[OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Collin Funk <collin.funk1@gmail.com>]

Leonid Iziumtsev said:

> This series backports upstream fixes to coreutils 9.11 to address
> multiple CVEs.
> 
> Leonid Iziumtsev (2):
>   coreutils: fix CVE-2026-56391
>   coreutils: fix CVE-2026-56392
> 
>  .../coreutils/coreutils/CVE-2026-56391.patch  | 66 +++++++++++++++++++
>  .../coreutils/coreutils/CVE-2026-56392.patch  | 65 ++++++++++++++++++
>  meta/recipes-core/coreutils/coreutils_9.11.bb |  2 +
>  3 files changed, 133 insertions(+)
>  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch
>  create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch

Note that CVEs don't really have a security impact. I'm mildly annoyed
there were assigned. It seems that Afine's entire existence as a company
is sending LLM generated essays to maintainers, bogus a large portion of
the time. For the others, which have dubious security implications, they
file CVEs with exaggerations [1].

Theoretically CVE-2026-56392 could allow problematic writes to the heap,
but that would require you to run it with untrusted slop as the input
and as arguments. If someone can do that on your system, they have much
better things to do.

Collin

[1] https://seclists.org/oss-sec/2026/q3/276