Re: [OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Fri, 2026-07-31 at 17:11 -0700, Collin Funk via lists.openembedded.org wrote:
> Leonid Iziumtsev said:
> 
> > This series backports upstream fixes to coreutils 9.11 to address
> > multiple CVEs.
> > 
> > Leonid Iziumtsev (2):
> >   coreutils: fix CVE-2026-56391
> >   coreutils: fix CVE-2026-56392
> > 
> >  .../coreutils/coreutils/CVE-2026-56391.patch  | 66 +++++++++++++++++++
> >  .../coreutils/coreutils/CVE-2026-56392.patch  | 65 ++++++++++++++++++
> >  meta/recipes-core/coreutils/coreutils_9.11.bb |  2 +
> >  3 files changed, 133 insertions(+)
> >  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
> >  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch
> 
> Note that CVEs don't really have a security impact. I'm mildly annoyed
> there were assigned. It seems that Afine's entire existence as a company
> is sending LLM generated essays to maintainers, bogus a large portion of
> the time. For the others, which have dubious security implications, they
> file CVEs with exaggerations [1].
> 
> Theoretically CVE-2026-56392 could allow problematic writes to the heap,
> but that would require you to run it with untrusted slop as the input
> and as arguments. If someone can do that on your system, they have much
> better things to do.

Sadly, I suspect this is becoming all the more common and I share your
frustrations.

We have an difficult position on whether to take things or not as we
probably don't have the time/experience to tell in many cases and not
taking a CVE fix means we'd get beaten over the head with the patch for
ever more as "there is a security problem" :(.

Cheers,

Richard