 rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
01aaa7935af30 PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
57d90fe7aab16 powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
1e9dfe15404dd powerpc/iommu: Move pSeries specific functions to pseries/iommu.c
2855445a1870b udp: Deal with race between UDP socket address change and rehash
6a97bfc0293db RDMA/siw: Remove direct link to net_device
30fc8f6d33bb2 PCI: imx6: Fix suspend/resume support on i.MX6QDL
d7dade716905b scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
465e06ffbb681 vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()
e469922fbdf6a udmabuf: fix memory leak on last export_udmabuf() error path
2384a29db79bd udmabuf: change folios array from kmalloc to kvmalloc
0015d54a47995 virtiofs: use pages instead of pointer for kernel direct IO
f9f621c5a26e0 fuse: Fix missing FOLL_PIN for direct-io
0335fb698ab04 drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe
1a0aecabff72a io_uring: check for overflows in io_pin_pages
82dc96f0f4eec exfat: fix out-of-bounds access of directory entries
41d73ca1fe161 exfat: convert to new timestamp accessors
9ada9ff6339d4 afs: Fix lock recursion
00872dcc2a3e4 drm/amd/display: Implement bounds check for stream encoder creation in DCN401
64704f231d5de net/ncsi: Disable the ncsi work before freeing the associated structure
98691b2e28a6c l2tp: prevent possible tunnel refcount underflow
692e9a20018da drm/amd/display: Check null pointers before used
4f51f6d23c585 drm/amd/display: Check null pointers before multiple uses
180280f3c4621 drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer
45f2bbe7bc08d bpf: Fix a sdiv overflow issue
7299868253c0e mm, slub: avoid zeroing kmalloc redzone
694eea36e3e16 mm/slub: avoid zeroing outside-object freepointer for single free
6158dbcba6986 slub, kasan: improve interaction of KASAN and slub_debug poisoning
f8ba0d22afa61 bpf: Prevent tailcall infinite loop caused by freplace
6fc6ef4cd858a drm/amd/display: Avoid overflow from uint32_t to uint8_t
29ec422b32c69 scsi: lpfc: Change lpfc_vport fc_flag member into a bitmask
6a80b818c63e0 scsi: lpfc: Protect vport fc_nodes list with an explicit spin lock
3543cdaf0185b scsi: lpfc: Change nlp state statistic counters into atomic_t
148b39768ff2b scsi: lpfc: Remove shost_lock protection for fc_host_port shost APIs
2d0dfb1f2fad2 scsi: lpfc: Fix failure to delete vports when discovery is in progress
117df33ecfd8a drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range
0c1e8a6f7ce9b drm/amd/display: Use kcalloc() instead of kzalloc()
7eed5b3115ce9 pktgen: use cpus_read_lock() in pg_net_init()
2a0ba376cdf72 serial: sc16is7xx: fix TX fifo corruption
97cee643a8258 PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
2011c0ebaf710 mm/huge_memory: avoid PMD-size page cache if needed
6d1f6dd02a2d7 mm: simplify thp_vma_allowable_order
88f520120f999 mm/thp: fix "mm: thp: kill __transhuge_page_enabled()"
acf609843a848 gve: Account for stopped queues when reading NIC stats
7d5711e03cefd s390/pkey: Wipe copies of protected- and secure-keys
3732398dcf65d s390/pkey: harmonize pkey s390 debug feature calls
1f7f63f7165d1 ice: Fix improper extts handling
1eb6c4a0d83d1 drm/amdgpu: fix double free err_addr pointer warnings
9aa83a5eb013f ice: Don't process extts if PTP is disabled
2bbfffa802adc bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
c20d0fa873039 bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
d35130036d327 sched: fix warning in sched_setaffinity
f8005214946fd sched/deadline: Fix task_struct reference leak
251840f22eff3 drm/amdgpu: change vm->task_info handling
2860d59e4ce2b net: nexthop: Increase weight to u16
942ae3d64c3ce net: nexthop: Have all NH notifiers carry NH ID
f6dd625053726 drm/msm/dpu: Add mutex lock in control vblank irq
fee05f14bf747 drm/msm/dpu: shift IRQ indices by 1
ec2e11c1d36db tty: add break_wait kernel-doc
5e8f3ac8fa3d4 namespace: handle mount locking for automounts correctly
55d7433e26c79 fcntl: refuse F_SET_RW_HINT on an immutable inode
b98dd4af91ade namespace: check the target before walking it in do_mount_setattr()
86a2d56b19607 namespace: don't copy an unmounted mount tree
db90eecbde319 namespace: unhash a dentry before detaching the mounts on it
013c060b2f122 drm/vc4: Fix firmware reference leak in vc4_drm_bind()
45f2d1a6edf1c scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock()
49dd29ce73653 scsi: ufs: core: Add a comment block above ufshcd_mcq_compl_all_cqes_lock()
cce865a62cec3 scsi: ufs: core: Add debug log for MCQ command timeout
4813a6624ce48 scsi: ufs: core: Move an assignment in ufshcd_mcq_process_cqe()
40589a91c7b9b scsi: ufs: mcq: Remove unused parameters
ec6ecab1b7577 scsi: ch: Do not keep references to data transfer element devices
37a0d6e81a42e scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ
262062c01f5a8 optee: register TEE devices only once fully initialized
cf59abb49e91f wifi: ath12k: copy M3 firmware when reusing the buffer
4af250fc84828 wifi: ath12k: fix reusing m3 memory
2be324c89993c ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
60b5824ae259a ASoC: hdac_hda: Fix hlink refcount leak on component registration failure
3b8a540b36aa0 ALSA: control: Don't add invalid kcontrols to LED layer
c17fe25dcb55a ACPI: processor_idle: Mark LPI enter functions as __cpuidle
444b0e44aa430 net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
7b3b902320214 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
04474009a2ea7 most: core: fix leak on early registration failure
82f42a13e3d7a most: core: fix resource leak in most_register_interface error paths
a56d4f8f8f4c5 namespace: check the mounts before reading their parents in pivot_root()
99698cfa34e49 namespace: don't inherit MNT_UMOUNT in clone_mnt()
9b6ed57eb8c89 Bluetooth: ISO: Serialize concurrent connect calls
db6fbc2b77849 drm/vmwgfx: validate pitch coming from userspace
4dc3d5a004b8f Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex
f01cbddfb4273 Bluetooth: hci_sync: Fix command skb lifetime during scan setup
b21f20320fa2f net: team: stop reusing skb after queue override
9486377e5e971 net: team: fix NULL pointer dereference in team_xmit during mode change
84600e7b30fc1 net: team: Rename port_disabled team mode op to port_tx_disabled
85cf6665154de net: team: Remove unused team_mode_op, port_enabled
4f46ac83d87a4 netfilter: nf_tables: fix bidirectional offload regression
089f10b47843a apparmor: fix cred UAF caused by begin_current_label_crit_section()
20c52a7041409 ALSA: mixer: oss: Add card disconnect checkpoints
c937a494901df ALSA: pcm: oss: Fix data race at accessing runtime.oss.trigger
d9df965284abd ALSA: pcm: oss: Fix setup list UAF on proc write error
8f27d152b2a59 nvme-tcp: sanitize request list handling
604cf76a6a7e8 llist: add interface to check if a node is on a list.
24120e90d4638 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge
522fd1a6efd0a mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP
1f26323565177 ice: fix metadata_dst refcount handling on representor teardown
b14a682ad7d45 ip6_gre: remove obsolete ERSPAN PMTU update
578d39ab420b1 tracing: Set the trace clock before registering the histogram trigger
cbf9961602ffb HID: steam: Clean up locking
3c2f97343d4df HID: steam: Refactor registration
d2587923d50c8 HID: steam: Rearrange teardown sequence
5f135cfc1d68c HID: steam: Fully unregister controller when hidraw is opened
0aa096eec8d87 HID: hid-steam: Make client_opened a counter
dd7a39f644373 drm/amd/display: Don't replace a sink mode that shares the native totals
8ed6cf7f77915 can: fix unique skb identifier regression under RPS
2deafd015ea9a dlm: validate length in dlm_search_rsb_tree
99b8bd6323e6f wifi: mt76: mt7603: initialize global station WCID
63ec518b737c4 netfilter: flowtable: fix offloaded ct timeout never being extended
5d3ee9fc5fb08 netfilter: conntrack: fix erronous removal of offload bit
b7b80d204abdc net: openvswitch: validate transport header presence in set_ipv6_addr
41ad5bcf0219a mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
3e531d85b7823 net/mlx5e: Order ICOSQ cc update after CQ doorbell
194685b13dc9e veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
c44c02c930c65 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
774856241e7dc net/sched: cls_route: reject change with no routing attribute
d9e08836d06c8 flow_dissector: avoid u16 truncation of skb->len when computing thoff
2c64c30d493d8 ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
2cb098262ce2f ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes
58905982b0d91 ASoC: adau1372: allow sleepy powerdown GPIOs
50deef6dc4dd4 wifi: mt76: mt792x: pick the SAR table layout from the table itself
26f0504432add wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
7a53bb4668b31 btrfs: fix xattr replace when multiple xattrs are packed in the same item
3c231142c4f4b nvmet: use the local P2P device on metadata allocation failure
8739f06e3f82c cxgb4/ch_ktls: disable softirqs around tid_list erases
95114e4211962 amt: send the relay's General Query directly from the receive path
00bcc303000ba net/sched: em_text: reject unterminated algo before autoload
bf2848e50bd73 drm/vc4: Free the BO cache size list on teardown
ad8a96a9e0fee drm/aspeed: Balance the display clock enable on teardown
bf3d841ef12fc gpio: exar: initialize the ID before registering its cleanup
f424fc191ec2b drm/dp: don't mark the AUX backlight enabled when enabling failed
95fb7c259b86f namespace: refuse an automount below a mount that is in no namespace
5e6bfd9f249f2 dcache: don't put a mountpoint on a dentry that's being removed
f639428183449 namespace: check a submount for references right before unmounting it
cae49d34f0cd1 fs: refuse fspick() on internal superblocks
d63df57e738a3 drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs
b5f813f500c44 drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks
067c88010df80 drm/amdgpu: make Mac FB workaround generic
037796d9ca1da drm/amdgpu: serialize vblank counter reads against GPU reset
8a2b420ee227a drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info
4a86f0a696f48 drm/amdkfd: align SDMA doorbell base for shader doorbell writes
17c5fa371de2d drm/vc4: drain the hangcheck timer and works on V3D unbind
77abc1837c965 drm/i915/gt: Unmask interrupts only when ACTIVE is true
24c04e80c35ff drm/i915/gem: Prevent overstepping exec array boundary
a5ce29550386f drm/gud: don't keep a connector without a CRTC as connector_state
4a2006c675758 drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN
d5c372ad03330 Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
a54ce160e3ef7 Bluetooth: RFCOMM: free the skb when the DLC has no owner
44ce36c5789ac Bluetooth: MGMT: Fix status of pending commands flushed on power off
37cef0c8fb537 Bluetooth: hci_sock: Serialize dead-device detachment
8181a1a45c706 scsi: qedi: Initialize callback state before registration
a613e4fafb47c iio: light: Drop ROHM BU27034
7e90b11a4f699 pmdomain: rockchip: propagate subdomain add errors
1b476b9a90ac9 pmdomain: rockchip: fix clock leak on domain probe failure
b94c6104c4949 pmdomain: rockchip: don't ignore clock lookup errors on attach
3601dd1cdc97c pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains
1ea151615a82f regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
fd376d8374111 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers
c995c52eba192 openvswitch: fix soft lockup in the netlink flow dump
ab0d2a6fe87e8 nvme: fix swapped ZRASF zone state values for full and read only
c128173919a65 net: usb: ax88179_178a: fix rx frame length for non-last packets
1e4d51d903ecf net: dsa: microchip: fix KSZ8765 fiber detection
695a5a4c69c92 net: bridge: avoid recursive multicast port cleanup
e607017a553d2 net/smc: protect clcsock lifetime in smc_getname
d8a24b9e1774a net/packet: guard the ll header push in packet_rcv_spkt()
605a59639abb9 mmc: sdhci-sprd: disable runtime PM on remove
9e799f25c420e mmc: mtk-sd: Cancel request timeout work on remove
5d4cdd4a15075 mmc: cavium-thunderx: destroy slot platform devices on remove
a1019e0722049 mmc: cavium-octeon: destroy slot platform devices on remove
281f68d6cf8ac dm: fix reading free memory in do_resume
bcfb26658e0fa dm-snap: reject the transient exception store for snapshot-merge
9a0dab8a9d997 dm-crypt: reject the lmk IV mode with AEAD ciphers
f2c181e1d58e9 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
c3ab92542475d memstick: core: wait for request completion before freeing card
305f1828b871d KEYS: Fix add_key() race with keyring restriction
f7bff12d5de4b keys: finalize persistent keyring timeout after link attempt
c2e0cbb587a8a ibmveth: fix TX LTB and filter unwind on open-fail
decb4d4ead2c7 ibmveth: h_free logical LAN on open-fail after register
b07b3925f6766 gpio: xilinx: fix runtime PM leak on request error path
ce45166daf6bd EDAC/amd64: Mask UMC chip select to the four implemented selects
be0167091542e sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute
a545def625860 selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
a07d325ebb37a selinux: fix data race on AVC latest_notif
af4b3d33f2ff5 Revert "wifi: libertas: reject short monitor TX frames"
b60259d4047fb tipc: hold a reference to nodes found by link name
7f796bb3b440d tipc: destroy topsrv workqueues before closing connections
dbee987ecf312 swiotlb: fix default_swiotlb_limit() for non-growable default pool
a18dd388045dc strparser: make sure __strp_recv isn't running before tearing down the parser
5051df0311447 xen/netfront: don't leak the skb when xennet_fill_frags() fails
3dc61af2998cf workqueue: Fix NULL current_pwq deref in chained work check
fb5ce4c7790c3 wireguard: noise: reject response consumption after intermediate initiation
b261dbed0c538 wireguard: queueing: preserve tstamp_type when encapsulating packet
7b79131e357c4 wifi: brcmfmac: fix P2P device removal race in brcmf_detach()
3ad7606400f38 usb: f81604: fix struct f81604_int_data size mismatch
98195e822343a dm ioctl: don't let data_start run past the buffer
41cabfbf3532e btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()
496a45b7c6705 ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P)
e35becbd03191 arm64: irq: exclude the softirq stack switch from KCOV
1eeeb4d315401 Input: xpad - add support for Corsair Novablade Pro
8a3b935b6b603 ipv6: do not warn on route notification size race
088ba80eef85f ipv4: do not warn on route notification size race
72d9d17092bb3 ipv4: stop route notification sizing when nexthop group shrinks
7fd60d3c9a1e1 ipv4: stop PMTU walk when nexthop group shrinks
408c78e50feab crypto: drbg - Fix ineffective sanity check
8f1215a370e89 netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting
80861f424fe5c Bluetooth: hci_event: fix simultaneous discovery stuck in FINDING
45adb04a8ad0c mm/damon/core: fix unconditionally skip last region
e3c206de1fcba mm/damon/core: do non-safe region walk on kdamond_apply_schemes()
82ecc6b5af65d f2fs: fix to reset all pinned status during fggc
9f5510b0452ba f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
f4ee42c35022a f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
7d7ad2bea4eed HID: uhid: convert to hid_safe_input_report()
b9d2deecddae7 HID: core: introduce hid_safe_input_report()
f1dc59675d542 wifi: cfg80211: release locks on error in cfg80211_wext_siwgenie()
909b31661be70 iio: cdc: ad7150: fix OF matching and publish module aliases
a2df3f13f00b3 smb: client: only require read lease for size-extending preallocate
55f1cebee909c iio: adc: stm32-adc: fix possible division by zero in processed channel
b950ad53ca6ea iio: adc: axp288: Add TS bias override for Haier HV103H
f66a164ea6bd4 iio: adc: max1363: sign-extend bipolar differential channel reads
9f503cda04f2c iio: adc: aspeed: propagate reset deassert errors
3d8019516f028 iio: adc: aspeed: Simplify with dev_err_probe
975b09bc680ac iio: adc: ad_sigma_delta: fix use-after-free on unbind
3df27277f8f95 smb: client: discard post-EOF pagecache when extending a file via zero range
6535f7084d958 wifi: mac80211: set info->band for 802.3 encap offload frames
40d7e969b6f15 wifi: mac80211: Add sta pointer sanity check in ieee80211_8023_xmit()
84da7a0e92207 KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted
b1ac8181a59ab mm/hugetlb: fix avoid_reserve to allow taking folio from subpool
6a2baff6fecae net: mana: remove double CQ cleanup in mana_create_rxq error path
cd9c62753becf net: mana: Skip WQ object destruction for uninitialized RXQ
263d45141069a net: mana: check xdp_rxq registration before unreg in mana_destroy_rxq()
f3a52e2ec2788 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
32bbb870078d4 net/mlx5e: Prevent stale XSK buffer release on refill retry
f1c966eb6ed5e fs: Free any excess xarray nodes in clear_inode()
2a74f30a7bb30 iio: health: max30102: fix NULL dereference in interrupt handler
b76f068b2d3d0 iio: core: add accessors 'masklength'
4ae6ed5b6074d wifi: mac80211: count only matching reservations in reserved switch
47864a9092fd6 wifi: mac80211: keep paired old chanctx alive
6b5366ba63a58 jbd2: bound shrinker scans by examined checkpoint buffers
dc7ece0b827fe jbd2: check need_resched() when skipping busy checkpoint buffers
6198123cac2ff gpio: rockchip: fix generic IRQ chip leak on remove
77b6ff33c8f56 gpio: rockchip: teardown bugs and resource leaks
d4cf99c7ea95a firmware: arm_scmi: Unwind TX receiver mailbox setup failure
50e38091a657a firmware: arm_scmi: Publish channel state before callbacks
b1a86a5ab0d44 fbdev: hyperv_fb: Allow graceful removal of framebuffer
3a489c3bbf5ed fbdev: hyperv_fb: Simplify hvfb_putmem
18f9f3ddbf2ed erofs: unify lcn as u64 for 32-bit platforms
b18a82503a67a erofs: avoid infinite loops due to corrupted subpage compact indexes
6b6b47c1aa717 ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers
796207e63c51f ASoC: SOF: topology: Parse DAI type token for dspless mode
ce220b4cdf62f tty: port: fix tty_port_tty_vhangup() race
cf8530a25ae92 bnxt_en: fix DMA mapping length for padded small packets
b4f2a7ae80ed4 mtd: spinand: Enable QE on all dies
bff83b723e93a mtd: block2mtd: Fix divide error when erase_size is zero
057320c36c5a2 block2mtd: prevent direct access of bd_inode
8736c49d6ff27 mtd: block2mtd: Convert to bdev_open_by_dev/path()
de77b0f681421 wifi: mac80211: keep fallback association elements alive
d0da6ab1fc53a wifi: mac80211: shut down RX BA session timer on teardown
77c449c9c946f mtd: spinand: fix NULL pointer dereference with no ECC engine
1fbc4b24c7443 apparmor: Fix & Optimize table creation from possibly unaligned memory
bd00629b52788 AppArmor: Allow apparmor to handle unaligned dfa tables
122b1fdcd26b5 drm/amd/display: Mark DCE 6.4 as not APU
04c259eaceba4 i2c: xiic: preserve PEC byte length in SMBus block read setup
7b42e4a70f8c4 i2c: xiic: Relocate xiic_i2c_runtime_suspend and xiic_i2c_runtime_resume to facilitate atomic mode
4ae00993e6d92 ALSA: hda/tegra: Re-enable SDO workaround for Tegra194
3cdad0c541f89 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
0af044c47a957 serial: ma35d1: Convert to platform remove callback returning void
2f973fe58d70e serial: fix TIOCMIWAIT race
158a07da2da72 tty: serial: max3100: shut down timer before freeing port
b71f75408c466 tty: n_gsm: fix missing modem controls after DLCI open in convergence layer type 2
16032c980d8f7 tty: tty_port: restore TTY_IO_ERROR on activation failure
402b1aceabfb4 usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41
5a206e64ae8ab drm/amd/display: Preserve eDP mode on initial ASSR failure
82cc242da6d62 USB: dwc2: shut down wakeup timer before freeing HCD state
4f35e6be2f86b usb: ohci-spear: disable controller wakeup on removal
7037a6a567223 usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare()
c1e3aed32da03 drm/amdgpu: reset VI ASIC on MacBookPro14,3
79c4721c17fbc drm/amdgpu: reset VI ASIC on MacBookPro15,1
29302964ef583 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
12dace1387d3c fsverity: add dependency on 64K or smaller pages
0a5c76eb3950a KVM: arm64: Don't use the VMA to size stage-2 block mappings for VM_PFNMAP
e786386c882d5 arm64: errata: Add Cortex-A725 erratum 3821522 workaround
fb8b57d0321f6 arm64: errata: Factor out broken AMU const counter cap
94afa17d6bfd5 Bluetooth: Serialize SMP remote OOB data access
f997e03e2ef58 Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
052acee988011 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
8c38cb055f6a9 perf: Require kernel access for text poke events
6b4e15cccfbe0 tty: fix saved termios reset race
6cd82563bb270 usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
bc992b73f7af6 drm/amd/display: Fix fast updates on DCE 8.1
3f3b0898557a9 fs,fsverity: remove check for fsverity being enabled in setattr_prepare()
a4ca8102e70e1 fs,fsverity: reject size changes on fsverity files in setattr_prepare
0542d213253ee xen/netfront: drop RX packets with a short Ethernet header
5ea733af79616 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
424e4d0bc47f0 usb: typec: tcpm: fix debug accessory mode detection for sink ports
0a2f71ccf9c20 usb: gadget: f_fs: Fix Use-After-Free in AIO error path
aee2fde0f39e2 USB: gadget: ffs: fix mm lifetime handling
723d73b245843 usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
09ddd44db0a84 usb: gadget: at91_udc: Convert to platform remove callback returning void
abc17fd508a51 serial: imx: serialize imx_uart_ports[] lifetime
4663bded2e49a serial: imx: Convert to platform remove callback returning void
dd34630226211 net: usb: qmi_wwan: add Quectel EG120K-EA
ffac3399bf627 wifi: wlcore: Fix runtime PM leak in wlcore_remove()
8435103a82aa7 wifi: wlcore: Convert to platform remove callback returning void
75b3b30ae4ee6 mptcp: prevent race between disconnect() and rtx
0f7668bcf6685 tcp: introduce icsk->icsk_keepalive_timer
9116b5ef5a5b3 mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
c073d01f6f536 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
4b5ebb4f91a61 SUNRPC: reject duplicate CREDS_VALUE options
8c56a46db3b75 SUNRPC: fix gssx_dec_option_array error path bugs
574af7c61f2be drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
dd0c3e6c03e3b KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
c873363497808 jfs: fix array-index-out-of-bounds read in add_missing_indices
ac5d26a46c90f iio: trigger: cancel reenable_work before freeing trigger
42eb8c2cf1744 iio: proximity: vcnl3020: fix ISR bitmask check in IRQ handler
2272efb10096e iio: proximity: sx9324: Correct proximity channel resolution
2c8211eef9892 iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure
59ab2f302548d iio: proximity: isl29501: Fix return type of isl29501_register_write
05ef1af381a0f iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup
85c20d1cf3f01 iio: light: gp2ap020a00f: drain irq_work after free_irq
8a78224497271 iio: imu: adis16480: fix unprotected debugfs reads
d3078aaef8af4 iio: imu: adis16400: fix unprotected debugfs reads
b62c3944c006c iio: gyro: adis16136: fix unprotected debugfs reads
2bde96b2857aa iio: frequency: admv1013: fix wrong channel field used in admv1013_read_raw()
b4f53cec8cc94 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.
6a728408ff522 iio: buffer: serialize buffer teardown with mode claims
012451d72c122 iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind
d94d2ec25ff26 iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls
53473b0556296 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure
01d20048ab0e2 iio: adc: stm32-adc: fix check on internal channel availability
57628402e9cbf iio: accel: sca3000: fix frequency divider condition check
137c35cff4d4d iio: accel: kxcjk-1013: reject duplicate event disable
3b8e7928cf192 smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
b270c1074860d thunderbolt: Reject oversized XDomain properties responses
7bca83bf8ba00 thunderbolt: Disable CL states for the Anker Prime TB5 dock
b70b9c41f240c thunderbolt: Fix KASAN reported use-after-free when request is canceled
4375b5d91db4d USB: serial: option: add Compal EXC-T1 support
992a471458f96 USB: serial: option: add Quectel RG660QB
85750b58e8d4f USB: serial: option: add Compal EXM-G1x support
9c910016df78c USB: serial: option: add Quectel EG060W
bb5487f3aadbe USB: serial: option: add support for SIMCom SIM8260C
24d6edb6bd7f7 USB: serial: fix ioctl hangup race
e7ad832b1144d USB: serial: fix driver deregistration order
2917216123615 USB: serial: fix dynamic id driver deregistration race
f8e290609546a USB: serial: ssu100: fix baud rate overflow
7ee47aea0baca USB: serial: quatech2: fix baud rate overflow
e7fa5128bcc4f USB: serial: cp210x: add Corsair AX1500i Power Supply
0b1e4a7eeb6a3 wifi: mac80211: handle empty FILS association request payload
ebb7cba623d38 wifi: mac80211: fix mesh fast xmit path deletion UAF
57bfaa8b28534 wifi: mac80211: release mesh path quota on failed additions
eebc70f132041 wifi: mac80211: minstrel_ht: validate fixed rate index
c66ab4b94bb04 wifi: mac80211: account proxy paths against the mesh path limit
cbff71fe689f3 wifi: mac80211: drain PS delivery work during station teardown
3ebc529726c0c wifi: iwlegacy: 3945: free EEPROM data on remove
b66539a4dab12 wifi: cw1200: fix TX padding OOB read leaking heap data to device
951fce1510645 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
40d855d6ad463 mtd: spinand: fix zero oobavail when no ECC engine is used
e238c19826cc9 mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
c69d8aceda362 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
ef4dfad231a78 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
e7188a268c356 nvme-pci: add NVME_QUIRK_DMAPOOL_ALIGN_512 for Micron 4100AT
3045128294d34 nvme-multipath: fix underflow in ANA log bounds checks
5a2b9cc53719b net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
fdbd83c2d929e net: extend IPv6 exthdr detection of tunneled packets
3776f34fbce99 HID: multitouch: stop the release timer from being rearmed on remove
bc9ff8e64771c ipvs: bound LBLCR and LBLC cache growth
be58b239d2be5 Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
545fa70f730eb Bluetooth: hci_core: Serialize fragmented ISO packet queueing
780affacd9297 Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
b208818492cde Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems
70b55855eecb4 Bluetooth: hci_conn: Lock parent access during enhanced SCO setup
ddc9edb244cc8 Bluetooth: hci_sync: Fix inquiry cache use-after-free
55d162aa00d1e Bluetooth: RFCOMM: Fix initial port reference race
48f0e0bcf683f i2c: xiic: don't clobber msg->len to signal block-read completion
ada5ded765f05 ALSA: ua101: reject mismatched capture/playback packet sizes
2db234e163f0d ALSA: seq: Serialize compat port-info ioctls
775df6a27e843 ASoC: qcom: lpass-cpu: use DAI table index for playback constraints
30a60e74ee71d ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
a756c93fae312 ASoC: codecs: max98363: fix uninitialized stream_config->type
3d9faec1da7e8 serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
2c4ddc8ed0d87 serial: tegra: don't clear the Tx FIFO on an Rx-only reset
dd81650bec58a serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
6c9c9367351a4 tty: abort break signalling on hangup
a42d96e8101ca tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
57753441ef84b tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
4b59afc8af314 tty: vcc: zero-initialize control packet in vcc_send_ctl()
674b1c890322f tty: amiserial: fix broken TIOCMIWAIT
bdda8d889accc tty: vt: fix memory leak in vc_allocate()
dbdd0ca9a7eac usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
efdf0ddaed011 usb: cdns3: fix use-after-free in cdns3_gadget_exit()
9a86cdb675949 usb: typec: ucsi: displayport: Current CAM OOB index fixup
abe93f73639da usb: typec: ucsi: Get the connector fwnode based on reg value
a39d53f70e637 usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
ae8aae45a39fc usb: typec: tcpm: recover after failure to start the frs ams
198d74dcfa129 usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
40fef138eb6c1 usb: chipidea: tegra: disable runtime PM on resume failure
06ac8609d6d18 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
6849e51b89de5 USB: gadget: dummy-hcd: Fix wait for outstanding request completions
0d39ac4f65f93 usb: gadget: aspeed-vhub: cancel wake work on device removal
be347590e188d usb: dwc3: am62: Fix runtime PM usage count leak on probe error path
a789838675afa usb: typec: anx7411 - stop the IRQ before destroying the workqueue
da841c1511a61 usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
18138d9f19cf6 usb: gadget: midi2: Fix the jack descriptor array sizes
61db743284896 usb: ohci-st: disable controller wakeup on removal
203094415f85c usb: ohci-s3c2410: disable controller wakeup on removal
2cf192041c00b usb: ohci-da8xx: disable controller wakeup on cleanup
ba0f023cee31c usb: octeon-hcd: fix the FIFO-flush timeout computation
e4df763ba3c4f usb: hub: use shorter 120ms post resume hold for SS root hubs
4faaad69f1833 usb: storage: sierra_ms: reject short SWoC info transfers
e4a6883ad9b46 USB: serial: fix port tear down use-after-free
d86775e79838d USB: cdc-acm: skip URB restart in port_shutdown if disconnected
451ded3b33bef USB: cdc-acm: fix racy TIOCMIWAIT implementation
4cea8e5b6c593 soc: qcom: geni-se: Correct QUP Core ICC vote constants
8bde6f643ab6f nitro_enclaves: fix use-after-free on SLOT_ALLOC failure
d74220bb59af0 Input: synaptics - limit T440p InterTouch quirk to LEN0036
a2300ca8797eb Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
9ef8a8de8717d Input: s6sy761 - fix resume ordering and restore sensing
dee75ece52b6a Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
a71adc66e8401 Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
69b1ed4acc56c kgdboc: Fix tty driver reference leak in configure_kgdboc()
a7329ea53d04f binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
e9b364e46d594 binder: fix is_failure flag for superseded transaction cleanup
d700c26ed64bd drm/amdgpu: fix ACP MFD device leak on init failure
f6364e7284a13 drm/amdgpu: fix IP instance memory leak on kobject add failure
4a0ae61067671 drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
03fb1c657028c drm/mediatek: Fix ovl adaptor platform device leak
f0ffb09cf1bf2 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
bc7255b8623de drm/radeon: Read the VRAM VBIOS signature with readb()
2aee72150b0ea drm/amdgpu/gfx6: fix firmware leak on teardown
e28008f8d5020 drm/amd/pm/si: Fix updating clock limits on AC/DC
48ab11f054267 drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC
e0c2f42f7c608 PCI: Accept AtomicOps already enabled by the hypervisor
a2047aff72ce5 ALSA: ice1712: Fix the error handling via auto-cleanup at probe
80c7c10debd3a ALSA: core: Define auto-cleanup for snd_card_free()
655acfa713bce perf: Fix race between perf_event_exit_task() and perf_pending_task()
22efeebe688fe i2c: at91: release DMA channels when probe defers
4ab37e4f4a33c ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
963e11f65c1be net: add and use skb_get_hash_net
68f35f8ffa803 net: sparx5: make ports inherit the switch base mac address type
ef82f57fc999e net: microchip: vcap: stop scanning after deleting key field
f7e292f3c8c85 netfilter: flowtable: generalize pending status bit
28c2a0ed2657b netfilter: conntrack: rework offload nf_conn timeout extension logic
b6aefccb76489 netfilter: conntrack: remove skb argument from nf_ct_refresh
752492947be31 netfilter: bpf: reject invalid NAT manipulation types
d7d33c9efa9d1 ipvs: filter some flags received in the backup server
1c68bfde05276 ipvs: do not create invisible templates
0632541dbfa43 ipvs: fix missing counter decrement in lblc
0c52040a3f69f tcp: refresh TS.Recent for accepted old ACKs
efc91ab1d97bd net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
213ff02ab26a4 net: bcmgenet: fix NULL dereference in set_coalesce before first open
41583c7d80ea6 net/sched: sch_codel: match the no-drop threshold to the packet size
5172124684e12 net/sched: fq_codel: match the no-drop threshold to the packet size
a85a3dce4b6c7 tipc: prevent GCM nonce reuse on peer key changes
f9531e8331790 octeontx2-af: mcs: Fix SC resource cleanup loop
5b353908e3be9 net: systemport: Fix RUNT MIB counter register offset calculation
96a2b04205155 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
b11acfcb5925e Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister
71d660ec3c5d4 netfilter: ipset: do not update comments from kernel-side adds
44b6c6a3d10ac ipv6: fix prefix route expiry in modify_prefix_route()
0fc74e7d97d23 net/sched: cls_api: reclaim an empty proto on the error path
288ef37e0c463 net/mctp: publish the mctp_dev only after it is initialised
7df748aa9f9ec Bluetooth: btintel: validate DDC record lengths
bb5d897e1c5e8 Bluetooth: hci_core: free the HCI ID if naming fails
0edda2d686666 ASoC: codecs: rt274: Fix format setting for 44100 rate
d7b0b90517d23 ASoC: codecs: rt286: Revert delay value for jack setup
2fe08c8ff2684 wifi: mac80211: prevent AP VLAN tx from other interfaces
8c01127f8940e wifi: mac80211: Add 802.3 multicast encapsulation offload support
2d822b7b09828 wifi: mac80211: Add multicast to unicast support for 802.3 path
5617d53288390 wifi: cfg80211: preserve hidden-group beacon IE ownership
ab741d1b714b4 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()
a2215eb3cbbd3 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak
60142eb2afda3 wifi: ath11k: reset ar->num_stations on hardware start
a7223b725905d ASoC: tegra: Fix ASRC Stream6 input threshold control
819d4c1323e2a wifi: wfx: validate MIB read length before copying to caller
c881b1e4e9249 ASoC: wm8903: Move the DRC QR threshold to the register that holds it
cd68146459b10 of/overlay: don't create "//" paths for fragments targeting the root
702b5db6e7b38 of/overlay: don't leak fragment references when changeset init fails
287a399310045 nvmet: preserve device path on allocation failure
d94731cafa57e mtd: core: call _get_device() with the master MTD
714d8f0b1c616 iio: accel: kionix-kx022a: Fix array boundary check
84f8401d9bc5b mm/damon/core: don't skip damos_adjust_quota() while esz is not zero
4cea59e43e3cc perf/core: Fix WARN in perf_sigtrap()
51fba083e454f mm/secretmem: properly account locked pages
933d8ac23388e ALSA: line6: reject oversized playback packets
df2787819bd13 ALSA: caiaq: unregister the input device when probe fails
2fc4e71aefab5 vt: skip screen update for DEC alignment test on backgroup consoles
786b74335c219 rds_tcp: close NULL deref window in rds_tcp_set_callbacks
1130350c8975a wifi: cfg80211: avoid double free if updating BSS fails
c6d8cce685d60 scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
8ec545537c110 scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr
7ceb6f7cb8f8f smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
1bef1944ef15a sctp: check RCV_SHUTDOWN after the sendmsg connect wait
aeda50d645bbb rtc: spear: initialize IRQ state before requesting alarm IRQ
e77c5fc1f39fd rtc: ac100: Assign .num before accessing .hws
ae169d318d5d2 net/packet: prevent TX_RING byte count overflow
1d27214fd9a4d netfilter: nft_flow_offload: drop flowtable reference on init error path
ec96aa3ade2eb net: fix checksum offsets in skb_splice_from_iter()
cc688475c56d3 of/overlay: only treat a positive changeset id as registered
936f1ffcb87a1 of/overlay: put property on deadprops only after changeset add succeeds
b5f488c2a9ed3 of/irq: Fix remaining refcount leaks in of_irq_init()
3f968dcdf0188 kprobes: Skip disarmed probes when checking optkprobe overlap
9aee3caeff4dd audit: fix exe mark UAF in kill_rules()
8b417c887ac82 ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
7ed1062d154ec mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
47a948ba653a4 xfs: fix cursor and pointer handling when recovering iunlink buckets
8afc80156b1d9 smb: client: close completed creates on compound wait errors
eaa97a196a107 smb: client: close handle after create-context parsing failure
2f8118f4c4313 smb/client: pass cifs_open_info_data to SMB2_open()
b63f09fdcb523 smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
bd9571812d022 HID: alps: unregister DualPoint Stick input device on remove
37dc19c454191 HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM
74cbf0acf9de5 HID: core: remove #ifdef CONFIG_PM from hid_driver
a35160b2c75bf Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table
bd06033625ec2 bpf, xdp: move offload check into dev_xdp_install()
43d61b442a0a1 RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr()
d8ec34618e710 drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
045532f920d86 smb: client: use finish_no_open() for non-regular inodes
fbe8c7c940a7c perf/x86/intel: Fix GRT PEBS load/store direction for latency events, to fix sample classification
2e4c5400f489e perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
5e20b39aa7844 netfilter: nf_tables: skip expired catchall elements on insert and delete
ab8dfb330c907 netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST
a0f5fd7a285f4 net: ena: fix MMIO read buffer leak on probe failure
33b32efafb729 net: ena: Remove autopolling mode
d4bd24339b505 perf/core: Run sched_task() for PMUs with only CPU-wide events
fa360a018369f perf/core: Allow list_del during perf_event_overflow()
98181f9721f75 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
403d8e4d52f5f perf: Supply task information to sched_task()
38a6a118260eb net: ipconfig: bound DHCP option construction
f770bd77c6e15 net: ipconfig: Remove outdated comment and indent code block
a9d9819a7d239 PCI: Fix BAR resize for devices on a root bus
bf58ea4958118 PCI: Fix Resizable BAR restore order
4ab3655384e1d super: make iterate_supers_type() deletion-safe
6c2bcf6b173d4 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
3486ce08c383e RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr()
18866dc1f525f net: openvswitch: conntrack: fix helper UAF due to extensions realloc
7ecaa9628b05a net: openvswitch: conntrack: remove 'add_helper' dead code
7ce66bca55e37 openvswitch: prepare for stolen verdict coming from conntrack and nat engine
c812bb4aea13d net/sched: act_ct: avoid modifying shared unconfirmed ct entry
31f5fe29a5720 net/sched: act_ct: fix helper UAF due to extensions realloc
cf73ef2a761df mm/hugetlb: preserve mremap address delta when skipping page tables
465e222815c88 mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
34d9dffaf0ff4 drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
8a8d16d19207d drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
070a004d9d752 perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities
9e2a2f98e8c01 tcp: prevent collapsing skbs across boundary in rtx queue
f04cbdfac9b82 bna: prevent IOC timer rearm during teardown
aa00eead258e4 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
ffc88169f4fac smb/client: send lease break ACKs thru correct session for multiuser mounts
15e59e377facc wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
d073d306e587c hwmon: (pwm-fan) Stop RPM timer before freeing tach data
93a025166495c btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
525c225e23d61 smb: client: fix cifsFileInfo reference leak in deferred close
11cff5518f798 mptcp: do not reschedule the RTX timer for fallback sockets
3fe0b4b1aed10 mptcp: pm: reset retrans_time when ADD_ADDR entry is reused
518fb6a834258 mptcp: pm: userspace: fix address ID overflow
c003c9ab21406 mptcp: use sock_kmemdup for address entry
f116f8462c8c2 sock: add sock_kmemdup helper
48bf542f03cf0 mptcp: pm: drop match in userspace_pm_append_new_local_addr
a92e0910f5fb8 erofs: add sysfs feature entry for xattr prefixes
db0c3465b54a1 erofs: preserve LZMA decoders on resize failure
1b5730a1c7def net/sched: act_api: release all action references on NEWACTION failure
b2eb38377671a virtio_mmio: disable IRQ wake before free_irq
cbfd5d11311bb virtio-mmio: Remove virtqueue list from mmio device
21e0749e8ef27 ipmr: account multicast table and route memory
8ca55a476af2d drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
0cec951667a62 drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
110dd054fd4af drm/sysfb: simpledrm: Improve stride validation
52f36434159e4 drm/sysfb: simpledrm: Improve panel-size validation
b6c0e77d950bf f2fs: fix dentry folio leak in find_in_level
e754120f8ede5 f2fs: limit recovery filename logging to stored length
428e244dd4066 scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
2df8c86309047 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
8b6565f19423a scsi: qla2xxx: Use ring-slot helpers in __qla2x00_alloc_iocbs
9d69eed95b841 scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate
5e0d6ffabbbd8 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
bbe692466399a media: rkvdec: Propagate platform_get_irq() errors
7cdb1e2d3b0e5 media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup
d20ef2b13a2e0 mm/mremap: reset unfaulted VMA page offset for MREMAP_DONTUNMAP
461dbac2056bb clk: qcom: Fix test_ctl_hi field for DEFAULT_EVO PLLs
3ce0e9b43f355 nvme-fabrics: fix DHCHAP secret leak on parse failure
68cb1f5d4aa50 rtc: rzn1: Handle unset alarm weekday in rzn1_rtc_read_alarm
16dbe1300ebad ftrace: Synchronize the initialization of ftrace_ops
abdc98e67d7db tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
aa4e177ae7108 staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
f4f0fe3ab47ed usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
4892be1ef0bbe wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
027679d613ea7 i3c: master: Fix use-after-free of master->this
7b25b755d5907 i3c: master: Do not treat master device as a duplicate target
73f3697a7b1c1 hwrng: stm32 - Fix runtime PM cleanup on registration failure
35964ed01e10b power: supply: qcom_battmgr: fix use-after-free
98d0b8a1bfd9a platform/x86: ISST: Validate max level for set feature
8bae4ab7a4c84 platform/x86: ISST: Validate parameter for core power state
55d71c70f11d9 mmc: via-sdmmc: cancel card-detect work on remove
4fe2db296c9cd lockd: fix swapped arguments in nlmsvc_match_ip()
730bb75ed5f66 i2c: mxs: fix DMA channel leak on probe error
6c6ec0f6be517 dmaengine: Add devm_dma_request_chan()
2064fdbec82ec ASoC: codecs: aw88261: only check PLL and clock state at power-up
c45851fc674be ASoC: codecs: aw88261: reduce log spam
31b41ea8383d5 params: fix charp corruption on allocation failure
29144aa486899 params: Fix multi-line comment style
75f9f1e0b4082 params: Sort headers
641d864ba4d0d params: Use size_add() for kmalloc()
710c30766efd8 params: Do not go over the limit when getting the string length
88b11059bb23f ACPI: TAD: Add locking around AML evaluations
d4a76ed0d9b4c ACPI: TAD: Split three functions to untangle runtime PM handling
156fbd020ae36 ACPI: TAD: Rearrange RT data validation checking
12b54e5aab7c0 cpufreq: apple-soc: Fix OPP table cleanup
6b1c1130fcbfa coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior
04c3e4456fe76 nfsd: fix clock domain mismatch in clients_still_reclaiming()
2d8a8ed4f9d86 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
1c6a4d6c20fd4 nfsd: size fh_verify server sockaddr slot by xpt_locallen
f5e9f3a75efc7 zram: fix out-of-bounds access in read_block_state()
a5dda540c113c zram: fixup read_block_state()
81dfc6c665547 KEYS: trusted: Fix TPM teardown ordering
7e6ff8c58985f ethtool: fail closed if we can't get max channel used in indirection tables
0e58d7070eef1 media: av7110: fix a spectre vulnerability
705a8b8cc5a44 kvm: s390: Reject memory region operations for ucontrol VMs
d233c8da8b70f drm/i915/hdcp: Add encoder check in hdcp2_get_capability
df17aa6038f96 drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability
017bea876eca3 pinctrl: sunxi: keep a shadow copy of the data register output latches
3d531429524df vlan: require the MAC header to be present in __vlan_insert_inner_tag()
61812323c037a smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
ee0d8f83d68f6 smb: client: fix use-after-free of iface in cifs_try_adding_channels()
d8bc505cabfba smb: mark the new channel addition log as informational log with cifs_info
f448b267968d0 wifi: libipw: reject TKIP frames without a full MIC
8b637ab10e40e ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
72399eb8bfaa2 ALSA: usb-audio: Optimize the copy of packet sizes for implicit fb handling
48fc1c74052c9 landlock: Fix use-after-free of the source's parent directory
4a1ba62a486a4 ieee802154: cc2520: fix FIFOP work use-after-free
260f99b355a44 net: bridge: use option bits for CFM/MRP frame handlers
ed1cead97afb9 io_uring/rw: end write accounting from ->ki_complete
1a345d95e59a9 genetlink: pin family module during policy dump
aaa7f676418e1 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev
b88e69064588e Bluetooth: btqcomsmd: Convert to platform remove callback returning void
c94985e4fd77e tracing: Fix memory corruption from a "STACKTRACE" histogram key
cc004a1107e2c f2fs: embed f2fs_gc_kthread in f2fs_sb_info
54c587f3f95ce f2fs: validate MOVE_RANGE destination size
5f33efe046589 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
9bd063c082ef0 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
2e6f60adf609c scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
2ecc30066c228 scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
ab1a8a3c99712 KVM: s390: Zero initialize data structures for inject_pfault_token
3868476cd3916 nvme: add missing SRCU grace period in error path
29266da8ee1d9 ftrace: Take trace_array reference before accessing its ftrace_ops
716850842d2f1 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
5a55352d30ad3 staging: rtl8723bs: fix spacing around operators
c1e7e35100eff usb: storage: realtek_cr: fix use-after-free on disconnect
5aade99d72ede udf: Fix data loss when converting inline inodes to out of line
17d5ae5897312 wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
aad3129b8e915 ocfs2: validate directory-index entry counts when reading metadata
1ecc0a9f100a7 ocfs2: validate dx_root extent list fields during block read
66358f5789c9a HID: universal-pidff: stop the device when force-feedback init fails
56ef23198bdd5 HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
6eb70b78e48b0 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
23c5cc9652c6e ceph: properly decrypt filenames in vmalloc() buffers
ab949252fdf10 nfsd: fix nfsd_file leak on inter-server COPY setup failure
b9f5bde07c0f9 x86/xen: fix init of balloon stats again
4a138cd221545 xen/balloon: improve accuracy of initial balloon target for dom0
b17c8f5dcb36a apparmor: fix out-of-bounds write when null terminating a label vec
cf79df1770660 x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
edb9a302cc938 net: ena: Add validation for completion descriptors consistency
70eca80d98a44 net/mlx5e: Fix netif state handling
1743d5a678048 ocfs2: Avoid touching renamed directory if parent does not change
08f3e29665c31 xfrm: prevent policy_hthresh.work from racing with netns teardown
7801e616fbe36 dma-direct: return struct page from dma_direct_alloc_from_pool()
9f1262802008b dma-direct: simplify the use atomic pool logic in dma_direct_alloc
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.6.bb | 6 ++--
.../linux/linux-yocto-tiny_6.6.bb | 6 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 28 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index 3c91a4ba7a5..dbd7894eaba 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,13 +14,13 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "aafd2f2dba2b549d89a66f79826d770742d968ab"
-SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef"
+SRCREV_machine ?= "5d98280cab593fe037ee0dc56c451b48fa549507"
+SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
-LINUX_VERSION ?= "6.6.159"
+LINUX_VERSION ?= "6.6.160"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index 1b06d1e35fb..ba598063efa 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -8,7 +8,7 @@ require recipes-kernel/linux/linux-yocto.inc
# CVE exclusions
include recipes-kernel/linux/cve-exclusion_6.6.inc
-LINUX_VERSION ?= "6.6.159"
+LINUX_VERSION ?= "6.6.160"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
DEPENDS += "${@bb.utils.contains('ARCH', 'x86', 'elfutils-native', '', d)}"
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "7d022d231f699d2c767d88bb1fa305550ca68e01"
-SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef"
+SRCREV_machine ?= "67b2cec31617d8d448fdb6b9786a0bf90bb49bcb"
+SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index 601eb925955..ac5c593f1b0 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,25 +18,25 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "9d17d5c9ac32b38ca5186199ed824b43f3d4308b"
-SRCREV_machine:qemuarm64 ?= "857114866d2445d49024c9ef1ec710a7ef291a5b"
-SRCREV_machine:qemuloongarch64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
-SRCREV_machine:qemumips ?= "2349f4c462400a8fb6f95c6bc0fbbdf959b2cb18"
-SRCREV_machine:qemuppc ?= "47e791b3b9f786f926e66a672c524c1e858c76c1"
-SRCREV_machine:qemuriscv64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
-SRCREV_machine:qemuriscv32 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
-SRCREV_machine:qemux86 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
-SRCREV_machine:qemux86-64 ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
-SRCREV_machine:qemumips64 ?= "a77a45b7cea3e691d2dafca4d9bdbaa60d134617"
-SRCREV_machine ?= "f175bcee52358aef9b53e1ddc5300e65735226ac"
-SRCREV_meta ?= "3254590036234c69bdd4cbc92af14a8178fc64ef"
+SRCREV_machine:qemuarm ?= "6f024f9863d3f9bd5a3e40b24e65b355e0ff57f6"
+SRCREV_machine:qemuarm64 ?= "edbaaeea3aa5ea133a35962f75ba32fab5ffaa25"
+SRCREV_machine:qemuloongarch64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
+SRCREV_machine:qemumips ?= "657fdce3e983f75a5a21e0399651a2bbdc034c12"
+SRCREV_machine:qemuppc ?= "75f8fea793b8611a220cfaba666a59a9aecc8f3c"
+SRCREV_machine:qemuriscv64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
+SRCREV_machine:qemuriscv32 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
+SRCREV_machine:qemux86 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
+SRCREV_machine:qemux86-64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
+SRCREV_machine:qemumips64 ?= "cfed5cc4b70b7c7d59f45b1bc8d58b4f4e4c1a95"
+SRCREV_machine ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
+SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
# meta SRCREV as the linux-yocto-standard builds. Select your version using the
# normal PREFERRED_VERSION settings.
BBCLASSEXTEND = "devupstream:target"
-SRCREV_machine:class-devupstream ?= "cecd39af8a1ab81373fd9fa765b2f7ab73becaad"
+SRCREV_machine:class-devupstream ?= "0aebf2870d53a8d97e02a99e2103ea0b38950c1b"
PN:class-devupstream = "linux-yocto-upstream"
KBRANCH:class-devupstream = "v6.6/base"
@@ -44,7 +44,7 @@ SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRA
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
LIC_FILES_CHKSUM = "file://COPYING;md5=6bc538ed5bd9a7fc9398086aedcd7e46"
-LINUX_VERSION ?= "6.6.159"
+LINUX_VERSION ?= "6.6.160"
PV = "${LINUX_VERSION}+git"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 45/55] linux-yocto/6.6: aufs: refresh to upstream aufs6.6.84
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (43 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 44/55] linux-yocto/6.6: update to v6.6.160 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 46/55] linux-yocto/6.6: update CVE exclusions (6.6.160) Yoann Congal
` (9 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Integrating the following commit(s) to linux-yocto/6.6:
1/4 [
Author: Bruce Ashfield
Email: bruce.ashfield@gmail.com
Subject: aufs: update to upstream aufs6.6.84
Date: Tue, 27 Oct 2026 12:19:23 -0400
Refresh the in-tree aufs from the aufs6.5-era snapshot (6.5-20230918)
to the current upstream aufs-standalone aufs6.6.84 snapshot
(6.6.84-20250414, 31c39fd5). This moves v6.6 onto the native aufs6.6
series, which handles the 6.6 VFS ctime accessors directly and already
carries the allyesconfig build fixes in debug.c/sysrq.c, superseding
our carried adaptations for those.
aufs6.6.84 is the newest aufs6.6 point branch and targets the v6.6.84+
stable API, matching linux-yocto's v6.6 stable base.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
2/4 [
Author: Bruce Ashfield
Email: bruce.ashfield@gmail.com
Subject: aufs6: fix magic.mk include path
Date: Thu, 6 Jul 2023 11:34:59 -0400
commit 482d7131560c51da3ca [aufs stdalone: make it standalone] in the
aufs upstream changes the way that the .mk file is included.
This doesn't work properly with all kernel build processes, so we
restore the use of srctree/src to locate the file.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
(cherry picked from commit c4342d979bf213fcf2168f60c5f8fbdc76d1ac4d)
]
3/4 [
Author: Bruce Ashfield
Email: bruce.ashfield@gmail.com
Subject: mm/mmap: aufs: drop prfile reference on remap_file_pages -EINTR path
Date: Tue, 27 Oct 2026 12:19:34 -0400
remap_file_pages() takes references on both vma->vm_file and the aufs
vma->vm_prfile via vma_get_file(). Every exit path releases both, except
the mmap_write_lock_killable() failure path, which only does fput(file)
and leaks the vm_prfile reference whenever the mapping is backed by aufs.
Release prfile there as well, matching the security_mmap_file() failure
and normal exit paths (upstream aufs6.6.84 uses vma_fput(vma) on this
path for the same reason).
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
4/4 [
Author: Bruce Ashfield
Email: bruce.ashfield@gmail.com
Subject: splice: aufs: drop stale do_splice_to() declaration
Date: Tue, 27 Oct 2026 12:19:48 -0400
The aufs6 base integration added an extern declaration for
do_splice_to() to <linux/splice.h>. Upstream since folded do_splice_to()
into vfs_splice_read(), so there is no longer any definition or user of
it in the tree, leaving a dangling prototype. Upstream aufs6.6.84 dropped
it from its base patch; drop it here too.
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/linux-yocto-rt_6.6.bb | 4 ++--
.../linux/linux-yocto-tiny_6.6.bb | 4 ++--
meta/recipes-kernel/linux/linux-yocto_6.6.bb | 24 +++++++++----------
3 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
index dbd7894eaba..51a4e9703cb 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.6.bb
@@ -14,8 +14,8 @@ python () {
raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
}
-SRCREV_machine ?= "5d98280cab593fe037ee0dc56c451b48fa549507"
-SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e"
+SRCREV_machine ?= "bbef8f873c0872eaa717fb9b043b7b428de82c92"
+SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef"
SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-6.6;destsuffix=${KMETA};protocol=https"
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
index ba598063efa..14f0a62d797 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.6.bb
@@ -17,8 +17,8 @@ DEPENDS += "openssl-native util-linux-native"
KMETA = "kernel-meta"
KCONF_BSP_AUDIT_LEVEL = "2"
-SRCREV_machine ?= "67b2cec31617d8d448fdb6b9786a0bf90bb49bcb"
-SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e"
+SRCREV_machine ?= "ada4ee01eb1897a0f2a46b9b3ceeb94690f9e619"
+SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef"
PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.6.bb b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
index ac5c593f1b0..13fe981462e 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.6.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.6.bb
@@ -18,18 +18,18 @@ KBRANCH:qemux86-64 ?= "v6.6/standard/base"
KBRANCH:qemuloongarch64 ?= "v6.6/standard/base"
KBRANCH:qemumips64 ?= "v6.6/standard/mti-malta64"
-SRCREV_machine:qemuarm ?= "6f024f9863d3f9bd5a3e40b24e65b355e0ff57f6"
-SRCREV_machine:qemuarm64 ?= "edbaaeea3aa5ea133a35962f75ba32fab5ffaa25"
-SRCREV_machine:qemuloongarch64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
-SRCREV_machine:qemumips ?= "657fdce3e983f75a5a21e0399651a2bbdc034c12"
-SRCREV_machine:qemuppc ?= "75f8fea793b8611a220cfaba666a59a9aecc8f3c"
-SRCREV_machine:qemuriscv64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
-SRCREV_machine:qemuriscv32 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
-SRCREV_machine:qemux86 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
-SRCREV_machine:qemux86-64 ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
-SRCREV_machine:qemumips64 ?= "cfed5cc4b70b7c7d59f45b1bc8d58b4f4e4c1a95"
-SRCREV_machine ?= "8f55e2a3b837190130b37f52b906396739b6ac24"
-SRCREV_meta ?= "d601e00cf0670dade657151698a6e1bfc431833e"
+SRCREV_machine:qemuarm ?= "e67812bab0b383dea8ae786005a5ec642e6b860a"
+SRCREV_machine:qemuarm64 ?= "dce83a630a519666f8c5599478cd8db87cf772c2"
+SRCREV_machine:qemuloongarch64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707"
+SRCREV_machine:qemumips ?= "e74bfb3fbb54e475fea2371332942c68ab7edc8e"
+SRCREV_machine:qemuppc ?= "a384bf5c01fda52c362015fb31815f41193f9e3b"
+SRCREV_machine:qemuriscv64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707"
+SRCREV_machine:qemuriscv32 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707"
+SRCREV_machine:qemux86 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707"
+SRCREV_machine:qemux86-64 ?= "0615dc1f6a56bbd35510d527380a9e899adf8707"
+SRCREV_machine:qemumips64 ?= "14d15eae8d97e33895da68333b4347af334e5c65"
+SRCREV_machine ?= "0615dc1f6a56bbd35510d527380a9e899adf8707"
+SRCREV_meta ?= "111e66d07f015c08755ae564c4a2f4a7710863ef"
# set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll
# get the <version>/base branch, which is pure upstream -stable, and the same
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 46/55] linux-yocto/6.6: update CVE exclusions (6.6.160)
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (44 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 45/55] linux-yocto/6.6: aufs: refresh to upstream aufs6.6.84 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 47/55] curl: fix CVE-2026-80230 Yoann Congal
` (8 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Yoann Congal <yoann.congal@smile.fr>
$ ./meta/recipes-kernel/linux/generate-cve-exclusions.py .../cvelistV5/ 6.6.160 > meta/recipes-kernel/linux/cve-exclusion_6.6.inc
Generated at 2026-10-29 13:34:05.293881+00:00 for kernel version 6.6.160
From cvelistV5 cve_2026-10-29_1300Z-1-g135f63d1c5d
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../linux/cve-exclusion_6.6.inc | 7716 +++++++++++++++--
1 file changed, 6817 insertions(+), 899 deletions(-)
diff --git a/meta/recipes-kernel/linux/cve-exclusion_6.6.inc b/meta/recipes-kernel/linux/cve-exclusion_6.6.inc
index d2704e76449..24961f31688 100644
--- a/meta/recipes-kernel/linux/cve-exclusion_6.6.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion_6.6.inc
@@ -1,11 +1,11 @@
# Auto-generated CVE metadata, DO NOT EDIT BY HAND.
-# Generated at 2026-09-10 12:23:31.488006+00:00 for kernel version 6.6.151
-# From cvelistV5 cve_2026-09-10_1100Z-4-g5fc16492753
+# Generated at 2026-10-29 13:34:05.293881+00:00 for kernel version 6.6.160
+# From cvelistV5 cve_2026-10-29_1300Z-1-g135f63d1c5d
python check_kernel_cve_status_version() {
- this_version = "6.6.151"
+ this_version = "6.6.160"
kernel_version = d.getVar("LINUX_VERSION")
if kernel_version != this_version:
bb.warn("Kernel CVE status needs updating: generated for %s but kernel is %s" % (this_version, kernel_version))
@@ -6054,7 +6054,7 @@ CVE_STATUS[CVE-2023-52584] = "cpe-stable-backport: Backported in 6.6.16"
CVE_STATUS[CVE-2023-52585] = "fixed-version: only affects 6.7 onwards"
-# CVE-2023-52586 needs backporting (fixed from 6.8)
+CVE_STATUS[CVE-2023-52586] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2023-52587] = "cpe-stable-backport: Backported in 6.6.16"
@@ -6062,7 +6062,7 @@ CVE_STATUS[CVE-2023-52588] = "cpe-stable-backport: Backported in 6.6.16"
CVE_STATUS[CVE-2023-52589] = "cpe-stable-backport: Backported in 6.6.16"
-# CVE-2023-52590 needs backporting (fixed from 6.8)
+CVE_STATUS[CVE-2023-52590] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2023-52591] = "cpe-stable-backport: Backported in 6.6.16"
@@ -9030,9 +9030,11 @@ CVE_STATUS[CVE-2023-54326] = "fixed-version: Fixed from version 6.5"
CVE_STATUS[CVE-2023-7324] = "fixed-version: Fixed from version 6.3"
+CVE_STATUS[CVE-2023-7356] = "cpe-stable-backport: Backported in 6.6.145"
+
CVE_STATUS[CVE-2024-14027] = "cpe-stable-backport: Backported in 6.6.133"
-# CVE-2024-14040 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-14040] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-26581] = "cpe-stable-backport: Backported in 6.6.17"
@@ -9732,7 +9734,7 @@ CVE_STATUS[CVE-2024-26946] = "cpe-stable-backport: Backported in 6.6.24"
CVE_STATUS[CVE-2024-26947] = "cpe-stable-backport: Backported in 6.6.24"
-# CVE-2024-26948 needs backporting (fixed from 6.9)
+CVE_STATUS[CVE-2024-26948] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-26949] = "fixed-version: only affects 6.7.9 onwards"
@@ -9852,7 +9854,7 @@ CVE_STATUS[CVE-2024-27008] = "cpe-stable-backport: Backported in 6.6.29"
CVE_STATUS[CVE-2024-27009] = "cpe-stable-backport: Backported in 6.6.29"
-# CVE-2024-27010 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2024-27010] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2024-27011] = "cpe-stable-backport: Backported in 6.6.55"
@@ -10940,7 +10942,7 @@ CVE_STATUS[CVE-2024-38606] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2024-38607] = "cpe-stable-backport: Backported in 6.6.33"
-# CVE-2024-38608 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-38608] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-38609] = "fixed-version: only affects 6.9 onwards"
@@ -11068,7 +11070,7 @@ CVE_STATUS[CVE-2024-39476] = "cpe-stable-backport: Backported in 6.6.34"
CVE_STATUS[CVE-2024-39477] = "fixed-version: only affects 6.9 onwards"
-# CVE-2024-39478 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2024-39478] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2024-39479] = "cpe-stable-backport: Backported in 6.6.34"
@@ -11290,7 +11292,7 @@ CVE_STATUS[CVE-2024-40977] = "cpe-stable-backport: Backported in 6.6.36"
CVE_STATUS[CVE-2024-40978] = "cpe-stable-backport: Backported in 6.6.36"
-# CVE-2024-40979 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-40979] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-40980] = "cpe-stable-backport: Backported in 6.6.36"
@@ -11328,7 +11330,7 @@ CVE_STATUS[CVE-2024-40997] = "cpe-stable-backport: Backported in 6.6.36"
CVE_STATUS[CVE-2024-40998] = "cpe-stable-backport: Backported in 6.6.36"
-# CVE-2024-40999 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-40999] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-41000] = "cpe-stable-backport: Backported in 6.6.36"
@@ -11346,7 +11348,7 @@ CVE_STATUS[CVE-2024-41006] = "cpe-stable-backport: Backported in 6.6.36"
CVE_STATUS[CVE-2024-41007] = "cpe-stable-backport: Backported in 6.6.41"
-# CVE-2024-41008 needs backporting (fixed from 6.9)
+CVE_STATUS[CVE-2024-41008] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-41009] = "cpe-stable-backport: Backported in 6.6.37"
@@ -11376,7 +11378,7 @@ CVE_STATUS[CVE-2024-41021] = "cpe-stable-backport: Backported in 6.6.44"
CVE_STATUS[CVE-2024-41022] = "cpe-stable-backport: Backported in 6.6.43"
-# CVE-2024-41023 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-41023] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-41025] = "cpe-stable-backport: Backported in 6.6.41"
@@ -11418,7 +11420,7 @@ CVE_STATUS[CVE-2024-41043] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2024-41044] = "cpe-stable-backport: Backported in 6.6.41"
-# CVE-2024-41045 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-41045] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-41046] = "cpe-stable-backport: Backported in 6.6.41"
@@ -11490,13 +11492,13 @@ CVE_STATUS[CVE-2024-41080] = "cpe-stable-backport: Backported in 6.6.62"
CVE_STATUS[CVE-2024-41081] = "cpe-stable-backport: Backported in 6.6.42"
-# CVE-2024-41082 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-41082] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-41083] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2024-41084] = "cpe-stable-backport: Backported in 6.6.37"
-# CVE-2024-41085 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-41085] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-41086] = "fixed-version: only affects 6.7 onwards"
@@ -11526,7 +11528,7 @@ CVE_STATUS[CVE-2024-41098] = "cpe-stable-backport: Backported in 6.6.37"
CVE_STATUS[CVE-2024-41149] = "fixed-version: only affects 6.12.6 onwards"
-# CVE-2024-41932 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-41932] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-41935] = "cpe-stable-backport: Backported in 6.6.66"
@@ -11538,9 +11540,9 @@ CVE_STATUS[CVE-2024-42065] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2024-42066] = "fixed-version: only affects 6.8 onwards"
-# CVE-2024-42067 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-42067] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2024-42068 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-42068] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-42069] = "cpe-stable-backport: Backported in 6.6.37"
@@ -11618,7 +11620,7 @@ CVE_STATUS[CVE-2024-42105] = "cpe-stable-backport: Backported in 6.6.39"
CVE_STATUS[CVE-2024-42106] = "cpe-stable-backport: Backported in 6.6.39"
-# CVE-2024-42107 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-42107] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-42108] = "fixed-version: only affects 6.8 onwards"
@@ -11648,7 +11650,7 @@ CVE_STATUS[CVE-2024-42121] = "cpe-stable-backport: Backported in 6.6.39"
CVE_STATUS[CVE-2024-42122] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-42123 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-42123] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-42124] = "cpe-stable-backport: Backported in 6.6.39"
@@ -11678,7 +11680,7 @@ CVE_STATUS[CVE-2024-42137] = "cpe-stable-backport: Backported in 6.6.39"
CVE_STATUS[CVE-2024-42138] = "cpe-stable-backport: Backported in 6.6.39"
-# CVE-2024-42139 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-42139] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-42140] = "cpe-stable-backport: Backported in 6.6.39"
@@ -11708,7 +11710,7 @@ CVE_STATUS[CVE-2024-42153] = "cpe-stable-backport: Backported in 6.6.39"
CVE_STATUS[CVE-2024-42154] = "cpe-stable-backport: Backported in 6.6.39"
-# CVE-2024-42155 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-42155] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-42156] = "cpe-stable-backport: Backported in 6.6.64"
@@ -11722,7 +11724,7 @@ CVE_STATUS[CVE-2024-42160] = "cpe-stable-backport: Backported in 6.6.39"
CVE_STATUS[CVE-2024-42161] = "cpe-stable-backport: Backported in 6.6.39"
-# CVE-2024-42162 needs backporting (fixed from 6.10)
+CVE_STATUS[CVE-2024-42162] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-42223] = "cpe-stable-backport: Backported in 6.6.39"
@@ -11908,7 +11910,7 @@ CVE_STATUS[CVE-2024-42315] = "cpe-stable-backport: Backported in 6.6.44"
CVE_STATUS[CVE-2024-42316] = "cpe-stable-backport: Backported in 6.6.44"
-# CVE-2024-42317 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-42317] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-42318] = "cpe-stable-backport: Backported in 6.6.44"
@@ -11930,7 +11932,7 @@ CVE_STATUS[CVE-2024-43817] = "cpe-stable-backport: Backported in 6.6.44"
CVE_STATUS[CVE-2024-43818] = "cpe-stable-backport: Backported in 6.6.44"
-# CVE-2024-43819 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-43819] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-43820] = "fixed-version: only affects 6.7.12 onwards"
@@ -11940,7 +11942,7 @@ CVE_STATUS[CVE-2024-43822] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2024-43823] = "cpe-stable-backport: Backported in 6.6.44"
-# CVE-2024-43824 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-43824] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-43825] = "cpe-stable-backport: Backported in 6.6.44"
@@ -12066,7 +12068,7 @@ CVE_STATUS[CVE-2024-43886] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2024-43887] = "fixed-version: only affects 6.7 onwards"
-CVE_STATUS[CVE-2024-43888] = "fixed-version: only affects 6.8 onwards"
+# CVE-2024-43888 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2024-43889] = "cpe-stable-backport: Backported in 6.6.46"
@@ -12154,7 +12156,7 @@ CVE_STATUS[CVE-2024-44949] = "cpe-stable-backport: Backported in 6.6.46"
CVE_STATUS[CVE-2024-44950] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-44951 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2024-44951] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-44953] = "fixed-version: only affects 6.8 onwards"
@@ -12328,9 +12330,9 @@ CVE_STATUS[CVE-2024-46679] = "cpe-stable-backport: Backported in 6.6.49"
CVE_STATUS[CVE-2024-46680] = "cpe-stable-backport: Backported in 6.6.49"
-# CVE-2024-46681 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-46681] = "cpe-stable-backport: Backported in 6.6.160"
-CVE_STATUS[CVE-2024-46682] = "fixed-version: only affects 6.9 onwards"
+# CVE-2024-46682 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2024-46683] = "fixed-version: only affects 6.8 onwards"
@@ -12424,7 +12426,7 @@ CVE_STATUS[CVE-2024-46728] = "cpe-stable-backport: Backported in 6.6.50"
# CVE-2024-46729 needs backporting (fixed from 6.11)
-# CVE-2024-46730 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-46730] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-46731] = "cpe-stable-backport: Backported in 6.6.50"
@@ -12472,7 +12474,7 @@ CVE_STATUS[CVE-2024-46752] = "cpe-stable-backport: Backported in 6.6.51"
CVE_STATUS[CVE-2024-46753] = "cpe-stable-backport: Backported in 6.6.87"
-# CVE-2024-46754 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2024-46754] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2024-46755] = "cpe-stable-backport: Backported in 6.6.51"
@@ -12508,7 +12510,7 @@ CVE_STATUS[CVE-2024-46773] = "cpe-stable-backport: Backported in 6.6.51"
CVE_STATUS[CVE-2024-46774] = "cpe-stable-backport: Backported in 6.6.88"
-# CVE-2024-46775 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-46775] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-46776] = "cpe-stable-backport: Backported in 6.6.51"
@@ -12574,7 +12576,7 @@ CVE_STATUS[CVE-2024-46806] = "cpe-stable-backport: Backported in 6.6.50"
CVE_STATUS[CVE-2024-46807] = "cpe-stable-backport: Backported in 6.6.50"
-# CVE-2024-46808 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-46808] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-46809] = "cpe-stable-backport: Backported in 6.6.50"
@@ -12626,7 +12628,7 @@ CVE_STATUS[CVE-2024-46832] = "cpe-stable-backport: Backported in 6.6.51"
CVE_STATUS[CVE-2024-46833] = "fixed-version: only affects 6.10 onwards"
-# CVE-2024-46834 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-46834] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-46835] = "cpe-stable-backport: Backported in 6.6.51"
@@ -12640,7 +12642,7 @@ CVE_STATUS[CVE-2024-46840] = "cpe-stable-backport: Backported in 6.6.51"
CVE_STATUS[CVE-2024-46841] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-46842 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-46842] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-46843] = "cpe-stable-backport: Backported in 6.6.51"
@@ -12714,7 +12716,7 @@ CVE_STATUS[CVE-2024-47659] = "cpe-stable-backport: Backported in 6.6.50"
CVE_STATUS[CVE-2024-47660] = "cpe-stable-backport: Backported in 6.6.50"
-# CVE-2024-47661 needs backporting (fixed from 6.11)
+CVE_STATUS[CVE-2024-47661] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2024-47662 needs backporting (fixed from 6.11)
@@ -12794,7 +12796,7 @@ CVE_STATUS[CVE-2024-47700] = "cpe-stable-backport: Backported in 6.6.54"
CVE_STATUS[CVE-2024-47701] = "cpe-stable-backport: Backported in 6.6.54"
-# CVE-2024-47702 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-47702] = "cpe-stable-backport: Backported in 6.6.158"
# CVE-2024-47703 needs backporting (fixed from 6.12)
@@ -12900,7 +12902,7 @@ CVE_STATUS[CVE-2024-47756] = "cpe-stable-backport: Backported in 6.6.54"
CVE_STATUS[CVE-2024-47757] = "cpe-stable-backport: Backported in 6.6.54"
-# CVE-2024-47794 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-47794] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-47809] = "cpe-stable-backport: Backported in 6.6.66"
@@ -12992,13 +12994,13 @@ CVE_STATUS[CVE-2024-49883] = "cpe-stable-backport: Backported in 6.6.55"
CVE_STATUS[CVE-2024-49884] = "cpe-stable-backport: Backported in 6.6.55"
-# CVE-2024-49885 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49885] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-49886] = "cpe-stable-backport: Backported in 6.6.55"
CVE_STATUS[CVE-2024-49887] = "fixed-version: only affects 6.9 onwards"
-# CVE-2024-49888 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49888] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-49889] = "cpe-stable-backport: Backported in 6.6.55"
@@ -13058,15 +13060,15 @@ CVE_STATUS[CVE-2024-49915] = "cpe-stable-backport: Backported in 6.6.64"
CVE_STATUS[CVE-2024-49917] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-49918 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49918] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-49919] = "cpe-stable-backport: Backported in 6.6.79"
-# CVE-2024-49920 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49920] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2024-49921 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49921] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2024-49922 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49922] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-49923] = "cpe-stable-backport: Backported in 6.6.79"
@@ -13102,7 +13104,7 @@ CVE_STATUS[CVE-2024-49938] = "cpe-stable-backport: Backported in 6.6.55"
CVE_STATUS[CVE-2024-49939] = "cpe-stable-backport: Backported in 6.6.55"
-# CVE-2024-49940 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49940] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-49941] = "fixed-version: only affects 6.9 onwards"
@@ -13112,7 +13114,7 @@ CVE_STATUS[CVE-2024-49943] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2024-49944] = "cpe-stable-backport: Backported in 6.6.55"
-# CVE-2024-49945 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49945] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-49946] = "cpe-stable-backport: Backported in 6.6.55"
@@ -13160,7 +13162,7 @@ CVE_STATUS[CVE-2024-49968] = "cpe-stable-backport: Backported in 6.6.120"
CVE_STATUS[CVE-2024-49969] = "cpe-stable-backport: Backported in 6.6.55"
-# CVE-2024-49970 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-49970] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-49971] = "fixed-version: only affects 6.11 onwards"
@@ -13296,7 +13298,7 @@ CVE_STATUS[CVE-2024-50041] = "cpe-stable-backport: Backported in 6.6.57"
CVE_STATUS[CVE-2024-50042] = "fixed-version: only affects 6.7.10 onwards"
-CVE_STATUS[CVE-2024-50043] = "fixed-version: only affects 6.9 onwards"
+# CVE-2024-50043 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2024-50044] = "cpe-stable-backport: Backported in 6.6.57"
@@ -13772,7 +13774,7 @@ CVE_STATUS[CVE-2024-50287] = "cpe-stable-backport: Backported in 6.6.61"
CVE_STATUS[CVE-2024-50288] = "fixed-version: only affects 6.8 onwards"
-# CVE-2024-50289 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-50289] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-50290] = "cpe-stable-backport: Backported in 6.6.61"
@@ -13814,7 +13816,7 @@ CVE_STATUS[CVE-2024-52557] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2024-52559] = "cpe-stable-backport: Backported in 6.6.80"
-# CVE-2024-52560 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2024-52560] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2024-53042] = "cpe-stable-backport: Backported in 6.6.60"
@@ -13834,7 +13836,7 @@ CVE_STATUS[CVE-2024-53049] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2024-53050] = "fixed-version: only affects 6.7 onwards"
-# CVE-2024-53051 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-53051] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-53052] = "cpe-stable-backport: Backported in 6.6.60"
@@ -13842,7 +13844,7 @@ CVE_STATUS[CVE-2024-53053] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2024-53055] = "cpe-stable-backport: Backported in 6.6.60"
-# CVE-2024-53056 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-53056] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2024-53057] = "cpe-stable-backport: Backported in 6.6.60"
@@ -13910,7 +13912,7 @@ CVE_STATUS[CVE-2024-53088] = "cpe-stable-backport: Backported in 6.6.61"
# CVE-2024-53089 needs backporting (fixed from 6.12)
-# CVE-2024-53090 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-53090] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-53091] = "cpe-stable-backport: Backported in 6.6.62"
@@ -13956,7 +13958,7 @@ CVE_STATUS[CVE-2024-53112] = "cpe-stable-backport: Backported in 6.6.63"
CVE_STATUS[CVE-2024-53113] = "cpe-stable-backport: Backported in 6.6.63"
-# CVE-2024-53114 needs backporting (fixed from 6.12)
+CVE_STATUS[CVE-2024-53114] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-53115] = "fixed-version: only affects 6.10.4 onwards"
@@ -14022,7 +14024,7 @@ CVE_STATUS[CVE-2024-53145] = "cpe-stable-backport: Backported in 6.6.64"
CVE_STATUS[CVE-2024-53146] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-53147 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-53147] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-53148] = "cpe-stable-backport: Backported in 6.6.64"
@@ -14100,7 +14102,7 @@ CVE_STATUS[CVE-2024-53185] = "cpe-stable-backport: Backported in 6.6.64"
CVE_STATUS[CVE-2024-53186] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-53187 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-53187] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-53188] = "cpe-stable-backport: Backported in 6.6.64"
@@ -14128,7 +14130,7 @@ CVE_STATUS[CVE-2024-53199] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2024-53200] = "cpe-stable-backport: Backported in 6.6.64"
-CVE_STATUS[CVE-2024-53201] = "fixed-version: only affects 6.11.3 onwards"
+CVE_STATUS[CVE-2024-53201] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-53202] = "cpe-stable-backport: Backported in 6.6.64"
@@ -14164,7 +14166,7 @@ CVE_STATUS[CVE-2024-53217] = "cpe-stable-backport: Backported in 6.6.64"
CVE_STATUS[CVE-2024-53218] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-53219 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-53219] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-53220] = "cpe-stable-backport: Backported in 6.6.64"
@@ -14280,7 +14282,7 @@ CVE_STATUS[CVE-2024-56542] = "fixed-version: only affects 6.11.2 onwards"
CVE_STATUS[CVE-2024-56543] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-56544 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-56544] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-56545] = "cpe-stable-backport: Backported in 6.6.64"
@@ -14592,7 +14594,7 @@ CVE_STATUS[CVE-2024-56700] = "cpe-stable-backport: Backported in 6.6.64"
CVE_STATUS[CVE-2024-56701] = "cpe-stable-backport: Backported in 6.6.64"
-# CVE-2024-56702 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-56702] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-56703] = "cpe-stable-backport: Backported in 6.6.75"
@@ -14612,7 +14614,7 @@ CVE_STATUS[CVE-2024-56710] = "cpe-stable-backport: Backported in 6.6.69"
CVE_STATUS[CVE-2024-56711] = "fixed-version: only affects 6.11 onwards"
-# CVE-2024-56712 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-56712] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-56713] = "fixed-version: only affects 6.10 onwards"
@@ -14654,7 +14656,7 @@ CVE_STATUS[CVE-2024-56739] = "cpe-stable-backport: Backported in 6.6.64"
CVE_STATUS[CVE-2024-56740] = "fixed-version: only affects 6.12 onwards"
-# CVE-2024-56742 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-56742] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-56743] = "fixed-version: only affects 6.12 onwards"
@@ -14760,7 +14762,7 @@ CVE_STATUS[CVE-2024-57801] = "cpe-stable-backport: Backported in 6.6.70"
CVE_STATUS[CVE-2024-57802] = "cpe-stable-backport: Backported in 6.6.70"
-# CVE-2024-57804 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-57804] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-57805] = "fixed-version: only affects 6.11.6 onwards"
@@ -14768,7 +14770,7 @@ CVE_STATUS[CVE-2024-57806] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2024-57807] = "cpe-stable-backport: Backported in 6.6.69"
-# CVE-2024-57809 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-57809] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-57834] = "cpe-stable-backport: Backported in 6.6.79"
@@ -14788,7 +14790,7 @@ CVE_STATUS[CVE-2024-57850] = "cpe-stable-backport: Backported in 6.6.66"
CVE_STATUS[CVE-2024-57852] = "fixed-version: only affects 6.11.8 onwards"
-# CVE-2024-57857 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2024-57857] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2024-57872 needs backporting (fixed from 6.13)
@@ -14946,11 +14948,11 @@ CVE_STATUS[CVE-2024-57953] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2024-57973] = "cpe-stable-backport: Backported in 6.6.76"
-# CVE-2024-57974 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2024-57974] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2024-57975 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2024-57975] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2024-57976 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2024-57976] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-57977] = "cpe-stable-backport: Backported in 6.6.80"
@@ -14996,7 +14998,7 @@ CVE_STATUS[CVE-2024-57997] = "cpe-stable-backport: Backported in 6.6.76"
CVE_STATUS[CVE-2024-57998] = "cpe-stable-backport: Backported in 6.6.76"
-# CVE-2024-57999 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2024-57999] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-58000] = "fixed-version: only affects 6.13 onwards"
@@ -15010,7 +15012,7 @@ CVE_STATUS[CVE-2024-58004] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2024-58005] = "cpe-stable-backport: Backported in 6.6.78"
-# CVE-2024-58006 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2024-58006] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-58007] = "cpe-stable-backport: Backported in 6.6.78"
@@ -15022,7 +15024,7 @@ CVE_STATUS[CVE-2024-58010] = "cpe-stable-backport: Backported in 6.6.78"
CVE_STATUS[CVE-2024-58011] = "cpe-stable-backport: Backported in 6.6.78"
-# CVE-2024-58012 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2024-58012] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2024-58013] = "cpe-stable-backport: Backported in 6.6.78"
@@ -15134,9 +15136,9 @@ CVE_STATUS[CVE-2024-58092] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2024-58093] = "cpe-stable-backport: Backported in 6.6.87"
-# CVE-2024-58094 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2024-58094] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2024-58095 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2024-58095] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2024-58096] = "cpe-stable-backport: Backported in 6.6.123"
@@ -15166,7 +15168,7 @@ CVE_STATUS[CVE-2025-21632] = "cpe-stable-backport: Backported in 6.6.72"
# CVE-2025-21634 needs backporting (fixed from 6.13)
-# CVE-2025-21635 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2025-21635] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21636] = "cpe-stable-backport: Backported in 6.6.72"
@@ -15194,11 +15196,11 @@ CVE_STATUS[CVE-2025-21647] = "cpe-stable-backport: Backported in 6.6.72"
CVE_STATUS[CVE-2025-21648] = "cpe-stable-backport: Backported in 6.6.72"
-# CVE-2025-21649 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2025-21649] = "cpe-stable-backport: Backported in 6.6.157"
-# CVE-2025-21650 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2025-21650] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-21651 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2025-21651] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2025-21652] = "cpe-stable-backport: Backported in 6.6.72"
@@ -15286,7 +15288,7 @@ CVE_STATUS[CVE-2025-21694] = "cpe-stable-backport: Backported in 6.6.74"
CVE_STATUS[CVE-2025-21695] = "fixed-version: only affects 6.10 onwards"
-# CVE-2025-21696 needs backporting (fixed from 6.13)
+CVE_STATUS[CVE-2025-21696] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21697] = "cpe-stable-backport: Backported in 6.6.74"
@@ -15320,7 +15322,7 @@ CVE_STATUS[CVE-2025-21712] = "cpe-stable-backport: Backported in 6.6.80"
CVE_STATUS[CVE-2025-21713] = "fixed-version: only affects 6.11 onwards"
-# CVE-2025-21714 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21714] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21715] = "cpe-stable-backport: Backported in 6.6.76"
@@ -15336,9 +15338,9 @@ CVE_STATUS[CVE-2025-21720] = "cpe-stable-backport: Backported in 6.6.76"
CVE_STATUS[CVE-2025-21721] = "cpe-stable-backport: Backported in 6.6.80"
-# CVE-2025-21722 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21722] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-21723 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21723] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21724] = "cpe-stable-backport: Backported in 6.6.76"
@@ -15350,7 +15352,7 @@ CVE_STATUS[CVE-2025-21727] = "cpe-stable-backport: Backported in 6.6.76"
CVE_STATUS[CVE-2025-21728] = "cpe-stable-backport: Backported in 6.6.76"
-# CVE-2025-21729 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21729] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21730] = "fixed-version: only affects 6.13 onwards"
@@ -15422,7 +15424,7 @@ CVE_STATUS[CVE-2025-21766] = "cpe-stable-backport: Backported in 6.6.79"
CVE_STATUS[CVE-2025-21767] = "cpe-stable-backport: Backported in 6.6.79"
-# CVE-2025-21768 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21768] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21769] = "fixed-version: only affects 6.13 onwards"
@@ -15488,7 +15490,7 @@ CVE_STATUS[CVE-2025-21799] = "cpe-stable-backport: Backported in 6.6.76"
CVE_STATUS[CVE-2025-21800] = "fixed-version: only affects 6.12 onwards"
-# CVE-2025-21801 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21801] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21802] = "cpe-stable-backport: Backported in 6.6.76"
@@ -15534,7 +15536,7 @@ CVE_STATUS[CVE-2025-21823] = "cpe-stable-backport: Backported in 6.6.79"
CVE_STATUS[CVE-2025-21824] = "fixed-version: only affects 6.12 onwards"
-# CVE-2025-21825 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21825] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21826] = "cpe-stable-backport: Backported in 6.6.76"
@@ -15622,7 +15624,7 @@ CVE_STATUS[CVE-2025-21868] = "cpe-stable-backport: Backported in 6.6.117"
CVE_STATUS[CVE-2025-21869] = "fixed-version: only affects 6.7 onwards"
-# CVE-2025-21870 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21870] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21871] = "cpe-stable-backport: Backported in 6.6.80"
@@ -15652,13 +15654,13 @@ CVE_STATUS[CVE-2025-21883] = "cpe-stable-backport: Backported in 6.6.81"
CVE_STATUS[CVE-2025-21884] = "cpe-stable-backport: Backported in 6.6.103"
-# CVE-2025-21885 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21885] = "cpe-stable-backport: Backported in 6.6.160"
-CVE_STATUS[CVE-2025-21886] = "fixed-version: only affects 6.12.13 onwards"
+# CVE-2025-21886 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2025-21887] = "cpe-stable-backport: Backported in 6.6.81"
-# CVE-2025-21888 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21888] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21889] = "cpe-stable-backport: Backported in 6.6.81"
@@ -15666,7 +15668,7 @@ CVE_STATUS[CVE-2025-21890] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2025-21891] = "cpe-stable-backport: Backported in 6.6.81"
-# CVE-2025-21892 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21892] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21893] = "fixed-version: only affects 6.10 onwards"
@@ -15736,7 +15738,7 @@ CVE_STATUS[CVE-2025-21925] = "cpe-stable-backport: Backported in 6.6.83"
CVE_STATUS[CVE-2025-21926] = "cpe-stable-backport: Backported in 6.6.83"
-# CVE-2025-21927 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21927] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21928] = "cpe-stable-backport: Backported in 6.6.83"
@@ -15766,7 +15768,7 @@ CVE_STATUS[CVE-2025-21940] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2025-21941] = "cpe-stable-backport: Backported in 6.6.83"
-CVE_STATUS[CVE-2025-21942] = "fixed-version: only affects 6.13.2 onwards"
+# CVE-2025-21942 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2025-21943] = "cpe-stable-backport: Backported in 6.6.83"
@@ -15804,7 +15806,7 @@ CVE_STATUS[CVE-2025-21959] = "cpe-stable-backport: Backported in 6.6.84"
CVE_STATUS[CVE-2025-21960] = "cpe-stable-backport: Backported in 6.6.84"
-# CVE-2025-21961 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21961] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21962] = "cpe-stable-backport: Backported in 6.6.84"
@@ -15826,7 +15828,7 @@ CVE_STATUS[CVE-2025-21970] = "cpe-stable-backport: Backported in 6.6.84"
CVE_STATUS[CVE-2025-21971] = "cpe-stable-backport: Backported in 6.6.84"
-# CVE-2025-21972 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21972] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21973] = "fixed-version: only affects 6.9 onwards"
@@ -15834,7 +15836,7 @@ CVE_STATUS[CVE-2025-21974] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2025-21975] = "cpe-stable-backport: Backported in 6.6.84"
-# CVE-2025-21976 needs backporting (fixed from 6.14)
+CVE_STATUS[CVE-2025-21976] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-21977] = "fixed-version: only affects 6.8 onwards"
@@ -15958,7 +15960,7 @@ CVE_STATUS[CVE-2025-22037] = "cpe-stable-backport: Backported in 6.6.107"
CVE_STATUS[CVE-2025-22038] = "cpe-stable-backport: Backported in 6.6.87"
-# CVE-2025-22039 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-22039] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2025-22040] = "cpe-stable-backport: Backported in 6.6.87"
@@ -16020,7 +16022,7 @@ CVE_STATUS[CVE-2025-22068] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2025-22069] = "fixed-version: only affects 6.12.75 onwards"
-# CVE-2025-22070 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-22070] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-22071] = "cpe-stable-backport: Backported in 6.6.87"
@@ -16082,13 +16084,13 @@ CVE_STATUS[CVE-2025-22099] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2025-22100] = "fixed-version: only affects 6.13 onwards"
-# CVE-2025-22101 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-22101] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2025-22102] = "cpe-stable-backport: Backported in 6.6.92"
CVE_STATUS[CVE-2025-22103] = "cpe-stable-backport: Backported in 6.6.117"
-# CVE-2025-22104 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-22104] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2025-22105] = "cpe-stable-backport: Backported in 6.6.119"
@@ -16098,7 +16100,7 @@ CVE_STATUS[CVE-2025-22107] = "cpe-stable-backport: Backported in 6.6.120"
# CVE-2025-22108 needs backporting (fixed from 6.15)
-# CVE-2025-22109 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-22109] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-22110] = "fixed-version: only affects 6.14 onwards"
@@ -16106,11 +16108,11 @@ CVE_STATUS[CVE-2025-22111] = "cpe-stable-backport: Backported in 6.6.120"
CVE_STATUS[CVE-2025-22112] = "fixed-version: only affects 6.12.20 onwards"
-# CVE-2025-22113 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-22113] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-22114] = "fixed-version: only affects 6.14 onwards"
-# CVE-2025-22115 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-22115] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-22116] = "fixed-version: only affects 6.7 onwards"
@@ -16128,17 +16130,17 @@ CVE_STATUS[CVE-2025-22122] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2025-22123] = "fixed-version: only affects 6.9 onwards"
-# CVE-2025-22124 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-22124] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2025-22125] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2025-22126] = "cpe-stable-backport: Backported in 6.6.88"
-# CVE-2025-22127 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-22127] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-22128] = "fixed-version: only affects 6.8 onwards"
-# CVE-2025-23129 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-23129] = "cpe-stable-backport: Backported in 6.6.157"
# CVE-2025-23130 needs backporting (fixed from 6.15)
@@ -16146,11 +16148,11 @@ CVE_STATUS[CVE-2025-23131] = "cpe-stable-backport: Backported in 6.6.144"
# CVE-2025-23132 needs backporting (fixed from 6.15)
-# CVE-2025-23133 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-23133] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-23134] = "fixed-version: only affects 6.9 onwards"
-# CVE-2025-23135 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-23135] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-23136] = "cpe-stable-backport: Backported in 6.6.87"
@@ -16216,7 +16218,7 @@ CVE_STATUS[CVE-2025-37741] = "cpe-stable-backport: Backported in 6.6.88"
CVE_STATUS[CVE-2025-37742] = "cpe-stable-backport: Backported in 6.6.88"
-# CVE-2025-37743 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37743] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37744] = "fixed-version: only affects 6.14 onwards"
@@ -16224,13 +16226,13 @@ CVE_STATUS[CVE-2025-37745] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2025-37746] = "fixed-version: only affects 6.8 onwards"
-# CVE-2025-37747 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-37747] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37748] = "cpe-stable-backport: Backported in 6.6.88"
CVE_STATUS[CVE-2025-37749] = "cpe-stable-backport: Backported in 6.6.88"
-# CVE-2025-37750 may need backporting (fixed from 6.7)
+# CVE-2025-37750 needs backporting (fixed from 6.15)
CVE_STATUS[CVE-2025-37751] = "fixed-version: only affects 6.14 onwards"
@@ -16246,7 +16248,7 @@ CVE_STATUS[CVE-2025-37757] = "cpe-stable-backport: Backported in 6.6.88"
CVE_STATUS[CVE-2025-37758] = "cpe-stable-backport: Backported in 6.6.88"
-# CVE-2025-37759 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37759] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37760] = "fixed-version: only affects 6.12.19 onwards"
@@ -16328,15 +16330,15 @@ CVE_STATUS[CVE-2025-37800] = "cpe-stable-backport: Backported in 6.6.89"
CVE_STATUS[CVE-2025-37801] = "cpe-stable-backport: Backported in 6.6.89"
-# CVE-2025-37802 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37802] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2025-37803] = "cpe-stable-backport: Backported in 6.6.89"
CVE_STATUS[CVE-2025-37805] = "cpe-stable-backport: Backported in 6.6.89"
-# CVE-2025-37806 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37806] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-37807 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37807] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37808] = "cpe-stable-backport: Backported in 6.6.89"
@@ -16386,7 +16388,7 @@ CVE_STATUS[CVE-2025-37830] = "cpe-stable-backport: Backported in 6.6.89"
CVE_STATUS[CVE-2025-37831] = "cpe-stable-backport: Backported in 6.6.89"
-# CVE-2025-37833 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37833] = "cpe-stable-backport: Backported in 6.6.157"
# CVE-2025-37834 needs backporting (fixed from 6.15)
@@ -16430,7 +16432,7 @@ CVE_STATUS[CVE-2025-37854] = "cpe-stable-backport: Backported in 6.6.88"
CVE_STATUS[CVE-2025-37855] = "fixed-version: only affects 6.14 onwards"
-# CVE-2025-37856 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37856] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37857] = "cpe-stable-backport: Backported in 6.6.88"
@@ -16438,9 +16440,9 @@ CVE_STATUS[CVE-2025-37858] = "cpe-stable-backport: Backported in 6.6.88"
CVE_STATUS[CVE-2025-37859] = "cpe-stable-backport: Backported in 6.6.88"
-# CVE-2025-37860 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37860] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-37861 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37861] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37862] = "cpe-stable-backport: Backported in 6.6.88"
@@ -16458,7 +16460,7 @@ CVE_STATUS[CVE-2025-37868] = "fixed-version: only affects 6.12.19 onwards"
CVE_STATUS[CVE-2025-37869] = "fixed-version: only affects 6.8 onwards"
-# CVE-2025-37870 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37870] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37871] = "fixed-version: only affects 6.13.11 onwards"
@@ -16666,7 +16668,7 @@ CVE_STATUS[CVE-2025-37974] = "fixed-version: only affects 6.12.5 onwards"
CVE_STATUS[CVE-2025-37975] = "fixed-version: only affects 6.8 onwards"
-# CVE-2025-37977 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-37977] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-37978] = "fixed-version: only affects 6.8 onwards"
@@ -16768,7 +16770,7 @@ CVE_STATUS[CVE-2025-38027] = "cpe-stable-backport: Backported in 6.6.92"
CVE_STATUS[CVE-2025-38028] = "fixed-version: only affects 6.14 onwards"
-# CVE-2025-38029 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-38029] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38031] = "cpe-stable-backport: Backported in 6.6.93"
@@ -16790,9 +16792,9 @@ CVE_STATUS[CVE-2025-38039] = "cpe-stable-backport: Backported in 6.6.93"
CVE_STATUS[CVE-2025-38040] = "cpe-stable-backport: Backported in 6.6.93"
-# CVE-2025-38041 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-38041] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-38042 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-38042] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38043] = "cpe-stable-backport: Backported in 6.6.93"
@@ -16826,7 +16828,7 @@ CVE_STATUS[CVE-2025-38058] = "cpe-stable-backport: Backported in 6.6.93"
CVE_STATUS[CVE-2025-38059] = "cpe-stable-backport: Backported in 6.6.93"
-# CVE-2025-38060 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-38060] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38061] = "cpe-stable-backport: Backported in 6.6.93"
@@ -16834,7 +16836,7 @@ CVE_STATUS[CVE-2025-38062] = "cpe-stable-backport: Backported in 6.6.93"
CVE_STATUS[CVE-2025-38063] = "cpe-stable-backport: Backported in 6.6.93"
-# CVE-2025-38064 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-38064] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38065] = "cpe-stable-backport: Backported in 6.6.93"
@@ -16844,7 +16846,7 @@ CVE_STATUS[CVE-2025-38067] = "cpe-stable-backport: Backported in 6.6.99"
CVE_STATUS[CVE-2025-38068] = "cpe-stable-backport: Backported in 6.6.93"
-# CVE-2025-38069 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-38069] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38070] = "fixed-version: only affects 6.13 onwards"
@@ -16896,7 +16898,7 @@ CVE_STATUS[CVE-2025-38094] = "cpe-stable-backport: Backported in 6.6.92"
CVE_STATUS[CVE-2025-38095] = "cpe-stable-backport: Backported in 6.6.92"
-# CVE-2025-38096 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-38096] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38097] = "cpe-stable-backport: Backported in 6.6.93"
@@ -16968,7 +16970,7 @@ CVE_STATUS[CVE-2025-38130] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2025-38131] = "cpe-stable-backport: Backported in 6.6.94"
-# CVE-2025-38132 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38132] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38133] = "fixed-version: only affects 6.15 onwards"
@@ -17108,13 +17110,13 @@ CVE_STATUS[CVE-2025-38201] = "cpe-stable-backport: Backported in 6.6.124"
CVE_STATUS[CVE-2025-38202] = "cpe-stable-backport: Backported in 6.6.95"
-# CVE-2025-38203 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-38203] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2025-38204 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38204] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38205] = "fixed-version: only affects 6.7 onwards"
-# CVE-2025-38206 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-38206] = "cpe-stable-backport: Backported in 6.6.156"
# CVE-2025-38207 needs backporting (fixed from 6.16)
@@ -17174,7 +17176,7 @@ CVE_STATUS[CVE-2025-38235] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2025-38236] = "cpe-stable-backport: Backported in 6.6.96"
-# CVE-2025-38237 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-38237] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2025-38238] = "fixed-version: only affects 6.14 onwards"
@@ -17222,13 +17224,13 @@ CVE_STATUS[CVE-2025-38259] = "cpe-stable-backport: Backported in 6.6.96"
CVE_STATUS[CVE-2025-38260] = "cpe-stable-backport: Backported in 6.6.96"
-# CVE-2025-38261 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38261] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38262] = "cpe-stable-backport: Backported in 6.6.96"
CVE_STATUS[CVE-2025-38263] = "cpe-stable-backport: Backported in 6.6.96"
-# CVE-2025-38264 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38264] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38265] = "cpe-stable-backport: Backported in 6.6.94"
@@ -17244,7 +17246,7 @@ CVE_STATUS[CVE-2025-38270] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2025-38271] = "fixed-version: only affects 6.15 onwards"
-# CVE-2025-38272 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38272] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38273] = "cpe-stable-backport: Backported in 6.6.94"
@@ -17258,7 +17260,7 @@ CVE_STATUS[CVE-2025-38277] = "cpe-stable-backport: Backported in 6.6.94"
CVE_STATUS[CVE-2025-38278] = "cpe-stable-backport: Backported in 6.6.94"
-# CVE-2025-38279 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38279] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38280] = "cpe-stable-backport: Backported in 6.6.94"
@@ -17284,7 +17286,7 @@ CVE_STATUS[CVE-2025-38290] = "cpe-stable-backport: Backported in 6.6.94"
CVE_STATUS[CVE-2025-38291] = "fixed-version: only affects 6.13 onwards"
-# CVE-2025-38292 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38292] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38293] = "cpe-stable-backport: Backported in 6.6.94"
@@ -17306,7 +17308,7 @@ CVE_STATUS[CVE-2025-38301] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2025-38302] = "fixed-version: only affects 6.10 onwards"
-# CVE-2025-38303 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38303] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38304] = "cpe-stable-backport: Backported in 6.6.94"
@@ -17418,7 +17420,7 @@ CVE_STATUS[CVE-2025-38357] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2025-38358] = "fixed-version: only affects 6.15 onwards"
-# CVE-2025-38359 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38359] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38360] = "fixed-version: only affects 6.7 onwards"
@@ -17526,7 +17528,7 @@ CVE_STATUS[CVE-2025-38412] = "cpe-stable-backport: Backported in 6.6.97"
CVE_STATUS[CVE-2025-38413] = "fixed-version: only affects 6.11 onwards"
-# CVE-2025-38414 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38414] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38415] = "cpe-stable-backport: Backported in 6.6.94"
@@ -17712,7 +17714,7 @@ CVE_STATUS[CVE-2025-38505] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2025-38506] = "fixed-version: only affects 6.8 onwards"
-# CVE-2025-38507 needs backporting (fixed from 6.16)
+CVE_STATUS[CVE-2025-38507] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38508] = "fixed-version: only affects 6.14 onwards"
@@ -17860,7 +17862,7 @@ CVE_STATUS[CVE-2025-38580] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2025-38581] = "cpe-stable-backport: Backported in 6.6.102"
-# CVE-2025-38582 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-38582] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38583] = "cpe-stable-backport: Backported in 6.6.102"
@@ -17878,7 +17880,7 @@ CVE_STATUS[CVE-2025-38589] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2025-38590] = "cpe-stable-backport: Backported in 6.6.102"
-# CVE-2025-38591 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38591] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2025-38592] = "fixed-version: only affects 6.15 onwards"
@@ -17886,11 +17888,11 @@ CVE_STATUS[CVE-2025-38593] = "cpe-stable-backport: Backported in 6.6.117"
CVE_STATUS[CVE-2025-38594] = "fixed-version: only affects 6.16 onwards"
-# CVE-2025-38595 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38595] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38596] = "fixed-version: only affects 6.16 onwards"
-# CVE-2025-38597 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38597] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38598] = "fixed-version: only affects 6.16 onwards"
@@ -17904,7 +17906,7 @@ CVE_STATUS[CVE-2025-38602] = "cpe-stable-backport: Backported in 6.6.102"
CVE_STATUS[CVE-2025-38604] = "cpe-stable-backport: Backported in 6.6.102"
-# CVE-2025-38605 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38605] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38606] = "fixed-version: only affects 6.14 onwards"
@@ -17964,7 +17966,7 @@ CVE_STATUS[CVE-2025-38634] = "cpe-stable-backport: Backported in 6.6.102"
CVE_STATUS[CVE-2025-38635] = "cpe-stable-backport: Backported in 6.6.102"
-# CVE-2025-38636 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38636] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38637] = "cpe-stable-backport: Backported in 6.6.87"
@@ -18004,7 +18006,7 @@ CVE_STATUS[CVE-2025-38654] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2025-38655] = "fixed-version: only affects 6.13 onwards"
-# CVE-2025-38656 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-38656] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38657] = "fixed-version: only affects 6.16 onwards"
@@ -18012,7 +18014,7 @@ CVE_STATUS[CVE-2025-38658] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2025-38659] = "cpe-stable-backport: Backported in 6.6.102"
-# CVE-2025-38660 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38660] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2025-38661] = "fixed-version: only affects 6.15 onwards"
@@ -18102,7 +18104,7 @@ CVE_STATUS[CVE-2025-38703] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2025-38704] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2025-38705 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38705] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38706] = "cpe-stable-backport: Backported in 6.6.103"
@@ -18136,7 +18138,7 @@ CVE_STATUS[CVE-2025-38720] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2025-38721] = "cpe-stable-backport: Backported in 6.6.103"
-# CVE-2025-38722 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-38722] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-38723] = "cpe-stable-backport: Backported in 6.6.103"
@@ -18176,7 +18178,7 @@ CVE_STATUS[CVE-2025-39675] = "cpe-stable-backport: Backported in 6.6.103"
CVE_STATUS[CVE-2025-39676] = "cpe-stable-backport: Backported in 6.6.103"
-# CVE-2025-39677 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39677] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39678] = "fixed-version: only affects 6.7 onwards"
@@ -18232,7 +18234,7 @@ CVE_STATUS[CVE-2025-39703] = "cpe-stable-backport: Backported in 6.6.103"
CVE_STATUS[CVE-2025-39704] = "fixed-version: only affects 6.13 onwards"
-# CVE-2025-39705 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39705] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39706] = "cpe-stable-backport: Backported in 6.6.103"
@@ -18286,7 +18288,7 @@ CVE_STATUS[CVE-2025-39730] = "cpe-stable-backport: Backported in 6.6.102"
CVE_STATUS[CVE-2025-39731] = "cpe-stable-backport: Backported in 6.6.102"
-# CVE-2025-39732 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39732] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39733] = "fixed-version: only affects 6.15 onwards"
@@ -18328,7 +18330,7 @@ CVE_STATUS[CVE-2025-39752] = "cpe-stable-backport: Backported in 6.6.103"
CVE_STATUS[CVE-2025-39753] = "fixed-version: only affects 6.12 onwards"
-# CVE-2025-39754 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39754] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39755] = "fixed-version: only affects 6.13 onwards"
@@ -18398,7 +18400,7 @@ CVE_STATUS[CVE-2025-39787] = "cpe-stable-backport: Backported in 6.6.103"
CVE_STATUS[CVE-2025-39788] = "cpe-stable-backport: Backported in 6.6.103"
-# CVE-2025-39789 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39789] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39790] = "cpe-stable-backport: Backported in 6.6.103"
@@ -18438,7 +18440,7 @@ CVE_STATUS[CVE-2025-39808] = "cpe-stable-backport: Backported in 6.6.104"
CVE_STATUS[CVE-2025-39809] = "fixed-version: only affects 6.14 onwards"
-# CVE-2025-39810 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39810] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39811] = "fixed-version: only affects 6.8 onwards"
@@ -18476,7 +18478,7 @@ CVE_STATUS[CVE-2025-39827] = "cpe-stable-backport: Backported in 6.6.104"
CVE_STATUS[CVE-2025-39828] = "cpe-stable-backport: Backported in 6.6.104"
-# CVE-2025-39829 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39829] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39830] = "fixed-version: only affects 6.12 onwards"
@@ -18484,7 +18486,7 @@ CVE_STATUS[CVE-2025-39831] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2025-39832] = "cpe-stable-backport: Backported in 6.6.104"
-# CVE-2025-39833 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-39833] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2025-39834] = "fixed-version: only affects 6.12 onwards"
@@ -18518,9 +18520,9 @@ CVE_STATUS[CVE-2025-39848] = "cpe-stable-backport: Backported in 6.6.105"
CVE_STATUS[CVE-2025-39849] = "cpe-stable-backport: Backported in 6.6.105"
-# CVE-2025-39850 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39850] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-39851 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39851] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39852] = "fixed-version: only affects 6.7 onwards"
@@ -18536,13 +18538,13 @@ CVE_STATUS[CVE-2025-39857] = "cpe-stable-backport: Backported in 6.6.105"
CVE_STATUS[CVE-2025-39858] = "fixed-version: only affects 6.15 onwards"
-# CVE-2025-39859 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39859] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39860] = "cpe-stable-backport: Backported in 6.6.105"
CVE_STATUS[CVE-2025-39861] = "cpe-stable-backport: Backported in 6.6.105"
-# CVE-2025-39862 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39862] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39863] = "cpe-stable-backport: Backported in 6.6.105"
@@ -18634,7 +18636,7 @@ CVE_STATUS[CVE-2025-39908] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2025-39909] = "cpe-stable-backport: Backported in 6.6.107"
-# CVE-2025-39910 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39910] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39911] = "cpe-stable-backport: Backported in 6.6.107"
@@ -18664,11 +18666,11 @@ CVE_STATUS[CVE-2025-39923] = "cpe-stable-backport: Backported in 6.6.107"
CVE_STATUS[CVE-2025-39924] = "fixed-version: only affects 6.15 onwards"
-# CVE-2025-39925 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-39925] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2025-39926] = "fixed-version: only affects 6.9 onwards"
-# CVE-2025-39927 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39927] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39928] = "fixed-version: only affects 6.13 onwards"
@@ -18680,7 +18682,7 @@ CVE_STATUS[CVE-2025-39931] = "cpe-stable-backport: Backported in 6.6.108"
# CVE-2025-39932 needs backporting (fixed from 6.17)
-# CVE-2025-39933 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39933] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39934] = "cpe-stable-backport: Backported in 6.6.108"
@@ -18694,7 +18696,7 @@ CVE_STATUS[CVE-2025-39938] = "cpe-stable-backport: Backported in 6.6.108"
CVE_STATUS[CVE-2025-39939] = "fixed-version: only affects 6.15 onwards"
-# CVE-2025-39940 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39940] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39941] = "fixed-version: only affects 6.14 onwards"
@@ -18710,7 +18712,7 @@ CVE_STATUS[CVE-2025-39946] = "cpe-stable-backport: Backported in 6.6.108"
CVE_STATUS[CVE-2025-39947] = "cpe-stable-backport: Backported in 6.6.108"
-CVE_STATUS[CVE-2025-39948] = "fixed-version: only affects 6.12.14 onwards"
+CVE_STATUS[CVE-2025-39948] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39949] = "cpe-stable-backport: Backported in 6.6.108"
@@ -18730,7 +18732,7 @@ CVE_STATUS[CVE-2025-39956] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2025-39957] = "cpe-stable-backport: Backported in 6.6.108"
-# CVE-2025-39958 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39958] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39959] = "fixed-version: only affects 6.15 onwards"
@@ -18794,7 +18796,7 @@ CVE_STATUS[CVE-2025-39988] = "cpe-stable-backport: Backported in 6.6.109"
CVE_STATUS[CVE-2025-39989] = "cpe-stable-backport: Backported in 6.6.89"
-# CVE-2025-39990 needs backporting (fixed from 6.17)
+CVE_STATUS[CVE-2025-39990] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-39991] = "fixed-version: only affects 6.7 onwards"
@@ -18820,7 +18822,7 @@ CVE_STATUS[CVE-2025-40001] = "cpe-stable-backport: Backported in 6.6.113"
CVE_STATUS[CVE-2025-40002] = "fixed-version: only affects 6.14 onwards"
-# CVE-2025-40003 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40003] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40004] = "fixed-version: only affects 6.12 onwards"
@@ -18922,13 +18924,13 @@ CVE_STATUS[CVE-2025-40052] = "cpe-stable-backport: Backported in 6.6.112"
CVE_STATUS[CVE-2025-40053] = "cpe-stable-backport: Backported in 6.6.112"
-# CVE-2025-40054 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2025-40054] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2025-40055] = "cpe-stable-backport: Backported in 6.6.112"
CVE_STATUS[CVE-2025-40056] = "cpe-stable-backport: Backported in 6.6.112"
-# CVE-2025-40057 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40057] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40058] = "fixed-version: only affects 6.7 onwards"
@@ -18942,9 +18944,9 @@ CVE_STATUS[CVE-2025-40062] = "cpe-stable-backport: Backported in 6.6.112"
CVE_STATUS[CVE-2025-40063] = "fixed-version: only affects 6.16 onwards"
-# CVE-2025-40064 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-40064] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2025-40065 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40065] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40066] = "fixed-version: only affects 6.15 onwards"
@@ -18962,9 +18964,9 @@ CVE_STATUS[CVE-2025-40072] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2025-40073] = "fixed-version: only affects 6.16 onwards"
-# CVE-2025-40074 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40074] = "cpe-stable-backport: Backported in 6.6.157"
-# CVE-2025-40075 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40075] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40076] = "fixed-version: only affects 6.17 onwards"
@@ -19008,7 +19010,7 @@ CVE_STATUS[CVE-2025-40095] = "cpe-stable-backport: Backported in 6.6.114"
CVE_STATUS[CVE-2025-40096] = "cpe-stable-backport: Backported in 6.6.114"
-# CVE-2025-40097 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40097] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2025-40098] = "fixed-version: only affects 6.7 onwards"
@@ -19018,7 +19020,7 @@ CVE_STATUS[CVE-2025-40100] = "cpe-stable-backport: Backported in 6.6.114"
CVE_STATUS[CVE-2025-40101] = "fixed-version: only affects 6.7.11 onwards"
-# CVE-2025-40102 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-40102] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2025-40103] = "cpe-stable-backport: Backported in 6.6.114"
@@ -19084,13 +19086,13 @@ CVE_STATUS[CVE-2025-40134] = "cpe-stable-backport: Backported in 6.6.112"
CVE_STATUS[CVE-2025-40135] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2025-40136 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40136] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40137] = "cpe-stable-backport: Backported in 6.6.112"
CVE_STATUS[CVE-2025-40138] = "fixed-version: only affects 6.17 onwards"
-# CVE-2025-40139 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-40139] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2025-40140] = "cpe-stable-backport: Backported in 6.6.112"
@@ -19126,7 +19128,7 @@ CVE_STATUS[CVE-2025-40156] = "cpe-stable-backport: Backported in 6.6.112"
CVE_STATUS[CVE-2025-40157] = "cpe-stable-backport: Backported in 6.6.112"
-# CVE-2025-40158 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40158] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40159] = "fixed-version: only affects 6.8 onwards"
@@ -19146,11 +19148,11 @@ CVE_STATUS[CVE-2025-40166] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2025-40167] = "cpe-stable-backport: Backported in 6.6.114"
-# CVE-2025-40168 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2025-40168] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2025-40169] = "cpe-stable-backport: Backported in 6.6.112"
-# CVE-2025-40170 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40170] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40171] = "cpe-stable-backport: Backported in 6.6.112"
@@ -19170,7 +19172,7 @@ CVE_STATUS[CVE-2025-40178] = "cpe-stable-backport: Backported in 6.6.113"
CVE_STATUS[CVE-2025-40179] = "cpe-stable-backport: Backported in 6.6.113"
-# CVE-2025-40180 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40180] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40181] = "fixed-version: only affects 6.12 onwards"
@@ -19236,7 +19238,7 @@ CVE_STATUS[CVE-2025-40211] = "cpe-stable-backport: Backported in 6.6.117"
CVE_STATUS[CVE-2025-40212] = "fixed-version: only affects 6.12 onwards"
-# CVE-2025-40213 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-40213] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40214] = "cpe-stable-backport: Backported in 6.6.117"
@@ -19388,7 +19390,7 @@ CVE_STATUS[CVE-2025-40287] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2025-40288] = "cpe-stable-backport: Backported in 6.6.117"
-# CVE-2025-40289 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40289] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40290] = "fixed-version: only affects 6.16.8 onwards"
@@ -19460,7 +19462,7 @@ CVE_STATUS[CVE-2025-40323] = "cpe-stable-backport: Backported in 6.6.117"
CVE_STATUS[CVE-2025-40324] = "cpe-stable-backport: Backported in 6.6.117"
-# CVE-2025-40325 needs backporting (fixed from 6.15)
+CVE_STATUS[CVE-2025-40325] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-40326] = "fixed-version: only affects 6.14 onwards"
@@ -19486,7 +19488,7 @@ CVE_STATUS[CVE-2025-40336] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2025-40337] = "cpe-stable-backport: Backported in 6.6.117"
-# CVE-2025-40338 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-40338] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2025-40339 needs backporting (fixed from 6.18)
@@ -19554,7 +19556,7 @@ CVE_STATUS[CVE-2025-68173] = "cpe-stable-backport: Backported in 6.6.117"
# CVE-2025-68174 needs backporting (fixed from 6.18)
-# CVE-2025-68175 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68175] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68176] = "cpe-stable-backport: Backported in 6.6.117"
@@ -19580,11 +19582,11 @@ CVE_STATUS[CVE-2025-68186] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2025-68187] = "fixed-version: only affects 6.17 onwards"
-# CVE-2025-68188 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68188] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68189] = "fixed-version: only affects 6.17 onwards"
-# CVE-2025-68190 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68190] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2025-68191] = "cpe-stable-backport: Backported in 6.6.117"
@@ -19594,8 +19596,6 @@ CVE_STATUS[CVE-2025-68193] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2025-68194] = "cpe-stable-backport: Backported in 6.6.117"
-CVE_STATUS[CVE-2025-68195] = "fixed-version: only affects 6.12.58 onwards"
-
CVE_STATUS[CVE-2025-68196] = "fixed-version: only affects 6.17 onwards"
CVE_STATUS[CVE-2025-68197] = "fixed-version: only affects 6.13 onwards"
@@ -19606,7 +19606,7 @@ CVE_STATUS[CVE-2025-68199] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2025-68200] = "cpe-stable-backport: Backported in 6.6.117"
-# CVE-2025-68201 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68201] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68202] = "fixed-version: only affects 6.12 onwards"
@@ -19620,7 +19620,7 @@ CVE_STATUS[CVE-2025-68207] = "fixed-version: only affects 6.12.37 onwards"
CVE_STATUS[CVE-2025-68208] = "cpe-stable-backport: Backported in 6.6.117"
-# CVE-2025-68209 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68209] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68210] = "fixed-version: only affects 6.10 onwards"
@@ -19660,7 +19660,7 @@ CVE_STATUS[CVE-2025-68228] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2025-68229] = "cpe-stable-backport: Backported in 6.6.118"
-# CVE-2025-68230 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68230] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68231] = "cpe-stable-backport: Backported in 6.6.118"
@@ -19672,7 +19672,7 @@ CVE_STATUS[CVE-2025-68234] = "fixed-version: only affects 6.17 onwards"
CVE_STATUS[CVE-2025-68235] = "cpe-stable-backport: Backported in 6.6.118"
-# CVE-2025-68236 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68236] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68237] = "cpe-stable-backport: Backported in 6.6.118"
@@ -19702,7 +19702,7 @@ CVE_STATUS[CVE-2025-68249] = "cpe-stable-backport: Backported in 6.6.115"
CVE_STATUS[CVE-2025-68250] = "fixed-version: only affects 6.16 onwards"
-# CVE-2025-68251 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2025-68251] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68252] = "cpe-stable-backport: Backported in 6.6.115"
@@ -19794,11 +19794,11 @@ CVE_STATUS[CVE-2025-68309] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2025-68310] = "cpe-stable-backport: Backported in 6.6.117"
-# CVE-2025-68311 needs backporting (fixed from 6.18)
+CVE_STATUS[CVE-2025-68311] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68312] = "cpe-stable-backport: Backported in 6.6.117"
-CVE_STATUS[CVE-2025-68313] = "fixed-version: only affects 6.6.156 onwards"
+# CVE-2025-68313 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2025-68314] = "fixed-version: only affects 6.17 onwards"
@@ -19820,7 +19820,7 @@ CVE_STATUS[CVE-2025-68321] = "cpe-stable-backport: Backported in 6.6.117"
CVE_STATUS[CVE-2025-68323] = "fixed-version: only affects 6.16 onwards"
-# CVE-2025-68324 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68324] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68325] = "cpe-stable-backport: Backported in 6.6.120"
@@ -19884,7 +19884,7 @@ CVE_STATUS[CVE-2025-68354] = "cpe-stable-backport: Backported in 6.6.120"
CVE_STATUS[CVE-2025-68355] = "fixed-version: only affects 6.18 onwards"
-# CVE-2025-68356 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68356] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68357] = "fixed-version: only affects 6.17.13 onwards"
@@ -19920,15 +19920,15 @@ CVE_STATUS[CVE-2025-68372] = "cpe-stable-backport: Backported in 6.6.120"
CVE_STATUS[CVE-2025-68373] = "fixed-version: only affects 6.17 onwards"
-# CVE-2025-68374 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68374] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68375] = "fixed-version: only affects 6.16 onwards"
-# CVE-2025-68376 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68376] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68377] = "fixed-version: only affects 6.18 onwards"
-# CVE-2025-68378 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68378] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68379] = "cpe-stable-backport: Backported in 6.6.120"
@@ -19944,7 +19944,7 @@ CVE_STATUS[CVE-2025-68727] = "cpe-stable-backport: Backported in 6.6.120"
CVE_STATUS[CVE-2025-68728] = "cpe-stable-backport: Backported in 6.6.120"
-# CVE-2025-68729 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68729] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68730] = "fixed-version: only affects 6.8 onwards"
@@ -19976,7 +19976,7 @@ CVE_STATUS[CVE-2025-68743] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2025-68744] = "cpe-stable-backport: Backported in 6.6.120"
-# CVE-2025-68745 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68745] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68746] = "cpe-stable-backport: Backported in 6.6.120"
@@ -20126,7 +20126,7 @@ CVE_STATUS[CVE-2025-68820] = "cpe-stable-backport: Backported in 6.6.120"
CVE_STATUS[CVE-2025-68821] = "cpe-stable-backport: Backported in 6.6.120"
-# CVE-2025-68822 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-68822] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-68823] = "cpe-stable-backport: Backported in 6.6.124"
@@ -20146,11 +20146,11 @@ CVE_STATUS[CVE-2025-71070] = "fixed-version: only affects 6.14.6 onwards"
CVE_STATUS[CVE-2025-71071] = "cpe-stable-backport: Backported in 6.6.120"
-# CVE-2025-71072 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-71072] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-71073 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-71073] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-71074 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-71074] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-71075] = "cpe-stable-backport: Backported in 6.6.120"
@@ -20220,7 +20220,7 @@ CVE_STATUS[CVE-2025-71107] = "cpe-stable-backport: Backported in 6.6.120"
CVE_STATUS[CVE-2025-71108] = "cpe-stable-backport: Backported in 6.6.120"
-# CVE-2025-71109 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-71109] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-71110] = "fixed-version: only affects 6.18 onwards"
@@ -20388,9 +20388,9 @@ CVE_STATUS[CVE-2025-71223] = "cpe-stable-backport: Backported in 6.6.124"
CVE_STATUS[CVE-2025-71224] = "cpe-stable-backport: Backported in 6.6.124"
-# CVE-2025-71225 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-71225] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-71227 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2025-71227] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-71229] = "cpe-stable-backport: Backported in 6.6.125"
@@ -20428,13 +20428,13 @@ CVE_STATUS[CVE-2025-71270] = "cpe-stable-backport: Backported in 6.6.124"
CVE_STATUS[CVE-2025-71271] = "fixed-version: only affects 6.13 onwards"
-# CVE-2025-71272 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2025-71272] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2025-71273 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2025-71273] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-71274] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2025-71285 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2025-71285] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-71286] = "cpe-stable-backport: Backported in 6.6.128"
@@ -20488,12 +20488,32 @@ CVE_STATUS[CVE-2025-71311] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2025-71312] = "fixed-version: only affects 6.19 onwards"
-# CVE-2025-71313 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2025-71313] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2025-71314] = "fixed-version: only affects 6.10 onwards"
# CVE-2025-71315 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-100070] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-100071] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-100072] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-100073] = "fixed-version: only affects 6.16.3 onwards"
+
+CVE_STATUS[CVE-2026-100074] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-100075] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-100076] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-100077] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-100078] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-100079] = "cpe-stable-backport: Backported in 6.6.157"
+
CVE_STATUS[CVE-2026-17523] = "fixed-version: Fixed from version 5.4"
CVE_STATUS[CVE-2026-22976] = "cpe-stable-backport: Backported in 6.6.121"
@@ -20536,7 +20556,7 @@ CVE_STATUS[CVE-2026-22994] = "cpe-stable-backport: Backported in 6.6.121"
CVE_STATUS[CVE-2026-22995] = "fixed-version: only affects 6.18.4 onwards"
-# CVE-2026-22996 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-22996] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-22997] = "cpe-stable-backport: Backported in 6.6.122"
@@ -20614,7 +20634,7 @@ CVE_STATUS[CVE-2026-23033] = "cpe-stable-backport: Backported in 6.6.122"
CVE_STATUS[CVE-2026-23034] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-23035 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-23035] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23036] = "fixed-version: only affects 6.13 onwards"
@@ -20818,7 +20838,7 @@ CVE_STATUS[CVE-2026-23135] = "cpe-stable-backport: Backported in 6.6.122"
CVE_STATUS[CVE-2026-23136] = "cpe-stable-backport: Backported in 6.6.121"
-# CVE-2026-23137 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-23137] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23138] = "cpe-stable-backport: Backported in 6.6.130"
@@ -20926,7 +20946,7 @@ CVE_STATUS[CVE-2026-23189] = "fixed-version: only affects 6.12.58 onwards"
CVE_STATUS[CVE-2026-23190] = "cpe-stable-backport: Backported in 6.6.124"
-# CVE-2026-23191 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-23191] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-23192] = "fixed-version: only affects 6.15 onwards"
@@ -20958,9 +20978,9 @@ CVE_STATUS[CVE-2026-23205] = "cpe-stable-backport: Backported in 6.6.124"
CVE_STATUS[CVE-2026-23206] = "cpe-stable-backport: Backported in 6.6.124"
-# CVE-2026-23207 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-23207] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-23208 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-23208] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23209] = "cpe-stable-backport: Backported in 6.6.124"
@@ -20970,9 +20990,9 @@ CVE_STATUS[CVE-2026-23211] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-23212] = "cpe-stable-backport: Backported in 6.6.123"
-# CVE-2026-23213 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-23213] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-23214 needs backporting (fixed from 6.19)
+CVE_STATUS[CVE-2026-23214] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23215] = "fixed-version: only affects 6.11 onwards"
@@ -20996,7 +21016,7 @@ CVE_STATUS[CVE-2026-23224] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-23225] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-23226 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23226] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23227] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21038,7 +21058,7 @@ CVE_STATUS[CVE-2026-23245] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-23246] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2026-23247 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23247] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23248] = "fixed-version: only affects 6.14 onwards"
@@ -21096,7 +21116,7 @@ CVE_STATUS[CVE-2026-23274] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-23275] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-23276 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23276] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23277] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21134,7 +21154,7 @@ CVE_STATUS[CVE-2026-23293] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-23294] = "fixed-version: only affects 6.18 onwards"
-CVE_STATUS[CVE-2026-23295] = "fixed-version: only affects 6.19 onwards"
+CVE_STATUS[CVE-2026-23295] = "fixed-version: only affects 6.18.57 onwards"
CVE_STATUS[CVE-2026-23296] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21196,7 +21216,7 @@ CVE_STATUS[CVE-2026-23325] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-23326] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-23327 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23327] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23328] = "fixed-version: only affects 6.14 onwards"
@@ -21262,7 +21282,7 @@ CVE_STATUS[CVE-2026-23359] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-23360] = "cpe-stable-backport: Backported in 6.6.131"
-# CVE-2026-23361 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23361] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23362] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21282,7 +21302,7 @@ CVE_STATUS[CVE-2026-23369] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2026-23370] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2026-23371 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23371] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23372] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21294,7 +21314,7 @@ CVE_STATUS[CVE-2026-23375] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2026-23376] = "fixed-version: only affects 6.17.3 onwards"
-# CVE-2026-23377 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23377] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23378] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21306,7 +21326,7 @@ CVE_STATUS[CVE-2026-23381] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-23382] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2026-23383 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23383] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23384] = "fixed-version: only affects 6.18 onwards"
@@ -21458,7 +21478,7 @@ CVE_STATUS[CVE-2026-23457] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-23458] = "cpe-stable-backport: Backported in 6.6.130"
-CVE_STATUS[CVE-2026-23459] = "fixed-version: only affects 6.6.153 onwards"
+CVE_STATUS[CVE-2026-23459] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23460] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21482,7 +21502,7 @@ CVE_STATUS[CVE-2026-23469] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2026-23470] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-23472 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-23472] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-23474] = "cpe-stable-backport: Backported in 6.6.130"
@@ -21528,7 +21548,7 @@ CVE_STATUS[CVE-2026-31408] = "cpe-stable-backport: Backported in 6.6.131"
CVE_STATUS[CVE-2026-31409] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2026-31410 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31410] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31411] = "cpe-stable-backport: Backported in 6.6.128"
@@ -21548,7 +21568,7 @@ CVE_STATUS[CVE-2026-31418] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-31419] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-31420 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31420] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-31421] = "cpe-stable-backport: Backported in 6.6.134"
@@ -21632,7 +21652,7 @@ CVE_STATUS[CVE-2026-31460] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-31461] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-31462 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31462] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31463] = "fixed-version: only affects 6.19 onwards"
@@ -21682,7 +21702,7 @@ CVE_STATUS[CVE-2026-31485] = "cpe-stable-backport: Backported in 6.6.131"
CVE_STATUS[CVE-2026-31486] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-31487 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31487] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31488] = "cpe-stable-backport: Backported in 6.6.140"
@@ -21694,7 +21714,7 @@ CVE_STATUS[CVE-2026-31491] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-31492] = "cpe-stable-backport: Backported in 6.6.131"
-# CVE-2026-31493 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31493] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31494] = "cpe-stable-backport: Backported in 6.6.131"
@@ -21718,9 +21738,9 @@ CVE_STATUS[CVE-2026-31503] = "cpe-stable-backport: Backported in 6.6.131"
CVE_STATUS[CVE-2026-31504] = "cpe-stable-backport: Backported in 6.6.131"
-# CVE-2026-31505 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31505] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-31506 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31506] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31507] = "cpe-stable-backport: Backported in 6.6.131"
@@ -21736,7 +21756,7 @@ CVE_STATUS[CVE-2026-31512] = "cpe-stable-backport: Backported in 6.6.131"
CVE_STATUS[CVE-2026-31513] = "fixed-version: only affects 6.12.75 onwards"
-CVE_STATUS[CVE-2026-31514] = "fixed-version: only affects 6.12.75 onwards"
+CVE_STATUS[CVE-2026-31514] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-31515] = "cpe-stable-backport: Backported in 6.6.131"
@@ -21768,9 +21788,9 @@ CVE_STATUS[CVE-2026-31528] = "cpe-stable-backport: Backported in 6.6.131"
CVE_STATUS[CVE-2026-31529] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-31530 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31530] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-31531 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31531] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31532] = "cpe-stable-backport: Backported in 6.6.136"
@@ -21820,13 +21840,13 @@ CVE_STATUS[CVE-2026-31555] = "cpe-stable-backport: Backported in 6.6.131"
CVE_STATUS[CVE-2026-31556] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-31557 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31557] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31558] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2026-31559] = "fixed-version: only affects 6.12.43 onwards"
-# CVE-2026-31560 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31560] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31561] = "fixed-version: only affects 6.9 onwards"
@@ -21842,7 +21862,7 @@ CVE_STATUS[CVE-2026-31566] = "cpe-stable-backport: Backported in 6.6.131"
CVE_STATUS[CVE-2026-31567] = "fixed-version: only affects 6.17.8 onwards"
-# CVE-2026-31568 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31568] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31569] = "fixed-version: only affects 6.13 onwards"
@@ -21852,7 +21872,7 @@ CVE_STATUS[CVE-2026-31571] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-31572] = "fixed-version: only affects 6.16 onwards"
-CVE_STATUS[CVE-2026-31573] = "fixed-version: only affects 6.19.6 onwards"
+# CVE-2026-31573 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2026-31574] = "fixed-version: only affects 7.0 onwards"
@@ -21890,7 +21910,7 @@ CVE_STATUS[CVE-2026-31590] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-31591] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-31592 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-31592] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31593] = "fixed-version: only affects 6.11 onwards"
@@ -21918,7 +21938,7 @@ CVE_STATUS[CVE-2026-31604] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-31605] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-31606 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-31606] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31607] = "cpe-stable-backport: Backported in 6.6.136"
@@ -21966,7 +21986,7 @@ CVE_STATUS[CVE-2026-31628] = "cpe-stable-backport: Backported in 6.6.135"
CVE_STATUS[CVE-2026-31629] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-31630 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31630] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31631] = "fixed-version: only affects 6.16 onwards"
@@ -21996,7 +22016,7 @@ CVE_STATUS[CVE-2026-31643] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-31644] = "fixed-version: only affects 6.12 onwards"
-# CVE-2026-31645 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31645] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31646] = "cpe-stable-backport: Backported in 6.6.135"
@@ -22032,7 +22052,7 @@ CVE_STATUS[CVE-2026-31661] = "cpe-stable-backport: Backported in 6.6.135"
CVE_STATUS[CVE-2026-31662] = "cpe-stable-backport: Backported in 6.6.135"
-# CVE-2026-31663 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31663] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31664] = "cpe-stable-backport: Backported in 6.6.135"
@@ -22060,7 +22080,7 @@ CVE_STATUS[CVE-2026-31675] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-31676] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-31677 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31677] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31678] = "cpe-stable-backport: Backported in 6.6.131"
@@ -22116,7 +22136,7 @@ CVE_STATUS[CVE-2026-31704] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-31705] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-31706 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-31706] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31707] = "cpe-stable-backport: Backported in 6.6.141"
@@ -22124,7 +22144,7 @@ CVE_STATUS[CVE-2026-31708] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-31709] = "cpe-stable-backport: Backported in 6.6.140"
-CVE_STATUS[CVE-2026-31710] = "fixed-version: only affects 7.0 onwards"
+CVE_STATUS[CVE-2026-31710] = "fixed-version: only affects 6.18.53 onwards"
CVE_STATUS[CVE-2026-31711] = "cpe-stable-backport: Backported in 6.6.136"
@@ -22148,13 +22168,13 @@ CVE_STATUS[CVE-2026-31720] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-31721] = "cpe-stable-backport: Backported in 6.6.135"
-# CVE-2026-31722 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31722] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-31723 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31723] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-31724 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31724] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-31725 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31725] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31726] = "cpe-stable-backport: Backported in 6.6.134"
@@ -22238,7 +22258,7 @@ CVE_STATUS[CVE-2026-31765] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2026-31766] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-31767 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31767] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31768] = "cpe-stable-backport: Backported in 6.6.134"
@@ -22246,7 +22266,7 @@ CVE_STATUS[CVE-2026-31769] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2026-31770] = "cpe-stable-backport: Backported in 6.6.134"
-# CVE-2026-31771 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-31771] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-31772] = "fixed-version: only affects 6.12.2 onwards"
@@ -22254,7 +22274,7 @@ CVE_STATUS[CVE-2026-31773] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-31774] = "fixed-version: only affects 6.10 onwards"
-CVE_STATUS[CVE-2026-31775] = "fixed-version: only affects 6.19 onwards"
+CVE_STATUS[CVE-2026-31775] = "fixed-version: only affects 6.18.57 onwards"
CVE_STATUS[CVE-2026-31776] = "fixed-version: only affects 6.19 onwards"
@@ -22292,7 +22312,7 @@ CVE_STATUS[CVE-2026-43007] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-43008] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-43009 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43009] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43010] = "cpe-stable-backport: Backported in 6.6.144"
@@ -22318,7 +22338,7 @@ CVE_STATUS[CVE-2026-43020] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-43021] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-43022 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-43022] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43023] = "cpe-stable-backport: Backported in 6.6.134"
@@ -22346,7 +22366,7 @@ CVE_STATUS[CVE-2026-43034] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2026-43035] = "cpe-stable-backport: Backported in 6.6.134"
-# CVE-2026-43036 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43036] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43037] = "cpe-stable-backport: Backported in 6.6.134"
@@ -22358,7 +22378,7 @@ CVE_STATUS[CVE-2026-43040] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-43041] = "cpe-stable-backport: Backported in 6.6.134"
-# CVE-2026-43042 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43042] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43043] = "cpe-stable-backport: Backported in 6.6.134"
@@ -22370,9 +22390,9 @@ CVE_STATUS[CVE-2026-43046] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-43047] = "cpe-stable-backport: Backported in 6.6.134"
-# CVE-2026-43048 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43048] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43049 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43049] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43050] = "cpe-stable-backport: Backported in 6.6.134"
@@ -22392,7 +22412,7 @@ CVE_STATUS[CVE-2026-43057] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-43058] = "cpe-stable-backport: Backported in 6.6.136"
-CVE_STATUS[CVE-2026-43059] = "fixed-version: only affects 6.12.59 onwards"
+CVE_STATUS[CVE-2026-43059] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43060] = "cpe-stable-backport: Backported in 6.6.130"
@@ -22420,7 +22440,7 @@ CVE_STATUS[CVE-2026-43071] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-43072] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-43073 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-43073] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43074] = "cpe-stable-backport: Backported in 6.6.136"
@@ -22440,7 +22460,7 @@ CVE_STATUS[CVE-2026-43081] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-43082] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-43083 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43083] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43084] = "fixed-version: only affects 6.12.75 onwards"
@@ -22476,7 +22496,7 @@ CVE_STATUS[CVE-2026-43099] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-43100] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-43101 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43101] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43102] = "fixed-version: only affects 6.15 onwards"
@@ -22488,7 +22508,7 @@ CVE_STATUS[CVE-2026-43105] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-43106] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-43107 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43107] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43108] = "fixed-version: only affects 6.11 onwards"
@@ -22504,13 +22524,13 @@ CVE_STATUS[CVE-2026-43113] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-43114] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-43115 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43115] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43116] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-43117] = "cpe-stable-backport: Backported in 6.6.136"
-# CVE-2026-43118 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43118] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43119] = "cpe-stable-backport: Backported in 6.6.145"
@@ -22522,11 +22542,11 @@ CVE_STATUS[CVE-2026-43123] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43124] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43125 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43125] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43126 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43126] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43127 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-43127] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43128] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22578,7 +22598,7 @@ CVE_STATUS[CVE-2026-43151] = "fixed-version: only affects 6.18.3 onwards"
CVE_STATUS[CVE-2026-43152] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43153 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43153] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43154] = "fixed-version: only affects 6.18 onwards"
@@ -22616,7 +22636,7 @@ CVE_STATUS[CVE-2026-43170] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43171] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43172 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43172] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43173] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22642,13 +22662,13 @@ CVE_STATUS[CVE-2026-43183] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43184] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43185 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43185] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43186] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43187] = "cpe-stable-backport: Backported in 6.6.128"
-CVE_STATUS[CVE-2026-43188] = "fixed-version: only affects 6.15 onwards"
+CVE_STATUS[CVE-2026-43188] = "fixed-version: only affects 6.12.114 onwards"
CVE_STATUS[CVE-2026-43189] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22666,11 +22686,11 @@ CVE_STATUS[CVE-2026-43195] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-43196] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43197 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43197] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43198 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43198] = "cpe-stable-backport: Backported in 6.6.157"
-# CVE-2026-43199 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43199] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43200] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22680,7 +22700,7 @@ CVE_STATUS[CVE-2026-43202] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43203] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43204 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43204] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43205] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22698,7 +22718,7 @@ CVE_STATUS[CVE-2026-43211] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43212] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43213 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43213] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43214] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22740,7 +22760,7 @@ CVE_STATUS[CVE-2026-43232] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43233] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43234 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43234] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43235] = "fixed-version: only affects 6.18 onwards"
@@ -22760,7 +22780,7 @@ CVE_STATUS[CVE-2026-43242] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43243] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-43244 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43244] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43245] = "cpe-stable-backport: Backported in 6.6.141"
@@ -22768,11 +22788,11 @@ CVE_STATUS[CVE-2026-43246] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43247] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-43248 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43248] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43249 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43249] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43250 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43250] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43251] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22788,7 +22808,7 @@ CVE_STATUS[CVE-2026-43256] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43257] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43258 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43258] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43259] = "fixed-version: only affects 6.15 onwards"
@@ -22860,7 +22880,7 @@ CVE_STATUS[CVE-2026-43292] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2026-43293] = "fixed-version: only affects 6.10 onwards"
-# CVE-2026-43294 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43294] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43295] = "cpe-stable-backport: Backported in 6.6.128"
@@ -22868,9 +22888,9 @@ CVE_STATUS[CVE-2026-43296] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43297] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-43298 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43298] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43299 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43299] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43300] = "fixed-version: only affects 6.7 onwards"
@@ -22888,11 +22908,11 @@ CVE_STATUS[CVE-2026-43306] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2026-43307] = "fixed-version: only affects 6.12 onwards"
-# CVE-2026-43308 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43308] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2026-43309 needs backporting (fixed from 7.0)
-# CVE-2026-43310 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43310] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43311] = "cpe-stable-backport: Backported in 6.6.143"
@@ -22906,7 +22926,7 @@ CVE_STATUS[CVE-2026-43315] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-43316] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-43317 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43317] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2026-43318 needs backporting (fixed from 7.0)
@@ -22948,7 +22968,7 @@ CVE_STATUS[CVE-2026-43336] = "cpe-stable-backport: Backported in 6.6.135"
CVE_STATUS[CVE-2026-43337] = "fixed-version: only affects 6.11.3 onwards"
-# CVE-2026-43338 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43338] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43339] = "cpe-stable-backport: Backported in 6.6.134"
@@ -22960,7 +22980,7 @@ CVE_STATUS[CVE-2026-43342] = "cpe-stable-backport: Backported in 6.6.134"
CVE_STATUS[CVE-2026-43343] = "cpe-stable-backport: Backported in 6.6.134"
-# CVE-2026-43344 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43344] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-43345] = "cpe-stable-backport: Backported in 6.6.136"
@@ -22976,9 +22996,9 @@ CVE_STATUS[CVE-2026-43350] = "cpe-stable-backport: Backported in 6.6.136"
CVE_STATUS[CVE-2026-43351] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-43352 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43352] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43353 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43353] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43354] = "fixed-version: only affects 6.12 onwards"
@@ -23100,7 +23120,7 @@ CVE_STATUS[CVE-2026-43412] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-43413] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2026-43414 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-43414] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43415] = "cpe-stable-backport: Backported in 6.6.130"
@@ -23154,13 +23174,13 @@ CVE_STATUS[CVE-2026-43441] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-43442] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-43443 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-43443] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43444] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-43445] = "cpe-stable-backport: Backported in 6.6.130"
-CVE_STATUS[CVE-2026-43446] = "fixed-version: only affects 6.19 onwards"
+CVE_STATUS[CVE-2026-43446] = "fixed-version: only affects 6.18.57 onwards"
CVE_STATUS[CVE-2026-43447] = "fixed-version: only affects 6.15 onwards"
@@ -23196,9 +23216,9 @@ CVE_STATUS[CVE-2026-43462] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-43463] = "fixed-version: only affects 6.7.3 onwards"
-# CVE-2026-43464 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-43464] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-43465 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-43465] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-43466] = "cpe-stable-backport: Backported in 6.6.130"
@@ -23326,11 +23346,11 @@ CVE_STATUS[CVE-2026-45857] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-45858] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2026-45859 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-45859] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45860] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-45861 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45861] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45862] = "cpe-stable-backport: Backported in 6.6.128"
@@ -23362,7 +23382,7 @@ CVE_STATUS[CVE-2026-45875] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-45876] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-45877 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45877] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45878] = "cpe-stable-backport: Backported in 6.6.128"
@@ -23394,15 +23414,15 @@ CVE_STATUS[CVE-2026-45891] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-45892] = "fixed-version: Fixed from version 6.1.168"
-# CVE-2026-45893 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45893] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-45894 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45894] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45895] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-45896] = "fixed-version: only affects 6.17 onwards"
-# CVE-2026-45897 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-45897] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-45898] = "fixed-version: only affects 6.11 onwards"
@@ -23410,7 +23430,7 @@ CVE_STATUS[CVE-2026-45899] = "cpe-stable-backport: Backported in 6.6.130"
CVE_STATUS[CVE-2026-45900] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-45901 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-45901] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45902] = "cpe-stable-backport: Backported in 6.6.128"
@@ -23442,7 +23462,7 @@ CVE_STATUS[CVE-2026-45915] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-45916] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-45917 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45917] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45918] = "fixed-version: only affects 6.16 onwards"
@@ -23472,11 +23492,11 @@ CVE_STATUS[CVE-2026-45930] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-45931] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-45932 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45932] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45933] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-45934 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45934] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45935] = "cpe-stable-backport: Backported in 6.6.128"
@@ -23488,15 +23508,15 @@ CVE_STATUS[CVE-2026-45938] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2026-45939] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-45940 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45940] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45941] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-45942] = "cpe-stable-backport: Backported in 6.6.130"
-# CVE-2026-45943 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45943] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-45944 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45944] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45945] = "fixed-version: only affects 6.13 onwards"
@@ -23506,7 +23526,7 @@ CVE_STATUS[CVE-2026-45947] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-45948] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-45949 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45949] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45950] = "fixed-version: only affects 6.10 onwards"
@@ -23530,11 +23550,11 @@ CVE_STATUS[CVE-2026-45959] = "fixed-version: only affects 6.17 onwards"
CVE_STATUS[CVE-2026-45960] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-45961 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-45961] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45962] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-45963 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-45963] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-45964] = "cpe-stable-backport: Backported in 6.6.128"
@@ -23554,7 +23574,7 @@ CVE_STATUS[CVE-2026-45971] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-45972] = "cpe-stable-backport: Backported in 6.6.128"
-CVE_STATUS[CVE-2026-45973] = "fixed-version: only affects 6.12.2 onwards"
+CVE_STATUS[CVE-2026-45973] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-45974] = "cpe-stable-backport: Backported in 6.6.128"
@@ -23634,7 +23654,7 @@ CVE_STATUS[CVE-2026-46012] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46013] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-46014 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46014] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46015] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23670,7 +23690,7 @@ CVE_STATUS[CVE-2026-46030] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-46031] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46032 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46032] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46033] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23724,7 +23744,7 @@ CVE_STATUS[CVE-2026-46057] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-46058] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46059 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46059] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46060] = "fixed-version: only affects 6.16 onwards"
@@ -23738,7 +23758,7 @@ CVE_STATUS[CVE-2026-46064] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46065] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46066 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46066] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46067] = "fixed-version: only affects 6.19 onwards"
@@ -23748,7 +23768,7 @@ CVE_STATUS[CVE-2026-46069] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46070] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46071 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46071] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46072] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23758,7 +23778,7 @@ CVE_STATUS[CVE-2026-46074] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-46075] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46076 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46076] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46077] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23786,7 +23806,7 @@ CVE_STATUS[CVE-2026-46088] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46089] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46090 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46090] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-46091] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23866,7 +23886,7 @@ CVE_STATUS[CVE-2026-46128] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46129] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46130 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-46130] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46131] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23902,7 +23922,7 @@ CVE_STATUS[CVE-2026-46146] = "cpe-stable-backport: Backported in 6.6.140"
# CVE-2026-46147 needs backporting (fixed from 7.1)
-# CVE-2026-46148 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46148] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46149] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23920,7 +23940,7 @@ CVE_STATUS[CVE-2026-46155] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46156] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46157 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46157] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46158] = "cpe-stable-backport: Backported in 6.6.142"
@@ -23948,7 +23968,7 @@ CVE_STATUS[CVE-2026-46169] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46170] = "cpe-stable-backport: Backported in 6.6.142"
-# CVE-2026-46171 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46171] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46172] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23956,7 +23976,7 @@ CVE_STATUS[CVE-2026-46173] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46174] = "cpe-stable-backport: Backported in 6.6.139"
-# CVE-2026-46175 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46175] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46176] = "cpe-stable-backport: Backported in 6.6.140"
@@ -23968,7 +23988,7 @@ CVE_STATUS[CVE-2026-46179] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46180] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46181 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46181] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46182] = "fixed-version: only affects 6.18 onwards"
@@ -24004,7 +24024,7 @@ CVE_STATUS[CVE-2026-46198] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46199] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46200 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46200] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46201] = "fixed-version: only affects 6.8 onwards"
@@ -24082,7 +24102,7 @@ CVE_STATUS[CVE-2026-46239] = "fixed-version: only affects 7.0 onwards"
CVE_STATUS[CVE-2026-46240] = "fixed-version: only affects 6.18.16 onwards"
-# CVE-2026-46241 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46241] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46242] = "cpe-stable-backport: Backported in 6.6.144"
@@ -24090,7 +24110,7 @@ CVE_STATUS[CVE-2026-46243] = "cpe-stable-backport: Backported in 6.6.142"
CVE_STATUS[CVE-2026-46244] = "cpe-stable-backport: Backported in 6.6.142"
-# CVE-2026-46245 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-46245] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46246] = "fixed-version: only affects 6.7 onwards"
@@ -24108,7 +24128,7 @@ CVE_STATUS[CVE-2026-46252] = "cpe-stable-backport: Backported in 6.6.144"
CVE_STATUS[CVE-2026-46253] = "cpe-stable-backport: Backported in 6.6.128"
-# CVE-2026-46254 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-46254] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46255] = "cpe-stable-backport: Backported in 6.6.128"
@@ -24144,7 +24164,7 @@ CVE_STATUS[CVE-2026-46270] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-46271] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-46272 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-46272] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46273] = "cpe-stable-backport: Backported in 6.6.140"
@@ -24164,7 +24184,7 @@ CVE_STATUS[CVE-2026-46280] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-46281] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-46282 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46282] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46283] = "fixed-version: only affects 6.10 onwards"
@@ -24204,7 +24224,7 @@ CVE_STATUS[CVE-2026-46300] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-46301] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-46302 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46302] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46303] = "cpe-stable-backport: Backported in 6.6.140"
@@ -24248,9 +24268,9 @@ CVE_STATUS[CVE-2026-46322] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-46323] = "cpe-stable-backport: Backported in 6.6.142"
-# CVE-2026-46324 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-46324] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-46325 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-46325] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46326] = "fixed-version: only affects 6.9 onwards"
@@ -24260,7 +24280,7 @@ CVE_STATUS[CVE-2026-46328] = "cpe-stable-backport: Backported in 6.6.128"
CVE_STATUS[CVE-2026-46329] = "fixed-version: only affects 6.12 onwards"
-# CVE-2026-46330 needs backporting (fixed from 7.0)
+CVE_STATUS[CVE-2026-46330] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-46331] = "cpe-stable-backport: Backported in 6.6.144"
@@ -24334,7 +24354,7 @@ CVE_STATUS[CVE-2026-52935] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-52936] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-52937 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-52937] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-52938] = "fixed-version: only affects 7.0 onwards"
@@ -24372,7 +24392,7 @@ CVE_STATUS[CVE-2026-52954] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-52955] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-52956 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-52956] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-52957] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24380,9 +24400,9 @@ CVE_STATUS[CVE-2026-52958] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-52959] = "fixed-version: only affects 6.13.8 onwards"
-CVE_STATUS[CVE-2026-52960] = "fixed-version: only affects 6.15 onwards"
+CVE_STATUS[CVE-2026-52960] = "fixed-version: only affects 6.12.114 onwards"
-# CVE-2026-52961 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-52961] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-52962] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24436,13 +24456,13 @@ CVE_STATUS[CVE-2026-52986] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-52987] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-52988 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-52988] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-52989] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-52990 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-52990] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-52991 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-52991] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-52992] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24460,7 +24480,7 @@ CVE_STATUS[CVE-2026-52998] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-52999] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53000 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53000] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53001] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24470,7 +24490,7 @@ CVE_STATUS[CVE-2026-53003] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-53004] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53005 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53005] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-53006] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24478,9 +24498,9 @@ CVE_STATUS[CVE-2026-53007] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-53008] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-53009 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53009] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-53010 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-53010] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-53011] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24490,13 +24510,13 @@ CVE_STATUS[CVE-2026-53013] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-53014] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-53015 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53015] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53016] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53017 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53017] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-53018 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53018] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53019] = "fixed-version: only affects 6.16 onwards"
@@ -24508,9 +24528,9 @@ CVE_STATUS[CVE-2026-53022] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-53023] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53024 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53024] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-53025 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53025] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53026] = "fixed-version: only affects 6.18.4 onwards"
@@ -24566,7 +24586,7 @@ CVE_STATUS[CVE-2026-53051] = "fixed-version: only affects 6.12.2 onwards"
CVE_STATUS[CVE-2026-53052] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53053 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53053] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53054] = "fixed-version: only affects 6.17 onwards"
@@ -24600,7 +24620,7 @@ CVE_STATUS[CVE-2026-53068] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-53069] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53070 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53070] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53071] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24616,7 +24636,7 @@ CVE_STATUS[CVE-2026-53076] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-53077] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53078 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53078] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-53079] = "fixed-version: only affects 6.19 onwards"
@@ -24638,11 +24658,11 @@ CVE_STATUS[CVE-2026-53087] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-53088] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53089 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-53089] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-53090] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-53091 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53091] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53092] = "fixed-version: only affects 6.11 onwards"
@@ -24654,7 +24674,7 @@ CVE_STATUS[CVE-2026-53095] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-53096] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53097 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53097] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53098] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24664,7 +24684,7 @@ CVE_STATUS[CVE-2026-53100] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-53101] = "fixed-version: only affects 6.9 onwards"
-# CVE-2026-53102 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53102] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53103] = "fixed-version: only affects 6.11.2 onwards"
@@ -24676,9 +24696,9 @@ CVE_STATUS[CVE-2026-53105] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-53107] = "fixed-version: only affects 6.18.16 onwards"
-# CVE-2026-53108 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53108] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-53109 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53109] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53110] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24686,27 +24706,27 @@ CVE_STATUS[CVE-2026-53111] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-53112] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53113 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53113] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53114] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-53115 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53115] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53116] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-53117] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53118 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53118] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53119] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-53120 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53120] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53121] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-53122 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53122] = "cpe-stable-backport: Backported in 6.6.160"
-CVE_STATUS[CVE-2026-53123] = "fixed-version: only affects 6.7 onwards"
+# CVE-2026-53123 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2026-53124] = "fixed-version: only affects 6.14.6 onwards"
@@ -24718,7 +24738,7 @@ CVE_STATUS[CVE-2026-53127] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-53128] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53129 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53129] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53130] = "cpe-stable-backport: Backported in 6.6.141"
@@ -24772,7 +24792,7 @@ CVE_STATUS[CVE-2026-53154] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-53155] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-53156 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53156] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53157] = "cpe-stable-backport: Backported in 6.6.144"
@@ -24814,9 +24834,9 @@ CVE_STATUS[CVE-2026-53176] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-53177] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-53178 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53178] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-53179 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53179] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53180] = "fixed-version: only affects 6.9 onwards"
@@ -24898,7 +24918,7 @@ CVE_STATUS[CVE-2026-53218] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-53219] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-53220 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53220] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53221] = "cpe-stable-backport: Backported in 6.6.143"
@@ -24906,17 +24926,17 @@ CVE_STATUS[CVE-2026-53222] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-53223] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-53224 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53224] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53225] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-53226 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53226] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53227] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-53228] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-53229 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53229] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53230] = "cpe-stable-backport: Backported in 6.6.143"
@@ -24974,7 +24994,7 @@ CVE_STATUS[CVE-2026-53256] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-53257] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-53258 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53258] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53259] = "fixed-version: only affects 6.17 onwards"
@@ -24982,7 +25002,7 @@ CVE_STATUS[CVE-2026-53260] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-53261] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-53262 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53262] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53263] = "cpe-stable-backport: Backported in 6.6.143"
@@ -25002,7 +25022,7 @@ CVE_STATUS[CVE-2026-53270] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-53271] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-53272 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53272] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53273] = "cpe-stable-backport: Backported in 6.6.143"
@@ -25026,7 +25046,7 @@ CVE_STATUS[CVE-2026-53282] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-53283] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-53284 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53284] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2026-53285 needs backporting (fixed from 7.1)
@@ -25042,7 +25062,7 @@ CVE_STATUS[CVE-2026-53290] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-53291] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53292 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53292] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53293] = "cpe-stable-backport: Backported in 6.6.141"
@@ -25052,7 +25072,7 @@ CVE_STATUS[CVE-2026-53295] = "cpe-stable-backport: Backported in 6.6.141"
CVE_STATUS[CVE-2026-53296] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-53297 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53297] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53298] = "fixed-version: only affects 6.11 onwards"
@@ -25084,7 +25104,7 @@ CVE_STATUS[CVE-2026-53311] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-53312] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-53313 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53313] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53314] = "cpe-stable-backport: Backported in 6.6.141"
@@ -25092,7 +25112,7 @@ CVE_STATUS[CVE-2026-53315] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-53316] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-53317 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53317] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53318] = "fixed-version: only affects 6.11 onwards"
@@ -25118,7 +25138,7 @@ CVE_STATUS[CVE-2026-53328] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-53329] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-53330 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53330] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53331] = "cpe-stable-backport: Backported in 6.6.143"
@@ -25212,7 +25232,7 @@ CVE_STATUS[CVE-2026-53375] = "cpe-stable-backport: Backported in 6.6.140"
CVE_STATUS[CVE-2026-53376] = "cpe-stable-backport: Backported in 6.6.140"
-# CVE-2026-53377 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-53377] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53378] = "fixed-version: only affects 6.19 onwards"
@@ -25260,7 +25280,7 @@ CVE_STATUS[CVE-2026-53399] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-53400] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-53401 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-53401] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-53402] = "cpe-stable-backport: Backported in 6.6.145"
@@ -25302,7 +25322,7 @@ CVE_STATUS[CVE-2026-63809] = "cpe-stable-backport: Backported in 6.6.144"
CVE_STATUS[CVE-2026-63810] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-63811 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-63811] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63812] = "cpe-stable-backport: Backported in 6.6.144"
@@ -25330,7 +25350,7 @@ CVE_STATUS[CVE-2026-63823] = "cpe-stable-backport: Backported in 6.6.144"
CVE_STATUS[CVE-2026-63824] = "cpe-stable-backport: Backported in 6.6.144"
-# CVE-2026-63825 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-63825] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63826] = "cpe-stable-backport: Backported in 6.6.144"
@@ -25386,7 +25406,7 @@ CVE_STATUS[CVE-2026-63851] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2026-63852] = "cpe-stable-backport: Backported in 6.6.141"
-# CVE-2026-63853 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63853] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63854] = "cpe-stable-backport: Backported in 6.6.141"
@@ -25436,7 +25456,7 @@ CVE_STATUS[CVE-2026-63877] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-63878] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-63879 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63879] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63880] = "fixed-version: only affects 6.18 onwards"
@@ -25558,7 +25578,7 @@ CVE_STATUS[CVE-2026-63938] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-63939] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-63940 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63940] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63941] = "fixed-version: only affects 6.11 onwards"
@@ -25602,9 +25622,9 @@ CVE_STATUS[CVE-2026-63960] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-63961] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-63962 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63962] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-63963 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63963] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63964] = "cpe-stable-backport: Backported in 6.6.143"
@@ -25626,7 +25646,7 @@ CVE_STATUS[CVE-2026-63972] = "fixed-version: only affects 6.18.33 onwards"
CVE_STATUS[CVE-2026-63973] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-63974 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63974] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63975] = "cpe-stable-backport: Backported in 6.6.143"
@@ -25634,9 +25654,9 @@ CVE_STATUS[CVE-2026-63976] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-63977] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-63978 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63978] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-63979 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-63979] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-63980] = "fixed-version: only affects 6.7 onwards"
@@ -25676,11 +25696,11 @@ CVE_STATUS[CVE-2026-63997] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-63998] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-63999 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-63999] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64000] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-64001 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64001] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64002] = "cpe-stable-backport: Backported in 6.6.143"
@@ -25750,11 +25770,11 @@ CVE_STATUS[CVE-2026-64034] = "cpe-stable-backport: Backported in 6.6.142"
CVE_STATUS[CVE-2026-64035] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-64036 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64036] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64037] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-64038 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64038] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64039] = "cpe-stable-backport: Backported in 6.6.142"
@@ -25818,7 +25838,7 @@ CVE_STATUS[CVE-2026-64068] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2026-64069] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-64070 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-64070] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-64071] = "fixed-version: only affects 6.13 onwards"
@@ -25830,19 +25850,19 @@ CVE_STATUS[CVE-2026-64074] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-64075] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-64076 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64076] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-64077 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64077] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2026-64078 needs backporting (fixed from 7.1)
-# CVE-2026-64079 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64079] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64080] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-64081] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-64082 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-64082] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-64083] = "cpe-stable-backport: Backported in 6.6.142"
@@ -25912,7 +25932,7 @@ CVE_STATUS[CVE-2026-64115] = "cpe-stable-backport: Backported in 6.6.142"
CVE_STATUS[CVE-2026-64116] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-64117 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64117] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64118] = "cpe-stable-backport: Backported in 6.6.142"
@@ -25954,7 +25974,7 @@ CVE_STATUS[CVE-2026-64136] = "cpe-stable-backport: Backported in 6.6.142"
CVE_STATUS[CVE-2026-64137] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-64138 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64138] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64139] = "cpe-stable-backport: Backported in 6.6.142"
@@ -25970,7 +25990,7 @@ CVE_STATUS[CVE-2026-64144] = "cpe-stable-backport: Backported in 6.6.142"
CVE_STATUS[CVE-2026-64145] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-64146 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64146] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64147] = "cpe-stable-backport: Backported in 6.6.142"
@@ -25986,7 +26006,7 @@ CVE_STATUS[CVE-2026-64152] = "fixed-version: only affects 7.0 onwards"
CVE_STATUS[CVE-2026-64153] = "cpe-stable-backport: Backported in 6.6.142"
-# CVE-2026-64154 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64154] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64155] = "cpe-stable-backport: Backported in 6.6.142"
@@ -26056,7 +26076,7 @@ CVE_STATUS[CVE-2026-64188] = "cpe-stable-backport: Backported in 6.6.144"
CVE_STATUS[CVE-2026-64189] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64190 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64190] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64191] = "cpe-stable-backport: Backported in 6.6.144"
@@ -26072,13 +26092,13 @@ CVE_STATUS[CVE-2026-64208] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-64209] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-64210 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64210] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-64211] = "fixed-version: only affects 7.0 onwards"
# CVE-2026-64212 needs backporting (fixed from 7.1)
-# CVE-2026-64213 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64213] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64214] = "cpe-stable-backport: Backported in 6.6.142"
@@ -26134,7 +26154,7 @@ CVE_STATUS[CVE-2026-64239] = "cpe-stable-backport: Backported in 6.6.143"
CVE_STATUS[CVE-2026-64240] = "cpe-stable-backport: Backported in 6.6.143"
-# CVE-2026-64241 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64241] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64242] = "cpe-stable-backport: Backported in 6.6.143"
@@ -26262,7 +26282,7 @@ CVE_STATUS[CVE-2026-64303] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-64304] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64305 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64305] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64306] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26292,7 +26312,7 @@ CVE_STATUS[CVE-2026-64318] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-64319] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64320 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64320] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64321] = "fixed-version: only affects 6.8 onwards"
@@ -26334,7 +26354,7 @@ CVE_STATUS[CVE-2026-64339] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-64340] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64341 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64341] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64342] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26406,7 +26426,7 @@ CVE_STATUS[CVE-2026-64375] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-64376] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64377 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64377] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64378] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26428,13 +26448,13 @@ CVE_STATUS[CVE-2026-64386] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-64387] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64388 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64388] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-64389 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64389] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64390] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64391 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64391] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64392] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26452,7 +26472,7 @@ CVE_STATUS[CVE-2026-64398] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-64399] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64400 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64400] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64401] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26614,7 +26634,7 @@ CVE_STATUS[CVE-2026-64479] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-64480] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64481 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64481] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64482] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26698,7 +26718,7 @@ CVE_STATUS[CVE-2026-64521] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-64522] = "fixed-version: only affects 6.17.4 onwards"
-# CVE-2026-64523 needs backporting (fixed from 7.1)
+CVE_STATUS[CVE-2026-64523] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64524] = "cpe-stable-backport: Backported in 6.6.143"
@@ -26730,7 +26750,7 @@ CVE_STATUS[CVE-2026-64537] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-64538] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-64539 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-64539] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-64540] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26814,7 +26834,7 @@ CVE_STATUS[CVE-2026-64579] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-64580] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-64581 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-64581] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-64582] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26862,11 +26882,11 @@ CVE_STATUS[CVE-2026-64603] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2026-64604] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-68081 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68081] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-68082 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68082] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-68083 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68083] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68084] = "cpe-stable-backport: Backported in 6.6.145"
@@ -26934,7 +26954,7 @@ CVE_STATUS[CVE-2026-68116] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68117] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68118 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68118] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68119] = "fixed-version: only affects 6.7 onwards"
@@ -26962,7 +26982,7 @@ CVE_STATUS[CVE-2026-68130] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68131] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68132 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68132] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68133] = "fixed-version: only affects 6.9 onwards"
@@ -26970,11 +26990,11 @@ CVE_STATUS[CVE-2026-68134] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2026-68135] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68136 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68136] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68137] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68138 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68138] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68139] = "fixed-version: only affects 6.7 onwards"
@@ -26988,7 +27008,7 @@ CVE_STATUS[CVE-2026-68143] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68144] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68145 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68145] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68146] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27016,7 +27036,7 @@ CVE_STATUS[CVE-2026-68157] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68158] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68159 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68159] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68160] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27030,7 +27050,7 @@ CVE_STATUS[CVE-2026-68164] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68165] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68166 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68166] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68167] = "fixed-version: only affects 7.1 onwards"
@@ -27066,7 +27086,7 @@ CVE_STATUS[CVE-2026-68183] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-68184] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68185 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68185] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68186] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27102,7 +27122,7 @@ CVE_STATUS[CVE-2026-68201] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-68202] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68203 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68203] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68204] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27162,7 +27182,7 @@ CVE_STATUS[CVE-2026-68231] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68232] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-68233 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68233] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68234] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27172,25 +27192,25 @@ CVE_STATUS[CVE-2026-68236] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68237] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-68238 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68238] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68239] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-68240] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-68241 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68241] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-68242 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68242] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68243] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68244] = "cpe-stable-backport: Backported in 6.6.148"
-CVE_STATUS[CVE-2026-68245] = "fixed-version: only affects 6.9 onwards"
+# CVE-2026-68245 may need backporting (fixed from 6.7)
CVE_STATUS[CVE-2026-68246] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68247 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68247] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68248] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27212,7 +27232,7 @@ CVE_STATUS[CVE-2026-68256] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68257] = "fixed-version: only affects 6.12.59 onwards"
-# CVE-2026-68258 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68258] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68259] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27242,7 +27262,7 @@ CVE_STATUS[CVE-2026-68271] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68272] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68273 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68273] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68274] = "fixed-version: only affects 6.13 onwards"
@@ -27268,13 +27288,13 @@ CVE_STATUS[CVE-2026-68284] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68285] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-68286 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68286] = "cpe-stable-backport: Backported in 6.6.158"
-# CVE-2026-68287 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68287] = "cpe-stable-backport: Backported in 6.6.158"
-# CVE-2026-68288 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68288] = "cpe-stable-backport: Backported in 6.6.158"
-# CVE-2026-68289 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68289] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-68290] = "fixed-version: only affects 6.12.10 onwards"
@@ -27282,7 +27302,7 @@ CVE_STATUS[CVE-2026-68291] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2026-68292] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-68293 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68293] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68294] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27302,7 +27322,7 @@ CVE_STATUS[CVE-2026-68301] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68302] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68303 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68303] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68304] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27320,7 +27340,7 @@ CVE_STATUS[CVE-2026-68310] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68311] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-68312 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68312] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68313] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27332,7 +27352,7 @@ CVE_STATUS[CVE-2026-68316] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-68317] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68318 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68318] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68319] = "fixed-version: only affects 6.8.7 onwards"
@@ -27342,7 +27362,7 @@ CVE_STATUS[CVE-2026-68321] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-68322] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-68323 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68323] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68324] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27488,23 +27508,23 @@ CVE_STATUS[CVE-2026-68394] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-68395] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68396 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68396] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68397] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68398] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68399 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68399] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68400] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-68401 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68401] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68402] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68403] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68404 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68404] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68405] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27512,9 +27532,9 @@ CVE_STATUS[CVE-2026-68406] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68407] = "cpe-stable-backport: Backported in 6.6.148"
-CVE_STATUS[CVE-2026-68408] = "fixed-version: only affects 6.12.78 onwards"
+CVE_STATUS[CVE-2026-68408] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-68409 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68409] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68410] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27532,7 +27552,7 @@ CVE_STATUS[CVE-2026-68416] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68417] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68418 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68418] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68419] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27548,7 +27568,7 @@ CVE_STATUS[CVE-2026-68424] = "fixed-version: only affects 7.1 onwards"
CVE_STATUS[CVE-2026-68425] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68426 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68426] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68427] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27558,7 +27578,7 @@ CVE_STATUS[CVE-2026-68429] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68430] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68431 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-68431] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-68432] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27566,7 +27586,7 @@ CVE_STATUS[CVE-2026-68433] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-68434] = "cpe-stable-backport: Backported in 6.6.148"
-# CVE-2026-68435 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68435] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68436] = "fixed-version: only affects 6.10 onwards"
@@ -27578,7 +27598,7 @@ CVE_STATUS[CVE-2026-68439] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2026-68440] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-68441 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68441] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68442] = "fixed-version: only affects 6.8 onwards"
@@ -27592,7 +27612,7 @@ CVE_STATUS[CVE-2026-68446] = "cpe-stable-backport: Backported in 6.6.148"
# CVE-2026-68447 needs backporting (fixed from 7.2)
-# CVE-2026-68448 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68448] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68449] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27602,7 +27622,7 @@ CVE_STATUS[CVE-2026-68451] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-68452] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-68453 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68453] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68454] = "cpe-stable-backport: Backported in 6.6.145"
@@ -27638,7 +27658,7 @@ CVE_STATUS[CVE-2026-68469] = "cpe-stable-backport: Backported in 6.6.145"
# CVE-2026-68470 needs backporting (fixed from 7.2)
-# CVE-2026-68471 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-68471] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-68472] = "fixed-version: only affects 6.14 onwards"
@@ -27796,7 +27816,7 @@ CVE_STATUS[CVE-2026-72071] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-72072] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72073 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72073] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72074] = "cpe-stable-backport: Backported in 6.6.145"
@@ -27846,7 +27866,7 @@ CVE_STATUS[CVE-2026-72096] = "cpe-stable-backport: Backported in 6.6.148"
CVE_STATUS[CVE-2026-72097] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72098 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72098] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72099] = "cpe-stable-backport: Backported in 6.6.145"
@@ -27910,9 +27930,9 @@ CVE_STATUS[CVE-2026-72128] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-72129] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72130 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72130] = "cpe-stable-backport: Backported in 6.6.160"
-CVE_STATUS[CVE-2026-72131] = "fixed-version: only affects 6.18 onwards"
+CVE_STATUS[CVE-2026-72131] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-72132] = "cpe-stable-backport: Backported in 6.6.148"
@@ -27974,7 +27994,7 @@ CVE_STATUS[CVE-2026-72160] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72161] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72162 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72162] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72163] = "cpe-stable-backport: Backported in 6.6.145"
@@ -27986,7 +28006,7 @@ CVE_STATUS[CVE-2026-72166] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72167] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72168 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72168] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72169] = "fixed-version: only affects 6.16 onwards"
@@ -28046,17 +28066,17 @@ CVE_STATUS[CVE-2026-72196] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72197] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72198 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72198] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72199] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-72200 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72200] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72201] = "fixed-version: only affects 7.1 onwards"
CVE_STATUS[CVE-2026-72202] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-72203 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72203] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72204] = "fixed-version: only affects 7.1 onwards"
@@ -28076,7 +28096,7 @@ CVE_STATUS[CVE-2026-72211] = "fixed-version: only affects 7.1 onwards"
CVE_STATUS[CVE-2026-72212] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-72213 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72213] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72214] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28224,7 +28244,7 @@ CVE_STATUS[CVE-2026-72286] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-72287] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-72288 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72288] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72289] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28278,7 +28298,7 @@ CVE_STATUS[CVE-2026-72313] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-72314] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72315 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-72315] = "fixed-version: only affects 6.12.78 onwards"
CVE_STATUS[CVE-2026-72316] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28288,17 +28308,17 @@ CVE_STATUS[CVE-2026-72318] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72319] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72320 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72320] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72321 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72321] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72322] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72323] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72324 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72324] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72325 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72325] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72326] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28306,7 +28326,7 @@ CVE_STATUS[CVE-2026-72327] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2026-72328] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-72329 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72329] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72330] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28316,13 +28336,13 @@ CVE_STATUS[CVE-2026-72332] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-72333] = "fixed-version: only affects 6.18.21 onwards"
-# CVE-2026-72334 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72334] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-72335] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72336] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72337 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72337] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72338] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28330,7 +28350,7 @@ CVE_STATUS[CVE-2026-72339] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72340] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72341 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72341] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72342] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28338,7 +28358,7 @@ CVE_STATUS[CVE-2026-72343] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72344] = "fixed-version: only affects 7.1 onwards"
-CVE_STATUS[CVE-2026-72345] = "fixed-version: only affects 6.14 onwards"
+CVE_STATUS[CVE-2026-72345] = "fixed-version: only affects 6.12.113 onwards"
CVE_STATUS[CVE-2026-72346] = "fixed-version: only affects 7.1 onwards"
@@ -28352,7 +28372,7 @@ CVE_STATUS[CVE-2026-72350] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72351] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72352 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72352] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72353] = "fixed-version: only affects 7.1 onwards"
@@ -28398,7 +28418,7 @@ CVE_STATUS[CVE-2026-72372] = "fixed-version: only affects 6.12.97 onwards"
CVE_STATUS[CVE-2026-72374] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72375 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72375] = "cpe-stable-backport: Backported in 6.6.160"
# CVE-2026-72376 needs backporting (fixed from 7.2)
@@ -28408,13 +28428,13 @@ CVE_STATUS[CVE-2026-72378] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72379] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72380 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72380] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72381] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72382] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72383 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72383] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72384] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28442,9 +28462,9 @@ CVE_STATUS[CVE-2026-72395] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72396] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72397 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72397] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72398 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72398] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72399] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28452,13 +28472,13 @@ CVE_STATUS[CVE-2026-72400] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72401] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-72402 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72402] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-72403] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-72404 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72404] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72405 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72405] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72406] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28474,7 +28494,7 @@ CVE_STATUS[CVE-2026-72411] = "fixed-version: only affects 7.1 onwards"
CVE_STATUS[CVE-2026-72412] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-72413 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72413] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-72414] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28488,13 +28508,13 @@ CVE_STATUS[CVE-2026-72418] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72419] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72420 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72420] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72421] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72422] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72423 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72423] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72424] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28524,11 +28544,11 @@ CVE_STATUS[CVE-2026-72436] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72437] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72438 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72438] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72439 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72439] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72440 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72440] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72441] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28586,7 +28606,7 @@ CVE_STATUS[CVE-2026-72467] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72468] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-72469 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72469] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72470] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28618,13 +28638,13 @@ CVE_STATUS[CVE-2026-72483] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72484] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72485 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72485] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-72486] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-72487] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-72488 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72488] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72489] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28636,11 +28656,11 @@ CVE_STATUS[CVE-2026-72492] = "cpe-stable-backport: Backported in 6.6.145"
# CVE-2026-72493 needs backporting (fixed from 7.2)
-# CVE-2026-72494 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72494] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72495 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72495] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-72496 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72496] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-72497] = "fixed-version: only affects 6.12 onwards"
@@ -28650,7 +28670,7 @@ CVE_STATUS[CVE-2026-72499] = "fixed-version: only affects 6.8 onwards"
CVE_STATUS[CVE-2026-72500] = "fixed-version: only affects 6.12 onwards"
-# CVE-2026-72501 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-72501] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-72502] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28658,21 +28678,19 @@ CVE_STATUS[CVE-2026-74255] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74256] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74257 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74257] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74258 needs backporting (fixed from 7.2)
-
-CVE_STATUS[CVE-2026-74259] = "cpe-stable-backport: Backported in 6.6.145"
+CVE_STATUS[CVE-2026-74258] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-74260] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-74261 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74261] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74262] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74263] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74264 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74264] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74265] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28680,17 +28698,17 @@ CVE_STATUS[CVE-2026-74266] = "fixed-version: only affects 6.17 onwards"
CVE_STATUS[CVE-2026-74267] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74268 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74268] = "cpe-stable-backport: Backported in 6.6.157"
-# CVE-2026-74269 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74269] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74270] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74271] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74272 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74272] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74273 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74273] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74274] = "fixed-version: only affects 6.19 onwards"
@@ -28700,7 +28718,7 @@ CVE_STATUS[CVE-2026-74276] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74277] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-74278 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74278] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74279] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28722,17 +28740,17 @@ CVE_STATUS[CVE-2026-74287] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74288] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74289 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74289] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-74290] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74291 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74291] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-74292] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74293] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74294 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74294] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-74295] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28748,7 +28766,7 @@ CVE_STATUS[CVE-2026-74300] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74301] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-74302 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-74302] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74303] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28758,7 +28776,7 @@ CVE_STATUS[CVE-2026-74305] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74306] = "fixed-version: only affects 6.10 onwards"
-# CVE-2026-74307 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74307] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74308] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28778,9 +28796,9 @@ CVE_STATUS[CVE-2026-74315] = "fixed-version: only affects 7.1 onwards"
CVE_STATUS[CVE-2026-74316] = "fixed-version: only affects 6.9 onwards"
-# CVE-2026-74317 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74317] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74318 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74318] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74319] = "fixed-version: only affects 7.1 onwards"
@@ -28812,7 +28830,7 @@ CVE_STATUS[CVE-2026-74332] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-74333] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-74334 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74334] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-74335] = "fixed-version: only affects 6.13 onwards"
@@ -28820,7 +28838,7 @@ CVE_STATUS[CVE-2026-74336] = "fixed-version: only affects 6.18 onwards"
# CVE-2026-74337 needs backporting (fixed from 7.2)
-# CVE-2026-74338 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74338] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74339] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28832,19 +28850,19 @@ CVE_STATUS[CVE-2026-74341] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74343] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-74344 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74344] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74345 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74345] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74346] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74347 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74347] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74348] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74349] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74350 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74350] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74351] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28856,7 +28874,7 @@ CVE_STATUS[CVE-2026-74354] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2026-74355] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-74356 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74356] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74357] = "fixed-version: only affects 7.1 onwards"
@@ -28880,7 +28898,7 @@ CVE_STATUS[CVE-2026-74366] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-74367] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-74368 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-74368] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74369] = "fixed-version: only affects 7.1 onwards"
@@ -28890,11 +28908,11 @@ CVE_STATUS[CVE-2026-74371] = "fixed-version: only affects 6.17 onwards"
CVE_STATUS[CVE-2026-74372] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-74373 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74373] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74374 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74374] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74375 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74375] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74376] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28916,13 +28934,13 @@ CVE_STATUS[CVE-2026-74384] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74385] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-74386 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74386] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74387] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74388 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74388] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74389 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74389] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74390] = "cpe-stable-backport: Backported in 6.6.145"
@@ -28954,11 +28972,11 @@ CVE_STATUS[CVE-2026-74403] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-74404] = "fixed-version: only affects 6.9 onwards"
-# CVE-2026-74405 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74405] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74406] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-74407 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74407] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74408] = "cpe-stable-backport: Backported in 6.6.145"
@@ -29044,7 +29062,7 @@ CVE_STATUS[CVE-2026-74448] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74449] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-74450 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74450] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74451] = "fixed-version: only affects 6.10 onwards"
@@ -29076,7 +29094,7 @@ CVE_STATUS[CVE-2026-74464] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74465] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74466 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74466] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74467] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29092,17 +29110,17 @@ CVE_STATUS[CVE-2026-74472] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74473] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74474 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74474] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74475] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74476 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74476] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74477] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2026-74478] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74479 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74479] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74480] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29118,7 +29136,7 @@ CVE_STATUS[CVE-2026-74485] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74486] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-74487 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74487] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74488] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29132,11 +29150,11 @@ CVE_STATUS[CVE-2026-74492] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74493] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74494 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74494] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74495] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74496 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74496] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-74497] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29162,7 +29180,7 @@ CVE_STATUS[CVE-2026-74507] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74508] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74509 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-74509] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-74510] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29170,7 +29188,7 @@ CVE_STATUS[CVE-2026-74512] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74513] = "fixed-version: only affects 6.10 onwards"
-# CVE-2026-74514 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74514] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74515] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29184,7 +29202,7 @@ CVE_STATUS[CVE-2026-74519] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74520] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-74521 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74521] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-74522] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29196,7 +29214,7 @@ CVE_STATUS[CVE-2026-74525] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74526] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-74527 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74527] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74528] = "fixed-version: only affects 6.19 onwards"
@@ -29208,15 +29226,15 @@ CVE_STATUS[CVE-2026-74531] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74532] = "cpe-stable-backport: Backported in 6.6.151"
-CVE_STATUS[CVE-2026-74533] = "fixed-version: only affects 6.11.11 onwards"
+CVE_STATUS[CVE-2026-74533] = "fixed-version: only affects 6.12.2 onwards"
-CVE_STATUS[CVE-2026-74534] = "fixed-version: only affects 6.11.11 onwards"
+CVE_STATUS[CVE-2026-74534] = "fixed-version: only affects 6.12.2 onwards"
CVE_STATUS[CVE-2026-74535] = "fixed-version: only affects 6.12.2 onwards"
# CVE-2026-74536 needs backporting (fixed from 7.2)
-# CVE-2026-74537 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74537] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74538] = "fixed-version: only affects 6.8.9 onwards"
@@ -29228,9 +29246,9 @@ CVE_STATUS[CVE-2026-74541] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74542] = "fixed-version: only affects 6.12 onwards"
-# CVE-2026-74543 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74543] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74544 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74544] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74545] = "fixed-version: only affects 6.12 onwards"
@@ -29262,7 +29280,7 @@ CVE_STATUS[CVE-2026-74557] = "cpe-stable-backport: Backported in 6.6.151"
# CVE-2026-74559 needs backporting (fixed from 7.2)
-# CVE-2026-74560 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74560] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74561] = "fixed-version: only affects 6.16 onwards"
@@ -29272,7 +29290,7 @@ CVE_STATUS[CVE-2026-74563] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74564] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74565 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74565] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74566] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29284,7 +29302,7 @@ CVE_STATUS[CVE-2026-74569] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-74570] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-74571 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74571] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74572] = "cpe-stable-backport: Backported in 6.6.151"
@@ -29302,25 +29320,25 @@ CVE_STATUS[CVE-2026-74578] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-74579] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74580 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74580] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74581] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-74582 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74582] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74583 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74583] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74584] = "cpe-stable-backport: Backported in 6.6.144"
-# CVE-2026-74585 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74585] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74586 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74586] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74587 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74587] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74588 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74588] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74589 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74589] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74590] = "fixed-version: only affects 6.8 onwards"
@@ -29330,93 +29348,93 @@ CVE_STATUS[CVE-2026-74591] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-74593] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-74594 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74594] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74595 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74595] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74596] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-74597 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74597] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74598 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74598] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74599 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74599] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-74600 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74600] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74601 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74601] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74602] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-74603 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74603] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74604 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74604] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74605 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-74605] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74606 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74606] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74607 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74607] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-74608 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74608] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74609 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74609] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74610 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74610] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74611 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74611] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74612 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74612] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74613 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74613] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74614 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74614] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74615 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74615] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74616 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74616] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74617] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-74618] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-74619 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74619] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74620 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74620] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74621 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74621] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74622 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74622] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74623 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74623] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74624 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74624] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74625 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74625] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74626 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-74626] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-74627] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-74628 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74628] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74629] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-74630 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74630] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74631 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74631] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74632 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74632] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74633] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-74634] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-74635 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74635] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74636 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74636] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74637 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-74637] = "cpe-stable-backport: Backported in 6.6.154"
# CVE-2026-74638 may need backporting (fixed from 6.7)
@@ -29424,9 +29442,9 @@ CVE_STATUS[CVE-2026-74639] = "fixed-version: only affects 6.18.39 onwards"
CVE_STATUS[CVE-2026-74640] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-74641 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74641] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74642 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74642] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74643] = "fixed-version: only affects 6.17 onwards"
@@ -29434,125 +29452,125 @@ CVE_STATUS[CVE-2026-74644] = "fixed-version: only affects 6.12.44 onwards"
CVE_STATUS[CVE-2026-74645] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-74646 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74646] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74647 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74647] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74648 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74648] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74649 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74649] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74650 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74650] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74651 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74651] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74652] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-74653 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74653] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74654 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74654] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74655 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-74655] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-74656 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74656] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74657 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74657] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74658 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74658] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74659 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74659] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74660 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74660] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74661 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74661] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74662 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-74662] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-74663 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74663] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74664 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74664] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74665] = "fixed-version: only affects 6.9 onwards"
-# CVE-2026-74666 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74666] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74667 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74667] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74668 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74668] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74669 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74669] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74670 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74670] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74671 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74671] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74672 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74672] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-74673 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74673] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74674] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-74675 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74675] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74676 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74676] = "cpe-stable-backport: Backported in 6.6.152"
# CVE-2026-74677 needs backporting (fixed from 7.2)
-# CVE-2026-74678 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74678] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74679 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74679] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74680 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74680] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74681] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-74682 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74682] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74683 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74683] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74684 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74684] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74685] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2026-74686] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-74687 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74687] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74688 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74688] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74689 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74689] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74690 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74690] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74691 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74691] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74692 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74692] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74693 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74693] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74694 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74694] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74695 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74695] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74696 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74696] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74697 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74697] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74698] = "fixed-version: only affects 6.17 onwards"
CVE_STATUS[CVE-2026-74699] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-74700 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74700] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74701 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74701] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74702] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-74703] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-74704 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74704] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74705 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74705] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74706] = "fixed-version: only affects 6.19 onwards"
@@ -29564,81 +29582,79 @@ CVE_STATUS[CVE-2026-74709] = "fixed-version: only affects 6.14.2 onwards"
CVE_STATUS[CVE-2026-74710] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-74711 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74711] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74712] = "fixed-version: only affects 6.12 onwards"
-# CVE-2026-74713 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74713] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74714 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74714] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74715 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74715] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-74716] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-74717 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74717] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74718 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74718] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74719 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74719] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74720 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74720] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74721] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-74722 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74722] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-74723 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74723] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74724 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74724] = "cpe-stable-backport: Backported in 6.6.152"
# CVE-2026-74725 needs backporting (fixed from 7.2)
-# CVE-2026-74726 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74726] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74727] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-74728] = "fixed-version: only affects 6.9 onwards"
-# CVE-2026-74729 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74729] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74730 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-74730] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-74731] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-74732 needs backporting (fixed from 7.2)
-
-# CVE-2026-74733 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-74733] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74734 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74734] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74735 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74735] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74736 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74736] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-74737 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74737] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74738] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-74739 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74739] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-74740 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74740] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74741] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-74742] = "fixed-version: only affects 6.12.61 onwards"
-# CVE-2026-74743 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74743] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-74744 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74744] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74745] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-74746 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74746] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-74747 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74747] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74748 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-74748] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-74749] = "fixed-version: only affects 7.1 onwards"
@@ -29646,17 +29662,17 @@ CVE_STATUS[CVE-2026-74750] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-74751] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-74752 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74752] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-74753 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-74753] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-74754 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-74754] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80519] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-80520] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-80521 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-80521] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-80522] = "fixed-version: only affects 6.10 onwards"
@@ -29666,13 +29682,13 @@ CVE_STATUS[CVE-2026-80524] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-80525] = "fixed-version: only affects 6.10 onwards"
-# CVE-2026-80526 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80526] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80527 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80527] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80528 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80528] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80529 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80529] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80530] = "fixed-version: only affects 6.10 onwards"
@@ -29682,119 +29698,119 @@ CVE_STATUS[CVE-2026-80532] = "fixed-version: only affects 6.10 onwards"
CVE_STATUS[CVE-2026-80533] = "fixed-version: only affects 6.10 onwards"
-# CVE-2026-80534 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80534] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80535] = "fixed-version: only affects 6.10 onwards"
-# CVE-2026-80536 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80536] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80537] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-80538] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-80539 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80539] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80540 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80540] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80541 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80541] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80542] = "fixed-version: only affects 6.18 onwards"
-CVE_STATUS[CVE-2026-80543] = "fixed-version: only affects 7.1 onwards"
+CVE_STATUS[CVE-2026-80543] = "fixed-version: only affects 6.12.114 onwards"
-CVE_STATUS[CVE-2026-80544] = "fixed-version: only affects 7.1 onwards"
+CVE_STATUS[CVE-2026-80544] = "fixed-version: only affects 6.12.114 onwards"
-CVE_STATUS[CVE-2026-80545] = "fixed-version: only affects 7.1 onwards"
+CVE_STATUS[CVE-2026-80545] = "fixed-version: only affects 6.12.114 onwards"
-CVE_STATUS[CVE-2026-80546] = "fixed-version: only affects 7.1 onwards"
+CVE_STATUS[CVE-2026-80546] = "fixed-version: only affects 6.12.114 onwards"
-# CVE-2026-80547 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80547] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80548 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80548] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80549 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80549] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80550 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80550] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80551 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80551] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80552 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80552] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80553 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80553] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80554 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80554] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80555 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80555] = "cpe-stable-backport: Backported in 6.6.154"
# CVE-2026-80556 needs backporting (fixed from 7.2)
-# CVE-2026-80557 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80557] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80558 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80558] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80559 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80559] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80560 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80560] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80561 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80561] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80562 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80562] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80563] = "fixed-version: only affects 6.11 onwards"
CVE_STATUS[CVE-2026-80564] = "fixed-version: only affects 6.17 onwards"
-# CVE-2026-80565 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80565] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80566 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80566] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80567 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80567] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80568 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80568] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80569 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80569] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80570 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80570] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80571] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-80572 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80572] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80573 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80573] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80574 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80574] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80575] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-80576 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80576] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80577] = "fixed-version: only affects 6.10 onwards"
-# CVE-2026-80578 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80578] = "cpe-stable-backport: Backported in 6.6.153"
# CVE-2026-80579 needs backporting (fixed from 7.2)
# CVE-2026-80580 needs backporting (fixed from 7.2)
-# CVE-2026-80581 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80581] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80582] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-80583 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80583] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80584 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80584] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80585 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80585] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80586 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80586] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80587 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80587] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80588] = "fixed-version: only affects 6.18.35 onwards"
-# CVE-2026-80589 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80589] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80590 may need backporting (fixed from 6.6.155)
+CVE_STATUS[CVE-2026-80590] = "cpe-stable-backport: Backported in 6.6.155"
CVE_STATUS[CVE-2026-80591] = "cpe-stable-backport: Backported in 6.6.145"
@@ -29828,7 +29844,7 @@ CVE_STATUS[CVE-2026-80605] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-80606] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-80607 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80607] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80608] = "fixed-version: only affects 7.1 onwards"
@@ -29836,7 +29852,7 @@ CVE_STATUS[CVE-2026-80609] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-80610] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-80611 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80611] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80612] = "fixed-version: only affects 6.19 onwards"
@@ -29846,7 +29862,7 @@ CVE_STATUS[CVE-2026-80614] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-80615] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-80616 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80616] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80617] = "fixed-version: only affects 6.18.33 onwards"
@@ -29860,7 +29876,7 @@ CVE_STATUS[CVE-2026-80621] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-80622] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80623 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80623] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80624] = "cpe-stable-backport: Backported in 6.6.145"
@@ -29870,25 +29886,25 @@ CVE_STATUS[CVE-2026-80626] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-80627] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80628 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80628] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80629 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80629] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80630] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80631 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80631] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80632] = "fixed-version: only affects 7.1 onwards"
CVE_STATUS[CVE-2026-80633] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-80634 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80634] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80635] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-80636] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80637 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80637] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80638] = "fixed-version: only affects 6.19 onwards"
@@ -29900,7 +29916,7 @@ CVE_STATUS[CVE-2026-80641] = "fixed-version: only affects 7.0 onwards"
CVE_STATUS[CVE-2026-80642] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-80643 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80643] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80644] = "cpe-stable-backport: Backported in 6.6.145"
@@ -29914,15 +29930,15 @@ CVE_STATUS[CVE-2026-80648] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2026-80649] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80650 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80650] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80651] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-80652] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80653 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80653] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80654 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80654] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80655] = "fixed-version: only affects 6.11 onwards"
@@ -29938,7 +29954,7 @@ CVE_STATUS[CVE-2026-80660] = "cpe-stable-backport: Backported in 6.6.145"
CVE_STATUS[CVE-2026-80661] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-80662 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80662] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80663] = "cpe-stable-backport: Backported in 6.6.145"
@@ -29950,13 +29966,13 @@ CVE_STATUS[CVE-2026-80666] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2026-80667] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-80668 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-80668] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80669] = "cpe-stable-backport: Backported in 6.6.145"
# CVE-2026-80670 needs backporting (fixed from 7.2)
-# CVE-2026-80671 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80671] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-80672] = "fixed-version: only affects 7.1 onwards"
@@ -29966,7 +29982,7 @@ CVE_STATUS[CVE-2026-80674] = "fixed-version: only affects 7.1 onwards"
CVE_STATUS[CVE-2026-80675] = "fixed-version: only affects 6.18 onwards"
-# CVE-2026-80676 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80676] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80677] = "cpe-stable-backport: Backported in 6.6.145"
@@ -29984,33 +30000,33 @@ CVE_STATUS[CVE-2026-80683] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2026-80684] = "cpe-stable-backport: Backported in 6.6.151"
-CVE_STATUS[CVE-2026-80685] = "fixed-version: only affects 6.15 onwards"
+CVE_STATUS[CVE-2026-80685] = "fixed-version: only affects 6.12.111 onwards"
-# CVE-2026-80686 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80686] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80687] = "fixed-version: only affects 6.17 onwards"
CVE_STATUS[CVE-2026-80688] = "fixed-version: only affects 6.13.11 onwards"
-# CVE-2026-80689 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80689] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-80690] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-80691] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-80692 may need backporting (fixed from 6.7)
+CVE_STATUS[CVE-2026-80692] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80693] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-80694 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80694] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80695 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80695] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80696] = "fixed-version: only affects 6.9 onwards"
CVE_STATUS[CVE-2026-80697] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-80698 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80698] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80699] = "fixed-version: only affects 6.19 onwards"
@@ -30022,7 +30038,7 @@ CVE_STATUS[CVE-2026-80702] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-80703] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-80704 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80704] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80705] = "fixed-version: only affects 6.11 onwards"
@@ -30030,7 +30046,7 @@ CVE_STATUS[CVE-2026-80706] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-80707] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-80708 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80708] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-80709] = "cpe-stable-backport: Backported in 6.6.151"
@@ -30044,7 +30060,7 @@ CVE_STATUS[CVE-2026-80713] = "fixed-version: only affects 7.0 onwards"
CVE_STATUS[CVE-2026-80714] = "cpe-stable-backport: Backported in 6.6.151"
-# CVE-2026-80715 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80715] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80716] = "cpe-stable-backport: Backported in 6.6.151"
@@ -30064,51 +30080,49 @@ CVE_STATUS[CVE-2026-80723] = "fixed-version: only affects 6.12.13 onwards"
CVE_STATUS[CVE-2026-80724] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-80725 may need backporting (fixed from 6.6.154)
-
-# CVE-2026-80726 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80725] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80727] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-80728 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80728] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-80729] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-80730 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80730] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-80731 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80731] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-80732 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80732] = "cpe-stable-backport: Backported in 6.6.152"
-# CVE-2026-80733 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80733] = "cpe-stable-backport: Backported in 6.6.152"
-CVE_STATUS[CVE-2026-80734] = "fixed-version: only affects 6.14.6 onwards"
+CVE_STATUS[CVE-2026-80734] = "fixed-version: only affects 6.12.111 onwards"
CVE_STATUS[CVE-2026-80735] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-80736] = "fixed-version: only affects 6.9 onwards"
-# CVE-2026-80737 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80737] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80738 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80738] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80739 may need backporting (fixed from 6.6.152)
+CVE_STATUS[CVE-2026-80739] = "cpe-stable-backport: Backported in 6.6.152"
CVE_STATUS[CVE-2026-80740] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-80741] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-80742 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80742] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80743 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80743] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80744 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80744] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80745] = "fixed-version: only affects 6.19 onwards"
CVE_STATUS[CVE-2026-80746] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-80747 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80747] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80748] = "fixed-version: only affects 6.17 onwards"
@@ -30118,17 +30132,17 @@ CVE_STATUS[CVE-2026-80750] = "fixed-version: only affects 6.18 onwards"
CVE_STATUS[CVE-2026-80751] = "fixed-version: only affects 6.19 onwards"
-# CVE-2026-80752 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80752] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80753] = "fixed-version: only affects 6.16 onwards"
-# CVE-2026-80754 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80754] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80755 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80755] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80756 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80756] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80757 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80757] = "cpe-stable-backport: Backported in 6.6.153"
CVE_STATUS[CVE-2026-80758] = "fixed-version: only affects 6.16 onwards"
@@ -30136,29 +30150,29 @@ CVE_STATUS[CVE-2026-80759] = "fixed-version: only affects 6.12 onwards"
CVE_STATUS[CVE-2026-80760] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-80761 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80761] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80762 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80762] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80763 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80763] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80764 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80764] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80765 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80765] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80766 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80766] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80767 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80767] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80768 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80768] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80769] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-80770 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80770] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80771 needs backporting (fixed from 7.3rc1)
+# CVE-2026-80771 needs backporting (fixed from 7.3)
-# CVE-2026-80772 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80772] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80773] = "fixed-version: only affects 7.1 onwards"
@@ -30174,75 +30188,75 @@ CVE_STATUS[CVE-2026-80778] = "fixed-version: only affects 6.16 onwards"
CVE_STATUS[CVE-2026-80779] = "fixed-version: only affects 6.9 onwards"
-# CVE-2026-80780 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80780] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80781 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80781] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80782 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80782] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80783 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80783] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80784 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80784] = "cpe-stable-backport: Backported in 6.6.154"
# CVE-2026-80785 needs backporting (fixed from 7.2)
-# CVE-2026-80786 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80786] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80787] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-80788 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80788] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80789 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80789] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80790 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80790] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80791 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80791] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80792 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80792] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80793 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80793] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80794 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80794] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80795 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80795] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80796 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80796] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80797 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80797] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80798 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80798] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80799 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80799] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80800 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80800] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80801 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80801] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80802 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80802] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80803 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80803] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80804] = "fixed-version: only affects 7.0 onwards"
-# CVE-2026-80805 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80805] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80806 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80806] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80807 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80807] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80808 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80808] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80809 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80809] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80810] = "fixed-version: only affects 6.15 onwards"
CVE_STATUS[CVE-2026-80811] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-80812 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80812] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80813] = "fixed-version: only affects 6.13 onwards"
-# CVE-2026-80814 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80814] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80815] = "fixed-version: only affects 6.10 onwards"
@@ -30252,7 +30266,7 @@ CVE_STATUS[CVE-2026-80817] = "fixed-version: only affects 6.13 onwards"
CVE_STATUS[CVE-2026-80818] = "fixed-version: only affects 6.17 onwards"
-# CVE-2026-80819 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80819] = "cpe-stable-backport: Backported in 6.6.154"
# CVE-2026-80820 needs backporting (fixed from 7.2)
@@ -30260,73 +30274,73 @@ CVE_STATUS[CVE-2026-80821] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-80822] = "fixed-version: only affects 6.14 onwards"
-# CVE-2026-80823 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80823] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80824 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80824] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80825] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-80826 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80826] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80827 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80827] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80828 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80828] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80829 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80829] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80830 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80830] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80831 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80831] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80832 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80832] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80833 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80833] = "cpe-stable-backport: Backported in 6.6.158"
-# CVE-2026-80834 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80834] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-80835] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-80836 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80836] = "cpe-stable-backport: Backported in 6.6.158"
-# CVE-2026-80837 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80837] = "cpe-stable-backport: Backported in 6.6.158"
CVE_STATUS[CVE-2026-80838] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2026-80839] = "fixed-version: only affects 6.8 onwards"
-# CVE-2026-80840 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80840] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80841 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80841] = "cpe-stable-backport: Backported in 6.6.158"
-# CVE-2026-80842 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80842] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80843 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80843] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80844 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80844] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80845] = "fixed-version: only affects 6.11 onwards"
-# CVE-2026-80846 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80846] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80847 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80847] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80848 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80848] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80849] = "fixed-version: only affects 6.7 onwards"
CVE_STATUS[CVE-2026-80850] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-80851 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80851] = "cpe-stable-backport: Backported in 6.6.158"
-# CVE-2026-80852 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80852] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80853] = "fixed-version: only affects 7.2 onwards"
-# CVE-2026-80854 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80854] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80855 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80855] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80856 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80856] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80857] = "fixed-version: only affects 6.18.25 onwards"
@@ -30336,17 +30350,17 @@ CVE_STATUS[CVE-2026-80859] = "fixed-version: only affects 6.14 onwards"
CVE_STATUS[CVE-2026-80860] = "fixed-version: only affects 6.12.96 onwards"
-# CVE-2026-80861 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80861] = "cpe-stable-backport: Backported in 6.6.158"
-CVE_STATUS[CVE-2026-80862] = "fixed-version: only affects 6.12 onwards"
+# CVE-2026-80862 may need backporting (fixed from 6.7)
-# CVE-2026-80863 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80863] = "cpe-stable-backport: Backported in 6.6.156"
-# CVE-2026-80864 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80864] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80865] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80866 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80866] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80867] = "cpe-stable-backport: Backported in 6.6.145"
@@ -30382,7 +30396,7 @@ CVE_STATUS[CVE-2026-80882] = "fixed-version: only affects 6.12.91 onwards"
CVE_STATUS[CVE-2026-80883] = "cpe-stable-backport: Backported in 6.6.145"
-# CVE-2026-80884 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80884] = "cpe-stable-backport: Backported in 6.6.160"
CVE_STATUS[CVE-2026-80885] = "fixed-version: only affects 6.16 onwards"
@@ -30422,47 +30436,5951 @@ CVE_STATUS[CVE-2026-80902] = "cpe-stable-backport: Backported in 6.6.151"
CVE_STATUS[CVE-2026-80903] = "fixed-version: only affects 6.12.18 onwards"
-# CVE-2026-80904 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80904] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80905 needs backporting (fixed from 7.2)
+CVE_STATUS[CVE-2026-80905] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80906 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80906] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80907 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80907] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80908 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80908] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80909 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80909] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80910 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80910] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80911 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80911] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80912 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80912] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80913 may need backporting (fixed from 6.6.153)
+CVE_STATUS[CVE-2026-80913] = "cpe-stable-backport: Backported in 6.6.153"
-# CVE-2026-80914 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80914] = "cpe-stable-backport: Backported in 6.6.157"
CVE_STATUS[CVE-2026-80915] = "fixed-version: only affects 6.11.3 onwards"
-# CVE-2026-80916 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80916] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80917 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80917] = "cpe-stable-backport: Backported in 6.6.154"
-# CVE-2026-80918 may need backporting (fixed from 6.6.154)
+CVE_STATUS[CVE-2026-80918] = "cpe-stable-backport: Backported in 6.6.154"
CVE_STATUS[CVE-2026-80919] = "fixed-version: only affects 7.1 onwards"
-# CVE-2026-80920 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80920] = "cpe-stable-backport: Backported in 6.6.160"
-# CVE-2026-80921 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80921] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80922] = "fixed-version: only affects 6.7 onwards"
-# CVE-2026-80923 may need backporting (fixed from 6.6.156)
+CVE_STATUS[CVE-2026-80923] = "cpe-stable-backport: Backported in 6.6.156"
CVE_STATUS[CVE-2026-80924] = "fixed-version: only affects 6.15 onwards"
-# CVE-2026-80925 needs backporting (fixed from 7.3rc1)
+CVE_STATUS[CVE-2026-80925] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-80926] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-80927] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-80928] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80929] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-80930] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80931] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80932] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80933] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80934] = "fixed-version: only affects 6.17.8 onwards"
+
+CVE_STATUS[CVE-2026-80935] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80936] = "fixed-version: only affects 6.14.3 onwards"
+
+CVE_STATUS[CVE-2026-80937] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80938] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80939] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-80940] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-80941] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80942] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-80943] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-80944] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80945] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-80946] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-80947] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80948] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80949] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80950] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-80951] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80952] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80953] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80954] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-80955] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80956] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80957] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80958] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80959] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80960] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80961] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80962] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-80963] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80964] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80965] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80966] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80967] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80968] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80969] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80970] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-80971] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80972] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80973] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80974] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80975] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-80976] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80977] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80978] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80979] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80980] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80981] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-80982] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80983] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80984] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80985] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-80986] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-80987] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80988] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80989] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80990] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80991] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80992] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80993] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-80994] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-80995] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-80996] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-80997] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-80998] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-80999 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-81000] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81001] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81002] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81003] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81004] = "fixed-version: only affects 6.18.20 onwards"
+
+CVE_STATUS[CVE-2026-81005] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81006] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-81007] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81008] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81009] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-81010] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-81011] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81012] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81013] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81014] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81015] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-81016] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-81017] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-81018] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-89436] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-89437] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89438] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89439] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89440] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89441] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89442] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89443] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89444] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89445] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89446] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-89447] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-89448] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89449] = "fixed-version: only affects 6.17.3 onwards"
+
+CVE_STATUS[CVE-2026-89450] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-89451] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89452] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89453] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89454] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89455] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89456] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89457] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89458] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89459] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-89460] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89461] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89462] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89463] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89464] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89465] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89466] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89467] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89468] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89469] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89470] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89471] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89472] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89473] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89474] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89475] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89476] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89477] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89478] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89479] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89480] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89481] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89482] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89483] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89484] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89485] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89486] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89487] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89488] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89489] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89490] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89491] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89492] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89493] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89494] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89495] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89496] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89497] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89498] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89499] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89500] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89501] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89502] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89503] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89504] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89505] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89506] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-89507] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89508] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89509] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89510] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89511] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89512] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89513] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89514] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89515] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89516] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89517] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89518] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89519] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89520] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89521] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89522] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-89523] = "fixed-version: only affects 6.14.3 onwards"
+
+CVE_STATUS[CVE-2026-89524] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89525] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89526] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89527] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89528] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89529] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89530] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89531] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89532] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89533] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-89534 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-89535] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-89536] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89537] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89538] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89539] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89540] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89541] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89542] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89543] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89544] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-89545 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89546] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89547] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89548] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89549] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89550] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89551] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89552] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89553] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89554] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89555] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89556] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-89557] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89558] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-89559] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89560] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89561] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89562] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89563] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89564] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89565] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89566] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89567] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89568] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89569] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89570] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89571] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89572] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89573] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89574] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89575] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89576] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89577] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89578] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89579] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89580] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89581] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89582] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89583] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89584] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89585] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89586] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89587] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89588] = "fixed-version: only affects 6.12.75 onwards"
+
+CVE_STATUS[CVE-2026-89589] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89590] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89591] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89592] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89593] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-89594] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89595] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89596] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89597] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89598] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89599] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89600] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89601] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89602] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89604] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89605] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89606] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89607] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89608] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89609] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-89610 needs backporting (fixed from 7.3)
+
+# CVE-2026-89611 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89612] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89613] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89614] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89615] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89616] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89617] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89618] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89619] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89620] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89621] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89622] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89623] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89624] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89625] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89626] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89627] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89628] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89629] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-89630] = "fixed-version: only affects 6.18.56 onwards"
+
+CVE_STATUS[CVE-2026-89631] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89632] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89633] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89634] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89635] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-89636] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-89637 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89638] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89639] = "fixed-version: only affects 6.18.44 onwards"
+
+CVE_STATUS[CVE-2026-89640] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89641] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89642] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89643] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89644] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89645] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89646] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89647] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89648] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89649] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89650] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89651] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89652] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89653] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89654] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89655] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89656] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89657] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89658] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-89659] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89660] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-89661] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89662] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89663] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89664] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89665] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89666] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89667] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-89668] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89669] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89670] = "fixed-version: only affects 6.15.3 onwards"
+
+CVE_STATUS[CVE-2026-89671] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89672] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89673] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89674] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-89675 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89676] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89677] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89678] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89679] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89680] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89681] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89682] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89683] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-89684] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89685] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89686] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89687] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89688] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89689] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89690] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-89691] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-89692] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89693] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89694] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89695] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89696] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89697] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89698] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-89699] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89700] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89701] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89702] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89703] = "fixed-version: only affects 6.11.6 onwards"
+
+CVE_STATUS[CVE-2026-89704] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89705] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-89706] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89707] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-89708 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89709] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89710] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89711] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89712] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89713] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89714] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-89715] = "fixed-version: only affects 6.15.10 onwards"
+
+CVE_STATUS[CVE-2026-89716] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89717] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89718] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89719] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89720] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89721] = "fixed-version: only affects 6.15 onwards"
+
+# CVE-2026-89722 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89723] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89724] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89725] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89726] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89727] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89728] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89729] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89730] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89731] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-89732] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89733] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89734] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-89735] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89736] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89737] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89738] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-89739 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-89740] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89741] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89742] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89743] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89744] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89745] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89746] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89747] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89748] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89749] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89750] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89751] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89752] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89753] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89754] = "fixed-version: only affects 6.18.21 onwards"
+
+CVE_STATUS[CVE-2026-89755] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89756] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89757] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89758] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89759] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89760] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89761] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89762] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89763] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89764] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89765] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89766] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89767] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89768] = "fixed-version: only affects 6.12.95 onwards"
+
+CVE_STATUS[CVE-2026-89769] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89770] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89771] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89772] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-89773] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-89774] = "cpe-stable-backport: Backported in 6.6.145"
+
+CVE_STATUS[CVE-2026-89775] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89776] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89777] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89778] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89779] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89780] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89781] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89782] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89783] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89784] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89785] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89786] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89787] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89788] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89789] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89790] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89791] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89792] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-89793] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89794] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89795] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89796] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-89797 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89798] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89799] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89800] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89801] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89802] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89803] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89804] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89805] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-89806] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89807] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89808] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89809] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89810] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89811] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89812] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-89813] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89814] = "fixed-version: only affects 6.14.9 onwards"
+
+CVE_STATUS[CVE-2026-89815] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89816] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89817] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89818] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89819] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89820] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89821] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89822] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89823] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89824] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89825] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89826] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89827] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89828] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-89829] = "fixed-version: only affects 6.18.13 onwards"
+
+CVE_STATUS[CVE-2026-89830] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-89831] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89832] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89833] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89834] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89835] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89836] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89837] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89838] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89839] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89840] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89841] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89842] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89843] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89844] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89845] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89846] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89847] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89848] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89849] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89850] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89851] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89852] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89853] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89854] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89855] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89856] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89857] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89858] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89859] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89860] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89861] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-89862 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-89863] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89864] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89865] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89866] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89867] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89868] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89869] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89870] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89871] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89872] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89873] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89874] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89875] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89876] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89877] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89878] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89879] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89880] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89881] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89882] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89883] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89884] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89885] = "fixed-version: only affects 6.12.64 onwards"
+
+CVE_STATUS[CVE-2026-89886] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89887] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89888] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89889] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89890] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89891] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89892] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89893] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89894] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89895] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89896] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89897] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89898] = "fixed-version: only affects 6.12 onwards"
+
+# CVE-2026-89899 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89900] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89901] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89902] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89903] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89904] = "fixed-version: only affects 6.12.101 onwards"
+
+CVE_STATUS[CVE-2026-89905] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89906] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89907] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-89908] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89909] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-89910] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89911] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89912] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-89913 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-89914] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89915] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89916] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89917] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89918] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-89919] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89920] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89921] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89922] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89923] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89924] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89925] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89926] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89927] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89928] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89929] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89930] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89931] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89932] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89933] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89934] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89935] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89936] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89937] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89938] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89939] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89940] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89941] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89942] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89943] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-89944] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89945] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89946] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89947] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89948] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89949] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89950] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-89951] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89952] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89953] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89954] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89955] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89956] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89957] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89958] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89959] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89960] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89961] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89962] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89963] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89964] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89965] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89966] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89967] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89968] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89969] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89970] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89971] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-89972] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89973] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89974] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-89975] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89976] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89977] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-89978] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-89979] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89980] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89981] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-89982] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89983] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89984] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89985] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-89986] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-89987] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89988] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89989] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89990] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89991] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-89992] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89993] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89994] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-89995] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89996] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-89997] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89998] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-89999] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90000] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90001] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90002] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90003] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90004] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90005] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-90006] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90007] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90008] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90009] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90010] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90011] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90012] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90013] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90014] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90015] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90016] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90017] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90018] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90019] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90020] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90021] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90022] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90023] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90024] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90025] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90026] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-90027 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90028] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90029] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90030] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90031] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90032] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90033] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90034] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90035] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90036] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90037] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90038] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90039] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-90040] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90041] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90042] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90043] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90044] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90045] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90046] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90047] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-90048] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90049] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90051] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90053] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90054] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90055] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90056] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90057] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90058] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90059] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-90060] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90061] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90062] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90063] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90064] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90065] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90066] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90067] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90068] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90069] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90070] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90071] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90072] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90073] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90074] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90075] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90076] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90077] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90078] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90079] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90080] = "fixed-version: only affects 6.14.9 onwards"
+
+CVE_STATUS[CVE-2026-90081] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90082] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90083] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90084] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90085] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90086] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-90087] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90088] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90089] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90090] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90091] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90092] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90093] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90094] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90095] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-90096] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90097] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-90098 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90099] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90100] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90101] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90102] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90103] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90104] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90105] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90106] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90107] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90108] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90109] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90110] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90111] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90112] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90113] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-90114] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90115] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90116] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90117] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90118] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90119] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90120] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90121] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90122] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90123] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90124] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90125] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90126] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90127] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90128] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-90129 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-90130] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90131] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90132] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90133] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90134] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90135] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90136] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90137] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90138] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90139] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90140] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90141] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90142] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90143] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90144] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90145] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90146] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90147] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-90148] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90149] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90150] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90151] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90152] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90153] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90154] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90155] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90156] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90157] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90158] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90159] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90160] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90161] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90162] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90163] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90164] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90165] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90166] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90167] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90169] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90170] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90171] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90172] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90173] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90174] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90175] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90176] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90177] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-90178] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-90179] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90180] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90181] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90182] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90183] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90184] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90185] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90186] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90187] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90188] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90189] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90190] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90191] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90192] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90193] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90194] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90195] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-90196] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90197] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90198] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90199] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90200] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90201] = "fixed-version: only affects 6.12.34 onwards"
+
+CVE_STATUS[CVE-2026-90202] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90203] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90204] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90205] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90206] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90207] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90208] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90209] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90210] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90211] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90212] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-90213] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90214] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90215] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-90216] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90217] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90218] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90219] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90220] = "fixed-version: only affects 6.12.97 onwards"
+
+CVE_STATUS[CVE-2026-90221] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90222] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90223] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90224] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90225] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90226] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90227] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90228] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90229] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90230] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90231] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90232] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90233] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90234] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90235] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90236] = "fixed-version: only affects 7.2 onwards"
+
+# CVE-2026-90237 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90238] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90239] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90240] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-90241] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-90242] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-90243] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-90244] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90245] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90246] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90247] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90248] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90249] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90250] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90251] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90252] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-90253] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90254] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90255] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90256] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90257] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90258] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-90259] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90260] = "fixed-version: only affects 6.8 onwards"
+
+# CVE-2026-90261 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90262] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90263] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90264] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90265] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90266] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90267] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90268] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90269] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90270] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-90271] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-90272] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90273] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90274] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90275] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90276] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90277] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90278] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90279] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90280] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90281] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90282] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90283] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90284] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90285] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90286] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90287] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90288] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90289] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90290] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90291] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90292] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90293] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90294] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90295] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90296] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90297] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90298] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90299] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90300] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90301] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90302] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90303] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90304] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90305] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90306] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-90307] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90308] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90309] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90311] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90312] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90313] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90314] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-90315 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90316] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-90317 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90318] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90319] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90320] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90321] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90322] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90323] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90324] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90325] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90326] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90327] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90328] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90329] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90330] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90331] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90332] = "fixed-version: only affects 6.19.7 onwards"
+
+# CVE-2026-90333 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90334] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90335] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90336] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90337] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90338] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90339] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90340] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-90341] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90342] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-90343] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90344] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-90345] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90346] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90347] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90348] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90349] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90350] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90351] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-90352] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90353] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90354] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90355] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90356] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90357] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90358] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-90359 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90360] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90361] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90362] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90363] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90364] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90365] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90366] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90367] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90368] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90369] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-90370] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90371] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90372] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-90373 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-90374] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90375] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90376] = "fixed-version: only affects 6.18.33 onwards"
+
+CVE_STATUS[CVE-2026-90377] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-90378] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-90379 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90380] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90381] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-90382] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90383] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90384] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-90385] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90386] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90387] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90388] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-90389 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90390] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-90391] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90392] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90393] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90394] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90395] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90396] = "fixed-version: only affects 6.16.8 onwards"
+
+CVE_STATUS[CVE-2026-90397] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90398] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90399] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90400] = "fixed-version: only affects 6.7 onwards"
+
+# CVE-2026-90401 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-90402] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-90403] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90404] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90405] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90406] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90407] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90408] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90409] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-90410] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90411] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90412] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-90413] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90414] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90415] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90416] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90417] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90418] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90419] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90420] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90421] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90422] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90423] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-90424] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-90425] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90426] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-90427] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-90428] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-90429] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-90430] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-90431] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90432] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-90433] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-90434] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-90435] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92476] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92477] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92478] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-92479] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-92480] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-92481] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92482] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-92483] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-92484] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92485] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-92486] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-92487] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-92488] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-92489] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92490] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92491] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-92492] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-92493 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-92494] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92495] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92496] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92497] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92498] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-92499 needs backporting (fixed from 7.3)
+
+# CVE-2026-92500 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-92501] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92502] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92503] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-92504] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92505] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-92506] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92507] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92508] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92509] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92510] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92511] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92512] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92513] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-92514] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92515] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-92516] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-92517] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-92518] = "fixed-version: only affects 6.11.6 onwards"
+
+CVE_STATUS[CVE-2026-92519] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-92520] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-92521] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92522] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92523] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92524] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-92525] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93037] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93038] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93039] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93040] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93041] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93042] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93043] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93044] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-93045] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-93046] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-93047 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-93048] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93049] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93050] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93051] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93052] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93053] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93054] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93055] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93056] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93057] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93058] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93059] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-93060] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93061] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93062] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93063] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93064] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93065] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93066] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-93067] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93068] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93069] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93070] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-93071] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-93072] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93073] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93074] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93075] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93076] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93077] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-93078] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-93079] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-93080] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-93081] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93082] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-93083] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93084] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93085] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93086] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93089] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93090] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-93091 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-93092] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93093] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93094] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-93095] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93096] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-93097] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93098] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-93099 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-93100] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93101] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93102] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93103] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93104] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93105] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93106] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-93107] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93108] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93109] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93110] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93111] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93112] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-93113] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-93114] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93115] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93116] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93117] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93118] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93119] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-93120] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93121] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-93122] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-93123 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-93124] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93125] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93126] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93127] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-93128] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93129] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93130] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93131] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93132] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-93133] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-93134] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-93135] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-93136] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93137] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93138] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93139] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93140] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93141] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93142] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93143] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-93144] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93145] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93146] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93147] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93148] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93149] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93150] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93151] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93152] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93153] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-93154 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-93155] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93156] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93157] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93158] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93159] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93160] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93161] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93162] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-93163] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93164] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93165] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93166] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93167] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93168] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93169] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93170] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93171] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93172] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93173] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-93174] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93175] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93176] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93177] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93178] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93179] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93180] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-93181] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-93182] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93183] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-93184 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-93185] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93186] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93187] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-93188] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93189] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93190] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93191] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93192] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93193] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-93194] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93195] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93196] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93197] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93198] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93199] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93200] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93201] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93202] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93203] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93204] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93205] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93206] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93207] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93208] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93209] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93210] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93211] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-93212] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-93213] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93214] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93215] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-93216] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93217] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93218] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93219] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93220] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93221] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93222] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93223] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93224] = "fixed-version: only affects 6.12.35 onwards"
+
+CVE_STATUS[CVE-2026-93225] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-93226] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93227] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-93228] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93229] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-93230] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-93231] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93232] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93233] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93234] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93235] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93236] = "cpe-stable-backport: Backported in 6.6.157"
+
+# CVE-2026-93237 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-93238] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93239] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93240] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93241] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-93242] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93243] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93244] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93245] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93246] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93247] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93248] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-93249] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-93250] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93251] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93252] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93253] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-93254] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93255] = "fixed-version: only affects 7.1.8 onwards"
+
+CVE_STATUS[CVE-2026-93256] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93257] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93258] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93259] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93260] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93261] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93262] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93263] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93264] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93265] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-93266] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-93267] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-93268] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93269] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93270] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-93271] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93272] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93273] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93274] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93275] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-93276] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-93277] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93278] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93279] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93280] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93281] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93282] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93283] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-93284] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-93285] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93286] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93287] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93288] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93781] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93782] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93783] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93784] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93785] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93786] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93787] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93788] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93789] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93790] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93791] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93792] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93793] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93794] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93795] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93796] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93797] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93798] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93799] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93800] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93801] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93802] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93803] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93804] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93805] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93806] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93807] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93808] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93809] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-93810] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93811] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93812] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93813] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93814] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93815] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93816] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93817] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93818] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-93819] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93820] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93821] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93822] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93823] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93824] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93825] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93826] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93827] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-93828] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-93829] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-93830] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97407] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97408] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97409] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97410] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-97411] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97412] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97413] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97414] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-97415] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97416] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97417] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97418] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97419] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97420] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97421] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97422] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97423] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-97424] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97425] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97426] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-97427] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97428] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97429] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97430] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97431] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-97432] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97433] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97434] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97435] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97436] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97437] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97438] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97439] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97440] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97441] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97442] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97443] = "fixed-version: only affects 6.12.24 onwards"
+
+CVE_STATUS[CVE-2026-97444] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97445] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97446] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97447] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97448] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97449] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97450] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97451] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97452] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97453] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97454] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97455] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97456] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97472] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97473] = "fixed-version: only affects 6.10.12 onwards"
+
+CVE_STATUS[CVE-2026-97474] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-97475] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97476] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97477] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97478] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97479] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97480] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97481] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97482] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97483] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97484] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97485] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97486] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97487] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97488] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97489] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97490] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97491] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97492] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97493] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97494] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97495] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97496] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97497] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97498] = "fixed-version: only affects 6.16 onwards"
+
+# CVE-2026-97499 needs backporting (fixed from 7.2)
+
+CVE_STATUS[CVE-2026-97500] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97501] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97502] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97503] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97504] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97505] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97506] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97507] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97508] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97509] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97510] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97511] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-97512] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97513] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-97514] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-97515] = "fixed-version: only affects 6.12.31 onwards"
+
+CVE_STATUS[CVE-2026-97516] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97517] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97518] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97519] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-97520] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-97521] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-97522] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97523] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97524] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97525] = "fixed-version: only affects 6.18.7 onwards"
+
+CVE_STATUS[CVE-2026-97526] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-97527] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97528] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97529] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97530] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97531] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97532] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97533] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-97534] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97535] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97536] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97537] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97538] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-97539] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97540] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97541] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97542] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97543] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97544] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-97545] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-97546] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97547] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97548] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-97549] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97550] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-97551] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97552] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-97553] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-97554] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97555] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97556] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97557] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97558] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97559] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97560] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97561] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97562] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-97563 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-97564] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-97565 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-97566] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97567] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97568] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97569] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-97570] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-97571] = "fixed-version: only affects 6.12.20 onwards"
+
+CVE_STATUS[CVE-2026-97572] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97573] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97574] = "fixed-version: only affects 6.12.20 onwards"
+
+CVE_STATUS[CVE-2026-97575] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97576] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97577] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97578] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97579] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97580] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-97581] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97582] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97583] = "fixed-version: only affects 6.12.101 onwards"
+
+CVE_STATUS[CVE-2026-97584] = "fixed-version: only affects 6.12.101 onwards"
+
+CVE_STATUS[CVE-2026-97585] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-97586] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-97587] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97588] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97589] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97590] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97591] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-97592] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97593] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97594] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97595] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97596] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97597] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97598] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97599] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97600] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97601] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97602] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97603] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-97604] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97605] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97606] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-97607] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97608] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97609] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97610] = "fixed-version: only affects 6.18.17 onwards"
+
+CVE_STATUS[CVE-2026-97611] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97612] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97613] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97614] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-97615] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97616] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97617] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97618] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-97619] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97620] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-97621] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97899] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97900] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97901] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97902] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-97903] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97904] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97905] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97906] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97907] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97908] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97909] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97910] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97911] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-97912] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-97913] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-97914] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-97915] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97916] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97917] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97918] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97919] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97920] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97921] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97922] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97923] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97924] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97925] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97926] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97927] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97928] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97929] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97930] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97931] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97932] = "fixed-version: only affects 7.1.6 onwards"
+
+CVE_STATUS[CVE-2026-97933] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97934] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97935] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97936] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97937] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-97938] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97939] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97940] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97941] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-97942] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-97943] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-97944] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-97945] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97946] = "fixed-version: only affects 6.17.8 onwards"
+
+CVE_STATUS[CVE-2026-97947] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-97948] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97949] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97950] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97951] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97952] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97953] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97954] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97955] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-97956] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-97957] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97958] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97959] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97960] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97961] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97962] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97963] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97964] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97965] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97966] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97967] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-97968] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-97969] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97970] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97971] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-97972] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-97973] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97974] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-97975] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97976] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97977] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97978] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97979] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97980] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-97981] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97982] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97983] = "fixed-version: only affects 7.1.5 onwards"
+
+CVE_STATUS[CVE-2026-97984] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97985] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97986] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97987] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97988] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97989] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97990] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97991] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97992] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97993] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97994] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97995] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-97996] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-97997] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-97998] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98000] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98001] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98002] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98003] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98004] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98005] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98006] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98007] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98008] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98009] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98010] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98011] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98012] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98013] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98014] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98015] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98016] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98017] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98018] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-98019] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98020] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98021] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98022] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98023] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98024] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98025] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98026] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98027] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98028] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98029] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98030] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98031] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98032] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98033] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98034] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98035] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98036] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98037] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98038] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98039] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-98040] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98041] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98042] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98043] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98044] = "fixed-version: only affects 6.12.101 onwards"
+
+CVE_STATUS[CVE-2026-98045] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98046] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98047] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98048] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98049] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98050] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98051] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98052] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98053] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98054] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-98055] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98056] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98057] = "fixed-version: only affects 6.12.16 onwards"
+
+CVE_STATUS[CVE-2026-98058] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98059] = "fixed-version: only affects 6.12.6 onwards"
+
+CVE_STATUS[CVE-2026-98060] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98061] = "fixed-version: only affects 6.18.2 onwards"
+
+CVE_STATUS[CVE-2026-98062] = "fixed-version: only affects 6.12.6 onwards"
+
+CVE_STATUS[CVE-2026-98063] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98064] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98065] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98066] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98067] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98068] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98069] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98070] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98071] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98072] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98073] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98074] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98075] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98076] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98077] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98078] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98079] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98080] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98081] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98082] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98083] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98084] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98085] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98086] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98087 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98088] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98089] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98090] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98091] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98092] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98093] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98094] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98095] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98096] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98097] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98098] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98099] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98101] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98102] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98103] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98104] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98105] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98106] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98107] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98108] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98109] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98110] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98111] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98112] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98113] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98114] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98115 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-98116] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98117] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98118] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98119] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98120] = "fixed-version: only affects 6.18.17 onwards"
+
+CVE_STATUS[CVE-2026-98121] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98122] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98123] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98124] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98125] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98126] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98127] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98128] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98129] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98130] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98131 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98132] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98133] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98134] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98135] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98136] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98137] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98138] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98139] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98140] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98141] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98142] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98143] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98144] = "fixed-version: only affects 6.18.57 onwards"
+
+CVE_STATUS[CVE-2026-98145] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98146] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98147] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98148] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98149] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98150] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98151] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98152] = "fixed-version: only affects 6.12.96 onwards"
+
+CVE_STATUS[CVE-2026-98153] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98154] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98155] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98156] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98157] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98158] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98159] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98160] = "cpe-stable-backport: Backported in 6.6.157"
+
+CVE_STATUS[CVE-2026-98161] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98162] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98163] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98164] = "cpe-stable-backport: Backported in 6.6.156"
+
+CVE_STATUS[CVE-2026-98166] = "fixed-version: only affects 6.18.57 onwards"
+
+CVE_STATUS[CVE-2026-98167] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98168] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98169] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98170] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98171] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98172] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98173] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98174] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98175] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98176 needs backporting (fixed from 7.3)
+
+# CVE-2026-98177 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98178] = "fixed-version: only affects 7.2 onwards"
+
+# CVE-2026-98179 needs backporting (fixed from 7.3)
+
+# CVE-2026-98180 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98181] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98182 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98183] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98184] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98185] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98186] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98187] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98188] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98189] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98190] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98191] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98192] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98193] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98194] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98195] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98196] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98197] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98198] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98199] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98200] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98201] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98202] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98203] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98204] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98205] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98206] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98207] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98208] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98209] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98210] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98211 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98212] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98213] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98214] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98215] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98216] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98217] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98218] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98219] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98220] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98221] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98222 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98223] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98224] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98225] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98226] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98227] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98228] = "fixed-version: only affects 6.11 onwards"
+
+# CVE-2026-98229 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98230] = "fixed-version: only affects 6.12.13 onwards"
+
+CVE_STATUS[CVE-2026-98231] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98232] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98233] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98234] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98235] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98236] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98237] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98238] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98239] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98240] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98241] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98242] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98243] = "fixed-version: only affects 7.1.5 onwards"
+
+CVE_STATUS[CVE-2026-98244] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98245] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98246] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98247] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98248 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98249] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98250] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98251] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98252] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98253] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98254 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98255] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98256] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98257] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98258] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98259] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98260] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98261] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98262] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98263] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98264] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98265] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98266 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98267] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98268] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98269] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98270] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98271 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98272] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98273 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98274] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98275] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98276] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98277] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98278] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-98279 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98280] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98281] = "fixed-version: only affects 6.18.33 onwards"
+
+CVE_STATUS[CVE-2026-98282] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98283] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98284 needs backporting (fixed from 7.3)
+
+# CVE-2026-98285 needs backporting (fixed from 7.3)
+
+# CVE-2026-98286 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98287] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98288 needs backporting (fixed from 7.3)
+
+# CVE-2026-98289 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-98290] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98291] = "fixed-version: only affects 6.10 onwards"
+
+# CVE-2026-98292 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98293] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98294 needs backporting (fixed from 7.3)
+
+# CVE-2026-98295 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98296] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98297] = "fixed-version: only affects 6.12.93 onwards"
+
+CVE_STATUS[CVE-2026-98298] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98299] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98300] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98301] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98302] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98303] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98304 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98305] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98306] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98307 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98308] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98309] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98310] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98311] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98312] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98313 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98314] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98315] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98316] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98317 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98318] = "fixed-version: only affects 6.15.6 onwards"
+
+CVE_STATUS[CVE-2026-98319] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98320] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98321 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98322] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98323] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98324] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98325] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98326] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98327 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98328] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98329 needs backporting (fixed from 7.3)
+
+# CVE-2026-98330 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98331] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98332 needs backporting (fixed from 7.3)
+
+# CVE-2026-98333 needs backporting (fixed from 7.3)
+
+# CVE-2026-98334 needs backporting (fixed from 7.3)
+
+# CVE-2026-98335 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98336] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98337 needs backporting (fixed from 7.3)
+
+# CVE-2026-98338 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98339] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98340] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98341 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98342] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98343] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98344] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98345] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98346] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98347] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98348] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98349] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98350] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98351] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98352] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98353 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-98354] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98355 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98356] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98357] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98358] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98359] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98360] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98361] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98362] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98363] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98364 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98365] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98366] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98367] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98368] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98369] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98370] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98371] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98372] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98373] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98374] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98375] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98376] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98377] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98378] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98379] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98380] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98381] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98382] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98383] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98384] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98385] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98386] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98387 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98388] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98389] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98390] = "fixed-version: only affects 6.17.8 onwards"
+
+CVE_STATUS[CVE-2026-98391] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98392] = "fixed-version: only affects 6.10 onwards"
+
+# CVE-2026-98393 needs backporting (fixed from 7.3)
+
+# CVE-2026-98394 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98395] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98396] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98397] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98398] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98399] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98400] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98401 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98402] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98403 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98404] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98405] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98406] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98407] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98408] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98409] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98410] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98411] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98412] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98413] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98414] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98415] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98416] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98417] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98418] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98419] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98420 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98421] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98422] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98423] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98424 needs backporting (fixed from 7.3)
+
+# CVE-2026-98425 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98426] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98427 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98428] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98429] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98430] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98431] = "fixed-version: only affects 6.11.11 onwards"
+
+CVE_STATUS[CVE-2026-98432] = "cpe-stable-backport: Backported in 6.6.159"
+
+CVE_STATUS[CVE-2026-98433] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98434] = "fixed-version: only affects 7.0 onwards"
+
+# CVE-2026-98435 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98436] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98437] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98438] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-98439 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98440] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98441] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98442] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98443] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98444] = "fixed-version: only affects 6.12.14 onwards"
+
+CVE_STATUS[CVE-2026-98445] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98446] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98447] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98448] = "fixed-version: only affects 6.10 onwards"
+
+# CVE-2026-98449 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98450] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98451] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98452 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98453] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98454] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98455] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98456] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98457] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98458 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98459] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98460] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98461] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98462] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98463] = "fixed-version: only affects 6.18.19 onwards"
+
+CVE_STATUS[CVE-2026-98464] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98465] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98466 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98467] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98468] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98469] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98470] = "fixed-version: only affects 7.0 onwards"
+
+# CVE-2026-98471 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98472] = "fixed-version: only affects 6.17 onwards"
+
+# CVE-2026-98473 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-98474] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98475] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98476] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98477] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98478] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98479] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98480] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-98481] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98482] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98483] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98484] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98485] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98486] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98487] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98488] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98489] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98490] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98491] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98492] = "fixed-version: only affects 6.17.3 onwards"
+
+CVE_STATUS[CVE-2026-98493] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98494] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98495] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98496] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98497] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98498] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98499] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98500] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98501] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98502] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98503 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98504] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98505] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98506 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98507] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98508] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98509] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98510] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98511] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98512] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98513] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-98514] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98515] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98516] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98517] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98518] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98519] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98520] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98521] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98522] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98523] = "fixed-version: only affects 6.12.19 onwards"
+
+CVE_STATUS[CVE-2026-98524] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98525 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98526] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98527] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98528] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98529] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98530] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98531] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98532] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98533] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98534] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98535] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98536] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98537] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98538] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98539 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98540] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98541] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98542] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98543] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98544] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98545] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98546] = "fixed-version: only affects 6.12.25 onwards"
+
+CVE_STATUS[CVE-2026-98547] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98548] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98549] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98550] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98551 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98552] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98553] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98554] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98555] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98556 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98557] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-98558 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98559] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98560] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98561] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98562] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98563] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98564] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98565] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98566] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98567] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98568] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98569] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98570] = "fixed-version: only affects 6.12.16 onwards"
+
+CVE_STATUS[CVE-2026-98571] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98572] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98573] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98574] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98575] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98576] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98577] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98578] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98579] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98580] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98581] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98582] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98583] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98584] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-98585] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98586] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98587] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98588] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98589 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98590] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98591] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98592] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98593] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98594] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98595] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98596] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98597] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98598 needs backporting (fixed from 7.3)
+
+# CVE-2026-98599 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98600] = "fixed-version: only affects 6.12.111 onwards"
+
+CVE_STATUS[CVE-2026-98601] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98602] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98603] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98604] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98605] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98606] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98607] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98608] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98609] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98610] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98611] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98612] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98613] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98614] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98615] = "fixed-version: only affects 6.12.29 onwards"
+
+CVE_STATUS[CVE-2026-98616] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98617] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98618] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98619] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98620] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98621] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98622] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98623] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98624] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98625] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98626] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98627] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-98628 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98629] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98630] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98631] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98632] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98633] = "fixed-version: only affects 6.15 onwards"
+
+# CVE-2026-98634 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98635] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98636] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98637] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98638] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98639] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98640] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98641] = "fixed-version: only affects 6.12 onwards"
+
+# CVE-2026-98642 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98643] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98644] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98645] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98646] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98647] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98648] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98649] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98650] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98651] = "fixed-version: only affects 7.0 onwards"
+
+# CVE-2026-98652 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98653] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98655] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98656] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98657] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98658] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98659] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98660] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98661 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98662] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98663] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98664] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98665] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98666] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98667] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98668] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98669] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98670] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98671] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98672] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98673] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98674] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98675] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98676] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98677] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98678] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98679] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98680] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-98681] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98682 may need backporting (fixed from 6.7)
+
+# CVE-2026-98683 may need backporting (fixed from 6.7)
+
+# CVE-2026-98684 needs backporting (fixed from 7.3)
+
+# CVE-2026-98685 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-98686] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98687] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98688 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98689] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98690] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98691] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98692] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98693] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98694] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98695] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98696] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98697] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98698] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98699] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98700] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98701] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98702] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98703] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98704] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98705] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98706] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98707] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98708] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98709] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98710] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98711] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98712] = "fixed-version: only affects 6.19.9 onwards"
+
+CVE_STATUS[CVE-2026-98713] = "fixed-version: only affects 6.9 onwards"
+
+# CVE-2026-98714 needs backporting (fixed from 7.3)
+
+# CVE-2026-98715 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98716] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98717] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98718] = "fixed-version: only affects 6.18.55 onwards"
+
+CVE_STATUS[CVE-2026-98719] = "fixed-version: only affects 6.18.55 onwards"
+
+# CVE-2026-98720 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98721] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98722] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98723] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98724] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98725] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98726] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98727] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98728] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98729] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98730] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98731] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98732] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98733] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98734] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98735] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98736] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98737] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98738] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98739] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98740 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98741] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98742] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98743] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98744] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98745] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98746] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98747 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98748] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98749] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98750] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98751] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98752] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98753] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98754] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98755] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98756] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98757] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98758 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98759] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98760] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98761] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98762] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98763] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98764] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98765] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98766] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98767] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98768] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98769] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98770] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98771] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98772] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98773] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98774] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98775] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98776] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98777] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98778] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98779] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98780] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98781] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98782] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98783] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98784] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98785] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98786 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98787] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98788] = "fixed-version: only affects 6.17 onwards"
+
+# CVE-2026-98789 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98790] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98791] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98792] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98793] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98794] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98795 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98796] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98797 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98798] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98799 needs backporting (fixed from 7.3)
+
+# CVE-2026-98800 needs backporting (fixed from 7.3)
+
+# CVE-2026-98801 needs backporting (fixed from 7.3)
+
+# CVE-2026-98802 needs backporting (fixed from 7.3)
+
+# CVE-2026-98803 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98804] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98805] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98806] = "fixed-version: only affects 6.14.9 onwards"
+
+# CVE-2026-98807 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98808] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98809] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98810 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98811] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98812] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98813] = "fixed-version: only affects 6.12.112 onwards"
+
+# CVE-2026-98814 needs backporting (fixed from 7.3)
+
+# CVE-2026-98815 needs backporting (fixed from 7.3)
+
+# CVE-2026-98816 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98817] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98818] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98819] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98820 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98821] = "fixed-version: only affects 6.16.8 onwards"
+
+CVE_STATUS[CVE-2026-98822] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98823] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98824 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98825] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98826 needs backporting (fixed from 7.3)
+
+# CVE-2026-98827 needs backporting (fixed from 7.3)
+
+# CVE-2026-98828 needs backporting (fixed from 7.3)
+
+# CVE-2026-98829 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98830] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98831] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98832] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98833] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98834 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98835] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98836] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98837] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98838] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98839 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98840] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98841] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98842] = "fixed-version: only affects 6.15.4 onwards"
+
+CVE_STATUS[CVE-2026-98843] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-98844] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98845] = "fixed-version: only affects 6.11.7 onwards"
+
+CVE_STATUS[CVE-2026-98846] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98847] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98848] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98849] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98850] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98851] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98852] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98853 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98854] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98855] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98856] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98857] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98858] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98859] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98860] = "fixed-version: only affects 6.12.78 onwards"
+
+CVE_STATUS[CVE-2026-98861] = "fixed-version: only affects 6.18.34 onwards"
+
+CVE_STATUS[CVE-2026-98862] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98863 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98864] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98865] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98866] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98867] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98868] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98869] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-98870] = "fixed-version: Fixed from version 5.16"
+
+CVE_STATUS[CVE-2026-98871] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-98872] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98873] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98874] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98875] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-98876] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98877] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98878] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-98879] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98880] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98881] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98882] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98883] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98884] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98885] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98886] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98887] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98888] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98889] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98890] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98891] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98892] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98893] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98894] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98895] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-98896] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98897 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-98898] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98899] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98900] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98901] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98902] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98903 needs backporting (fixed from 7.2)
+
+# CVE-2026-98904 needs backporting (fixed from 7.2)
+
+CVE_STATUS[CVE-2026-98905] = "fixed-version: only affects 6.12 onwards"
+
+# CVE-2026-98906 needs backporting (fixed from 7.2)
+
+CVE_STATUS[CVE-2026-98907] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98908] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98909] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98910] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98911] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98912] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98913] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98914 needs backporting (fixed from 7.2)
+
+CVE_STATUS[CVE-2026-98915] = "cpe-stable-backport: Backported in 6.6.158"
+
+CVE_STATUS[CVE-2026-98916] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98917 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98918] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98919] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98920] = "fixed-version: only affects 6.12.114 onwards"
+
+CVE_STATUS[CVE-2026-98921] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98922] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98923] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98924 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98925] = "cpe-stable-backport: Backported in 6.6.158"
+
+# CVE-2026-98926 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98927] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98928] = "fixed-version: only affects 6.14 onwards"
+
+# CVE-2026-98929 needs backporting (fixed from 7.3)
+
+# CVE-2026-98930 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98931] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98932 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98933] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98934] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98935] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98936] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98937 needs backporting (fixed from 7.3)
+
+# CVE-2026-98938 has no known resolution
+
+CVE_STATUS[CVE-2026-98939] = "fixed-version: only affects 6.18.53 onwards"
+
+CVE_STATUS[CVE-2026-98940] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98941 has no known resolution
+
+CVE_STATUS[CVE-2026-98942] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-98944] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98945] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98946 needs backporting (fixed from 7.3)
+
+# CVE-2026-98947 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98948] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98949] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-98950] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98951 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98952] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-98953] = "fixed-version: only affects 6.7 onwards"
+
+# CVE-2026-98954 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98955] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98956] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98957 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98958] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-98959] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98960] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98961] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98962] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98963] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-98964] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98965] = "fixed-version: only affects 6.18 onwards"
+
+# CVE-2026-98966 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98967] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98968] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98969] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98970] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98971] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98972 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98973] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-98974] = "fixed-version: only affects 6.10 onwards"
+
+# CVE-2026-98975 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98976] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98977] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98978 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98979] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-98980 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98981] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98982] = "fixed-version: only affects 6.9 onwards"
+
+# CVE-2026-98983 may need backporting (fixed from 6.7)
+
+CVE_STATUS[CVE-2026-98984] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98985] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98986] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98987] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-98988] = "fixed-version: only affects 7.0 onwards"
+
+# CVE-2026-98989 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98990] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98991] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-98992] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98993] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-98994] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-98995] = "fixed-version: only affects 6.17 onwards"
+
+# CVE-2026-98996 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-98997] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-98998] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-98999] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-99000] = "fixed-version: only affects 6.15 onwards"
+
+CVE_STATUS[CVE-2026-99001] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-99002] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99003] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-99004] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-99005] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99006] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99007] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99008] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99009] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99010] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99011] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-99012] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99013] = "fixed-version: only affects 6.12.6 onwards"
+
+CVE_STATUS[CVE-2026-99014] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99015] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99016] = "fixed-version: only affects 6.13 onwards"
+
+CVE_STATUS[CVE-2026-99017] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-99018] = "fixed-version: only affects 6.7 onwards"
+
+CVE_STATUS[CVE-2026-99019] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99020] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-99021 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99022] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99023] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-99024] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99025] = "cpe-stable-backport: Backported in 6.6.160"
+
+# CVE-2026-99026 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99027] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99028] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-99029] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-99030] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-99031] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99032] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99033] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99034] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99035] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99036] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99037] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99038] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99039] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99040] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99041] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99042] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99043] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99044] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-99045] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99046] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-99047] = "fixed-version: only affects 6.17 onwards"
+
+CVE_STATUS[CVE-2026-99048] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-99049] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99050] = "fixed-version: only affects 6.18.6 onwards"
+
+CVE_STATUS[CVE-2026-99051] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-99052] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99053] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99054] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99055] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-99056] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99057] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99058] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99059] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99060] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99061] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99062] = "fixed-version: only affects 6.12.34 onwards"
+
+CVE_STATUS[CVE-2026-99063] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99064] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-99065] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-99066] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-99067] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99068] = "fixed-version: only affects 6.14 onwards"
+
+CVE_STATUS[CVE-2026-99069] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-99070] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99071] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99072] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99073] = "fixed-version: only affects 6.9 onwards"
+
+CVE_STATUS[CVE-2026-99074] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99075] = "fixed-version: only affects 6.18 onwards"
+
+# CVE-2026-99076 needs backporting (fixed from 7.3)
+
+# CVE-2026-99077 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99078] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99079] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99080] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99081] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99082] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99083] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99084] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-99085] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-99086] = "fixed-version: only affects 6.18.16 onwards"
+
+# CVE-2026-99087 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99088] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99089] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99090] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99091] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99092] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-99093] = "fixed-version: only affects 6.18.53 onwards"
+
+CVE_STATUS[CVE-2026-99094] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-99095] = "cpe-stable-backport: Backported in 6.6.160"
+
+CVE_STATUS[CVE-2026-99096] = "fixed-version: only affects 7.0 onwards"
+
+CVE_STATUS[CVE-2026-99097] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-99098] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-99099] = "fixed-version: only affects 6.15 onwards"
+
+# CVE-2026-99100 needs backporting (fixed from 7.3)
+
+# CVE-2026-99101 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99102] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-99103] = "cpe-stable-backport: Backported in 6.6.25"
+
+CVE_STATUS[CVE-2026-99104] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-99105] = "fixed-version: only affects 6.12 onwards"
+
+# CVE-2026-99106 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99107] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-99108] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-99109 needs backporting (fixed from 7.3)
+
+# CVE-2026-99110 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99111] = "fixed-version: only affects 6.18 onwards"
+
+# CVE-2026-99112 needs backporting (fixed from 7.3)
+
+# CVE-2026-99113 needs backporting (fixed from 7.3)
+
+# CVE-2026-99114 needs backporting (fixed from 7.3)
+
+# CVE-2026-99115 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99116] = "fixed-version: only affects 6.18 onwards"
+
+# CVE-2026-99117 needs backporting (fixed from 7.3)
+
+# CVE-2026-99118 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99119] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99120] = "fixed-version: only affects 6.18 onwards"
+
+# CVE-2026-99121 needs backporting (fixed from 7.3)
+
+# CVE-2026-99122 needs backporting (fixed from 7.3)
+
+# CVE-2026-99123 needs backporting (fixed from 7.3)
+
+# CVE-2026-99124 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99125] = "fixed-version: only affects 6.11 onwards"
+
+# CVE-2026-99126 needs backporting (fixed from 7.3)
+
+# CVE-2026-99127 needs backporting (fixed from 7.3)
+
+# CVE-2026-99128 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99129] = "fixed-version: only affects 7.0 onwards"
+
+# CVE-2026-99130 needs backporting (fixed from 7.3)
+
+# CVE-2026-99131 needs backporting (fixed from 7.3)
+
+# CVE-2026-99132 needs backporting (fixed from 7.3)
+
+# CVE-2026-99133 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99134] = "fixed-version: only affects 6.8 onwards"
+
+# CVE-2026-99135 needs backporting (fixed from 7.3)
+
+# CVE-2026-99136 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99137] = "fixed-version: only affects 6.18 onwards"
+
+# CVE-2026-99138 needs backporting (fixed from 7.3)
+
+# CVE-2026-99139 needs backporting (fixed from 7.3)
+
+# CVE-2026-99140 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99141] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-99142 needs backporting (fixed from 7.3)
+
+# CVE-2026-99143 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99144] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-99145] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-99146 needs backporting (fixed from 7.3)
+
+# CVE-2026-99147 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99148] = "fixed-version: only affects 6.16 onwards"
+
+CVE_STATUS[CVE-2026-99149] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-99150 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99151] = "fixed-version: only affects 7.2.9 onwards"
+
+# CVE-2026-99152 needs backporting (fixed from 7.3)
+
+# CVE-2026-99153 needs backporting (fixed from 7.3)
+
+# CVE-2026-99154 needs backporting (fixed from 7.3)
+
+# CVE-2026-99155 needs backporting (fixed from 7.3)
+
+# CVE-2026-99156 needs backporting (fixed from 7.3)
+
+# CVE-2026-99157 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99158] = "fixed-version: only affects 6.10 onwards"
+
+CVE_STATUS[CVE-2026-99159] = "fixed-version: only affects 6.12 onwards"
+
+CVE_STATUS[CVE-2026-99160] = "fixed-version: only affects 6.12 onwards"
+
+# CVE-2026-99161 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99162] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-99163 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99164] = "fixed-version: only affects 7.0 onwards"
+
+# CVE-2026-99165 needs backporting (fixed from 7.3)
+
+# CVE-2026-99166 needs backporting (fixed from 7.3)
+
+# CVE-2026-99167 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99168] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-99169 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99170] = "fixed-version: only affects 7.1 onwards"
+
+# CVE-2026-99171 needs backporting (fixed from 7.3)
+
+# CVE-2026-99172 needs backporting (fixed from 7.3)
+
+# CVE-2026-99173 may need backporting (fixed from 6.7)
+
+# CVE-2026-99174 needs backporting (fixed from 7.3)
+
+# CVE-2026-99175 needs backporting (fixed from 7.3)
+
+# CVE-2026-99176 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99177] = "fixed-version: only affects 7.2 onwards"
+
+# CVE-2026-99178 needs backporting (fixed from 7.3)
+
+# CVE-2026-99179 needs backporting (fixed from 7.3)
+
+# CVE-2026-99180 needs backporting (fixed from 7.3)
+
+# CVE-2026-99181 needs backporting (fixed from 7.3)
+
+# CVE-2026-99182 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99183] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-99184] = "fixed-version: only affects 6.18 onwards"
+
+CVE_STATUS[CVE-2026-99185] = "fixed-version: only affects 6.19 onwards"
+
+CVE_STATUS[CVE-2026-99186] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-99187 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99188] = "fixed-version: only affects 6.19 onwards"
+
+# CVE-2026-99189 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99190] = "fixed-version: only affects 6.12.114 onwards"
+
+# CVE-2026-99191 needs backporting (fixed from 7.3)
+
+# CVE-2026-99192 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99193] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99194] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99195] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99196] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99197] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99198] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99199] = "fixed-version: only affects 7.2 onwards"
+
+CVE_STATUS[CVE-2026-99200] = "fixed-version: only affects 7.2 onwards"
+
+# CVE-2026-99201 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99202] = "fixed-version: only affects 6.18.44 onwards"
+
+# CVE-2026-99203 needs backporting (fixed from 7.3)
+
+# CVE-2026-99204 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99205] = "fixed-version: only affects 7.0 onwards"
+
+# CVE-2026-99206 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99207] = "fixed-version: only affects 7.1 onwards"
+
+CVE_STATUS[CVE-2026-99208] = "fixed-version: only affects 6.11 onwards"
+
+CVE_STATUS[CVE-2026-99209] = "fixed-version: only affects 6.8 onwards"
+
+CVE_STATUS[CVE-2026-99210] = "fixed-version: only affects 6.18 onwards"
+
+# CVE-2026-99211 needs backporting (fixed from 7.3)
+
+# CVE-2026-99212 needs backporting (fixed from 7.3)
+
+# CVE-2026-99213 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99214] = "fixed-version: only affects 6.11 onwards"
+
+# CVE-2026-99215 needs backporting (fixed from 7.3)
+
+# CVE-2026-99216 needs backporting (fixed from 7.3)
+
+CVE_STATUS[CVE-2026-99999] = "cpe-stable-backport: Backported in 6.6.159"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 47/55] curl: fix CVE-2026-80230
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (45 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 46/55] linux-yocto/6.6: update CVE exclusions (6.6.160) Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 48/55] libarchive: fix CVE-2026-15028 Yoann Congal
` (7 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Backport the upstream fix [1] as mentioned in [2]
[1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
[2] https://curl.se/docs/CVE-2026-80230.html
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: This commit reformatted SRC_URI to match devtool code generation
and avoid a manual step ]
---
.../curl/curl/CVE-2026-80230.patch | 63 +++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 70 +++++++++----------
2 files changed, 98 insertions(+), 35 deletions(-)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
new file mode 100644
index 00000000000..0473c0922de
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
@@ -0,0 +1,63 @@
+From c14852aaf58042b71f98cf5aebea8d7821f6e5e1 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 24 Aug 2026 23:37:49 +0200
+Subject: [PATCH] openssl: no server cert is only okay if also not pinned
+
+Reported-by: Stanislav Fort
+Closes #22660
+
+CVE: CVE-2026-80230
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5267ed859d545534d0c21]
+
+Note: logic lives in servercert() in 8.7.1, not in ossl_check_pinned_key
+Macro CURL_EASY_STR is not available in 8.7.1 used direct data struct
+strict is set based on verifypeer and verifyhost by calling function
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ lib/vtls/openssl.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 3e130c5..481528b 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -4202,6 +4202,18 @@ static void infof_certstack(struct Curl_easy *data, const SSL *ssl)
+ #define infof_certstack(data, ssl)
+ #endif
+
++static const char *pinned(struct Curl_cfilter *cf,
++ struct Curl_easy *data)
++{
++ (void)cf;
++ return
++#ifndef CURL_DISABLE_PROXY
++ Curl_ssl_cf_is_proxy(cf) ?
++ data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
++#endif
++ data->set.str[STRING_SSL_PINNEDPUBLICKEY];
++}
++
+ /*
+ * Get the server cert, verify it and show it, etc., only call failf() if the
+ * 'strict' argument is TRUE as otherwise all this is for informational
+@@ -4248,7 +4260,7 @@ static CURLcode servercert(struct Curl_cfilter *cf,
+ backend->server_cert = SSL_get1_peer_certificate(backend->handle);
+ if(!backend->server_cert) {
+ BIO_free(mem);
+- if(!strict)
++ if(!strict && !pinned(cf, data))
+ return CURLE_OK;
+
+ failf(data, "SSL: couldn't get peer certificate");
+@@ -4424,9 +4436,7 @@ static CURLcode servercert(struct Curl_cfilter *cf,
+ /* when not strict, we don't bother about the verify cert problems */
+ result = CURLE_OK;
+
+- ptr = Curl_ssl_cf_is_proxy(cf)?
+- data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY]:
+- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
++ ptr = pinned(cf, data);
+ if(!result && ptr) {
+ result = ossl_pkp_pin_peer_pubkey(data, backend->server_cert, ptr);
+ if(result)
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index e361e6d6b13..ab33d4aa778 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -9,41 +9,41 @@ SECTION = "console/network"
LICENSE = "curl"
LIC_FILES_CHKSUM = "file://COPYING;md5=eed2e5088e1ac619c9a1c747da291d75"
-SRC_URI = " \
- https://curl.se/download/${BP}.tar.xz \
- file://721941aadf4adf4f6aeb3f4c0ab489bb89610c36.patch \
- file://run-ptest \
- file://disable-tests \
- file://no-test-timeout.patch \
- file://CVE-2024-6197.patch \
- file://CVE-2024-7264-1.patch \
- file://CVE-2024-7264-2.patch \
- file://CVE-2024-8096.patch \
- file://CVE-2024-9681.patch \
- file://CVE-2024-11053-0001.patch \
- file://CVE-2024-11053-0002.patch \
- file://CVE-2024-11053-0003.patch \
- file://CVE-2025-0167.patch \
- file://CVE-2025-9086.patch \
- file://CVE-2025-10148.patch \
- file://CVE-2025-14017.patch \
- file://CVE-2025-14524.patch \
- file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \
- file://CVE-2025-14819.patch \
- file://CVE-2025-15079.patch \
- file://CVE-2025-15224.patch \
- file://CVE-2026-1965-1.patch \
- file://CVE-2026-1965-2.patch \
- file://CVE-2026-3783.patch \
- file://CVE-2026-3784.patch \
- file://CVE-2026-5773.patch \
- file://CVE-2026-6276.patch \
- file://CVE-2026-5545.patch \
- file://CVE-2026-6253.patch \
- file://CVE-2026-4873.patch \
- file://CVE-2026-13608.patch \
- file://CVE-2026-8286.patch \
-"
+SRC_URI = "https://curl.se/download/${BP}.tar.xz \
+ file://721941aadf4adf4f6aeb3f4c0ab489bb89610c36.patch \
+ file://run-ptest \
+ file://disable-tests \
+ file://no-test-timeout.patch \
+ file://CVE-2024-6197.patch \
+ file://CVE-2024-7264-1.patch \
+ file://CVE-2024-7264-2.patch \
+ file://CVE-2024-8096.patch \
+ file://CVE-2024-9681.patch \
+ file://CVE-2024-11053-0001.patch \
+ file://CVE-2024-11053-0002.patch \
+ file://CVE-2024-11053-0003.patch \
+ file://CVE-2025-0167.patch \
+ file://CVE-2025-9086.patch \
+ file://CVE-2025-10148.patch \
+ file://CVE-2025-14017.patch \
+ file://CVE-2025-14524.patch \
+ file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \
+ file://CVE-2025-14819.patch \
+ file://CVE-2025-15079.patch \
+ file://CVE-2025-15224.patch \
+ file://CVE-2026-1965-1.patch \
+ file://CVE-2026-1965-2.patch \
+ file://CVE-2026-3783.patch \
+ file://CVE-2026-3784.patch \
+ file://CVE-2026-5773.patch \
+ file://CVE-2026-6276.patch \
+ file://CVE-2026-5545.patch \
+ file://CVE-2026-6253.patch \
+ file://CVE-2026-4873.patch \
+ file://CVE-2026-13608.patch \
+ file://CVE-2026-8286.patch \
+ file://CVE-2026-80230.patch \
+ "
SRC_URI:append:class-nativesdk = " \
file://environment.d-curl.sh \
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 48/55] libarchive: fix CVE-2026-15028
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (46 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 47/55] curl: fix CVE-2026-80230 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 49/55] systemd: try AT_EMPTY_PATH for access_fd() first Yoann Congal
` (6 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Jakub Szczudlo (Nokia) <jakub.szczudlo@nokia.com>
Backport patch to fix CVE-2026-15028.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-15028
The link in NVD is wrong. Based on project own pull request:
https://github.com/libarchive/libarchive/pull/3252
Fixing commit is the below one:
https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2
Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libarchive/CVE-2026-15028.patch | 41 +++++++++++++++++++
.../libarchive/libarchive_3.7.9.bb | 1 +
2 files changed, 42 insertions(+)
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch
diff --git a/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch
new file mode 100644
index 00000000000..c63fcf22f20
--- /dev/null
+++ b/meta/recipes-extended/libarchive/libarchive/CVE-2026-15028.patch
@@ -0,0 +1,41 @@
+From 40b92de1def08e4fc319d55702785f82cedb7ef2 Mon Sep 17 00:00:00 2001
+From: datauwu <datauwu@users.noreply.github.com>
+Date: Mon, 6 Jul 2026 21:51:15 +0800
+Subject: [PATCH] tar: fix 1-byte OOB read in SUN.holesdata parsing
+
+header_pax_extension() passes PAX attribute values without the trailing
+newline to pax_attribute(). The SUN.holesdata parser read one byte past
+the supplied value when the last numeric field ended at the value
+boundary.
+
+Handle length == 0 before checking *e.
+
+CVE: CVE-2026-15028
+Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/40b92de1def08e4fc319d55702785f82cedb7ef2]
+Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
+---
+ libarchive/archive_read_support_format_tar.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c
+index e07cfdb63b..1c0441db6c 100644
+--- a/libarchive/archive_read_support_format_tar.c
++++ b/libarchive/archive_read_support_format_tar.c
+@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar,
+ return (ARCHIVE_FATAL);
+ tar->sparse_last->hole = hole;
+ }
+- if (length == 0 || *e == '\n') {
+- if (length == 0 && *e == '\n') {
+- return (ARCHIVE_OK);
+- } else {
+- return (ARCHIVE_WARN);
+- }
+- }
++ if (length == 0)
++ return (ARCHIVE_OK);
++ if (*e == '\n')
++ return (ARCHIVE_WARN);
+ p = e + 1;
+ length--;
+ hole = hole == 0;
diff --git a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb
index 2eb22e2d61a..3719965eed9 100644
--- a/meta/recipes-extended/libarchive/libarchive_3.7.9.bb
+++ b/meta/recipes-extended/libarchive/libarchive_3.7.9.bb
@@ -51,6 +51,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
file://CVE-2026-4424-2.patch \
file://CVE-2026-5121-02.patch \
file://CVE-2026-5745.patch \
+ file://CVE-2026-15028.patch \
"
UPSTREAM_CHECK_URI = "http://libarchive.org/"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 49/55] systemd: try AT_EMPTY_PATH for access_fd() first
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (47 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 48/55] libarchive: fix CVE-2026-15028 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 50/55] apr-util: Fix CVE-2025-49506 Yoann Congal
` (5 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Suresh H A <Suresh.HA@bmwtechworks.in>
Backport a fix to try AT_EMPTY_PATH which changes access_fd() to use
faccessat(..., AT_EMPTY_PATH) instead of validating access through
/proc/self/fd/<fd>.
This fixes a reproducible race during service startup. On
Linux 6.6 / systemd 255 (Scarthgap) based platform, affected
services may fail to start when systemd-remount-fs.service runs
concurrently and remounts procfs. In this window, access_fd()
can fail with -ESRCH while resolving /proc/self/fd/<fd>, causing
systemd to report that the executable cannot be located.
The upstream implementation performs the access check directly on
the file descriptor, avoiding dependence on procfs path resolution
and eliminating the observed race.
Signed-off-by: Suresh H A <Suresh.HA@bmwtechworks.in>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: More details available at:
https://lore.kernel.org/all/MAXP287MB42404C1A7233A3D773FFA7DFEE802@MAXP287MB4240.INDP287.PROD.OUTLOOK.COM/ ]
---
...ry-AT_EMPTY_PATH-for-access_fd-first.patch | 34 +++++++++++++++++++
meta/recipes-core/systemd/systemd_255.22.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch
diff --git a/meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch b/meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch
new file mode 100644
index 00000000000..268ace04c46
--- /dev/null
+++ b/meta/recipes-core/systemd/systemd/0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch
@@ -0,0 +1,34 @@
+From 228d4c63102367a757ba4f31c49a148975607a72 Mon Sep 17 00:00:00 2001
+From: Mike Yuan <me@yhndnzj.com>
+Date: Mon, 20 May 2024 19:33:26 +0800
+Subject: [PATCH] fs-util: try AT_EMPTY_PATH for access_fd() first
+
+Upstream-Status: Backport [https://github.com/systemd/systemd/pull/32933/commits/c675851d5fd503c1ae5d244f041d43ae9e3ab79b]
+
+Signed-off-by: Suresh H A <Suresh.HA@bmwtechworks.in>
+---
+ src/basic/fs-util.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c
+index 5bc7d2f..3a7ebd2 100644
+--- a/src/basic/fs-util.c
++++ b/src/basic/fs-util.c
+@@ -668,6 +668,14 @@ int unlink_or_warn(const char *filename) {
+ int access_fd(int fd, int mode) {
+ /* Like access() but operates on an already open fd */
+
++ if (faccessat(fd, "", mode, AT_EMPTY_PATH) >= 0)
++ return 0;
++ if (errno != EINVAL)
++ return -errno;
++
++ /* Support for AT_EMPTY_PATH is added rather late (kernel 5.8), so fall back to going through /proc/
++ * if unavailable. */
++
+ if (access(FORMAT_PROC_FD_PATH(fd), mode) < 0) {
+ if (errno != ENOENT)
+ return -errno;
+--
+2.43.0
+
diff --git a/meta/recipes-core/systemd/systemd_255.22.bb b/meta/recipes-core/systemd/systemd_255.22.bb
index 84d41a86c9b..1bdeb551fd8 100644
--- a/meta/recipes-core/systemd/systemd_255.22.bb
+++ b/meta/recipes-core/systemd/systemd_255.22.bb
@@ -39,6 +39,7 @@ SRC_URI += " \
file://CVE-2026-29111-04.patch \
file://CVE-2026-4105.patch \
file://0023-journal-replace-a-bunch-of-assert-with-friendlier-ch.patch \
+ file://0024-fs-util-try-AT_EMPTY_PATH-for-access_fd-first.patch \
"
# patches needed by musl
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 50/55] apr-util: Fix CVE-2025-49506
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (48 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 49/55] systemd: try AT_EMPTY_PATH for access_fd() first Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 51/55] apr-util: Fix CVE-2026-32327 Yoann Congal
` (4 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Hetvi Thakar <hthakar@cisco.com>
Backport the upstream timing-safe comparison fix [1].
APR-util 1.6.4 identifies this issue as fixed [2].
[1] https://github.com/apache/apr-util/commit/f77a20761cb15686f8d4de5b5eafc534ae24b19e
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-49506
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../apr/apr-util/CVE-2025-49506.patch | 310 ++++++++++++++++++
meta/recipes-support/apr/apr-util_1.6.3.bb | 1 +
2 files changed, 311 insertions(+)
create mode 100644 meta/recipes-support/apr/apr-util/CVE-2025-49506.patch
diff --git a/meta/recipes-support/apr/apr-util/CVE-2025-49506.patch b/meta/recipes-support/apr/apr-util/CVE-2025-49506.patch
new file mode 100644
index 00000000000..0ab5cf06485
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2025-49506.patch
@@ -0,0 +1,310 @@
+From f77a20761cb15686f8d4de5b5eafc534ae24b19e Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 3 Aug 2026 12:10:13 +0000
+Subject: [PATCH] Merge r1936804 from aprutil 1.7.x:
+
+use timing safe comparison
+
+Submitted By: ylavic
+Reviewed By: ylavic, rpluem, covener
+
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936805 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2025-49506
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/f77a20761cb15686f8d4de5b5eafc534ae24b19e]
+
+(cherry picked from commit f77a20761cb15686f8d4de5b5eafc534ae24b19e)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ crypto/apr_crypto.c | 60 +++++++++++++++++---
+ crypto/apr_passwd.c | 135 ++++++++++++++++++++++++++++++++++++++++----
+ 2 files changed, 176 insertions(+), 19 deletions(-)
+
+diff --git a/crypto/apr_crypto.c b/crypto/apr_crypto.c
+index 9ba190ef..ca3f0887 100644
+--- a/crypto/apr_crypto.c
++++ b/crypto/apr_crypto.c
+@@ -21,6 +21,7 @@
+ #include "apu.h"
+ #include "apr_pools.h"
+ #include "apr_dso.h"
++#include "apr_version.h"
+ #include "apr_strings.h"
+ #include "apr_hash.h"
+ #include "apr_thread_mutex.h"
+@@ -173,19 +174,64 @@ APU_DECLARE(apr_status_t) apr_crypto_memzero(void *buffer, apr_size_t size)
+ return APR_SUCCESS;
+ }
+
++/* Borrow this from APR-1.8 if not available */
++#if !APR_VERSION_AT_LEAST(1,8,0)
++
++/* A volatile variable which is always zero but allows to block the compiler
++ * from optimizing or eliding code using it. Volatile forces the compiler to
++ * emit a memory load for which no value can be assumed, so for instance an
++ * add/sub/xor/or with "optblocker" is a noop that will hide the result to
++ * the optimizer.
++ */
++static volatile const apr_uint32_t optblocker;
++
++/* Return whether x is not zero, with no branching controlled by x.
++ *
++ * Taken from the cryptoint library (public domain) by D. J. Bernstein,
++ * which provides timing attacks safe integer operations/primitives.
++ * Code:
++ * https://lib.mceliece.org/libmceliece-20250507/cryptoint/crypto_uint32.h
++ * Paper:
++ * https://cr.yp.to/papers/cryptoint-20250424.pdf
++ */
++#if __has_attribute(always_inline)
++__attribute__((always_inline))
++#endif
++static APR_INLINE int test_nonzero_timingsafe(apr_uint32_t x)
++{
++ x |= -x; /* sets the most significant bit unless x == 0 */
++
++ /* shift bit 31 (MSB) to bit 0 */
++ x >>= 32-6; /* keep 6 bits */
++ x += optblocker; /* lose the optimizer */
++ x >>= 5; /* keep the (original) MSB only */
++
++ /* x is now 0 or 1 */
++ return x & INT_MAX;
++}
++
++#endif /* !APR_VERSION_AT_LEAST(1,8,0) */
++
+ APU_DECLARE(int) apr_crypto_equals(const void *buf1, const void *buf2,
+ apr_size_t size)
+ {
+- const unsigned char *p1 = buf1;
+- const unsigned char *p2 = buf2;
+- unsigned char diff = 0;
+- apr_size_t i;
++#if APR_VERSION_AT_LEAST(1,8,0)
++ return apr_memeq_timingsafe(buf1, buf2, size);
++#else
++ apr_uint32_t diff = 0;
++ volatile apr_size_t count = size; /* prevent loop unrolling */
++ apr_size_t i = 0;
+
+- for (i = 0; i < size; ++i) {
+- diff |= p1[i] ^ p2[i];
++ for (; i < count; ++i) {
++ const unsigned char c1 = ((volatile const unsigned char *)buf1)[i];
++ const unsigned char c2 = ((volatile const unsigned char *)buf2)[i];
++
++ diff |= c1 ^ c2; /* sets diff to non-zero whenever c1 != c2 */
+ }
+
+- return 1 & ((diff - 1) >> 8);
++ /* (diff == 0) <=> (diff != 0) ^ 1 */
++ return test_nonzero_timingsafe(diff) ^ 1;
++#endif
+ }
+
+ APU_DECLARE(apr_status_t) apr_crypto_get_driver(
+diff --git a/crypto/apr_passwd.c b/crypto/apr_passwd.c
+index c961de2b..74b5fc17 100644
+--- a/crypto/apr_passwd.c
++++ b/crypto/apr_passwd.c
+@@ -14,6 +14,7 @@
+ * limitations under the License.
+ */
+
++#include "apr_version.h"
+ #include "apr_strings.h"
+ #include "apr_md5.h"
+ #include "apr_lib.h"
+@@ -39,6 +40,111 @@
+
+ static const char * const apr1_id = "$apr1$";
+
++#if APR_VERSION_AT_LEAST(1,8,0)
++
++#define streq_timingsafe apr_streq_timingsafe
++#define strneq_timingsafe apr_strneq_timingsafe
++
++#else /* borrow code from APR-1.8 if not available */
++
++/* A volatile variable which is always zero but allows to block the compiler
++ * from optimizing or eliding code using it. Volatile forces the compiler to
++ * emit a memory load for which no value can be assumed, so for instance an
++ * add/sub/xor/or with "optblocker" is a noop that will hide the result to
++ * the optimizer.
++ */
++static volatile const apr_uint32_t optblocker;
++
++/* Return whether x is not zero, with no branching controlled by x.
++ *
++ * Taken from the cryptoint library (public domain) by D. J. Bernstein,
++ * which provides timing attacks safe integer operations/primitives.
++ * Code:
++ * https://lib.mceliece.org/libmceliece-20250507/cryptoint/crypto_uint32.h
++ * Paper:
++ * https://cr.yp.to/papers/cryptoint-20250424.pdf
++ */
++#if __has_attribute(always_inline)
++__attribute__((always_inline))
++#endif
++static APR_INLINE int test_nonzero_timingsafe(apr_uint32_t x)
++{
++ x |= -x; /* sets the most significant bit unless x == 0 */
++
++ /* shift bit 31 (MSB) to bit 0 */
++ x >>= 32-6; /* keep 6 bits */
++ x += optblocker; /* lose the optimizer */
++ x >>= 5; /* keep the (original) MSB only */
++
++ /* x is now 0 or 1 */
++ return x & INT_MAX;
++}
++
++static int streq_timingsafe(const char *sec1, const char *str2)
++{
++ apr_uint32_t diff = 0;
++ apr_size_t i1 = 0, i2 = 0;
++
++ for (;; ++i2) {
++ const unsigned char c1 = ((volatile const unsigned char *)sec1)[i1];
++ const unsigned char c2 = ((volatile const unsigned char *)str2)[i2];
++
++ diff |= c1 ^ c2; /* sets diff to non-zero whenever c1 != c2 */
++
++ /* Not a shortest/longest match because an attacker would usually know
++ * one of the strings and could then determine the length of the other.
++ * So assume only sec1 and its length are secret and stop the loop at
++ * the end of str2. If sec1 is shorter than str2 the loop will continue
++ * by comparing the rest of str2 with the trailing NUL byte of sec1.
++ * In any case since the diff above is computed up to and including a
++ * NUL byte, only the same content and length will raise match.
++ */
++ if (!c2) {
++ break;
++ }
++
++ /* Don't go above sec1's NUL byte */
++ i1 += test_nonzero_timingsafe(c1);
++ }
++
++ /* (diff == 0) <=> (diff != 0) ^ 1 */
++ return test_nonzero_timingsafe(diff) ^ 1;
++}
++
++static int strneq_timingsafe(const char *sec1, const char *str2, apr_size_t n)
++{
++ apr_uint32_t diff = 0;
++ volatile apr_size_t count = n; /* prevent loop unrolling */
++ apr_size_t i1 = 0, i2 = 0;
++
++ for (; i2 < count; ++i2) {
++ const unsigned char c1 = ((volatile const unsigned char *)sec1)[i1];
++ const unsigned char c2 = ((volatile const unsigned char *)str2)[i2];
++
++ diff |= c1 ^ c2; /* sets diff to non-zero whenever c1 != c2 */
++
++ /* Not a shortest/longest match because an attacker would usually know
++ * one of the strings and could then determine the length of the other.
++ * So assume only sec1 and its length are secret and stop the loop at
++ * the end of str2. If sec1 is shorter than str2 the loop will continue
++ * by comparing the rest of str2 with the trailing NUL byte of sec1.
++ * In any case since the diff above is computed up to and including a
++ * NUL byte, only the same content and length will raise match.
++ */
++ if (!c2) {
++ break;
++ }
++
++ /* Don't go above sec1's NUL byte */
++ i1 += test_nonzero_timingsafe(c1);
++ }
++
++ /* (diff == 0) <=> (diff != 0) ^ 1 */
++ return test_nonzero_timingsafe(diff) ^ 1;
++}
++
++#endif /* APR_VERSION_AT_LEAST(1,8,0) */
++
+ #if !defined(WIN32) && !defined(BEOS) && !defined(NETWARE)
+ #if defined(APU_CRYPT_THREADSAFE) || !APR_HAS_THREADS || \
+ defined(CRYPT_R_CRYPTD) || defined(CRYPT_R_STRUCT_CRYPT_DATA)
+@@ -86,28 +192,33 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd,
+ #if !CRYPT_MISSING
+ char *crypt_pw;
+ #endif
+- if (hash[0] == '$'
+- && hash[1] == '2'
+- && (hash[2] == 'a' || hash[2] == 'y')
+- && hash[3] == '$') {
++
++ if ((strneq_timingsafe(hash, "$2a$", 4) | /* test both */
++ strneq_timingsafe(hash, "$2y$", 4))) {
++ /*
++ * The hash was created using [apr_]bcrypt encoding.
++ */
+ if (_crypt_blowfish_rn(passwd, hash, sample, sizeof(sample)) == NULL)
+ return APR_FROM_OS_ERROR(errno);
+ }
+- else if (!strncmp(hash, apr1_id, strlen(apr1_id))) {
++ else if (strneq_timingsafe(hash, apr1_id, strlen(apr1_id))) {
+ /*
+ * The hash was created using our custom algorithm.
+ */
+ apr_md5_encode(passwd, hash, sample, sizeof(sample));
+ }
+- else if (!strncmp(hash, APR_SHA1PW_ID, APR_SHA1PW_IDLEN)) {
+- apr_sha1_base64(passwd, (int)strlen(passwd), sample);
++ else if (strneq_timingsafe(hash, APR_SHA1PW_ID, APR_SHA1PW_IDLEN)) {
++ /*
++ * The hash is a (naked) SHA1.
++ */
++ apr_sha1_base64(passwd, (int)strlen(passwd), sample);
+ }
+ else {
+ /*
+ * It's not our algorithm, so feed it to crypt() if possible.
+ */
+ #if CRYPT_MISSING
+- return (strcmp(passwd, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH;
++ return streq_timingsafe(hash, passwd) ? APR_SUCCESS : APR_EMISMATCH;
+ #elif defined(CRYPT_R_CRYPTD)
+ apr_status_t rv;
+ CRYPTD *buffer = malloc(sizeof(*buffer));
+@@ -118,7 +229,7 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd,
+ if (!crypt_pw)
+ rv = APR_EMISMATCH;
+ else
+- rv = (strcmp(crypt_pw, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH;
++ rv = streq_timingsafe(hash, crypt_pw) ? APR_SUCCESS : APR_EMISMATCH;
+ free(buffer);
+ return rv;
+ #elif defined(CRYPT_R_STRUCT_CRYPT_DATA)
+@@ -149,7 +260,7 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd,
+ if (!crypt_pw)
+ rv = APR_EMISMATCH;
+ else
+- rv = (strcmp(crypt_pw, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH;
++ rv = streq_timingsafe(hash, crypt_pw) ? APR_SUCCESS : APR_EMISMATCH;
+ free(buffer);
+ return rv;
+ #else
+@@ -173,14 +284,14 @@ APU_DECLARE(apr_status_t) apr_password_validate(const char *passwd,
+ rv = APR_EMISMATCH;
+ }
+ else {
+- rv = (strcmp(crypt_pw, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH;
++ rv = streq_timingsafe(hash, crypt_pw) ? APR_SUCCESS : APR_EMISMATCH;
+ }
+ crypt_mutex_unlock();
+ return rv;
+ }
+ #endif
+ }
+- return (strcmp(sample, hash) == 0) ? APR_SUCCESS : APR_EMISMATCH;
++ return streq_timingsafe(hash, sample) ? APR_SUCCESS : APR_EMISMATCH;
+ }
+
+ static const char * const bcrypt_id = "$2y$";
diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index 3a5f52d2501..7b5a04c4350 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -13,6 +13,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \
file://configfix.patch \
file://configure_fixes.patch \
file://0001-test_transformation-Check-if-transform-is-supported-.patch \
+ file://CVE-2025-49506.patch \
file://run-ptest \
"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 51/55] apr-util: Fix CVE-2026-32327
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (49 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 50/55] apr-util: Fix CVE-2025-49506 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 52/55] apr-util: Mark CVE-2026-34191 not applicable Yoann Congal
` (3 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Hetvi Thakar <hthakar@cisco.com>
Backport the upstream test compatibility prerequisite [1], which is
required by the regression tests included with the XML nesting-depth
fix [2]. The fix addresses CVE-2026-32327 as described by the advisory
[3].
[1] https://github.com/apache/apr-util/commit/dba5d434dba0547478f411d6fa068766455446ce
[2] https://github.com/apache/apr-util/commit/414e12e427c89f135d8ee66ab1203feffd3e2bd8
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-32327
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../apr-util/CVE-2026-32327-dependent.patch | 34 +
.../apr/apr-util/CVE-2026-32327.patch | 2162 +++++++++++++++++
meta/recipes-support/apr/apr-util_1.6.3.bb | 2 +
3 files changed, 2198 insertions(+)
create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch
create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-32327.patch
diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch b/meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch
new file mode 100644
index 00000000000..c3c570f4070
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-32327-dependent.patch
@@ -0,0 +1,34 @@
+From dba5d434dba0547478f411d6fa068766455446ce Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org>
+Date: Tue, 19 Dec 2023 11:20:33 +0000
+Subject: [PATCH] Merge r1914772 from 1.7.x:
+
+* test/testutil.h: Define APR_ASSERT_SUCCESS for compatibility
+ with apr trunk.
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1914774 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-32327
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/dba5d434dba0547478f411d6fa068766455446ce]
+
+(cherry picked from commit dba5d434dba0547478f411d6fa068766455446ce)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ test/testutil.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/test/testutil.h b/test/testutil.h
+index eaa7e759..4c5e30b8 100644
+--- a/test/testutil.h
++++ b/test/testutil.h
+@@ -40,6 +40,8 @@ extern apr_pool_t *p;
+ /* Assert that RV is an APR_SUCCESS value; else fail giving strerror
+ * for RV and CONTEXT message. */
+ void apr_assert_success(abts_case* tc, const char *context, apr_status_t rv);
++#define APR_ASSERT_SUCCESS(tc, ctxt, rv) \
++ apr_assert_success(tc, ctxt, rv)
+
+ void apr_assert_failure(abts_case* tc, const char *context,
+ apr_status_t rv, int lineno);
diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-32327.patch b/meta/recipes-support/apr/apr-util/CVE-2026-32327.patch
new file mode 100644
index 00000000000..a0c4004709c
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-32327.patch
@@ -0,0 +1,2162 @@
+From 414e12e427c89f135d8ee66ab1203feffd3e2bd8 Mon Sep 17 00:00:00 2001
+From: Joe Orton <jorton@apache.org>
+Date: Mon, 3 Aug 2026 12:34:32 +0000
+Subject: [PATCH] Merge r1936807 from 1.7.x:
+
+limit XML processing depth
+
+Submitted By: jorton
+Reviewed By: jorton, jfclere, ivan
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936815 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-32327
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/414e12e427c89f135d8ee66ab1203feffd3e2bd8]
+
+(cherry picked from commit 414e12e427c89f135d8ee66ab1203feffd3e2bd8)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ CMakeLists.txt | 3 +
+ test/data/nesting.xml | 2001 +++++++++++++++++++++++++++++++++++++++++
+ test/testxml.c | 32 +
+ xml/apr_xml.c | 21 +-
+ 4 files changed, 2056 insertions(+), 1 deletion(-)
+ create mode 100644 test/data/nesting.xml
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index fcbfc582..65b9194d 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -288,6 +288,9 @@ IF(APR_BUILD_TESTAPR)
+ EXECUTE_PROCESS(COMMAND ${CMAKE_COMMAND} -E copy_if_different
+ ${PROJECT_SOURCE_DIR}/test/data/billion-laughs.xml
+ ${PROJECT_BINARY_DIR}/data/billion-laughs.xml)
++ EXECUTE_PROCESS(COMMAND ${CMAKE_COMMAND} -E copy_if_different
++ ${PROJECT_SOURCE_DIR}/test/data/nesting.xml
++ ${PROJECT_BINARY_DIR}/data/nesting.xml)
+
+ IF(TEST_STATIC_LIBS)
+ SET(whichapr aprutil-1)
+diff --git a/test/data/nesting.xml b/test/data/nesting.xml
+new file mode 100644
+index 00000000..a4efda86
+--- /dev/null
++++ b/test/data/nesting.xml
+@@ -0,0 +1,2001 @@
++<?xml version="1.0"?>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++<n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
++</n>
+diff --git a/test/testxml.c b/test/testxml.c
+index eed10672..5284f888 100644
+--- a/test/testxml.c
++++ b/test/testxml.c
+@@ -20,6 +20,10 @@
+ #include "abts.h"
+ #include "testutil.h"
+
++#ifndef APR_XML_MAX_DEPTH
++#define APR_XML_MAX_DEPTH 256
++#endif
++
+ static apr_status_t create_dummy_file_error(abts_case *tc, apr_pool_t *p,
+ apr_file_t **fd)
+ {
+@@ -166,6 +170,33 @@ static void test_billion_laughs(abts_case *tc, void *data)
+ apr_file_close(fd);
+ }
+
++static void test_nesting_limit(abts_case *tc, void *data)
++{
++ apr_file_t *fd;
++ apr_xml_parser *parser = NULL;
++ apr_xml_doc *doc;
++ apr_status_t rv;
++ char errbuf[256], *err;
++
++ rv = apr_file_open(&fd, "data/nesting.xml",
++ APR_FOPEN_READ, 0, p);
++ APR_ASSERT_SUCCESS(tc, "open nesting.xml", rv);
++
++ rv = apr_xml_parse_file(p, &parser, &doc, fd, 2000);
++ ABTS_TRUE(tc, rv != APR_SUCCESS);
++
++ if (parser) {
++ err = apr_xml_parser_geterror(parser, errbuf, sizeof errbuf);
++ ABTS_STR_EQUAL(tc,
++ "The maximum element nesting limit "
++ "(" APR_STRINGIFY(APR_XML_MAX_DEPTH) ")"
++ " was exceeded.",
++ err);
++ }
++
++ apr_file_close(fd);
++}
++
+ static void test_CVE_2009_3720_alpha(abts_case *tc, void *data)
+ {
+ apr_xml_parser *xp;
+@@ -198,6 +229,7 @@ abts_suite *testxml(abts_suite *suite)
+
+ abts_run_test(suite, test_xml_parser, NULL);
+ abts_run_test(suite, test_billion_laughs, NULL);
++ abts_run_test(suite, test_nesting_limit, NULL);
+ abts_run_test(suite, test_CVE_2009_3720_alpha, NULL);
+ abts_run_test(suite, test_CVE_2009_3720_beta, NULL);
+
+diff --git a/xml/apr_xml.c b/xml/apr_xml.c
+index 2685a9a5..a2535f98 100644
+--- a/xml/apr_xml.c
++++ b/xml/apr_xml.c
+@@ -61,12 +61,19 @@ struct apr_xml_parser {
+ int error; /* an error has occurred */
+ #define APR_XML_ERROR_EXPAT 1
+ #define APR_XML_ERROR_PARSE_DONE 2
+-/* also: public APR_XML_NS_ERROR_* values (if any) */
++#define APR_XML_ERROR_DEPTH_LIMIT 3
+
++/* also: public APR_XML_NS_ERROR_* values (if any) */
++ /** depth of element tree. */
++ unsigned int depth;
+ XML_Parser xp; /* the actual (Expat) XML parser */
+ enum XML_Error xp_err; /* stored Expat error code */
+ };
+
++#ifndef APR_XML_MAX_DEPTH
++#define APR_XML_MAX_DEPTH 256
++#endif
++
+ /* struct for scoping namespace declarations */
+ typedef struct apr_xml_ns_scope {
+ const char *prefix; /* prefix used for this ns */
+@@ -154,6 +161,11 @@ static void start_handler(void *userdata, const char *name, const char **attrs)
+ if (parser->error)
+ return;
+
++ if (++parser->depth > APR_XML_MAX_DEPTH) {
++ parser->error = APR_XML_ERROR_DEPTH_LIMIT;
++ return;
++ }
++
+ elem = apr_pcalloc(parser->p, sizeof(*elem));
+
+ /* prep the element */
+@@ -327,6 +339,8 @@ static void end_handler(void *userdata, const char *name)
+ if (parser->error)
+ return;
+
++ parser->depth--;
++
+ /* pop up one level */
+ parser->cur_elem = parser->cur_elem->parent;
+ }
+@@ -499,6 +513,11 @@ APU_DECLARE(char *) apr_xml_parser_geterror(apr_xml_parser *parser,
+ XML_ErrorString(parser->xp_err), parser->xp_err);
+ return errbuf;
+
++ case APR_XML_ERROR_DEPTH_LIMIT:
++ msg = "The maximum element nesting limit ("
++ APR_STRINGIFY(APR_XML_MAX_DEPTH) ") was exceeded.";
++ break;
++
+ case APR_XML_ERROR_PARSE_DONE:
+ msg = "The parser is not active.";
+ break;
diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index 7b5a04c4350..00a9589ae83 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -14,6 +14,8 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \
file://configure_fixes.patch \
file://0001-test_transformation-Check-if-transform-is-supported-.patch \
file://CVE-2025-49506.patch \
+ file://CVE-2026-32327-dependent.patch \
+ file://CVE-2026-32327.patch \
file://run-ptest \
"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 52/55] apr-util: Mark CVE-2026-34191 not applicable
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (50 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 51/55] apr-util: Fix CVE-2026-32327 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 53/55] apr-util: Fix CVE-2026-34501 Yoann Congal
` (2 subsequent siblings)
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Hetvi Thakar <hthakar@cisco.com>
CVE-2026-34191 affects only the apr_dbd_oracle provider [1].
The apr-util recipe does not enable --with-oracle, so configure keeps
apu_have_oracle=0 [2]. Hence mark the CVE not applicable to this build.
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-34191
[2] https://github.com/apache/apr-util/blob/1.6.3/build/dbd.m4
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-support/apr/apr-util_1.6.3.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index 00a9589ae83..1b7beda9042 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -101,3 +101,5 @@ do_install_ptest() {
# Add CVE_PRODUCT to match the NVD CPE product name
CVE_PRODUCT = "apache:apr-util apache:portable_runtime_utility"
+
+CVE_STATUS[CVE-2026-34191] = "not-applicable-config: apr_dbd_oracle is not built because --with-oracle is not enabled"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 53/55] apr-util: Fix CVE-2026-34501
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (51 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 52/55] apr-util: Mark CVE-2026-34191 not applicable Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 54/55] apr-util: Fix CVE-2026-34502 Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 55/55] util-linux: patch CVE-2026-53615 Yoann Congal
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Hetvi Thakar <hthakar@cisco.com>
Backport the upstream Redis response-length and error-checking fix [1]
to address CVE-2026-34501 [2].
[1] https://github.com/apache/apr-util/commit/e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34501
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../apr/apr-util/CVE-2026-34501.patch | 128 ++++++++++++++++++
meta/recipes-support/apr/apr-util_1.6.3.bb | 1 +
2 files changed, 129 insertions(+)
create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34501.patch
diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch
new file mode 100644
index 00000000000..0056e621718
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-34501.patch
@@ -0,0 +1,128 @@
+From e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 3 Aug 2026 12:28:37 +0000
+Subject: [PATCH] Merge r1936809 from aprutil 1.7.x:
+
+Merge r1936808 from apr trunk:
+
+apr_redis error checking
+
+Submitted By: jfclere
+Reviewed By: jfclere, jorton, covener
+
+
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936810 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-34501
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2]
+
+(cherry picked from commit e8f36bd5f1cc1c82bed1ae52d5699a4c610251c2)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ redis/apr_redis.c | 54 +++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 43 insertions(+), 11 deletions(-)
+
+diff --git a/redis/apr_redis.c b/redis/apr_redis.c
+index 8d01fdd6..e7fe2071 100644
+--- a/redis/apr_redis.c
++++ b/redis/apr_redis.c
+@@ -853,26 +853,42 @@ APU_DECLARE(apr_status_t) apr_redis_setex(apr_redis_t *rc,
+ return rv;
+ }
+
++/* Redis upstream default is 512Mb. This code will try to read the entire
++ * response into a brigade, and then copy that into a pool, so impose
++ * some reasonable limit since RAM consumption will be double this.
++ * https://redis.io/docs/latest/develop/reference/protocol-spec/#bulk-strings
++ */
++#ifndef APR_REDIS_MAX_BULK_LEN
++#define APR_REDIS_MAX_BULK_LEN (64 * 1024 * 1024)
++#endif
++
+ static apr_status_t grab_bulk_resp(apr_redis_server_t *rs, apr_redis_t *rc,
+ apr_redis_conn_t *conn, apr_pool_t *p,
+ char **baton, apr_size_t *new_length)
+ {
+- char *length;
++ /* conn->buffer contains "$<length>\r\n" */
++ char *length = conn->buffer + 1;
+ char *last;
+ apr_status_t rv;
+ apr_size_t len = 0;
++ long val;
++
+ *new_length = 0;
++ *baton = NULL;
+
+- length = apr_strtok(conn->buffer + 1, " ", &last);
+- if (length) {
+- len = strtol(length, (char **) NULL, 10);
++ errno = 0;
++ last = NULL;
++ val = strtol(length, &last, 10);
++ if (errno || last == NULL || last == length || *last != '\r'
++ || val < 0 || val > APR_REDIS_MAX_BULK_LEN) {
++ rs_bad_conn(rs, conn);
++ if (rc)
++ apr_redis_disable_server(rc, rs);
++ return val > APR_REDIS_MAX_BULK_LEN ? APR_ENOSPC : APR_EGENERAL;
+ }
++ len = (apr_size_t)val;
+
+- if (len == 0) {
+- *new_length = 0;
+- *baton = NULL;
+- }
+- else {
++ if (len) {
+ apr_bucket_brigade *bbb;
+ apr_bucket *e;
+
+@@ -907,6 +923,11 @@ static apr_status_t grab_bulk_resp(apr_redis_server_t *rs, apr_redis_t *rc,
+
+ conn->bb = bbb;
+
++ if (len < 2) {
++ *baton = NULL;
++ *new_length = 0;
++ return APR_EGENERAL;
++ }
+ *new_length = len - 2;
+ (*baton)[*new_length] = '\0';
+ }
+@@ -992,6 +1013,10 @@ APU_DECLARE(apr_status_t) apr_redis_getp(apr_redis_t *rc,
+ }
+ else if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) {
+ rv = grab_bulk_resp(rs, rc, conn, p, baton, new_length);
++ if (rv != APR_SUCCESS) {
++ /* grab_bulk_resp already called rs_bad_conn; do not also release */
++ return rv;
++ }
+ }
+ else {
+ rv = APR_EGENERAL;
+@@ -1172,12 +1197,19 @@ apr_redis_info(apr_redis_server_t *rs, apr_pool_t *p, char **baton)
+ return rv;
+ }
+
+- if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) {
++ if (strncmp(RS_NOT_FOUND_GET, conn->buffer, RS_NOT_FOUND_GET_LEN) == 0) {
++ rv = APR_NOTFOUND;
++ }
++ else if (strncmp(RS_TYPE_STRING, conn->buffer, RS_TYPE_STRING_LEN) == 0) {
+ apr_size_t nl;
+ rv = grab_bulk_resp(rs, NULL, conn, p, baton, &nl);
++ if (rv != APR_SUCCESS) {
++ /* grab_bulk_resp already called rs_bad_conn; do not also release */
++ return rv;
++ }
+ } else {
+ rs_bad_conn(rs, conn);
+- rv = APR_EGENERAL;
++ return APR_EGENERAL;
+ }
+
+ rs_release_conn(rs, conn);
diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index 1b7beda9042..8d751e7b7a1 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -16,6 +16,7 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \
file://CVE-2025-49506.patch \
file://CVE-2026-32327-dependent.patch \
file://CVE-2026-32327.patch \
+ file://CVE-2026-34501.patch \
file://run-ptest \
"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 54/55] apr-util: Fix CVE-2026-34502
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (52 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 53/55] apr-util: Fix CVE-2026-34501 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
2026-10-31 0:15 ` [OE-core][scarthgap 55/55] util-linux: patch CVE-2026-53615 Yoann Congal
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Hetvi Thakar <hthakar@cisco.com>
Backport the upstream memcache validation fix [1] and its follow-up
parsing correction [2] to address CVE-2026-34502 [3].
[1] https://github.com/apache/apr-util/commit/f1c98dd0847c43375daf3789c936685adbc6d872
[2] https://github.com/apache/apr-util/commit/997c02ce5b9db44083c580e3e47095f5ac4524ae
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34502
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../apr/apr-util/CVE-2026-34502_p1.patch | 106 ++++++++++++++++++
.../apr/apr-util/CVE-2026-34502_p2.patch | 38 +++++++
meta/recipes-support/apr/apr-util_1.6.3.bb | 2 +
3 files changed, 146 insertions(+)
create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch
create mode 100644 meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch
diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch
new file mode 100644
index 00000000000..d4c6cb39b40
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p1.patch
@@ -0,0 +1,106 @@
+From f1c98dd0847c43375daf3789c936685adbc6d872 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Mon, 3 Aug 2026 12:33:18 +0000
+Subject: [PATCH] Merge r1936812 from aprutil 1.7.x:
+
+Merge r1936811 from apr trunk:
+
+apr_memcache: error checking
+
+Reviewed By: covener, jorton, jfclere
+
+
+
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936813 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-34502
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/f1c98dd0847c43375daf3789c936685adbc6d872]
+
+(cherry picked from commit f1c98dd0847c43375daf3789c936685adbc6d872)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ memcache/apr_memcache.c | 31 ++++++++++++++++++++++++++++---
+ 1 file changed, 28 insertions(+), 3 deletions(-)
+
+diff --git a/memcache/apr_memcache.c b/memcache/apr_memcache.c
+index 2c7bd1de..137be778 100644
+--- a/memcache/apr_memcache.c
++++ b/memcache/apr_memcache.c
+@@ -595,6 +595,11 @@ static apr_status_t get_server_line(apr_memcache_conn_t *conn)
+ conn->blen = bsize;
+ conn->buffer[bsize] = '\0';
+
++ /* Validate CRLF line termination to prevent integer underflow attacks */
++ if (bsize < 2 || conn->buffer[bsize-2] != '\r' || conn->buffer[bsize-1] != '\n') {
++ return APR_EGENERAL;
++ }
++
+ return apr_brigade_cleanup(conn->tb);
+ }
+
+@@ -1087,9 +1092,14 @@ apr_memcache_version(apr_memcache_server_t *ms,
+ }
+
+ if (strncmp(MS_VERSION, conn->buffer, MS_VERSION_LEN) == 0) {
+- *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1,
+- conn->blen - MS_VERSION_LEN - 2);
+- rv = APR_SUCCESS;
++ if (conn->blen < MS_VERSION_LEN + 2) {
++ rv = APR_EGENERAL;
++ }
++ else {
++ *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1,
++ conn->blen - MS_VERSION_LEN - 2);
++ rv = APR_SUCCESS;
++ }
+ }
+ else {
+ rv = APR_EGENERAL;
+@@ -1555,23 +1565,35 @@ apr_memcache_multgetp(apr_memcache_t *mc,
+ static const char *stat_read_string(apr_pool_t *p, char *buf, apr_size_t len)
+ {
+ /* remove trailing \r\n and null char */
++ if (len < 2) {
++ return apr_pstrdup(p, "");
++ }
+ return apr_pstrmemdup(p, buf, len-2);
+ }
+
+ static apr_uint32_t stat_read_uint32(apr_pool_t *p, char *buf, apr_size_t len)
+ {
++ if (len < 2) {
++ return 0;
++ }
+ buf[len-2] = '\0';
+ return atoi(buf);
+ }
+
+ static apr_uint64_t stat_read_uint64(apr_pool_t *p, char *buf, apr_size_t len)
+ {
++ if (len < 2) {
++ return 0;
++ }
+ buf[len-2] = '\0';
+ return apr_atoi64(buf);
+ }
+
+ static apr_time_t stat_read_time(apr_pool_t *p, char *buf, apr_size_t len)
+ {
++ if (len < 2) {
++ return 0;
++ }
+ buf[len-2] = '\0';
+ return apr_time_from_sec(atoi(buf));
+ }
+@@ -1583,6 +1605,9 @@ static apr_time_t stat_read_rtime(apr_pool_t *p, char *buf, apr_size_t len)
+ char *usecs;
+ const char *sep = ":.";
+
++ if (len < 2) {
++ return apr_time_make(0, 0);
++ }
+ buf[len-2] = '\0';
+
+ secs = apr_strtok(buf, sep, &tok);
diff --git a/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch
new file mode 100644
index 00000000000..844ad8109d4
--- /dev/null
+++ b/meta/recipes-support/apr/apr-util/CVE-2026-34502_p2.patch
@@ -0,0 +1,38 @@
+From 997c02ce5b9db44083c580e3e47095f5ac4524ae Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Fri, 7 Aug 2026 14:23:29 +0000
+Subject: [PATCH] fix memcache version parsing
+
+partial port of 1936966 from trunk
+
+
+git-svn-id: https://svn.apache.org/repos/asf/apr/apr-util/branches/1.6.x@1936975 13f79535-47bb-0310-9956-ffa450edef68
+
+CVE: CVE-2026-34502
+Upstream-Status: Backport [https://github.com/apache/apr-util/commit/997c02ce5b9db44083c580e3e47095f5ac4524ae]
+
+(cherry picked from commit 997c02ce5b9db44083c580e3e47095f5ac4524ae)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ memcache/apr_memcache.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/memcache/apr_memcache.c b/memcache/apr_memcache.c
+index 137be778..74146712 100644
+--- a/memcache/apr_memcache.c
++++ b/memcache/apr_memcache.c
+@@ -1092,12 +1092,12 @@ apr_memcache_version(apr_memcache_server_t *ms,
+ }
+
+ if (strncmp(MS_VERSION, conn->buffer, MS_VERSION_LEN) == 0) {
+- if (conn->blen < MS_VERSION_LEN + 2) {
++ if (conn->blen < MS_VERSION_LEN + 4) {
+ rv = APR_EGENERAL;
+ }
+ else {
+ *baton = apr_pstrmemdup(p, conn->buffer+MS_VERSION_LEN+1,
+- conn->blen - MS_VERSION_LEN - 2);
++ conn->blen - MS_VERSION_LEN - 3);
+ rv = APR_SUCCESS;
+ }
+ }
diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index 8d751e7b7a1..f694ae01eb9 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -17,6 +17,8 @@ SRC_URI = "${APACHE_MIRROR}/apr/${BPN}-${PV}.tar.gz \
file://CVE-2026-32327-dependent.patch \
file://CVE-2026-32327.patch \
file://CVE-2026-34501.patch \
+ file://CVE-2026-34502_p1.patch \
+ file://CVE-2026-34502_p2.patch \
file://run-ptest \
"
^ permalink raw reply related [flat|nested] 57+ messages in thread* [OE-core][scarthgap 55/55] util-linux: patch CVE-2026-53615
2026-10-31 0:14 [OE-core][scarthgap 00/55] Patch review Yoann Congal
` (53 preceding siblings ...)
2026-10-31 0:15 ` [OE-core][scarthgap 54/55] apr-util: Fix CVE-2026-34502 Yoann Congal
@ 2026-10-31 0:15 ` Yoann Congal
54 siblings, 0 replies; 57+ messages in thread
From: Yoann Congal @ 2026-10-31 0:15 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1] from 2.41 branch.
Resolve minor conflict with [2] (unrelated const variable).
[1] https://security-tracker.debian.org/tracker/CVE-2026-53615
[2] https://github.com/util-linux/util-linux/commit/7eba8f98bdc3ed9c0ef1c8527aa61e1a3656449c
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2026-53615.patch | 109 ++++++++++++++++++
2 files changed, 110 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index fdc8c62f6e5..66616f06527 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -63,6 +63,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2026-78410-02.patch \
file://CVE-2026-78410-03.patch \
file://CVE-2026-76642.patch \
+ file://CVE-2026-53615.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch
new file mode 100644
index 00000000000..f06f175e9c9
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-53615.patch
@@ -0,0 +1,109 @@
+From 05c2dbadf34cc74192287f377904afaaf4061623 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Wed, 25 Mar 2026 11:54:28 +0100
+Subject: [PATCH] libblkid: dos: validate EBR data and links within extended
+ partition
+
+The parse_dos_extended() function processes EBR (Extended Boot Record)
+chains, but does not properly validate that partitions and links stay
+within the master extended partition area [ex_start, ex_start+ex_size).
+
+For EBR data partitions at index 0 and 1, there are no bounds checks
+at all, unlike entries at index 2 and 3. This allows a crafted disk
+image to register partitions at arbitrary sectors via uint32_t overflow
+in the abs_start calculation (cur_start + start wraps to a small value).
+
+Fix by:
+ - using 64-bit arithmetic for the abs_start calculation to avoid
+ uint32_t wraparound
+ - applying the extended partition area bounds check to all EBR data
+ entries, not just index >= 2
+ - validating EBR link targets stay within the extended area and
+ advance forward (preventing backward links that could loop)
+
+Reported-by: Michele Piccinni <piccinni.michele@gmail.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit e9d544d013267ea86b70ee8ff78abd280e6641af)
+
+CVE: CVE-2026-53615
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/05c2dbadf34cc74192287f377904afaaf4061623]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libblkid/src/partitions/dos.c | 38 +++++++++++++++++++++++++++--------
+ 1 file changed, 30 insertions(+), 8 deletions(-)
+
+diff --git a/libblkid/src/partitions/dos.c b/libblkid/src/partitions/dos.c
+index d5a8aa3ae..5c78aac21 100644
+--- a/libblkid/src/partitions/dos.c
++++ b/libblkid/src/partitions/dos.c
+@@ -46,6 +46,7 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab,
+ {
+ blkid_partlist ls = blkid_probe_get_partlist(pr);
+ uint32_t cur_start = ex_start, cur_size = ex_size;
++ uint64_t ex_end = (uint64_t) ex_start + ex_size;
+ unsigned char *data;
+ int ct_nodata = 0; /* count ext.partitions without data partitions */
+ int i;
+@@ -88,24 +89,31 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab,
+ /* Parse data partition */
+ for (p = p0, i = 0; i < 4; i++, p++) {
+ uint32_t abs_start;
++ uint64_t abs;
+ blkid_partition par;
+
+ /* the start is relative to the parental ext.partition */
+ start = dos_partition_get_start(p) * ssf;
+ size = dos_partition_get_size(p) * ssf;
+- abs_start = cur_start + start; /* absolute start */
+
+ if (!size || is_extended(p))
+ continue;
++
++ abs = (uint64_t) cur_start + start;
++
++ /* data partition must be within the extended area */
++ if (abs < ex_start || abs + size > ex_end) {
++ DBG(LOWPROBE, ul_debug("#%d: EBR data partition outside "
++ "extended -- ignore", i + 1));
++ continue;
++ }
++ abs_start = (uint32_t) abs;
++
+ if (i >= 2) {
+- /* extra checks to detect real data on
++ /* extra check to detect real data on
+ * 3rd and 4th entries */
+ if (start + size > cur_size)
+ continue;
+- if (abs_start < ex_start)
+- continue;
+- if (abs_start + size > ex_start + ex_size)
+- continue;
+ }
+
+ /* Avoid recursive non-empty links, see ct_nodata counter */
+@@ -142,8 +150,22 @@ static int parse_dos_extended(blkid_probe pr, blkid_parttable tab,
+ if (i == 4)
+ goto leave;
+
+- cur_start = ex_start + start;
+- cur_size = size;
++ {
++ uint64_t next = (uint64_t) ex_start + start;
++
++ if (next + size > ex_end) {
++ DBG(LOWPROBE, ul_debug("EBR link outside "
++ "extended area -- leave"));
++ goto leave;
++ }
++ if (next <= cur_start) {
++ DBG(LOWPROBE, ul_debug("EBR link does not "
++ "advance -- leave"));
++ goto leave;
++ }
++ cur_start = (uint32_t) next;
++ cur_size = size;
++ }
+ }
+ leave:
+ return BLKID_PROBE_OK;
^ permalink raw reply related [flat|nested] 57+ messages in thread