* [OE-core][scarthgap 14/33] socat: patch CVE-2026-56123
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Peter Marko <peter.marko@siemens.com>
Pick the only commit in release 1.8.1.2.
This release has a note for this CVE which was added by this commit.
Drop change in VERSION file (as we're not upgrading).
Resolve minor conflicts in CHANGES and test.sh.
Since we're not running tests, it's not worth to pick next commit from
1.8.1.3 which is fixing test on non-bash shell systems.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
[YC: project git repo seem down. A mirror is here:
https://third-party-mirror.googlesource.com/socat/+/d44cd1cc4fbb70a9ae9e71890024ae8367fcb912%5E%21/ ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../socat/files/CVE-2026-56123.patch | 150 ++++++++++++++++++
.../socat/socat_1.8.0.0.bb | 1 +
2 files changed, 151 insertions(+)
create mode 100644 meta/recipes-connectivity/socat/files/CVE-2026-56123.patch
diff --git a/meta/recipes-connectivity/socat/files/CVE-2026-56123.patch b/meta/recipes-connectivity/socat/files/CVE-2026-56123.patch
new file mode 100644
index 00000000000..e2552a74451
--- /dev/null
+++ b/meta/recipes-connectivity/socat/files/CVE-2026-56123.patch
@@ -0,0 +1,150 @@
+From d44cd1cc4fbb70a9ae9e71890024ae8367fcb912 Mon Sep 17 00:00:00 2001
+From: Gerhard Rieger <gerhard@dest-unreach.org>
+Date: Thu, 25 Jun 2026 14:55:59 +0200
+Subject: [PATCH] Version 1.8.1.2 - fixed SOCKS5 client buffer overflow
+ (CVE-2026-56123)
+
+CVE: CVE-2026-56123
+Upstream-Status: Backport [repo.or.cz/socat.git/commitdiff/d44cd1cc4fbb70a9ae9e71890024ae8367fcb912]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ CHANGES | 13 ++++++++++
+ test.sh | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ xio-socks5.h | 4 +--
+ 3 files changed, 88 insertions(+), 2 deletions(-)
+
+diff --git a/CHANGES b/CHANGES
+index ba82024..3c2f230 100644
+--- a/CHANGES
++++ b/CHANGES
+@@ -1,4 +1,17 @@
+
++Security:
++ Socat security advisory 10
++ CVE-2026-56123
++ There was a possible heap overflow in the socks5 client code. It could
++ be triggered by connecting to a malicious socks5 server that expected
++ this connection and had knowledge about details of the client binary
++ code.
++ Only builds with C signed char (vs.unsigned char) are affected.
++ Thanks to Tristan Madani for finding and reporting this issue, and for
++ conveying the process.
++ Test: SOCKS5_OVERFL
++
++
+ ####################### V 1.8.0.0
+
+ Security:
+diff --git a/test.sh b/test.sh
+index 53bbb2a..467ac57 100755
+--- a/test.sh
++++ b/test.sh
+@@ -601,6 +601,9 @@ rm -rf "$TD" || (echo "cannot rm $TD" >&2; exit 1)
+ mkdir -p "$TD"
+ #trap "rm -r $TD" 0 3
+
++BINDIR=$td/bin
++mkdir -p $BINDIR
++
+ echo "Using temp directory $TD"
+
+ case "$TESTS" in
+@@ -19217,6 +19220,76 @@ fi # NUMCOND
+ esac
+ N=$((N+1))
+
++# Above tests introduced with 1.8.1.0 (none with 1.8.1.1)
++#==============================================================================
++# Below tests introduced with 1.8.1.2
++
++
++# Test socks5 client buffer overflow (CVE-2026-56123)
++NAME=SOCKS5_OVERFL
++case "$TESTS" in
++*%$N%*|*%functions%*|*%bugs%*|*%security%*|*%socks5%*|*%socks%*|*%%*|*%%*|*%socket%*|*%$NAME%*)
++#*%internet%*|*%root%*|*%listen%*|*%fork%*|*%ip4%*|*%tcp4%*|*%bug%*|...
++TEST="$NAME: socks5 client buffer overflow"
++# Start a listener that emulates a malicious socks5 server, using a temporary
++# shell script;
++# connect using Socat with socks5 client;
++# when is terminates with rc=0 the test succeeded (not vulnerable)
++if ! eval $NUMCOND; then :
++# Check if this test can be performed meaningfully
++elif ! cond=$(checkconds \
++ "" \
++ "" \
++ "" \
++ "IP4 TCP LISTEN SHELL GOPEN SOCKS5" \
++ "TCP4-LISTEN SHELL GOPEN SOCKS5" \
++ "socksport" \
++ "tcp4" ); then
++ $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
++ cant
++else
++ mkdir -p "$BINDIR"
++ tf="$td/test$N.stdout"
++ te="$td/test$N.stderr"
++ tdiff="$td/test$N.diff"
++ tsh="$BINDIR/test$N.sh"
++ cat >"$tsh" <<__EOF__
++$ECHO -n "\\x05\\x00"
++relsleep 1
++$ECHO -n "\\x05\\x00\\x00\\x03\\xfdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
++__EOF__
++ chmod a+x "$tsh"
++ newport tcp4 # -> PORT
++ CMD0="$TRACE $SOCAT $opts TCP4-LISTEN:$PORT SHELL:$tsh"
++ CMD1="$TRACE $SOCAT $opts /dev/null SOCKS5:$LOCALHOST4:17.34.51.68:85,socksport=$PORT"
++ printf "test $F_n $TEST... " $N
++ $CMD0 >/dev/null 2>"${te}0" &
++ pid0=$!
++ waittcp4port $PORT 1
++ $CMD1 >"${tf}1" 2>"${te}1"
++ rc1=$?
++ kill $pid0 2>/dev/null; wait
++ if [ "$rc1" -ne 0 ]; then
++ $PRINTF "$FAILED (rc1=$rc1)\n"
++ echo "$CMD0 &"
++ cat "${te}0" >&2
++ echo "$CMD1"
++ cat "${te}1" >&2
++ failed
++ else
++ $PRINTF "$OK\n"
++ if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi
++ if [ "$DEBUG" ]; then cat "${te}0" >&2; fi
++ if [ "$VERBOSE" ]; then echo "$CMD1"; fi
++ if [ "$DEBUG" ]; then cat "${te}1" >&2; fi
++ ok
++ fi
++fi # NUMCOND
++ ;;
++esac
++N=$((N+1))
++
++
+ # end of common tests
+
+ ##################################################################################
+diff --git a/xio-socks5.h b/xio-socks5.h
+index 4dab76b..d4712d2 100644
+--- a/xio-socks5.h
++++ b/xio-socks5.h
+@@ -23,7 +23,7 @@ struct socks5_request {
+ uint8_t command;
+ uint8_t reserved;
+ uint8_t address_type;
+- char dstdata[];
++ unsigned char dstdata[];
+ };
+
+ struct socks5_reply {
+@@ -31,7 +31,7 @@ struct socks5_reply {
+ uint8_t reply;
+ uint8_t reserved;
+ uint8_t address_type;
+- char dstdata[];
++ unsigned char dstdata[];
+ };
+
+ extern const struct addrdesc xioaddr_socks5_connect;
diff --git a/meta/recipes-connectivity/socat/socat_1.8.0.0.bb b/meta/recipes-connectivity/socat/socat_1.8.0.0.bb
index bb39730005a..156fd590aee 100644
--- a/meta/recipes-connectivity/socat/socat_1.8.0.0.bb
+++ b/meta/recipes-connectivity/socat/socat_1.8.0.0.bb
@@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
SRC_URI = "http://www.dest-unreach.org/socat/download/socat-${PV}.tar.bz2 \
file://0001-fix-compile-procan.c-failed.patch \
file://CVE-2024-54661.patch \
+ file://CVE-2026-56123.patch \
"
SRC_URI[sha256sum] = "e1de683dd22ee0e3a6c6bbff269abe18ab0c9d7eb650204f125155b9005faca7"
^ permalink raw reply related
* [OE-core][scarthgap 17/33] gzip: fix CVE-2026-41992
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Backport upstream fix for a global buffer overflow in the LZH
decompression logic (unlzh.c). The left[] and right[] global arrays
shared across LZW and LZH decompression routines are not reinitialized
between files processed in the same invocation, allowing an
out-of-bounds read in the LZH decoder.
Adapted for gzip 1.13:
- Refreshed NEWS and THANKS hunks to match 1.13 release context.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41992
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit deaaaacabbf8d21fb9271e3f6f83055893510cff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gzip/gzip-1.13/CVE-2026-41992.patch | 64 +++++++++++++++++++
meta/recipes-extended/gzip/gzip_1.13.bb | 1 +
2 files changed, 65 insertions(+)
create mode 100644 meta/recipes-extended/gzip/gzip-1.13/CVE-2026-41992.patch
diff --git a/meta/recipes-extended/gzip/gzip-1.13/CVE-2026-41992.patch b/meta/recipes-extended/gzip/gzip-1.13/CVE-2026-41992.patch
new file mode 100644
index 00000000000..4db9a1c1afd
--- /dev/null
+++ b/meta/recipes-extended/gzip/gzip-1.13/CVE-2026-41992.patch
@@ -0,0 +1,64 @@
+From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Wed, 15 Apr 2026 12:00:17 -0700
+Subject: =?UTF-8?q?gzip:=20don=E2=80=99t=20mishandle=20.lzh=20after=20.Z?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* unlzh.c (read_c_len): Clear left and right when n == 0.
+
+CVE: CVE-2026-41992
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ NEWS | 4 ++++
+ THANKS | 1 +
+ unlzh.c | 6 ++++++
+ 3 files changed, 11 insertions(+)
+
+diff --git a/NEWS b/NEWS
+index bdb7cc0..af2a08f 100644
+--- a/NEWS
++++ b/NEWS
+@@ -14,6 +14,10 @@ GNU gzip NEWS -*- outline -*-
+
+ ** Bug fixes
+
++ A buffer overflow has been fixed when decompressing an .lzh file
++ after decompressing a .Z file.
++ [bug present since the beginning]
++
+ 'gzip -d' no longer fails to report invalid compressed data
+ that uses a dictionary distance outside the input window.
+ [bug present since the beginning]
+diff --git a/THANKS b/THANKS
+index 4e545d9..a7d25e4 100644
+--- a/THANKS
++++ b/THANKS
+@@ -186,6 +186,7 @@ Jamie Lokier u90jl@ecs.oxford.ac.uk
+ Richard Lloyd R.K.Lloyd@csc.liv.ac.uk
+ David J. MacKenzie djm@eng.umd.edu
+ John R MacMillan john@chance.gts.org
++Michał Majchrowicz mmajchrowicz@afine.com
+ Ron Male male@eso.mc.xerox.com
+ Jakub Martisko jamartis@redhat.com
+ Don R. Maszle maze@bea.lbl.gov
+diff --git a/unlzh.c b/unlzh.c
+index 3320196..a6cf109 100644
+--- a/unlzh.c
++++ b/unlzh.c
+@@ -232,6 +232,12 @@ read_c_len ()
+ c = getbits(CBIT);
+ for (i = 0; i < NC; i++) c_len[i] = 0;
+ for (i = 0; i < 4096; i++) c_table[i] = c;
++
++ /* Needed in case LEFT and RIGHT are reused from a previous
++ LZW decompression. It may be overkill to clear all of both
++ arrays, but nobody has had time to analyze this carefully. */
++ memzero(left, (2 * NC - 1) * sizeof *left);
++ memzero(right, (2 * NC - 1) * sizeof *left);
+ } else {
+ i = 0;
+ while (i < n) {
diff --git a/meta/recipes-extended/gzip/gzip_1.13.bb b/meta/recipes-extended/gzip/gzip_1.13.bb
index fd846b30a55..208220867a6 100644
--- a/meta/recipes-extended/gzip/gzip_1.13.bb
+++ b/meta/recipes-extended/gzip/gzip_1.13.bb
@@ -6,6 +6,7 @@ LICENSE = "GPL-3.0-or-later"
SRC_URI = "${GNU_MIRROR}/gzip/${BP}.tar.gz \
file://run-ptest \
+ file://CVE-2026-41992.patch \
"
SRC_URI:append:class-target = " file://wrong-path-fix.patch"
^ permalink raw reply related
* [OE-core][scarthgap 16/33] rootfs: move tasks using image_list_installed_packages to postuninstall
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Peter Marko <peter.marko@siemens.com>
Since some packages can be uninstalled, any task querying installed
packages should be run only after both installation and uninstallation
is completed.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: c3097962ac925538e99b17b771c541950a8b8c26)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes-recipe/license_image.bbclass | 2 +-
meta/classes/vex.bbclass | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/classes-recipe/license_image.bbclass b/meta/classes-recipe/license_image.bbclass
index b18a64d2bc3..e934c74d246 100644
--- a/meta/classes-recipe/license_image.bbclass
+++ b/meta/classes-recipe/license_image.bbclass
@@ -294,7 +294,7 @@ def get_deployed_files(man_file):
dep_files.append(os.path.basename(f))
return dep_files
-ROOTFS_POSTPROCESS_COMMAND:prepend = "write_package_manifest license_create_manifest "
+ROOTFS_POSTUNINSTALL_COMMAND:prepend = "write_package_manifest license_create_manifest "
do_rootfs[recrdeptask] += "do_populate_lic"
python do_populate_lic_deploy() {
diff --git a/meta/classes/vex.bbclass b/meta/classes/vex.bbclass
index eac68ca6289..97213ea3497 100644
--- a/meta/classes/vex.bbclass
+++ b/meta/classes/vex.bbclass
@@ -229,7 +229,7 @@ python vex_write_rootfs_manifest () {
bb.plain("Image VEX JSON report stored in: %s" % manifest_name)
}
-ROOTFS_POSTPROCESS_COMMAND:prepend = "vex_write_rootfs_manifest "
+ROOTFS_POSTUNINSTALL_COMMAND:prepend = "vex_write_rootfs_manifest "
do_rootfs[recrdeptask] += "do_generate_vex "
do_populate_sdk[recrdeptask] += "do_generate_vex "
^ permalink raw reply related
* [OE-core][scarthgap 13/33] dropbear: Disable DSS correctly
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Mike Crowe <mac@mcrowe.com>
Take upstream patch that stops sysoptions.h unconditionally turning
DROPBEAR_DSS back on even when it has been disabled (which is the
default).
Signed-off-by: Mike Crowe <mac@mcrowe.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 30 +++++++++++++++++++
.../recipes-core/dropbear/dropbear_2022.83.bb | 1 +
2 files changed, 31 insertions(+)
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
diff --git a/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
new file mode 100644
index 00000000000..250cbb7a6f0
--- /dev/null
+++ b/meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
@@ -0,0 +1,30 @@
+From c7dfaebd5f6a4cde4198f4d2a7baabaa1f632274 Mon Sep 17 00:00:00 2001
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Tue, 6 Dec 2022 22:34:11 +0800
+Subject: [PATCH] Fix so DROPBEAR_DSS is only forced for fuzzing
+
+Regression from 787391ea3b5af2acf5e3c83372510f0c79477ad7,
+was missing fuzzing conditional
+
+Upstream-Status: Backport [https://github.com/mkj/dropbear/commit/c043efb47c3173072fa636ca0da0d19875d4511f]
+Signed-off-by: Mike Crowe <mac@mcrowe.com>
+---
+ sysoptions.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sysoptions.h b/sysoptions.h
+index fb6adc7..12db59c 100644
+--- a/sysoptions.h
++++ b/sysoptions.h
+@@ -383,9 +383,11 @@
+ #endif
+
+ /* Fuzzing expects all key types to be enabled */
++#if DROPBEAR_FUZZ
+ #if defined(DROPBEAR_DSS)
+ #undef DROPBEAR_DSS
+ #endif
+ #define DROPBEAR_DSS 1
++#endif
+
+ /* no include guard for this file */
diff --git a/meta/recipes-core/dropbear/dropbear_2022.83.bb b/meta/recipes-core/dropbear/dropbear_2022.83.bb
index 93563aa3b47..d203fee34b3 100644
--- a/meta/recipes-core/dropbear/dropbear_2022.83.bb
+++ b/meta/recipes-core/dropbear/dropbear_2022.83.bb
@@ -28,6 +28,7 @@ SRC_URI = "http://matt.ucc.asn.au/dropbear/releases/dropbear-${PV}.tar.bz2 \
file://0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch \
file://0001-cli-runopts.c-add-missing-DROPBEAR_CLI_PUBKEY_AUTH.patch \
file://0001-Avoid-unused-variable-with-DROPBEAR_CLI_PUBKEY_AUTH-.patch \
+ file://0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch \
file://CVE-2025-47203.patch \
file://CVE-2019-6111.patch \
"
^ permalink raw reply related
* [OE-core][scarthgap 15/33] vex: remove obsolete semicolon
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Peter Marko <peter.marko@siemens.com>
Usage of semicolon as separator in ROOTFS/IMAGE_*COMMAND was deprecated
long time ago.
Remove it.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 311d418d22a609fb54b87bfc909bdd1861892228)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes/vex.bbclass | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/classes/vex.bbclass b/meta/classes/vex.bbclass
index 45a15348724..eac68ca6289 100644
--- a/meta/classes/vex.bbclass
+++ b/meta/classes/vex.bbclass
@@ -229,7 +229,7 @@ python vex_write_rootfs_manifest () {
bb.plain("Image VEX JSON report stored in: %s" % manifest_name)
}
-ROOTFS_POSTPROCESS_COMMAND:prepend = "vex_write_rootfs_manifest; "
+ROOTFS_POSTPROCESS_COMMAND:prepend = "vex_write_rootfs_manifest "
do_rootfs[recrdeptask] += "do_generate_vex "
do_populate_sdk[recrdeptask] += "do_generate_vex "
^ permalink raw reply related
* [OE-core][scarthgap 21/33] expat: patch CVE-2026-45186
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Theo Gaige <tgaige.opensource@witekio.com>
Backport patches from [1] also mentioned in [2].
[1] https://github.com/libexpat/libexpat/pull/1216
[2] https://security-tracker.debian.org/tracker/CVE-2026-45186
Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
Reviewed-by: Bruno Vernay <bruno.vernay@se.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-45186-01.patch | 70 ++++
.../expat/expat/CVE-2026-45186-02.patch | 318 ++++++++++++++++++
.../expat/expat/CVE-2026-45186-03.patch | 46 +++
.../expat/expat/CVE-2026-45186-04.patch | 32 ++
.../expat/expat/CVE-2026-45186-05.patch | 32 ++
.../expat/expat/CVE-2026-45186-06.patch | 87 +++++
.../expat/expat/CVE-2026-45186-07.patch | 52 +++
meta/recipes-core/expat/expat_2.6.4.bb | 7 +
8 files changed, 644 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-03.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-04.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-05.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-06.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-07.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-45186-01.patch b/meta/recipes-core/expat/expat/CVE-2026-45186-01.patch
new file mode 100644
index 00000000000..787006c0fdb
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-45186-01.patch
@@ -0,0 +1,70 @@
+From 3020144133b2d860c44f4eeacf72e5f2843235a3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Berkay=20Eren=20=C3=9Cr=C3=BCn?= <berkay.ueruen@siemens.com>
+Date: Fri, 13 Mar 2026 13:26:45 +0100
+Subject: [PATCH 1/7] Make "counting_start_element_handler" count default attrs
+
+(cherry picked from commit 0802a5892030610144b736dec6e2f63e8600fe85)
+
+CVE: CVE-2026-45186
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1216/commits/0802a5892030610144b736dec6e2f63e8600fe85]
+Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
+---
+ tests/basic_tests.c | 8 ++++----
+ tests/handlers.c | 2 +-
+ tests/handlers.h | 1 +
+ 3 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/tests/basic_tests.c b/tests/basic_tests.c
+index 023d9ce..d6edb16 100644
+--- a/tests/basic_tests.c
++++ b/tests/basic_tests.c
+@@ -2439,9 +2439,9 @@ START_TEST(test_attributes) {
+ {XCS("id"), XCS("one")},
+ {NULL, NULL}};
+ AttrInfo tag_info[] = {{XCS("c"), XCS("3")}, {NULL, NULL}};
+- ElementInfo info[] = {{XCS("doc"), 3, XCS("id"), NULL},
+- {XCS("tag"), 1, NULL, NULL},
+- {NULL, 0, NULL, NULL}};
++ ElementInfo info[] = {{XCS("doc"), 3, 0, XCS("id"), NULL},
++ {XCS("tag"), 1, 0, NULL, NULL},
++ {NULL, 0, 0, NULL, NULL}};
+ info[0].attributes = doc_info;
+ info[1].attributes = tag_info;
+
+@@ -5496,7 +5496,7 @@ START_TEST(test_deep_nested_attribute_entity) {
+ (long unsigned)(N_LINES - 1));
+
+ AttrInfo doc_info[] = {{XCS("name"), XCS("deepText")}, {NULL, NULL}};
+- ElementInfo info[] = {{XCS("foo"), 1, NULL, NULL}, {NULL, 0, NULL, NULL}};
++ ElementInfo info[] = {{XCS("foo"), 1, 0, NULL, NULL}, {NULL, 0, 0, NULL, NULL}};
+ info[0].attributes = doc_info;
+
+ XML_Parser parser = XML_ParserCreate(NULL);
+diff --git a/tests/handlers.c b/tests/handlers.c
+index e658223..9ff7b35 100644
+--- a/tests/handlers.c
++++ b/tests/handlers.c
+@@ -137,7 +137,7 @@ counting_start_element_handler(void *userData, const XML_Char *name,
+ fail("ID does not have the correct name");
+ return;
+ }
+- for (i = 0; i < info->attr_count; i++) {
++ for (i = 0; i < info->attr_count + info->default_attr_count; i++) {
+ attr = info->attributes;
+ while (attr->name != NULL) {
+ if (! xcstrcmp(atts[0], attr->name))
+diff --git a/tests/handlers.h b/tests/handlers.h
+index ac4ca94..11d45eb 100644
+--- a/tests/handlers.h
++++ b/tests/handlers.h
+@@ -88,6 +88,7 @@ typedef struct attrInfo {
+ typedef struct elementInfo {
+ const XML_Char *name;
+ int attr_count;
++ int default_attr_count;
+ const XML_Char *id_name;
+ AttrInfo *attributes;
+ } ElementInfo;
+--
+2.43.0
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-45186-02.patch b/meta/recipes-core/expat/expat/CVE-2026-45186-02.patch
new file mode 100644
index 00000000000..fef531a4392
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-45186-02.patch
@@ -0,0 +1,318 @@
+From ba12af3b3ffd98b9e31c3a01a20d392c89aa974e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Berkay=20Eren=20=C3=9Cr=C3=BCn?= <berkay.ueruen@siemens.com>
+Date: Fri, 13 Mar 2026 13:27:31 +0100
+Subject: [PATCH 2/7] test(attlist): Cover duplicate attribute names
+
+Co-authored-by: Sebastian Pipping <sebastian@pipping.org>
+(cherry picked from commit e569f47181c43dca5d262089e541ddf9a9c09927)
+
+CVE: CVE-2026-45186
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1216/commits/e569f47181c43dca5d262089e541ddf9a9c09927]
+Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
+---
+ tests/basic_tests.c | 282 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 282 insertions(+)
+
+diff --git a/tests/basic_tests.c b/tests/basic_tests.c
+index d6edb16..907a458 100644
+--- a/tests/basic_tests.c
++++ b/tests/basic_tests.c
+@@ -2462,6 +2462,279 @@ START_TEST(test_attributes) {
+ }
+ END_TEST
+
++START_TEST(test_duplicate_cdata_attribute) {
++ /*
++ https://www.w3.org/TR/xml/#attdecls
++
++ Test the following statement from the linked specification:
++ When more than one definition is provided for the same attribute of a given
++ element type, the first declaration is binding and later declarations are
++ ignored.
++ */
++
++ const char *text
++ = "<!DOCTYPE doc [\n"
++ " <!ATTLIST doc attribute CDATA 'expected' attribute CDATA 'ignored'>\n"
++ "]>\n"
++ "<doc/>\n";
++ AttrInfo doc_info[] = {{XCS("attribute"), XCS("expected")}, {NULL, NULL}};
++ ElementInfo info[]
++ = {{XCS("doc"), 0, 1, NULL, doc_info}, {NULL, 0, 0, NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ assert_true(parser != NULL);
++
++ ParserAndElementInfo parserAndElementInfos = {
++ parser,
++ info,
++ };
++
++ XML_SetStartElementHandler(parser, counting_start_element_handler);
++ XML_SetUserData(parser, &parserAndElementInfos);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ != XML_STATUS_OK)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
++START_TEST(test_duplicate_id_attribute_1) {
++ /*
++ https://www.w3.org/TR/xml/#attdecls
++
++ Test the following statement from the linked specification:
++ When more than one definition is provided for the same attribute of a given
++ element type, the first declaration is binding and later declarations are
++ ignored.
++ */
++
++ const char *text
++ = "<!DOCTYPE doc [\n"
++ " <!ATTLIST doc identifier CDATA 'expected' identifier ID #REQUIRED>\n"
++ "]>\n"
++ "<doc/>\n";
++ AttrInfo doc_info[] = {{XCS("identifier"), XCS("expected")}, {NULL, NULL}};
++ ElementInfo info[]
++ = {{XCS("doc"), 0, 1, NULL, doc_info}, {NULL, 0, 0, NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ assert_true(parser != NULL);
++
++ ParserAndElementInfo parserAndElementInfos = {
++ parser,
++ info,
++ };
++
++ XML_SetStartElementHandler(parser, counting_start_element_handler);
++ XML_SetUserData(parser, &parserAndElementInfos);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ != XML_STATUS_OK)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
++START_TEST(test_duplicate_id_attribute_2) {
++ /*
++ https://www.w3.org/TR/xml/#attdecls
++
++ Test the following statement from the linked specification:
++ When more than one definition is provided for the same attribute of a given
++ element type, the first declaration is binding and later declarations are
++ ignored.
++ */
++
++ const char *text
++ = "<!DOCTYPE doc [\n"
++ " <!ATTLIST doc identifier ID #REQUIRED identifier CDATA 'unexpected'>\n"
++ "]>\n"
++ "<doc/>\n";
++ AttrInfo doc_info[] = {{NULL, NULL}};
++
++ ElementInfo info[]
++ = {{XCS("doc"), 0, 0, NULL, doc_info}, {NULL, 0, 0, NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ assert_true(parser != NULL);
++
++ ParserAndElementInfo parserAndElementInfos = {
++ parser,
++ info,
++ };
++
++ XML_SetStartElementHandler(parser, counting_start_element_handler);
++ XML_SetUserData(parser, &parserAndElementInfos);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ != XML_STATUS_OK)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
++START_TEST(test_duplicate_cdata_attribute_multiple_attlistdecl) {
++ /*
++ https://www.w3.org/TR/xml/#attdecls
++
++ Test the following statement from the linked specification:
++ When more than one AttlistDecl is provided for a given element type,
++ the contents of all those provided are merged.
++ */
++ const char *text = "<!DOCTYPE doc [\n"
++ " <!ATTLIST doc attribute CDATA 'expected'>\n"
++ " <!ATTLIST doc attribute CDATA 'ignored'>\n"
++ "]>\n"
++ "<doc/>\n";
++ AttrInfo doc_info[] = {{XCS("attribute"), XCS("expected")}, {NULL, NULL}};
++ ElementInfo info[]
++ = {{XCS("doc"), 0, 1, NULL, doc_info}, {NULL, 0, 0, NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ assert_true(parser != NULL);
++
++ ParserAndElementInfo parserAndElementInfos = {
++ parser,
++ info,
++ };
++
++ XML_SetStartElementHandler(parser, counting_start_element_handler);
++ XML_SetUserData(parser, &parserAndElementInfos);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ != XML_STATUS_OK)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
++START_TEST(test_duplicate_cdata_attribute_multiple_attlistdecl_2) {
++ /*
++ https://www.w3.org/TR/xml/#attdecls
++
++ Test the following statement from the linked specification:
++ When more than one AttlistDecl is provided for a given element type,
++ the contents of all those provided are merged.
++ */
++ const char *text = "<!DOCTYPE doc [\n"
++ " <!ATTLIST doc attribute CDATA 'expected_doc'>\n"
++ " <!ATTLIST tag attribute CDATA 'expected_tag'>\n"
++ " <!ATTLIST doc attribute CDATA 'ignored_doc'>\n"
++ "]>\n"
++ "<doc><tag></tag></doc>\n";
++ AttrInfo doc_info[] = {{XCS("attribute"), XCS("expected_doc")}, {NULL, NULL}};
++ AttrInfo tag_info[] = {{XCS("attribute"), XCS("expected_tag")}, {NULL, NULL}};
++ ElementInfo info[] = {{XCS("doc"), 0, 1, NULL, doc_info},
++ {XCS("tag"), 0, 1, NULL, tag_info},
++ {NULL, 0, 0, NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ assert_true(parser != NULL);
++
++ ParserAndElementInfo parserAndElementInfos = {
++ parser,
++ info,
++ };
++
++ XML_SetStartElementHandler(parser, counting_start_element_handler);
++ XML_SetUserData(parser, &parserAndElementInfos);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ != XML_STATUS_OK)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
++START_TEST(test_duplicate_cdata_attribute_multiple_attlistdecl_3) {
++ /*
++ https://www.w3.org/TR/xml/#attdecls
++
++ Test the following statement from the linked specification:
++ When more than one AttlistDecl is provided for a given element type,
++ the contents of all those provided are merged.
++ */
++ const char *text
++ = "<!DOCTYPE doc [\n"
++ " <!ATTLIST doc attribute CDATA 'expected_doc'>\n"
++ " <!ATTLIST tag attribute CDATA 'expected_tag'>\n"
++ " <!ATTLIST doc second_attribute CDATA 'second_expected_doc' attribute CDATA 'ignored_doc'>\n"
++ "]>\n"
++ "<doc><tag></tag></doc>\n";
++ AttrInfo doc_info[] = {{XCS("attribute"), XCS("expected_doc")},
++ {XCS("second_attribute"), XCS("second_expected_doc")},
++ {NULL, NULL}};
++ AttrInfo tag_info[] = {{XCS("attribute"), XCS("expected_tag")}, {NULL, NULL}};
++ ElementInfo info[] = {{XCS("doc"), 0, 2, NULL, doc_info},
++ {XCS("tag"), 0, 1, NULL, tag_info},
++ {NULL, 0, 0, NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ assert_true(parser != NULL);
++
++ ParserAndElementInfo parserAndElementInfos = {
++ parser,
++ info,
++ };
++
++ XML_SetStartElementHandler(parser, counting_start_element_handler);
++ XML_SetUserData(parser, &parserAndElementInfos);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ != XML_STATUS_OK)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
++START_TEST(test_duplicate_id_attribute_multiple_attlistdecl) {
++ /*
++ https://www.w3.org/TR/xml/#attdecls
++
++ Test the following statement from the linked specification:
++ When more than one AttlistDecl is provided for a given element type,
++ the contents of all those provided are merged.
++ */
++ const char *text = "<!DOCTYPE doc [\n"
++ " <!ATTLIST doc identifier ID #REQUIRED>\n"
++ " <!ATTLIST tag identifier CDATA 'identifier_tag'>\n"
++ " <!ATTLIST doc identifier CDATA 'ignored'>\n"
++ "]>\n"
++ "<doc identifier='doc_identity'><tag></tag></doc>\n";
++ AttrInfo doc_info[]
++ = {{XCS("identifier"), XCS("doc_identity")}, {NULL, NULL}};
++ AttrInfo tag_info[]
++ = {{XCS("identifier"), XCS("identifier_tag")}, {NULL, NULL}};
++ ElementInfo info[] = {{XCS("doc"), 1, 0, XCS("identifier"), doc_info},
++ {XCS("tag"), 0, 1, NULL, tag_info},
++ {NULL, 0, 0, NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ assert_true(parser != NULL);
++
++ ParserAndElementInfo parserAndElementInfos = {
++ parser,
++ info,
++ };
++
++ XML_SetStartElementHandler(parser, counting_start_element_handler);
++ XML_SetUserData(parser, &parserAndElementInfos);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ != XML_STATUS_OK)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ /* Test reset works correctly in the middle of processing an internal
+ * entity. Exercises some obscure code in XML_ParserReset().
+ */
+@@ -6325,6 +6598,15 @@ make_basic_test_case(Suite *s) {
+ tcase_add_test__ifdef_xml_dtd(tc_basic, test_empty_foreign_dtd);
+ tcase_add_test(tc_basic, test_set_base);
+ tcase_add_test(tc_basic, test_attributes);
++ tcase_add_test(tc_basic, test_duplicate_cdata_attribute);
++ tcase_add_test(tc_basic, test_duplicate_id_attribute_1);
++ tcase_add_test(tc_basic, test_duplicate_id_attribute_2);
++ tcase_add_test(tc_basic, test_duplicate_cdata_attribute_multiple_attlistdecl);
++ tcase_add_test(tc_basic,
++ test_duplicate_cdata_attribute_multiple_attlistdecl_2);
++ tcase_add_test(tc_basic,
++ test_duplicate_cdata_attribute_multiple_attlistdecl_3);
++ tcase_add_test(tc_basic, test_duplicate_id_attribute_multiple_attlistdecl);
+ tcase_add_test__if_xml_ge(tc_basic, test_reset_in_entity);
+ tcase_add_test(tc_basic, test_resume_invalid_parse);
+ tcase_add_test(tc_basic, test_resume_resuspended);
+--
+2.43.0
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-45186-03.patch b/meta/recipes-core/expat/expat/CVE-2026-45186-03.patch
new file mode 100644
index 00000000000..2afe6dbebc4
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-45186-03.patch
@@ -0,0 +1,46 @@
+From 852ab610685b45c62017556c38096d941c154963 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Mon, 20 Apr 2026 13:44:43 +0200
+Subject: [PATCH 3/7] tests: Define .attributes the first time around
+
+(cherry picked from commit 05307d352a5aa858cdda57ec53a53b597b3a4a82)
+
+CVE: CVE-2026-45186
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1216/commits/05307d352a5aa858cdda57ec53a53b597b3a4a82]
+Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
+---
+ tests/basic_tests.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/tests/basic_tests.c b/tests/basic_tests.c
+index 907a458..b0178fc 100644
+--- a/tests/basic_tests.c
++++ b/tests/basic_tests.c
+@@ -2439,11 +2439,9 @@ START_TEST(test_attributes) {
+ {XCS("id"), XCS("one")},
+ {NULL, NULL}};
+ AttrInfo tag_info[] = {{XCS("c"), XCS("3")}, {NULL, NULL}};
+- ElementInfo info[] = {{XCS("doc"), 3, 0, XCS("id"), NULL},
+- {XCS("tag"), 1, 0, NULL, NULL},
++ ElementInfo info[] = {{XCS("doc"), 3, 0, XCS("id"), doc_info},
++ {XCS("tag"), 1, 0, NULL, tag_info},
+ {NULL, 0, 0, NULL, NULL}};
+- info[0].attributes = doc_info;
+- info[1].attributes = tag_info;
+
+ XML_Parser parser = XML_ParserCreate(NULL);
+ assert_true(parser != NULL);
+@@ -5769,8 +5767,8 @@ START_TEST(test_deep_nested_attribute_entity) {
+ (long unsigned)(N_LINES - 1));
+
+ AttrInfo doc_info[] = {{XCS("name"), XCS("deepText")}, {NULL, NULL}};
+- ElementInfo info[] = {{XCS("foo"), 1, 0, NULL, NULL}, {NULL, 0, 0, NULL, NULL}};
+- info[0].attributes = doc_info;
++ ElementInfo info[]
++ = {{XCS("foo"), 1, 0, NULL, doc_info}, {NULL, 0, 0, NULL, NULL}};
+
+ XML_Parser parser = XML_ParserCreate(NULL);
+ ParserAndElementInfo parserPlusElemenInfo = {parser, info};
+--
+2.43.0
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-45186-04.patch b/meta/recipes-core/expat/expat/CVE-2026-45186-04.patch
new file mode 100644
index 00000000000..f4c7733c70d
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-45186-04.patch
@@ -0,0 +1,32 @@
+From 89c6acdcd919b64014b180fadec46b0d25760832 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Mon, 13 Apr 2026 01:34:03 +0200
+Subject: [PATCH 4/7] tests: Make counting_start_element_handler enforce
+ complete attribute lists
+
+(cherry picked from commit 4176aff73840711060913e0ac6aa1168d8ba5c8d)
+
+CVE: CVE-2026-45186
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1216/commits/4176aff73840711060913e0ac6aa1168d8ba5c8d]
+Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
+---
+ tests/handlers.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/handlers.c b/tests/handlers.c
+index 9ff7b35..5e72e8b 100644
+--- a/tests/handlers.c
++++ b/tests/handlers.c
+@@ -155,6 +155,9 @@ counting_start_element_handler(void *userData, const XML_Char *name,
+ /* Remember, two entries in atts per attribute (see above) */
+ atts += 2;
+ }
++
++ // Self-test that the test case's list of expected attributes is complete
++ assert_true(atts[0] == NULL);
+ }
+
+ void XMLCALL
+--
+2.43.0
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-45186-05.patch b/meta/recipes-core/expat/expat/CVE-2026-45186-05.patch
new file mode 100644
index 00000000000..480f941cb6f
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-45186-05.patch
@@ -0,0 +1,32 @@
+From d352c83afaa3945c964aba74cb60a00822af96d3 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 8 Mar 2026 22:14:41 +0100
+Subject: [PATCH 5/7] lib: Extract a constant for upcoming reuse
+
+(cherry picked from commit fb35f2d2040d114f355bae8a7450942533237530)
+
+CVE: CVE-2026-45186
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1216/commits/fb35f2d2040d114f355bae8a7450942533237530]
+Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
+---
+ lib/xmlparse.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 9bc67f3..8d3e8db 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7708,8 +7708,9 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
+ newE->prefix = (PREFIX *)lookup(oldParser, &(newDtd->prefixes),
+ oldE->prefix->name, 0);
+ for (i = 0; i < newE->nDefaultAtts; i++) {
++ const XML_Char *const attributeName = oldE->defaultAtts[i].id->name;
+ newE->defaultAtts[i].id = (ATTRIBUTE_ID *)lookup(
+- oldParser, &(newDtd->attributeIds), oldE->defaultAtts[i].id->name, 0);
++ oldParser, &(newDtd->attributeIds), attributeName, 0);
+ newE->defaultAtts[i].isCdata = oldE->defaultAtts[i].isCdata;
+ if (oldE->defaultAtts[i].value) {
+ newE->defaultAtts[i].value
+--
+2.43.0
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-45186-06.patch b/meta/recipes-core/expat/expat/CVE-2026-45186-06.patch
new file mode 100644
index 00000000000..d39eb91f2f1
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-45186-06.patch
@@ -0,0 +1,87 @@
+From a2c8ddb3d6f4df7af64e05bed4b3a4edeae33fd0 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 8 Mar 2026 23:05:49 +0100
+Subject: [PATCH 6/7] lib: Introduce ELEMENT_TYPE.defaultAttsNames
+
+(cherry picked from commit 7f0f1b9e70d937072d2e9e37ae9edf27784cc080)
+
+CVE: CVE-2026-45186
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1216/commits/7f0f1b9e70d937072d2e9e37ae9edf27784cc080]
+Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
+---
+ lib/xmlparse.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 8d3e8db..4a29c18 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -388,6 +388,7 @@ typedef struct {
+ int nDefaultAtts;
+ int allocDefaultAtts;
+ DEFAULT_ATTRIBUTE *defaultAtts;
++ HASH_TABLE defaultAttsNames;
+ } ELEMENT_TYPE;
+
+ typedef struct {
+@@ -3844,6 +3845,8 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ sizeof(ELEMENT_TYPE));
+ if (! elementType)
+ return XML_ERROR_NO_MEMORY;
++ if (! elementType->defaultAttsNames.parser)
++ hashTableInit(&(elementType->defaultAttsNames), parser);
+ if (parser->m_ns && ! setElementTypePrefix(parser, elementType))
+ return XML_ERROR_NO_MEMORY;
+ }
+@@ -7549,6 +7552,7 @@ dtdReset(DTD *p, XML_Parser parser) {
+ ELEMENT_TYPE *e = (ELEMENT_TYPE *)hashTableIterNext(&iter);
+ if (! e)
+ break;
++ hashTableDestroy(&(e->defaultAttsNames));
+ if (e->allocDefaultAtts != 0)
+ FREE(parser, e->defaultAtts);
+ }
+@@ -7590,6 +7594,7 @@ dtdDestroy(DTD *p, XML_Bool isDocEntity, XML_Parser parser) {
+ ELEMENT_TYPE *e = (ELEMENT_TYPE *)hashTableIterNext(&iter);
+ if (! e)
+ break;
++ hashTableDestroy(&(e->defaultAttsNames));
+ if (e->allocDefaultAtts != 0)
+ FREE(parser, e->defaultAtts);
+ }
+@@ -7683,6 +7688,10 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
+ sizeof(ELEMENT_TYPE));
+ if (! newE)
+ return 0;
++
++ if (! newE->defaultAttsNames.parser)
++ hashTableInit(&(newE->defaultAttsNames), parser);
++
+ if (oldE->nDefaultAtts) {
+ /* Detect and prevent integer overflow.
+ * The preprocessor guard addresses the "always false" warning
+@@ -7719,6 +7728,12 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
+ return 0;
+ } else
+ newE->defaultAtts[i].value = NULL;
++
++ NAMED *const nameAddedOrFound = (NAMED *)lookup(
++ parser, &(newE->defaultAttsNames), attributeName, sizeof(NAMED));
++ if (! nameAddedOrFound) {
++ return 0;
++ }
+ }
+ }
+
+@@ -8458,6 +8473,8 @@ getElementType(XML_Parser parser, const ENCODING *enc, const char *ptr,
+ sizeof(ELEMENT_TYPE));
+ if (! ret)
+ return NULL;
++ if (! ret->defaultAttsNames.parser)
++ hashTableInit(&(ret->defaultAttsNames), getRootParserOf(parser, NULL));
+ if (ret->name != name)
+ poolDiscard(&dtd->pool);
+ else {
+--
+2.43.0
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-45186-07.patch b/meta/recipes-core/expat/expat/CVE-2026-45186-07.patch
new file mode 100644
index 00000000000..26c829b5220
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-45186-07.patch
@@ -0,0 +1,52 @@
+From 0e4829f4be500ce687b37ec82f9650b86c8419c7 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 8 Mar 2026 23:06:29 +0100
+Subject: [PATCH 7/7] lib: Leverage ELEMENT_TYPE.defaultAttsNames for attribute
+ collision detection
+
+.. to resolve quadratic runtime behavior
+
+(cherry picked from commit 4cd4eb0683e04cd45a2ffc81a08ca2a2663994b5)
+
+CVE: CVE-2026-45186
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1216/commits/4cd4eb0683e04cd45a2ffc81a08ca2a2663994b5]
+Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com>
+---
+ lib/xmlparse.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 4a29c18..b3f0b73 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -7177,10 +7177,10 @@ defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata,
+ if (value || isId) {
+ /* The handling of default attributes gets messed up if we have
+ a default which duplicates a non-default. */
+- int i;
+- for (i = 0; i < type->nDefaultAtts; i++)
+- if (attId == type->defaultAtts[i].id)
+- return 1;
++ NAMED *const nameFound
++ = (NAMED *)lookup(parser, &(type->defaultAttsNames), attId->name, 0);
++ if (nameFound)
++ return 1;
+ if (isId && ! type->idAtt && ! attId->xmlns)
+ type->idAtt = attId;
+ }
+@@ -7227,6 +7227,12 @@ defineAttribute(ELEMENT_TYPE *type, ATTRIBUTE_ID *attId, XML_Bool isCdata,
+ att->isCdata = isCdata;
+ if (! isCdata)
+ attId->maybeTokenized = XML_TRUE;
++
++ NAMED *const nameAddedOrFound = (NAMED *)lookup(
++ parser, &(type->defaultAttsNames), attId->name, sizeof(NAMED));
++ if (! nameAddedOrFound)
++ return 0;
++
+ type->nDefaultAtts += 1;
+ return 1;
+ }
+--
+2.43.0
+
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index f5c3e3fdd2f..3581d94fac4 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -54,6 +54,13 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-41080-01.patch \
file://CVE-2026-41080-02.patch \
file://CVE-2026-41080-03.patch \
+ file://CVE-2026-45186-01.patch \
+ file://CVE-2026-45186-02.patch \
+ file://CVE-2026-45186-03.patch \
+ file://CVE-2026-45186-04.patch \
+ file://CVE-2026-45186-05.patch \
+ file://CVE-2026-45186-06.patch \
+ file://CVE-2026-45186-07.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related
* [OE-core][scarthgap 20/33] expat: patch CVE-2026-41080
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Peter Marko <peter.marko@siemens.com>
Pick github PR [1] mentioned in [2].
* 969af8f4654ce50d837bb9199a73d1d02d2c7e16..4ba09dc471b39a78d77e5179d0243186c0c4ff7a
* dropped code which doesn't exist in 2.6.4 yet (github actions, map
file)
* resolved minor conflicts (formatting)
* picked 2 additional commits to apply the code cleanly
[1] https://github.com/libexpat/libexpat/pull/1183
[2] https://security-tracker.debian.org/tracker/CVE-2026-41080
Signed-off-by: Peter Marko <peter.marko@siemens.com>
[YC: See discussion :
https://lore.kernel.org/openembedded-core/2030b4435c8bc81bb4452637c0517ac33ab94d20.camel@pbarker.dev/T/#m56c5da4033c2f3571027c2745431178064ea1b5d ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-41080-01.patch | 50 ++
.../expat/expat/CVE-2026-41080-02.patch | 29 ++
.../expat/expat/CVE-2026-41080-03.patch | 467 ++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 3 +
4 files changed, 549 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-03.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-41080-01.patch b/meta/recipes-core/expat/expat/CVE-2026-41080-01.patch
new file mode 100644
index 00000000000..0c6af75a5de
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-41080-01.patch
@@ -0,0 +1,50 @@
+From fe04a7f0ff8afe57ba33d919f368b1ba23bcda92 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 30 Mar 2025 19:26:55 +0200
+Subject: [PATCH 1/3] lib/xmlparse.c: Address clang-tidy warning
+ misc-no-recursion
+
+CVE: CVE-2026-41080
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/fe04a7f0ff8afe57ba33d919f368b1ba23bcda92]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 9bc67f38..cb25c37b 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1243,9 +1243,10 @@ generate_hash_secret_salt(XML_Parser parser) {
+
+ static unsigned long
+ get_hash_secret_salt(XML_Parser parser) {
+- if (parser->m_parentParser != NULL)
+- return get_hash_secret_salt(parser->m_parentParser);
+- return parser->m_hash_secret_salt;
++ const XML_Parser rootParser = getRootParserOf(parser, NULL);
++ assert(! rootParser->m_parentParser);
++
++ return rootParser->m_hash_secret_salt;
+ }
+
+ static enum XML_Error
+@@ -2321,12 +2322,14 @@ int XMLCALL
+ XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt) {
+ if (parser == NULL)
+ return 0;
+- if (parser->m_parentParser)
+- return XML_SetHashSalt(parser->m_parentParser, hash_salt);
++
++ const XML_Parser rootParser = getRootParserOf(parser, NULL);
++ assert(! rootParser->m_parentParser);
++
+ /* block after XML_Parse()/XML_ParseBuffer() has been called */
+- if (parserBusy(parser))
++ if (parserBusy(rootParser))
+ return 0;
+- parser->m_hash_secret_salt = hash_salt;
++ rootParser->m_hash_secret_salt = hash_salt;
+ return 1;
+ }
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-41080-02.patch b/meta/recipes-core/expat/expat/CVE-2026-41080-02.patch
new file mode 100644
index 00000000000..953f93c68a9
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-41080-02.patch
@@ -0,0 +1,29 @@
+From 7fb2c7a454edc9e2880073a27f899c31d9b078ce Mon Sep 17 00:00:00 2001
+From: Atrem Borovik <polzovatellllk@gmail.com>
+Date: Sat, 20 Dec 2025 13:22:16 +0300
+Subject: [PATCH 2/3] WASI: remove getpid
+
+CVE: CVE-2026-41080
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/7fb2c7a454edc9e2880073a27f899c31d9b078ce]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index cb25c37b..1bafb948 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1228,8 +1228,11 @@ generate_hash_secret_salt(XML_Parser parser) {
+ # endif /* ! defined(_WIN32) && defined(XML_DEV_URANDOM) */
+ /* .. and self-made low quality for backup: */
+
++ entropy = gather_time_entropy();
++# if ! defined(__wasi__)
+ /* Process ID is 0 bits entropy if attacker has local access */
+- entropy = gather_time_entropy() ^ getpid();
++ entropy ^= getpid();
++# endif
+
+ /* Factors are 2^31-1 and 2^61-1 (Mersenne primes M31 and M61) */
+ if (sizeof(unsigned long) == 4) {
diff --git a/meta/recipes-core/expat/expat/CVE-2026-41080-03.patch b/meta/recipes-core/expat/expat/CVE-2026-41080-03.patch
new file mode 100644
index 00000000000..4d17f1a0b0e
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-41080-03.patch
@@ -0,0 +1,467 @@
+From b77ab600e1893fdcfc3868d0a46efcc87c87943d Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Wed, 8 Apr 2026 15:41:54 +0200
+Subject: [PATCH 3/3] [CVE-2026-41080] Improve protection against hash flooding
+ (fixes #47)
+
+Fixes #47
+
+CVE: CVE-2026-41080
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1183]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ Changes | 16 ++++++
+ doc/reference.html | 51 ++++++++++++++--
+ lib/expat.h | 12 ++++
+ lib/internal.h | 2 +
+ lib/xmlparse.c | 118 ++++++++++++++++++++++++++------------
+ tests/basic_tests.c | 25 ++++++++
+ 6 files changed, 181 insertions(+), 43 deletions(-)
+
+diff --git a/Changes b/Changes
+index 4265d608..1d87d6a0 100644
+--- a/Changes
++++ b/Changes
+@@ -30,6 +30,22 @@
+ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+
+ Patches:
++ Security fixes:
++ #47 #1183 CVE-2026-41080 -- The existing hash flooding protection
++ (based on SipHash) only used 4 to 8 bytes of entropy for
++ a salt, when 16 bytes of salt are supported by the
++ implementation of SipHash used by Expat. Now full 16 bytes
++ of entropy are used to improve protection against hash
++ flooding attacks.
++ Existing API function XML_SetHashSalt is now deprecated
++ because of its limitations, and its use should be
++ considered a vulnerability. Please either use the new API
++ function XML_SetHashSalt16Bytes (with known-high-quality
++ entropy input only!) instead, or leave the derivation of
++ a 16-bytes hash salt from high quality entropy to Expat's
++ internal machinery (by *not* calling either of the two
++ XML_SetHashSalt* functions).
++
+ Security fixes:
+ #1018 #1034 CVE-2025-59375 -- Disallow use of disproportional amounts of
+ dynamic memory from within an Expat parser (e.g. previously
+diff --git a/doc/reference.html b/doc/reference.html
+index 8f14b011..7f374f84 100644
+--- a/doc/reference.html
++++ b/doc/reference.html
+@@ -174,7 +174,8 @@ interface.</p>
+ <li><a href="#XML_GetAttributeInfo">XML_GetAttributeInfo</a></li>
+ <li><a href="#XML_SetEncoding">XML_SetEncoding</a></li>
+ <li><a href="#XML_SetParamEntityParsing">XML_SetParamEntityParsing</a></li>
+- <li><a href="#XML_SetHashSalt">XML_SetHashSalt</a></li>
++ <li><a href="#XML_SetHashSalt">XML_SetHashSalt</a> (deprecated)</li>
++ <li><a href="#XML_SetHashSalt16Bytes">XML_SetHashSalt16Bytes</a></li>
+ <li><a href="#XML_UseForeignDTD">XML_UseForeignDTD</a></li>
+ <li><a href="#XML_SetReturnNSTriplet">XML_SetReturnNSTriplet</a></li>
+ <li><a href="#XML_DefaultCurrent">XML_DefaultCurrent</a></li>
+@@ -2553,10 +2554,10 @@ The choices for <code>code</code> are:
+ no effect and will always return 0.
+ </div>
+
+-<h4 id="XML_SetHashSalt">XML_SetHashSalt</h4>
++<h4 id="XML_SetHashSalt">XML_SetHashSalt (deprecated)</h4>
+ <pre class="fcndec">
+ int XMLCALL
+-XML_SetHashSalt(XML_Parser p,
++XML_SetHashSalt(XML_Parser parser,
+ unsigned long hash_salt);
+ </pre>
+ <div class="fcndef">
+@@ -2564,15 +2565,55 @@ Sets the hash salt to use for internal hash calculations.
+ Helps in preventing DoS attacks based on predicting hash
+ function behavior. In order to have an effect this must be called
+ before parsing has started. Returns 1 if successful, 0 when called
+-after <code>XML_Parse</code> or <code>XML_ParseBuffer</code>.
++after <code>XML_Parse</code> or <code>XML_ParseBuffer</code> or when
++ <code>parser</code> is <code>NULL</code>.
++ <p>
++ <b>Note:</b> Function <code>XML_SetHashSalt</code> is
++ <strong>deprecated</strong>. Please use function <code><a href=
++ "#XML_SetHashSalt16Bytes">XML_SetHashSalt16Bytes</a></code> instead for better
++ security. <code>XML_SetHashSalt</code> only provides 4 to 8 bytes of entropy
++ (depending on the size of type <code>unsigned long</code>) while the SipHash
++ implementation used by Expat can leverage up to 16 bytes of entropy — at least
++ twice as much. Function <code><a href=
++ "#XML_SetHashSalt16Bytes">XML_SetHashSalt16Bytes</a></code> of Expat >=2.7.6
++ (and where backported) matches the amount of entropy supported by SipHash.
++ </p>.
+ <p><b>Note:</b> This call is optional, as the parser will auto-generate
+-a new random salt value if no value has been set at the start of parsing.</p>
++a new random salt value internally if no value has been set by the start of parsing.</p>
+ <p><b>Note:</b> One should not call <code>XML_SetHashSalt</code> with a
+ hash salt value of 0, as this value is used as sentinel value to indicate
+ that <code>XML_SetHashSalt</code> has <b>not</b> been called. Consequently
+ such a call will have no effect, even if it returns 1.</p>
+ </div>
+
++ <h4 id="XML_SetHashSalt16Bytes">
++ XML_SetHashSalt16Bytes
++ </h4>
++
++ <pre class="fcndec">
++/* Added in Expat 2.7.6. */
++XML_Bool XMLCALL
++XML_SetHashSalt16Bytes(XML_Parser parser,
++ const uint8_t entropy[16]);
++</pre>
++ <div class="fcndef">
++ Sets the hash salt to use for internal hash calculations. Helps in preventing DoS
++ attacks based on predicting hash function behavior. In order to have an effect
++ this must be called before parsing has started. Returns <code>XML_TRUE</code> if
++ successful, <code>XML_FALSE</code> when called after <code>XML_Parse</code> or
++ <code>XML_ParseBuffer</code> or when <code>parser</code> is <code>NULL</code>.
++ <p>
++ <b>Note:</b> Setting a salt that is <em>not</em> from a source of high quality
++ entropy (like <code>getentropy(3)</code>) will make the parser vulnerable to
++ hash flooding attacks.
++ </p>
++
++ <p>
++ <b>Note:</b> This call is optional, as the parser will auto-generate a new
++ random salt value internally if no value has been set by the start of parsing.
++ </p>
++ </div>
++
+ <h4 id="XML_UseForeignDTD">XML_UseForeignDTD</h4>
+ <pre class="fcndec">
+ enum XML_Error XMLCALL
+diff --git a/lib/expat.h b/lib/expat.h
+index df207e9e..b356e002 100644
+--- a/lib/expat.h
++++ b/lib/expat.h
+@@ -44,6 +44,7 @@
+ #ifndef Expat_INCLUDED
+ #define Expat_INCLUDED 1
+
++# include <stdint.h> // for uint8_t
+ #include <stdlib.h>
+ #include "expat_external.h"
+
+@@ -916,10 +917,21 @@ XML_SetParamEntityParsing(XML_Parser parser,
+ function behavior. This must be called before parsing is started.
+ Returns 1 if successful, 0 when called after parsing has started.
+ Note: If parser == NULL, the function will do nothing and return 0.
++ DEPRECATED since Expat 2.7.6.
+ */
+ XMLPARSEAPI(int)
+ XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt);
+
++/* Sets the hash salt to use for internal hash calculations.
++ Helps in preventing DoS attacks based on predicting hash function behavior.
++ This must be called before parsing is started.
++ Returns XML_TRUE if successful, XML_FALSE when called after parsing has
++ started or when parser is NULL.
++ Added in Expat 2.7.6.
++*/
++XMLPARSEAPI(XML_Bool)
++XML_SetHashSalt16Bytes(XML_Parser parser, const uint8_t entropy[16]);
++
+ /* If XML_Parse or XML_ParseBuffer have returned XML_STATUS_ERROR, then
+ XML_GetErrorCode returns information about the error.
+ */
+diff --git a/lib/internal.h b/lib/internal.h
+index 32faaa05..617d6454 100644
+--- a/lib/internal.h
++++ b/lib/internal.h
+@@ -113,6 +113,7 @@
+ #if defined(_WIN32) \
+ && (! defined(__USE_MINGW_ANSI_STDIO) \
+ || (1 - __USE_MINGW_ANSI_STDIO - 1 == 0))
++# define EXPAT_FMT_LLX(midpart) "%" midpart "I64x"
+ # define EXPAT_FMT_ULL(midpart) "%" midpart "I64u"
+ # if defined(_WIN64) // Note: modifiers "td" and "zu" do not work for MinGW
+ # define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "I64d"
+@@ -122,6 +123,7 @@
+ # define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
+ # endif
+ #else
++# define EXPAT_FMT_LLX(midpart) "%" midpart "llx"
+ # define EXPAT_FMT_ULL(midpart) "%" midpart "llu"
+ # if ! defined(ULONG_MAX)
+ # error Compiler did not define ULONG_MAX for us
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 1bafb948..75a7e5d0 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -604,7 +604,7 @@ static ELEMENT_TYPE *getElementType(XML_Parser parser, const ENCODING *enc,
+
+ static XML_Char *copyString(const XML_Char *s, XML_Parser parser);
+
+-static unsigned long generate_hash_secret_salt(XML_Parser parser);
++static struct sipkey generate_hash_secret_salt(void);
+ static XML_Bool startParsing(XML_Parser parser);
+
+ static XML_Parser parserCreate(const XML_Char *encodingName,
+@@ -777,7 +777,8 @@ struct XML_ParserStruct {
+ XML_Bool m_useForeignDTD;
+ enum XML_ParamEntityParsing m_paramEntityParsing;
+ #endif
+- unsigned long m_hash_secret_salt;
++ struct sipkey m_hash_secret_salt_128;
++ XML_Bool m_hash_secret_salt_set;
+ #if XML_GE == 1
+ ACCOUNTING m_accounting;
+ MALLOC_TRACKER m_alloc_tracker;
+@@ -1189,69 +1190,65 @@ gather_time_entropy(void) {
+
+ #endif /* ! defined(HAVE_ARC4RANDOM_BUF) && ! defined(HAVE_ARC4RANDOM) */
+
+-static unsigned long
+-ENTROPY_DEBUG(const char *label, unsigned long entropy) {
++static struct sipkey
++ENTROPY_DEBUG(const char *label, struct sipkey entropy_128) {
+ if (getDebugLevel("EXPAT_ENTROPY_DEBUG", 0) >= 1u) {
+- fprintf(stderr, "expat: Entropy: %s --> 0x%0*lx (%lu bytes)\n", label,
+- (int)sizeof(entropy) * 2, entropy, (unsigned long)sizeof(entropy));
++ fprintf(stderr,
++ "expat: Entropy: %s --> [0x" EXPAT_FMT_LLX(
++ "016") ", 0x" EXPAT_FMT_LLX("016") "] (16 bytes)\n",
++ label, (unsigned long long)entropy_128.k[0],
++ (unsigned long long)entropy_128.k[1]);
+ }
+- return entropy;
++ return entropy_128;
+ }
+
+-static unsigned long
+-generate_hash_secret_salt(XML_Parser parser) {
+- unsigned long entropy;
+- (void)parser;
++static struct sipkey
++generate_hash_secret_salt(void) {
++ struct sipkey entropy;
+
+ /* "Failproof" high quality providers: */
+ #if defined(HAVE_ARC4RANDOM_BUF)
+ arc4random_buf(&entropy, sizeof(entropy));
+ return ENTROPY_DEBUG("arc4random_buf", entropy);
+ #elif defined(HAVE_ARC4RANDOM)
+- writeRandomBytes_arc4random((void *)&entropy, sizeof(entropy));
++ writeRandomBytes_arc4random(&entropy, sizeof(entropy));
+ return ENTROPY_DEBUG("arc4random", entropy);
+ #else
+ /* Try high quality providers first .. */
+ # ifdef _WIN32
+- if (writeRandomBytes_rand_s((void *)&entropy, sizeof(entropy))) {
++ if (writeRandomBytes_rand_s(&entropy, sizeof(entropy))) {
+ return ENTROPY_DEBUG("rand_s", entropy);
+ }
+ # elif defined(HAVE_GETRANDOM) || defined(HAVE_SYSCALL_GETRANDOM)
+- if (writeRandomBytes_getrandom_nonblock((void *)&entropy, sizeof(entropy))) {
++ if (writeRandomBytes_getrandom_nonblock(&entropy, sizeof(entropy))) {
+ return ENTROPY_DEBUG("getrandom", entropy);
+ }
+ # endif
+ # if ! defined(_WIN32) && defined(XML_DEV_URANDOM)
+- if (writeRandomBytes_dev_urandom((void *)&entropy, sizeof(entropy))) {
++ if (writeRandomBytes_dev_urandom(&entropy, sizeof(entropy))) {
+ return ENTROPY_DEBUG("/dev/urandom", entropy);
+ }
+ # endif /* ! defined(_WIN32) && defined(XML_DEV_URANDOM) */
+ /* .. and self-made low quality for backup: */
+
+- entropy = gather_time_entropy();
++ entropy.k[0] = 0;
++ entropy.k[1] = gather_time_entropy();
+ # if ! defined(__wasi__)
+ /* Process ID is 0 bits entropy if attacker has local access */
+- entropy ^= getpid();
++ entropy.k[1] ^= getpid();
+ # endif
+
+ /* Factors are 2^31-1 and 2^61-1 (Mersenne primes M31 and M61) */
+ if (sizeof(unsigned long) == 4) {
+- return ENTROPY_DEBUG("fallback(4)", entropy * 2147483647);
++ entropy.k[1] *= 2147483647;
++ return ENTROPY_DEBUG("fallback(4)", entropy);
+ } else {
+- return ENTROPY_DEBUG("fallback(8)",
+- entropy * (unsigned long)2305843009213693951ULL);
++ entropy.k[1] *= 2305843009213693951ULL;
++ return ENTROPY_DEBUG("fallback(8)", entropy);
+ }
+ #endif
+ }
+
+-static unsigned long
+-get_hash_secret_salt(XML_Parser parser) {
+- const XML_Parser rootParser = getRootParserOf(parser, NULL);
+- assert(! rootParser->m_parentParser);
+-
+- return rootParser->m_hash_secret_salt;
+-}
+-
+ static enum XML_Error
+ callProcessor(XML_Parser parser, const char *start, const char *end,
+ const char **endPtr) {
+@@ -1320,8 +1316,10 @@ callProcessor(XML_Parser parser, const char *start, const char *end,
+ static XML_Bool /* only valid for root parser */
+ startParsing(XML_Parser parser) {
+ /* hash functions must be initialized before setContext() is called */
+- if (parser->m_hash_secret_salt == 0)
+- parser->m_hash_secret_salt = generate_hash_secret_salt(parser);
++ if (parser->m_hash_secret_salt_set != XML_TRUE) {
++ parser->m_hash_secret_salt_128 = generate_hash_secret_salt();
++ parser->m_hash_secret_salt_set = XML_TRUE;
++ }
+ if (parser->m_ns) {
+ /* implicit context only set for root parser, since child
+ parsers (i.e. external entity parsers) will inherit it
+@@ -1609,7 +1607,9 @@ parserInit(XML_Parser parser, const XML_Char *encodingName) {
+ parser->m_useForeignDTD = XML_FALSE;
+ parser->m_paramEntityParsing = XML_PARAM_ENTITY_PARSING_NEVER;
+ #endif
+- parser->m_hash_secret_salt = 0;
++ parser->m_hash_secret_salt_128.k[0] = 0;
++ parser->m_hash_secret_salt_128.k[1] = 0;
++ parser->m_hash_secret_salt_set = XML_FALSE;
+
+ #if XML_GE == 1
+ memset(&parser->m_accounting, 0, sizeof(ACCOUNTING));
+@@ -1776,7 +1776,8 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
+ from hash tables associated with either parser without us having
+ to worry which hash secrets each table has.
+ */
+- unsigned long oldhash_secret_salt;
++ struct sipkey oldhash_secret_salt_128;
++ XML_Bool oldhash_secret_salt_set;
+ XML_Bool oldReparseDeferralEnabled;
+
+ /* Validate the oldParser parameter before we pull everything out of it */
+@@ -1822,7 +1823,8 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
+ from hash tables associated with either parser without us having
+ to worry which hash secrets each table has.
+ */
+- oldhash_secret_salt = parser->m_hash_secret_salt;
++ oldhash_secret_salt_128 = parser->m_hash_secret_salt_128;
++ oldhash_secret_salt_set = parser->m_hash_secret_salt_set;
+ oldReparseDeferralEnabled = parser->m_reparseDeferralEnabled;
+
+ #ifdef XML_DTD
+@@ -1877,7 +1879,8 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
+ parser->m_externalEntityRefHandlerArg = oldExternalEntityRefHandlerArg;
+ parser->m_defaultExpandInternalEntities = oldDefaultExpandInternalEntities;
+ parser->m_ns_triplets = oldns_triplets;
+- parser->m_hash_secret_salt = oldhash_secret_salt;
++ parser->m_hash_secret_salt_128 = oldhash_secret_salt_128;
++ parser->m_hash_secret_salt_set = oldhash_secret_salt_set;
+ parser->m_reparseDeferralEnabled = oldReparseDeferralEnabled;
+ parser->m_parentParser = oldParser;
+ #ifdef XML_DTD
+@@ -2321,6 +2324,7 @@ XML_SetParamEntityParsing(XML_Parser parser,
+ #endif
+ }
+
++// DEPRECATED since Expat 2.7.6.
+ int XMLCALL
+ XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt) {
+ if (parser == NULL)
+@@ -2332,10 +2336,46 @@ XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt) {
+ /* block after XML_Parse()/XML_ParseBuffer() has been called */
+ if (parserBusy(rootParser))
+ return 0;
+- rootParser->m_hash_secret_salt = hash_salt;
++
++ rootParser->m_hash_secret_salt_128.k[0] = 0;
++ rootParser->m_hash_secret_salt_128.k[1] = hash_salt;
++
++ if (hash_salt != 0) { // to remain backwards compatible
++ rootParser->m_hash_secret_salt_set = XML_TRUE;
++
++ if (sizeof(unsigned long) == 4)
++ ENTROPY_DEBUG("explicit(4)", rootParser->m_hash_secret_salt_128);
++ else
++ ENTROPY_DEBUG("explicit(8)", rootParser->m_hash_secret_salt_128);
++ }
++
+ return 1;
+ }
+
++XML_Bool XMLCALL
++XML_SetHashSalt16Bytes(XML_Parser parser, const uint8_t entropy[16]) {
++ if (parser == NULL)
++ return XML_FALSE;
++
++ if (entropy == NULL)
++ return XML_FALSE;
++
++ const XML_Parser rootParser = getRootParserOf(parser, NULL);
++ assert(! rootParser->m_parentParser);
++
++ /* block after XML_Parse()/XML_ParseBuffer() has been called */
++ if (parserBusy(rootParser))
++ return XML_FALSE;
++
++ sip_tokey(&(rootParser->m_hash_secret_salt_128), entropy);
++
++ rootParser->m_hash_secret_salt_set = XML_TRUE;
++
++ ENTROPY_DEBUG("explicit(16)", rootParser->m_hash_secret_salt_128);
++
++ return XML_TRUE;
++}
++
+ enum XML_Status XMLCALL
+ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) {
+ if ((parser == NULL) || (len < 0) || ((s == NULL) && (len != 0))) {
+@@ -7837,8 +7877,10 @@ keylen(KEY s) {
+
+ static void
+ copy_salt_to_sipkey(XML_Parser parser, struct sipkey *key) {
+- key->k[0] = 0;
+- key->k[1] = get_hash_secret_salt(parser);
++ const XML_Parser rootParser = getRootParserOf(parser, NULL);
++ assert(! rootParser->m_parentParser);
++
++ *key = rootParser->m_hash_secret_salt_128;
+ }
+
+ static unsigned long FASTCALL
+diff --git a/tests/basic_tests.c b/tests/basic_tests.c
+index 023d9ce4..380caf19 100644
+--- a/tests/basic_tests.c
++++ b/tests/basic_tests.c
+@@ -204,6 +204,30 @@ START_TEST(test_hash_collision) {
+ END_TEST
+ #undef COLLIDING_HASH_SALT
+
++START_TEST(test_hash_salt_setter) {
++ const uint8_t entropy[16] = {'0', '1', '2', '3', '4', '5', '6', '7',
++ '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
++ XML_Parser parser = XML_ParserCreate(NULL);
++
++ // NULL parser should be rejected
++ assert_true(XML_SetHashSalt16Bytes(NULL, entropy) == XML_FALSE);
++
++ // NULL entropy should be rejected
++ assert_true(XML_SetHashSalt16Bytes(parser, NULL) == XML_FALSE);
++
++ // Setting should be allowed more than once
++ assert_true(XML_SetHashSalt16Bytes(parser, entropy) == XML_TRUE);
++ assert_true(XML_SetHashSalt16Bytes(parser, entropy) == XML_TRUE);
++
++ // But not after parsing has started
++ assert_true(XML_Parse(parser, "", 0, XML_FALSE /* isFinal */)
++ == XML_STATUS_OK);
++ assert_true(XML_SetHashSalt16Bytes(parser, entropy) == XML_FALSE);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ /* Regression test for SF bug #491986. */
+ START_TEST(test_danish_latin1) {
+ const char *text = "<?xml version='1.0' encoding='iso-8859-1'?>\n"
+@@ -6244,6 +6268,7 @@ make_basic_test_case(Suite *s) {
+ tcase_add_test(tc_basic, test_bom_utf16_le);
+ tcase_add_test(tc_basic, test_nobom_utf16_le);
+ tcase_add_test(tc_basic, test_hash_collision);
++ tcase_add_test(tc_basic, test_hash_salt_setter);
+ tcase_add_test(tc_basic, test_illegal_utf8);
+ tcase_add_test(tc_basic, test_utf8_auto_align);
+ tcase_add_test(tc_basic, test_utf16);
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 151720a9e3c..f5c3e3fdd2f 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -51,6 +51,9 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-32777-02.patch \
file://CVE-2026-32778-01.patch \
file://CVE-2026-32778-02.patch \
+ file://CVE-2026-41080-01.patch \
+ file://CVE-2026-41080-02.patch \
+ file://CVE-2026-41080-03.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related
* [OE-core][scarthgap 18/33] util-linux: fix CVE-2026-13595
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream stable/v2.41 backport for
CVE-2026-13595. The upstream fix merge or commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.
[1] https://github.com/util-linux/util-linux/commit/132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa
[2] https://access.redhat.com/security/cve/CVE-2026-13595
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2026-13595.patch | 157 ++++++++++++++++++
2 files changed, 158 insertions(+)
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc
index 83804196345..753d032976d 100644
--- a/meta/recipes-core/util-linux/util-linux.inc
+++ b/meta/recipes-core/util-linux/util-linux.inc
@@ -47,6 +47,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin
file://CVE-2025-14104-01.patch \
file://CVE-2025-14104-02.patch \
file://CVE-2026-27456.patch \
+ file://CVE-2026-13595.patch \
"
SRC_URI[sha256sum] = "7b6605e48d1a49f43cc4b4cfc59f313d0dd5402fa40b96810bd572e167dfed0f"
diff --git a/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch b/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
new file mode 100644
index 00000000000..36e8658f69b
--- /dev/null
+++ b/meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
@@ -0,0 +1,157 @@
+From faf717ca4ed3b603eb213915fe15c6804c4b92d4 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Thu, 7 May 2026 12:50:48 +0200
+Subject: [PATCH] libblkid: fix use-after-free in nested partition probing
+
+The partitions list stores partitions in a contiguous array grown by
+realloc(). When the array is reallocated to a new address, all
+existing blkid_partition pointers (tab->parent, ls->next_parent, local
+parent variables in nested probers) become dangling.
+
+Fix this by changing the storage from an array of structs to an array
+of pointers, where each partition is individually allocated via
+calloc(). This makes all blkid_partition pointers stable across
+reallocations -- only the pointer array itself may move, which is
+harmless since no code caches pointers into the pointer array.
+
+This eliminates the need for callers to re-fetch parent pointers after
+every blkid_partlist_add_partition() call.
+
+CVE: CVE-2026-13595
+Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa]
+
+Backport Changes:
+- Scarthgap util-linux 2.39.3 still uses realloc() at this allocation site,
+ so this backport keeps realloc() and changes only the element size to
+ sizeof(*ls->parts) instead of adopting upstream's reallocarray() style.
+- The commit text was adjusted from reallocarray() to realloc() to match the
+ target source context.
+
+Reported-by: Thai Duong <thaidn@gmail.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+(cherry picked from commit c0186f14fbdb02f64c8e0ba701ce727ea764ff4c)
+(cherry picked from commit 132d9c8aa15a8efd0a23d8ca7ed8b98f365e84fa)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ libblkid/src/partitions/partitions.c | 36 ++++++++++++++++++----------
+ 1 file changed, 22 insertions(+), 14 deletions(-)
+
+diff --git a/libblkid/src/partitions/partitions.c b/libblkid/src/partitions/partitions.c
+index 8ebf480f5..6089028a8 100644
+--- a/libblkid/src/partitions/partitions.c
++++ b/libblkid/src/partitions/partitions.c
+@@ -197,7 +197,7 @@ struct blkid_struct_partlist {
+
+ int nparts; /* number of partitions */
+ int nparts_max; /* max.number of partitions */
+- blkid_partition parts; /* array of partitions */
++ blkid_partition *parts; /* array of pointers to partitions */
+
+ struct list_head l_tabs; /* list of partition tables */
+ };
+@@ -356,13 +356,16 @@ static void reset_partlist(blkid_partlist ls)
+ free_parttables(ls);
+
+ if (ls->next_partno) {
+- /* already initialized - reset */
+- int tmp_nparts = ls->nparts_max;
+- blkid_partition tmp_parts = ls->parts;
++ /* already initialized - free individually allocated partitions */
++ int i, tmp_nparts_max = ls->nparts_max;
++ blkid_partition *tmp_parts = ls->parts;
++
++ for (i = 0; i < ls->nparts; i++)
++ free(ls->parts[i]);
+
+ memset(ls, 0, sizeof(struct blkid_struct_partlist));
+
+- ls->nparts_max = tmp_nparts;
++ ls->nparts_max = tmp_nparts_max;
+ ls->parts = tmp_parts;
+ }
+
+@@ -397,6 +400,7 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)),
+ void *data)
+ {
+ blkid_partlist ls = (blkid_partlist) data;
++ int i;
+
+ if (!ls)
+ return;
+@@ -404,6 +408,8 @@ static void partitions_free_data(blkid_probe pr __attribute__((__unused__)),
+ free_parttables(ls);
+
+ /* deallocate partitions and partlist */
++ for (i = 0; i < ls->nparts; i++)
++ free(ls->parts[i]);
+ free(ls->parts);
+ free(ls);
+ }
+@@ -436,16 +442,18 @@ static blkid_partition new_partition(blkid_partlist ls, blkid_parttable tab)
+ /* Linux kernel has DISK_MAX_PARTS=256, but it's too much for
+ * generic Linux machine -- let start with 32 partitions.
+ */
+- void *tmp = realloc(ls->parts, (ls->nparts_max + 32) *
+- sizeof(struct blkid_struct_partition));
++ void *tmp = realloc(ls->parts, (ls->nparts_max + 32) *
++ sizeof(*ls->parts));
+ if (!tmp)
+ return NULL;
+ ls->parts = tmp;
+ ls->nparts_max += 32;
+ }
+
+- par = &ls->parts[ls->nparts++];
+- memset(par, 0, sizeof(struct blkid_struct_partition));
++ par = calloc(1, sizeof(struct blkid_struct_partition));
++ if (!par)
++ return NULL;
++ ls->parts[ls->nparts++] = par;
+
+ ref_parttable(tab);
+ par->tab = tab;
+@@ -849,7 +857,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr,
+
+ /* check if the partition table fits into the device */
+ for (i = 0; i < nparts; i++) {
+- blkid_partition par = &ls->parts[i];
++ blkid_partition par = ls->parts[i];
+
+ if (par->start + par->size > (pr->size >> 9)) {
+ DBG(LOWPROBE, ul_debug("partition #%d overflows "
+@@ -861,7 +869,7 @@ int blkid_probe_is_covered_by_pt(blkid_probe pr,
+
+ /* check if the requested area is covered by PT */
+ for (i = 0; i < nparts; i++) {
+- blkid_partition par = &ls->parts[i];
++ blkid_partition par = ls->parts[i];
+
+ if (start >= par->start && end <= par->start + par->size) {
+ rc = 1;
+@@ -960,7 +968,7 @@ blkid_partition blkid_partlist_get_partition(blkid_partlist ls, int n)
+ if (n < 0 || n >= ls->nparts)
+ return NULL;
+
+- return &ls->parts[n];
++ return ls->parts[n];
+ }
+
+ blkid_partition blkid_partlist_get_partition_by_start(blkid_partlist ls, uint64_t start)
+@@ -1072,7 +1080,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno
+ * and an entry in partition table.
+ */
+ for (i = 0; i < ls->nparts; i++) {
+- blkid_partition par = &ls->parts[i];
++ blkid_partition par = ls->parts[i];
+
+ if (partno != blkid_partition_get_partno(par))
+ continue;
+@@ -1088,7 +1096,7 @@ blkid_partition blkid_partlist_devno_to_partition(blkid_partlist ls, dev_t devno
+ DBG(LOWPROBE, ul_debug("searching by offset/size"));
+
+ for (i = 0; i < ls->nparts; i++) {
+- blkid_partition par = &ls->parts[i];
++ blkid_partition par = ls->parts[i];
+
+ if ((uint64_t)blkid_partition_get_start(par) == start &&
+ (uint64_t)blkid_partition_get_size(par) == size)
^ permalink raw reply related
* [OE-core][scarthgap 19/33] tzdata/tzcode-native: upgrade 2026b -> 2026c
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Vijay Anusuri <vanusuri@mvista.com>
This release contains the following changes:
Briefly:
Alberta moved to permanent -06 on 2026-06-18.
Morocco moves to permanent +00 on 2026-09-20.
More integer overflow bugs have been fixed in zic.
Changes to future timestamps
Alberta’s 2026-03-08 spring forward was its last foreseeable clock
change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh
Pournader and others.) Model this with its traditional abbreviation
CST. Although the change to permanent -06 legally took place on
2026-06-18, temporarily model the change to occur on 2026-11-01 at
02:00 instead, for the same reason we introduced a similarly
temporary hack for British Columbia in 2026b.
Although another TZDB release will likely be needed soon because
Northwest Territories will likely follow Alberta, the legal
formalities have not yet taken place.
Morocco plans to move back to permanent UTC, without daylight
saving time transitions, on 2026-09-20 at 02:00. This also
affects Western Sahara.
Changes to code
zic no longer overflows integers when processing outlandish input
like ‘Zone Ouch 0 - LMT 9223372036854775807’, ‘Zone Ouch 0
2562047788015215 LMT’, ‘Zone Ouch -2562047788015215:30:08 - LMT’,
and ‘Zone Ouch -2562047788015215:30:08 - %%z’. This avoids
undefined behavior in C. (Problems reported by Naveed Khan.)
On platforms that have EFTYPE, tzalloc now fails with errno set to
EFTYPE, not EINVAL, if it detects that the TZif file has an
invalid format or is not a regular file. Formerly it did this
only on NetBSD, and only when the file was not a regular file.
Unprivileged programs no longer require TZif files to be regular
files or reject relative names containing ".." components. This
reverts to the more-permissive 2025b behavior, as the stricter
behavior did not catch on in FreeBSD.
zic now reports any failure to remove a temporary file when
cleaning up after a previous failure. (Problem reported by Tom
Lane.)
Changes to commentary
Northwest Territories is expected to move to permanent -06 prior to
2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to
Tim Parenti and James Bellaire.) Model this with its traditional
abbreviation CST. Unfortunately the change is not yet official, so
it is currently present only as comments that can be uncommented as
needed.
Changes to build procedure
The undocumented ‘typecheck’ Makefile check rule has been removed.
It stopped working in 2025a and evidently nobody noticed.
The rule was superseded by ‘check_time_t_alternatives’ in 2013d.
Ref: https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/NVHSX2PAQIT44U5FCCEVNJJYXQMMTJSA/
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 33a7e1170b0c8ba83cdb4c7d6d9f83f6c194baed)
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-extended/timezone/timezone.inc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/meta/recipes-extended/timezone/timezone.inc b/meta/recipes-extended/timezone/timezone.inc
index a4774370662..4271b306486 100644
--- a/meta/recipes-extended/timezone/timezone.inc
+++ b/meta/recipes-extended/timezone/timezone.inc
@@ -6,7 +6,7 @@ SECTION = "base"
LICENSE = "PD & BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
-PV = "2026b"
+PV = "2026c"
SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode;subdir=tz \
http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata;subdir=tz \
@@ -16,5 +16,5 @@ S = "${WORKDIR}/tz"
UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
-SRC_URI[tzcode.sha256sum] = "37e9ed8427f5d3521c22fc58e293cbfb043d70eedf1003870b33f363f61ca344"
-SRC_URI[tzdata.sha256sum] = "114543d9f19a6bfeb5bca43686aea173d38755a3db1f2eec112647ae92c6f544"
+SRC_URI[tzcode.sha256sum] = "b1cffc3ace4c4c7cd0efba2f7add86ec3d0b79da48bcf03582671fd3c8feace8"
+SRC_URI[tzdata.sha256sum] = "e4a178a4477f3d0ea77cc31828ff72aa38feff8d61aa13e7e99e142e9d902be4"
^ permalink raw reply related
* [OE-core][scarthgap 12/33] bzip2: fix 'bzip2 --version > /tmp/aaa 2>&1' hang
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Hongxu Jia <hongxu.jia@windriver.com>
According to [1]
As of the current version 1.0.8, bzip2 --version will print version
info but it will also continue compressing stdin:
$ ./bzip2 --version
bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019.
Copyright (C) 1996-2019 by Julian Seward.
This program is free software; [...]
bzip2: I won't write compressed data to a terminal.
bzip2: For help, type: `bzip2 --help'.
Debian (and its downstreams like Ubuntu) will patch this out [2],
making the < /dev/null unnecessary, port a part of debian patch
to fix the issue
[1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2
[2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ae4fe4263ba9d372f9b9e80df4ec4697b51c1f9b)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
...-fix-bzip2-version-tmp-aaa-will-hang.patch | 62 +++++++++++++++++++
meta/recipes-extended/bzip2/bzip2_1.0.8.bb | 1 +
2 files changed, 63 insertions(+)
create mode 100644 meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch
diff --git a/meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch b/meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch
new file mode 100644
index 00000000000..84206b2a4d0
--- /dev/null
+++ b/meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch
@@ -0,0 +1,62 @@
+From a9dd6acbaca836fc4e943e69a31b2e7acda32045 Mon Sep 17 00:00:00 2001
+From: Hongxu Jia <hongxu.jia@windriver.com>
+Date: Wed, 13 Nov 2024 19:49:23 +0800
+Subject: [PATCH] fix 'bzip2 --version > /tmp/aaa 2>&1' hang
+
+According to [1]
+
+As of the current version 1.0.8, bzip2 --version will print version
+info but it will also continue compressing stdin:
+
+ $ ./bzip2 --version
+ bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019.
+
+ Copyright (C) 1996-2019 by Julian Seward.
+
+ This program is free software; [...]
+
+ bzip2: I won't write compressed data to a terminal.
+ bzip2: For help, type: `bzip2 --help'.
+
+Debian (and its downstreams like Ubuntu) will patch this out [2],
+making the < /dev/null unnecessary:
+
+[1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2
+[2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/
+
+Upstream-Status: Submitted [bzip2-devel@sourceware.org]
+
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+---
+ bzip2.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/bzip2.c b/bzip2.c
+index d95d280..6ec9871 100644
+--- a/bzip2.c
++++ b/bzip2.c
+@@ -1890,7 +1890,9 @@ IntNative main ( IntNative argc, Char *argv[] )
+ case '8': blockSize100k = 8; break;
+ case '9': blockSize100k = 9; break;
+ case 'V':
+- case 'L': license(); break;
++ case 'L': license();
++ exit ( 0 );
++ break;
+ case 'v': verbosity++; break;
+ case 'h': usage ( progName );
+ exit ( 0 );
+@@ -1916,8 +1918,8 @@ IntNative main ( IntNative argc, Char *argv[] )
+ if (ISFLAG("--keep")) keepInputFiles = True; else
+ if (ISFLAG("--small")) smallMode = True; else
+ if (ISFLAG("--quiet")) noisy = False; else
+- if (ISFLAG("--version")) license(); else
+- if (ISFLAG("--license")) license(); else
++ if (ISFLAG("--version")) { license(); exit ( 0 ); } else
++ if (ISFLAG("--license")) { license(); exit ( 0 ); } else
+ if (ISFLAG("--exponential")) workFactor = 1; else
+ if (ISFLAG("--repetitive-best")) redundant(aa->name); else
+ if (ISFLAG("--repetitive-fast")) redundant(aa->name); else
+--
+2.34.1
+
diff --git a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb
index b661bc95465..6c02dc3ed06 100644
--- a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb
+++ b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb
@@ -27,6 +27,7 @@ SRC_URI = "https://sourceware.org/pub/${BPN}/${BPN}-${PV}.tar.gz \
file://Makefile.am;subdir=${BP} \
file://run-ptest \
file://CVE-2026-42250.patch;subdir=${BP} \
+ file://0001-fix-bzip2-version-tmp-aaa-will-hang.patch;subdir=${BP} \
"
SRC_URI[md5sum] = "67e051268d0c475ea773822f7500d0e5"
SRC_URI[sha256sum] = "ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269"
^ permalink raw reply related
* [OE-core][scarthgap 22/33] libcap: Fix CVE-2026-4878
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
Pick patch from [1] as mentioned in Debian report in [2].
[1] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596
[2] https://security-tracker.debian.org/tracker/CVE-2026-4878
Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
Reviewed-by: Bruno VERNAY <bruno.vernay@se.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libcap/files/CVE-2026-4878.patch | 164 ++++++++++++++++++
meta/recipes-support/libcap/libcap_2.69.bb | 1 +
2 files changed, 165 insertions(+)
create mode 100644 meta/recipes-support/libcap/files/CVE-2026-4878.patch
diff --git a/meta/recipes-support/libcap/files/CVE-2026-4878.patch b/meta/recipes-support/libcap/files/CVE-2026-4878.patch
new file mode 100644
index 00000000000..dcc63d93a54
--- /dev/null
+++ b/meta/recipes-support/libcap/files/CVE-2026-4878.patch
@@ -0,0 +1,164 @@
+From f17734c6b0f4fd102fe4f7e863cb1165f8ec66e2 Mon Sep 17 00:00:00 2001
+From: "Andrew G. Morgan" <morgan@kernel.org>
+Date: Thu, 12 Mar 2026 07:38:05 -0700
+Subject: [PATCH] Address a potential TOCTOU race condition in cap_set_file().
+
+This issue was researched and reported by Ali Raza (@locus-x64). It
+has been assigned CVE-2026-4878.
+
+The finding is that while cap_set_file() checks if a file is a regular
+file before applying or removing a capability attribute, a small
+window existed after that check when the filepath could be overwritten
+either with new content or a symlink to some other file. To do this
+would imply that the caller of cap_set_file() was directing it to a
+directory over which a local attacker has write access, and performed
+the operation frequently enough that an attacker had a non-negligible
+chance of exploiting the race condition. The code now locks onto the
+intended file, eliminating the race condition.
+
+CVE: CVE-2026-4878
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=286ace1259992bd0c5d9016715833f2e148ac596]
+
+Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+(cherry picked from commit 286ace1259992bd0c5d9016715833f2e148ac596)
+Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
+---
+ libcap/cap_file.c | 69 +++++++++++++++++++++++++++++++++++++++-------
+ progs/quicktest.sh | 14 +++++++++-
+ 2 files changed, 72 insertions(+), 11 deletions(-)
+
+diff --git a/libcap/cap_file.c b/libcap/cap_file.c
+index 0bc07f7..f02bf9f 100644
+--- a/libcap/cap_file.c
++++ b/libcap/cap_file.c
+@@ -8,8 +8,13 @@
+ #define _DEFAULT_SOURCE
+ #endif
+
++#ifndef _GNU_SOURCE
++#define _GNU_SOURCE
++#endif
++
+ #include <sys/types.h>
+ #include <byteswap.h>
++#include <fcntl.h>
+ #include <sys/stat.h>
+ #include <unistd.h>
+
+@@ -322,26 +327,70 @@ int cap_set_file(const char *filename, cap_t cap_d)
+ struct vfs_ns_cap_data rawvfscap;
+ int sizeofcaps;
+ struct stat buf;
++ char fdpath[64];
++ int fd, ret;
++
++ _cap_debug("setting filename capabilities");
++ fd = open(filename, O_RDONLY|O_NOFOLLOW);
++ if (fd >= 0) {
++ ret = cap_set_fd(fd, cap_d);
++ close(fd);
++ return ret;
++ }
+
+- if (lstat(filename, &buf) != 0) {
+- _cap_debug("unable to stat file [%s]", filename);
++ /*
++ * Attempting to set a file capability on a file the process can't
++ * read the content of. This is considered a non-standard use case
++ * and the following (slower) code is complicated because it is
++ * trying to avoid a TOCTOU race condition.
++ */
++
++ fd = open(filename, O_PATH|O_NOFOLLOW);
++ if (fd < 0) {
++ _cap_debug("cannot find file at path [%s]", filename);
++ return -1;
++ }
++ if (fstat(fd, &buf) != 0) {
++ _cap_debug("unable to stat file [%s] descriptor %d",
++ filename, fd);
++ close(fd);
+ return -1;
+ }
+ if (S_ISLNK(buf.st_mode) || !S_ISREG(buf.st_mode)) {
+- _cap_debug("file [%s] is not a regular file", filename);
++ _cap_debug("file [%s] descriptor %d for non-regular file",
++ filename, fd);
++ close(fd);
+ errno = EINVAL;
+ return -1;
+ }
+
+- if (cap_d == NULL) {
+- _cap_debug("removing filename capabilities");
+- return removexattr(filename, XATTR_NAME_CAPS);
++ /*
++ * While the fd remains open, this named file is locked to the
++ * origin regular file. The size of the fdpath variable is
++ * sufficient to support a 160+ bit number.
++ */
++ if (snprintf(fdpath, sizeof(fdpath), "/proc/self/fd/%d", fd)
++ >= sizeof(fdpath)) {
++ _cap_debug("file descriptor too large %d", fd);
++ errno = EINVAL;
++ ret = -1;
++
++ } else if (cap_d == NULL) {
++ _cap_debug("dropping file caps on [%s] via [%s]",
++ filename, fdpath);
++ ret = removexattr(fdpath, XATTR_NAME_CAPS);
++
+ } else if (_fcaps_save(&rawvfscap, cap_d, &sizeofcaps) != 0) {
+- return -1;
+- }
++ _cap_debug("problem converting cap_d to vfscap format");
++ ret = -1;
+
+- _cap_debug("setting filename capabilities");
+- return setxattr(filename, XATTR_NAME_CAPS, &rawvfscap, sizeofcaps, 0);
++ } else {
++ _cap_debug("setting filename capabilities");
++ ret = setxattr(fdpath, XATTR_NAME_CAPS, &rawvfscap,
++ sizeofcaps, 0);
++ }
++ close(fd);
++ return ret;
+ }
+
+ /*
+diff --git a/progs/quicktest.sh b/progs/quicktest.sh
+index 59e16b0..bb49d53 100755
+--- a/progs/quicktest.sh
++++ b/progs/quicktest.sh
+@@ -148,7 +148,19 @@ pass_capsh --caps="cap_setpcap=p" --inh=cap_chown --current
+ pass_capsh --strict --caps="cap_chown=p" --inh=cap_chown --current
+
+ # change the way the capability is obtained (make it inheritable)
++chmod 0000 ./privileged
+ ./setcap cap_setuid,cap_setgid=ei ./privileged
++if [ $? -ne 0 ]; then
++ echo "FAILED to set file capability"
++ exit 1
++fi
++chmod 0755 ./privileged
++ln -s privileged unprivileged
++./setcap -r ./unprivileged
++if [ $? -eq 0 ]; then
++ echo "FAILED by removing a capability from a symlinked file"
++ exit 1
++fi
+
+ # Note, the bounding set (edited with --drop) only limits p
+ # capabilities, not i's.
+@@ -246,7 +258,7 @@ EOF
+ pass_capsh --iab='!%cap_chown,^cap_setpcap,cap_setuid'
+ fail_capsh --mode=PURE1E --iab='!%cap_chown,^cap_setuid'
+ fi
+-/bin/rm -f ./privileged
++/bin/rm -f ./privileged ./unprivileged
+
+ echo "testing namespaced file caps"
+
+--
+2.43.0
+
diff --git a/meta/recipes-support/libcap/libcap_2.69.bb b/meta/recipes-support/libcap/libcap_2.69.bb
index 03975b44a0a..43185f027ea 100644
--- a/meta/recipes-support/libcap/libcap_2.69.bb
+++ b/meta/recipes-support/libcap/libcap_2.69.bb
@@ -16,6 +16,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/libs/security/linux-privs/${BPN}2/${BPN}-${
file://0001-ensure-the-XATTR_NAME_CAPS-is-defined-when-it-is-use.patch \
file://0002-tests-do-not-run-target-executables.patch \
file://CVE-2025-1390.patch \
+ file://CVE-2026-4878.patch \
"
SRC_URI:append:class-nativesdk = " \
file://0001-nativesdk-libcap-Raise-the-size-of-arrays-containing.patch \
^ permalink raw reply related
* [OE-core][scarthgap 11/33] bzip2: Fix CVE-2026-42250
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
This patch applies the upstream fix as referenced in [1], using the commit shown in [2].
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-42250
[2] https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bf39a3c0497023e96de11444579ffef31f968bcd)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../bzip2/bzip2/CVE-2026-42250.patch | 35 +++++++++++++++++++
meta/recipes-extended/bzip2/bzip2_1.0.8.bb | 1 +
2 files changed, 36 insertions(+)
create mode 100644 meta/recipes-extended/bzip2/bzip2/CVE-2026-42250.patch
diff --git a/meta/recipes-extended/bzip2/bzip2/CVE-2026-42250.patch b/meta/recipes-extended/bzip2/bzip2/CVE-2026-42250.patch
new file mode 100644
index 00000000000..1679e744478
--- /dev/null
+++ b/meta/recipes-extended/bzip2/bzip2/CVE-2026-42250.patch
@@ -0,0 +1,35 @@
+From 71bf61d2e664c754ae5b1eb04018c8eaf5f99ae3 Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark@klomp.org>
+Date: Thu, 28 May 2026 16:15:45 +0200
+Subject: [PATCH] bzip2recover: Make sure to not process more than
+ BZ_MAX_HANDLED_BLOCKS
+
+There is an off-by-one in the check before calling tooManyBlocks. This
+causes the scanning loop to run one more time and cause a possible
+read or write one past the global bStart, bEnd, rbStart and rbEnd
+buffers. There are no known exploits of this issue and you will need
+to compile with something like gcc -fsanitize=address (ASAN
+AddressSanitizer) to observe the faulty read/write.
+
+This has been assigned CVE-2026-42250.
+
+CVE: CVE-2026-42250
+Upstream-Status: Backport [https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67]
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ bzip2recover.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bzip2recover.c b/bzip2recover.c
+index a8131e0..4b1c219 100644
+--- a/bzip2recover.c
++++ b/bzip2recover.c
+@@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv )
+ rbEnd[rbCtr] = bEnd[currBlock];
+ rbCtr++;
+ }
+- if (currBlock >= BZ_MAX_HANDLED_BLOCKS)
++ if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1)
+ tooManyBlocks(BZ_MAX_HANDLED_BLOCKS);
+ currBlock++;
+
diff --git a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb
index f9224908685..b661bc95465 100644
--- a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb
+++ b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb
@@ -26,6 +26,7 @@ SRC_URI = "https://sourceware.org/pub/${BPN}/${BPN}-${PV}.tar.gz \
file://configure.ac;subdir=${BP} \
file://Makefile.am;subdir=${BP} \
file://run-ptest \
+ file://CVE-2026-42250.patch;subdir=${BP} \
"
SRC_URI[md5sum] = "67e051268d0c475ea773822f7500d0e5"
SRC_URI[sha256sum] = "ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269"
^ permalink raw reply related
* [OE-core][scarthgap 02/33] glibc: stable 2.39 branch updates
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
git log --oneline ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc..be1e627cd72db31161a3b4ce1c8114674f0895eb
be1e627cd7 Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
98bc06a361 include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
3e13579841 Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
0dc95ae109 elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
9344c796f7 resolv: Check hostname for validity (CVE-2026-4438)
5663ab0b83 resolv: Count records correctly (CVE-2026-4437)
c53cd6e738 posix: Run tst-wordexp-reuse-mem test
2760e4c5ed iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
ba29a36aa3 posix: Fix invalid flags test for p{write,read}v2
60b039bf6a socket: Add new test for shutdown
Testing Results:
Before After Diff
PASS 4892 4896 +4
XPASS 4 4 0
FAIL 371 372 +1
XFAIL 16 16 0
UNSUPPORTED 224 224 0
Changes in testcases:
testcase-name before after
posix/tst-wordexp-reuse-mem(new) - PASS (native)
[Note: posix/tst-wordexp-reuse-mem is a new test added by this uplift
(c53cd6e738). It fails under QEMU user-mode because the test-wrapper
cannot support LD_PRELOAD and MALLOC_TRACE needed for mtrace. Running
natively with LD_PRELOAD=libc_malloc_debug.so confirms the test passes
with no memory leaks.
nptl/tst-getpid3 is a flaky test under QEMU user-mode (passes 7/10
re-runs). No nptl code was changed in this uplift.]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.39.bb | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 03a8e5d01e3..5d57dafed0a 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.39/master"
PV = "2.39+git"
-SRCREV_glibc ?= "ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc"
+SRCREV_glibc ?= "be1e627cd72db31161a3b4ce1c8114674f0895eb"
SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index 7958d64eed1..f6be1b5fc93 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -18,7 +18,8 @@ easier access for another. 'ASLR bypass itself is not a vulnerability.'"
CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
CVE_STATUS_STABLE_BACKPORTS = "CVE-2024-2961 CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602 CVE-2025-0395 \
- CVE-2025-4802 CVE-2025-5702 CVE-2025-8058 CVE-2025-15281 CVE-2026-0861 CVE-2026-0915"
+ CVE-2025-4802 CVE-2025-5702 CVE-2025-8058 CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 \
+ CVE-2026-4046 CVE-2026-4437 CVE-2026-4438"
CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
DEPENDS += "gperf-native bison-native"
^ permalink raw reply related
* [OE-core][scarthgap 01/33] create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Eric Meyers <eric.meyers15310@gmail.com>
The override was "task-create-image-sbom" but BitBake derives it as
"task-create-image-sbom-spdx" (do_ stripped, underscores to hyphens), so
the skip was never applied. The task then cached an ${IMAGE_NAME}-stamped
SBOM in sstate, letting a stale spdx.json be restored via setscene. A
later do_sbom_cve_check would compute the current IMAGE_NAME and fail with
"No such file or directory" on the missing timestamped SBOM. Correct the
key so the image SBOM is always regenerated, never restored from sstate.
Signed-off-by: Eric Meyers <eric.meyers@arthrex.com>
Cc: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 45302ff5cfaf91ece74d4065acf710507f27da15)
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes-recipe/create-spdx-image-3.0.bbclass | 2 +-
meta/classes-recipe/nospdx.bbclass | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/classes-recipe/create-spdx-image-3.0.bbclass b/meta/classes-recipe/create-spdx-image-3.0.bbclass
index e0f1766bb76..c516e954565 100644
--- a/meta/classes-recipe/create-spdx-image-3.0.bbclass
+++ b/meta/classes-recipe/create-spdx-image-3.0.bbclass
@@ -71,7 +71,7 @@ python do_create_image_sbom_spdx() {
}
addtask do_create_image_sbom_spdx after do_create_rootfs_spdx do_create_image_spdx before do_build
SSTATETASKS += "do_create_image_sbom_spdx"
-SSTATE_SKIP_CREATION:task-create-image-sbom = "1"
+SSTATE_SKIP_CREATION:task-create-image-sbom-spdx = "1"
do_create_image_sbom_spdx[sstate-inputdirs] = "${SPDXIMAGEDEPLOYDIR}"
do_create_image_sbom_spdx[sstate-outputdirs] = "${DEPLOY_DIR_IMAGE}"
do_create_image_sbom_spdx[stamp-extra-info] = "${MACHINE_ARCH}"
diff --git a/meta/classes-recipe/nospdx.bbclass b/meta/classes-recipe/nospdx.bbclass
index b20e28218be..913b213a654 100644
--- a/meta/classes-recipe/nospdx.bbclass
+++ b/meta/classes-recipe/nospdx.bbclass
@@ -10,4 +10,4 @@ deltask do_create_spdx_runtime
deltask do_create_package_spdx
deltask do_create_rootfs_spdx
deltask do_create_image_spdx
-deltask do_create_image_sbom
+deltask do_create_image_sbom_spdx
^ permalink raw reply related
* [OE-core][scarthgap 04/33] binutils: fix CVE-2025-69649, and CVE-2025-69652
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Roland Kovacs <roland.kovacs@est.tech>
CVE-2025-69649:
Null pointer dereference in readelf before 2.46 results in segfault when
processing a crafted ELF binary with malformed header fields.
No evidence of memory corruption beyond the null pointer dereference, nor
any possibility of code execution, was observed.
CVE-2025-69652:
Null pointer dereference in readelf when processing a crafted ELF binary
with malformed DWARF abbrev or debug information which leads to SIGABORT.
No evidence of memory corruption or code execution was observed; the impact
is limited to denial of service.
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
[YC: patches are referenced in the NVD database:
https://nvd.nist.gov/vuln/detail/CVE-2025-69649
https://nvd.nist.gov/vuln/detail/CVE-2025-69652 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../binutils/binutils-2.42.inc | 2 +
.../binutils/binutils/CVE-2025-69649.patch | 44 +++++++++++++++++++
.../binutils/binutils/CVE-2025-69652.patch | 39 ++++++++++++++++
3 files changed, 85 insertions(+)
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69649.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69652.patch
diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc
index 3ed80a82924..c93f51e3ee2 100644
--- a/meta/recipes-devtools/binutils/binutils-2.42.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.42.inc
@@ -74,6 +74,8 @@ SRC_URI = "\
file://0030-CVE-2025-11840.patch \
file://CVE-2025-69644-CVE-2025-69647.patch \
file://CVE-2025-69648.patch \
+ file://CVE-2025-69649.patch \
+ file://CVE-2025-69652.patch \
file://CVE-2026-6846.patch \
"
S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-69649.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-69649.patch
new file mode 100644
index 00000000000..8852ba4cb58
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-69649.patch
@@ -0,0 +1,44 @@
+From 37c8055eed3178a46417045dda63db7af21fd046 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Mon, 8 Dec 2025 15:58:33 +1030
+Subject: [PATCH] PR 33697, fuzzer segfault
+
+ PR 33697
+ * readelf.c (process_relocs): Don't segfault on no sections.
+
+CVE: CVE-2025-69649
+Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=66a3492ce68e1ae45b2489bd9a815c39ea5d7f66]
+
+Note:
+ The difference between this patch on v2.42 and upstream v2.46 is due to
+ the loop body printing the relocations in-line, which then in commit
+ 8e8d0b63ff15896cc2c228c01f18dfcf2a4a9305 have been factored out to a
+ separate 'display_relocations()' function.
+
+ See: [https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff;f=binutils/readelf.c;h=fa0de3a7e0d9c2acc18fe047a7019e09f1ce3894;hp=c1006480b7bc3e83dd87fb20d215342375614af9;hb=8e8d0b63ff15896cc2c228c01f18dfcf2a4a9305;hpb=31c21e2c13d85793b525f74aa911eb28700ed89c]
+
+Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
+---
+ binutils/readelf.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/binutils/readelf.c b/binutils/readelf.c
+index 5e4ad6ea6ad..8c1987ffaec 100644
+--- a/binutils/readelf.c
++++ b/binutils/readelf.c
+@@ -8961,9 +8961,9 @@ process_relocs (Filedata * filedata)
+ size_t i;
+ bool found = false;
+
+- for (i = 0, section = filedata->section_headers;
+- i < filedata->file_header.e_shnum;
+- i++, section++)
++ section = filedata->section_headers;
++ if (section != NULL)
++ for (i = 0; i < filedata->file_header.e_shnum; i++, section++)
+ {
+ if ( section->sh_type != SHT_RELA
+ && section->sh_type != SHT_REL
+--
+2.34.1
+
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-69652.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-69652.patch
new file mode 100644
index 00000000000..a3380ae4206
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-69652.patch
@@ -0,0 +1,39 @@
+From cb4f8fe24cc86a9f050be4cf9c619940f632ea6a Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Mon, 8 Dec 2025 16:04:44 +1030
+Subject: [PATCH] PR 33701, abort in byte_get_little_endian
+
+ PR 33701
+ * dwarf.c (process_debug_info): Set debug_info_p NULL when
+ DEBUG_INFO_UNAVAILABLE.
+
+CVE: CVE-2025-69652
+Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=44b79abd0fa12e7947252eb4c6e5d16ed6033e01]
+
+Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
+---
+ binutils/dwarf.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/binutils/dwarf.c b/binutils/dwarf.c
+index 615e051b2bf..13b11b46e41 100644
+--- a/binutils/dwarf.c
++++ b/binutils/dwarf.c
+@@ -4222,9 +4222,11 @@ process_debug_info (struct dwarf_section * section,
+ break;
+ }
+
+- debug_info *debug_info_p =
+- (debug_information && unit < alloc_num_debug_info_entries)
+- ? debug_information + unit : NULL;
++ debug_info *debug_info_p = NULL;
++ if (debug_information
++ && num_debug_info_entries != DEBUG_INFO_UNAVAILABLE
++ && unit < alloc_num_debug_info_entries)
++ debug_info_p = debug_information + unit;
+
+ assert (!debug_info_p
+ || (debug_info_p->num_loc_offsets
+--
+2.34.1
+
^ permalink raw reply related
* [OE-core][scarthgap 03/33] bind: Upgrade 9.18.44 -> 9.18.49
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Ashishkumar Parmar <asparmar@cisco.com>
This upgrade fixes CVE-2026-1519, CVE-2026-3039, CVE-2026-3592, CVE-2026-5946 and CVE-2026-5950.
Changelog
=========
https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html
The 9.18.45 changelog includes a Python 3.10 requirement change for ISC's
upstream system test suite, but OE-Core's bind recipe does not enable or package
that test suite and does not inherit ptest. This change is therefore not part of
the target build, installed packages, runtime dependencies, or runtime behavior.
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../bind/{bind_9.18.44.bb => bind_9.18.49.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-connectivity/bind/{bind_9.18.44.bb => bind_9.18.49.bb} (97%)
diff --git a/meta/recipes-connectivity/bind/bind_9.18.44.bb b/meta/recipes-connectivity/bind/bind_9.18.49.bb
similarity index 97%
rename from meta/recipes-connectivity/bind/bind_9.18.44.bb
rename to meta/recipes-connectivity/bind/bind_9.18.49.bb
index d424edcb4e2..723a09e7395 100644
--- a/meta/recipes-connectivity/bind/bind_9.18.44.bb
+++ b/meta/recipes-connectivity/bind/bind_9.18.49.bb
@@ -20,7 +20,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://0001-avoid-start-failure-with-bind-user.patch \
"
-SRC_URI[sha256sum] = "81f5035a25c576af1a93f0061cf70bde6d00a0c7bd1274abf73f5b5389a6f82d"
+SRC_URI[sha256sum] = "c43ce4548ebed788cd9df63658a7de105ceafba43fcd63fa352b1093e525cd24"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# follow the ESV versions divisible by 2
^ permalink raw reply related
* [OE-core][scarthgap 00/33] Patch review
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Wednesday, July 22.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4248
oe-selftest-armhost, oe-selftest-debian and oe-selftest-fedora failed
with 15289 – [scarthgap] AB-INT: sstatetests.SStatePrintdiff.test_gcc_runtime_vs_gcc_source failure
oe-selftest-debian was rebuilt on a isolated sstate/hashserv here:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/35/builds/4333
The following changes since commit 8aca19cff468c5f15c919c973c46be58e020af46:
cve-update: Avoid NFS caching issues (2026-07-17 12:05:24 +0200)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
for you to fetch changes up to 9a7f92f2dce94876fa63ce8625d53444a9a706aa:
glibc-testsuite: Do not generate SPDX (2026-07-20 13:50:16 +0200)
----------------------------------------------------------------
Aleksandar Nikolic (1):
wic: Fix updating fstab for nvme devices
Ankur Tyagi (3):
wireless-regdb: upgrade 2026.02.04 -> 2026.03.18
wireless-regdb: upgrade 2026.03.18 -> 2026.05.30
ca-certificates: upgrade 20260223 -> 20260601
Ashishkumar Parmar (1):
bind: Upgrade 9.18.44 -> 9.18.49
Benjamin Robin (Schneider Electric) (4):
python3: fix CVE-2026-11940
python3: fix CVE-2026-11972
python3: fix CVE-2026-9669
glib-2.0: fix CVE-2026-58016
Deepak Rathore (1):
util-linux: fix CVE-2026-13595
Eric Meyers (1):
create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for
do_create_image_sbom_spdx
Harish Sadineni (1):
binutils: Add CVE-2025-69646 to "CVE:" tag
Hitendra Prajapati (1):
vim: Fix for CVE-2026-52858,CVE-2026-52859,CVE-2026-52860
Hongxu Jia (1):
bzip2: fix 'bzip2 --version > /tmp/aaa 2>&1' hang
Hugo SIMELIERE (Schneider Electric) (1):
libcap: Fix CVE-2026-4878
Jaipaul Cheernam (3):
glibc: stable 2.39 branch updates
bzip2: Fix CVE-2026-42250
gzip: fix CVE-2026-41992
Joshua Watt (1):
glibc-testsuite: Do not generate SPDX
Kris Gavvala (1):
python3: skiptest tracemalloc_track_race
Mathieu Dubois-Briand (1):
python3: Simplify ptest exclusion list
Mike Crowe (1):
dropbear: Disable DSS correctly
Peter Marko (4):
socat: patch CVE-2026-56123
vex: remove obsolete semicolon
rootfs: move tasks using image_list_installed_packages to
postuninstall
expat: patch CVE-2026-41080
Roland Kovacs (2):
binutils: fix CVE-2025-69649, and CVE-2025-69652
binutils: fix CVE-2025-69645
Ross Burton (1):
xmlto: update SRC_URI
Sudhir Dumbhare (2):
python3-urllib3: fix CVE-2026-44431
openssh: set status for CVE-2026-3497
Theo Gaige (1):
expat: patch CVE-2026-45186
Vijay Anusuri (1):
tzdata/tzcode-native: upgrade 2026b -> 2026c
.../create-spdx-image-3.0.bbclass | 2 +-
meta/classes-recipe/license_image.bbclass | 2 +-
meta/classes-recipe/nospdx.bbclass | 2 +-
meta/classes/vex.bbclass | 2 +-
.../bind/{bind_9.18.44.bb => bind_9.18.49.bb} | 2 +-
.../openssh/openssh_9.6p1.bb | 1 +
.../socat/files/CVE-2026-56123.patch | 150 ++++++
.../socat/socat_1.8.0.0.bb | 1 +
...PBEAR_DSS-is-only-forced-for-fuzzing.patch | 30 ++
.../recipes-core/dropbear/dropbear_2022.83.bb | 1 +
.../expat/expat/CVE-2026-41080-01.patch | 50 ++
.../expat/expat/CVE-2026-41080-02.patch | 29 ++
.../expat/expat/CVE-2026-41080-03.patch | 467 ++++++++++++++++++
.../expat/expat/CVE-2026-45186-01.patch | 70 +++
.../expat/expat/CVE-2026-45186-02.patch | 318 ++++++++++++
.../expat/expat/CVE-2026-45186-03.patch | 46 ++
.../expat/expat/CVE-2026-45186-04.patch | 32 ++
.../expat/expat/CVE-2026-45186-05.patch | 32 ++
.../expat/expat/CVE-2026-45186-06.patch | 87 ++++
.../expat/expat/CVE-2026-45186-07.patch | 52 ++
meta/recipes-core/expat/expat_2.6.4.bb | 10 +
.../glib-2.0/glib-2.0/CVE-2026-58016-1.patch | 94 ++++
.../glib-2.0/glib-2.0/CVE-2026-58016-2.patch | 98 ++++
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 +
.../glibc/glibc-testsuite_2.39.bb | 1 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.39.bb | 3 +-
meta/recipes-core/util-linux/util-linux.inc | 1 +
.../util-linux/CVE-2026-13595.patch | 157 ++++++
.../binutils/binutils-2.42.inc | 3 +
.../binutils/binutils/CVE-2025-69645.patch | 135 +++++
.../binutils/binutils/CVE-2025-69648.patch | 2 +-
.../binutils/binutils/CVE-2025-69649.patch | 44 ++
.../binutils/binutils/CVE-2025-69652.patch | 39 ++
.../python3-urllib3/CVE-2026-44431.patch | 163 ++++++
.../python/python3-urllib3_2.2.2.bb | 1 +
.../python/python3/CVE-2026-11940.patch | 66 +++
.../python/python3/CVE-2026-11972.patch | 60 +++
.../python/python3/CVE-2026-9669.patch | 96 ++++
.../python/python3_3.12.13.bb | 23 +-
meta/recipes-devtools/xmlto/xmlto_0.0.28.bb | 2 +-
...-fix-bzip2-version-tmp-aaa-will-hang.patch | 62 +++
.../bzip2/bzip2/CVE-2026-42250.patch | 35 ++
meta/recipes-extended/bzip2/bzip2_1.0.8.bb | 2 +
.../gzip/gzip-1.13/CVE-2026-41992.patch | 64 +++
meta/recipes-extended/gzip/gzip_1.13.bb | 1 +
meta/recipes-extended/timezone/timezone.inc | 6 +-
....02.04.bb => wireless-regdb_2026.05.30.bb} | 2 +-
...0260223.bb => ca-certificates_20260601.bb} | 4 +-
.../libcap/files/CVE-2026-4878.patch | 164 ++++++
meta/recipes-support/libcap/libcap_2.69.bb | 1 +
.../vim/files/CVE-2026-52858.patch | 167 +++++++
.../vim/files/CVE-2026-52859.patch | 274 ++++++++++
.../vim/files/CVE-2026-52860.patch | 446 +++++++++++++++++
meta/recipes-support/vim/vim.inc | 3 +
scripts/lib/wic/plugins/imager/direct.py | 6 +-
56 files changed, 3595 insertions(+), 20 deletions(-)
rename meta/recipes-connectivity/bind/{bind_9.18.44.bb => bind_9.18.49.bb} (97%)
create mode 100644 meta/recipes-connectivity/socat/files/CVE-2026-56123.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Fix-so-DROPBEAR_DSS-is-only-forced-for-fuzzing.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-41080-03.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-03.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-04.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-05.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-06.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-45186-07.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58016-1.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-58016-2.patch
create mode 100644 meta/recipes-core/util-linux/util-linux/CVE-2026-13595.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69645.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69649.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69652.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44431.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-11940.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-11972.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-9669.patch
create mode 100644 meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch
create mode 100644 meta/recipes-extended/bzip2/bzip2/CVE-2026-42250.patch
create mode 100644 meta/recipes-extended/gzip/gzip-1.13/CVE-2026-41992.patch
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2026.02.04.bb => wireless-regdb_2026.05.30.bb} (94%)
rename meta/recipes-support/ca-certificates/{ca-certificates_20260223.bb => ca-certificates_20260601.bb} (94%)
create mode 100644 meta/recipes-support/libcap/files/CVE-2026-4878.patch
create mode 100644 meta/recipes-support/vim/files/CVE-2026-52858.patch
create mode 100644 meta/recipes-support/vim/files/CVE-2026-52859.patch
create mode 100644 meta/recipes-support/vim/files/CVE-2026-52860.patch
^ permalink raw reply
* [OE-core][scarthgap 05/33] binutils: fix CVE-2025-69645
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Roland Kovacs <roland.kovacs@est.tech>
Binutils objdump contains a denial-of-service vulnerability when processing
a crafted binary with malformed DWARF debug information. A logic error in
the handling of DWARF compilation units can result in an invalid offset_size
value being used inside byte_get_little_endian, leading to an abort (SIGABRT).
A local attacker can trigger the crash by supplying a malicious input file.
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
[YC: The patch is referenced on the NVD page:
https://nvd.nist.gov/vuln/detail/CVE-2025-69645 ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../binutils/binutils-2.42.inc | 1 +
.../binutils/binutils/CVE-2025-69645.patch | 135 ++++++++++++++++++
2 files changed, 136 insertions(+)
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-69645.patch
diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc
index c93f51e3ee2..d455acd7863 100644
--- a/meta/recipes-devtools/binutils/binutils-2.42.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.42.inc
@@ -77,5 +77,6 @@ SRC_URI = "\
file://CVE-2025-69649.patch \
file://CVE-2025-69652.patch \
file://CVE-2026-6846.patch \
+ file://CVE-2025-69645.patch \
"
S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-69645.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-69645.patch
new file mode 100644
index 00000000000..78d2d62a507
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-69645.patch
@@ -0,0 +1,135 @@
+From 3fe207e0625a76c8cba932e435762bfb5f544131 Mon Sep 17 00:00:00 2001
+From: Alan Modra <amodra@gmail.com>
+Date: Sun, 30 Nov 2025 12:51:54 +1030
+Subject: [PATCH] PR 33637, abort in byte_get
+
+When DWARF5 support was added to binutils in commit 77145576fadc,
+the loop over CUs in process_debug_info set do_types when finding a
+DW_UT_type unit, in order to process the signature and type offset
+entries. Unfortunately that broke debug_information/debug_info_p
+handling, which previously was allocated and initialised for each unit
+in .debug_info. debug_info_p was NULL when processing a DWARF4
+.debug_types section. After the 77145576fadc change it was possible
+for debug_infp_p to be non-NULL but point to zeroed data, in
+particular a zeroed offset_size. A zero for offset_size led to the
+byte_get_little_endian abort triggered by the fuzzer testcase.
+
+I haven't investigated whether there is any need for a valid
+offset_size when processing a non-fuzzed DWARF4 .debug_types section.
+Presumably we'd have found that out in the last 6 years if that was
+the case. We don't want to change debug_information[] for
+.debug_types!
+
+ PR 33637
+ * dwarf.c (process_debug_info): Don't change DO_TYPES flag bit
+ depending on cu_unit_type. Instead test cu_unit_type along
+ with DO_TYPES to handle signature and type_offset for a type
+ unit. Move find_cu_tu_set_v2 call a little later.
+
+CVE: CVE-2025-69645
+Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cdb728d4da6184631989b192f1022c219dea7677]
+
+Note:
+ Backported patch differs from upstream as commit
+ 1f7e70ddd2c49dd5442b8873dd6ef29b0a10fdc3 is not cherry-picked
+ just to introduce `do_flags` instead of the separate `do_type`
+ and `do_loc` booleans for it to apply cleanly.
+
+Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
+---
+ binutils/dwarf.c | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/binutils/dwarf.c b/binutils/dwarf.c
+index 615e051b2bf..836872f1b26 100644
+--- a/binutils/dwarf.c
++++ b/binutils/dwarf.c
+@@ -3865,8 +3865,6 @@ process_debug_info (struct dwarf_section * section,
+
+ SAFE_BYTE_GET_AND_INC (compunit.cu_version, hdrptr, 2, end_cu);
+
+- this_set = find_cu_tu_set_v2 (cu_offset, do_types);
+-
+ if (compunit.cu_version < 5)
+ {
+ compunit.cu_unit_type = DW_UT_compile;
+@@ -3876,8 +3874,6 @@ process_debug_info (struct dwarf_section * section,
+ else
+ {
+ SAFE_BYTE_GET_AND_INC (compunit.cu_unit_type, hdrptr, 1, end_cu);
+- do_types = (compunit.cu_unit_type == DW_UT_type);
+-
+ SAFE_BYTE_GET_AND_INC (compunit.cu_pointer_size, hdrptr, 1, end_cu);
+ }
+
+@@ -3891,6 +3887,7 @@ process_debug_info (struct dwarf_section * section,
+ SAFE_BYTE_GET_AND_INC (dwo_id, hdrptr, 8, end_cu);
+ }
+
++ this_set = find_cu_tu_set_v2 (cu_offset, do_types);
+ if (this_set == NULL)
+ {
+ abbrev_base = 0;
+@@ -3947,8 +3944,6 @@ process_debug_info (struct dwarf_section * section,
+
+ SAFE_BYTE_GET_AND_INC (compunit.cu_version, hdrptr, 2, end_cu);
+
+- this_set = find_cu_tu_set_v2 (cu_offset, do_types);
+-
+ if (compunit.cu_version < 5)
+ {
+ compunit.cu_unit_type = DW_UT_compile;
+@@ -3958,13 +3953,12 @@ process_debug_info (struct dwarf_section * section,
+ else
+ {
+ SAFE_BYTE_GET_AND_INC (compunit.cu_unit_type, hdrptr, 1, end_cu);
+- do_types = (compunit.cu_unit_type == DW_UT_type);
+-
+ SAFE_BYTE_GET_AND_INC (compunit.cu_pointer_size, hdrptr, 1, end_cu);
+ }
+
+ SAFE_BYTE_GET_AND_INC (compunit.cu_abbrev_offset, hdrptr, offset_size, end_cu);
+
++ this_set = find_cu_tu_set_v2 (cu_offset, do_types);
+ if (this_set == NULL)
+ {
+ abbrev_base = 0;
+@@ -3996,7 +3990,7 @@ process_debug_info (struct dwarf_section * section,
+ compunit.cu_pointer_size = offset_size;
+ }
+
+- if (do_types)
++ if (do_types || compunit.cu_unit_type == DW_UT_type)
+ {
+ SAFE_BYTE_GET_AND_INC (signature, hdrptr, 8, end_cu);
+ SAFE_BYTE_GET_AND_INC (type_offset, hdrptr, offset_size, end_cu);
+@@ -4011,7 +4005,7 @@ process_debug_info (struct dwarf_section * section,
+ if ((do_loc || do_debug_loc || do_debug_ranges || do_debug_info)
+ && num_debug_info_entries == 0
+ && alloc_num_debug_info_entries > unit
+- && ! do_types)
++ && !do_types)
+ {
+ free_debug_information (&debug_information[unit]);
+ memset (&debug_information[unit], 0, sizeof (*debug_information));
+@@ -4042,7 +4036,7 @@ process_debug_info (struct dwarf_section * section,
+ printf (_(" Abbrev Offset: %#" PRIx64 "\n"),
+ compunit.cu_abbrev_offset);
+ printf (_(" Pointer Size: %d\n"), compunit.cu_pointer_size);
+- if (do_types)
++ if (do_types || compunit.cu_unit_type == DW_UT_type)
+ {
+ printf (_(" Signature: %#" PRIx64 "\n"), signature);
+ printf (_(" Type Offset: %#" PRIx64 "\n"), type_offset);
+@@ -4319,7 +4313,7 @@ process_debug_info (struct dwarf_section * section,
+ we need to process .debug_loc and .debug_ranges sections. */
+ if ((do_loc || do_debug_loc || do_debug_ranges || do_debug_info)
+ && num_debug_info_entries == 0
+- && ! do_types)
++ && !do_types)
+ {
+ if (num_units > alloc_num_debug_info_entries)
+ num_debug_info_entries = alloc_num_debug_info_entries;
+--
+2.34.1
+
^ permalink raw reply related
* [OE-core][scarthgap 06/33] python3: Simplify ptest exclusion list
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Makes the exclusion list a bit more readable, avoiding very long sed
expression lines.
[Kris Gavvala]:
this commit was modified to fit scarthgap. the original commit expects
to skip test_timerfd_TFD_TIMER_ABSTIME, test_date_locale2 and test_null_dlsym.
These tests were not being skipped on scarthgap so were removed from the
backport.
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
(cherry picked from commit d9a44e7390d7c8f2c2b73572825a6f8ceeb729ac)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3_3.12.13.bb | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb
index 06dbc8e892d..b31dd3d743c 100644
--- a/meta/recipes-devtools/python/python3_3.12.13.bb
+++ b/meta/recipes-devtools/python/python3_3.12.13.bb
@@ -256,8 +256,19 @@ do_install:append:class-nativesdk () {
create_wrapper ${D}${bindir}/python${PYTHON_MAJMIN} TERMINFO_DIRS='${sysconfdir}/terminfo:/etc/terminfo:/usr/share/terminfo:/usr/share/misc/terminfo:/lib/terminfo' PYTHONNOUSERSITE='1'
}
-do_install_ptest:append:class-target:libc-musl () {
- sed -i -e 's|SKIPPED_TESTS=|SKIPPED_TESTS="-x test__locale -x test_c_locale_coercion -x test_locale -x test_os test_re -x test__xxsubinterpreters -x test_threading"|' ${D}${PTEST_PATH}/run-ptest
+
+SKIPPED_TESTS:append:class-target:libc-musl = " \
+ -x test__locale \
+ -x test_c_locale_coercion \
+ -x test_locale \
+ -x test_os test_re \
+ -x test__xxsubinterpreters \
+ -x test_threading \
+"
+
+
+do_install_ptest:append () {
+ sed -i -e "s|SKIPPED_TESTS=|SKIPPED_TESTS=\"${SKIPPED_TESTS}\"|" ${D}${PTEST_PATH}/run-ptest
}
SYSROOT_PREPROCESS_FUNCS:append:class-target = " provide_target_config_script"
^ permalink raw reply related
* [OE-core][scarthgap 07/33] python3: skiptest tracemalloc_track_race
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Kris Gavvala <kris.gavvala@windriver.com>
In python3 ptests, tracemalloc_track_race fails with a segfault.
To avoid ptest failures for now, skip the test.
Fixes [YOCTO #16182]
Upstream Issue: https://github.com/python/cpython/issues/143143
Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7504490ba5e6ce0317dd12bdb961542062f05830)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/python/python3_3.12.13.bb | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb
index b31dd3d743c..d74bdc158b6 100644
--- a/meta/recipes-devtools/python/python3_3.12.13.bb
+++ b/meta/recipes-devtools/python/python3_3.12.13.bb
@@ -256,6 +256,11 @@ do_install:append:class-nativesdk () {
create_wrapper ${D}${bindir}/python${PYTHON_MAJMIN} TERMINFO_DIRS='${sysconfdir}/terminfo:/etc/terminfo:/usr/share/terminfo:/usr/share/misc/terminfo:/lib/terminfo' PYTHONNOUSERSITE='1'
}
+# Fails with segfault
+# Bugzilla YP 16182 (test_tracemalloc_track_race)
+SKIPPED_TESTS = " \
+ --ignore test.test_tracemalloc.TestCAPI.test_tracemalloc_track_race \
+"
SKIPPED_TESTS:append:class-target:libc-musl = " \
-x test__locale \
^ permalink raw reply related
* [OE-core][scarthgap 08/33] python3: fix CVE-2026-11940
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed
by a crafted archive where a hardlink references a symlink stored at a
deeper name than the hardlink itself.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python/python3/CVE-2026-11940.patch | 66 +++++++++++++++++++
.../python/python3_3.12.13.bb | 1 +
2 files changed, 67 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-11940.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11940.patch b/meta/recipes-devtools/python/python3/CVE-2026-11940.patch
new file mode 100644
index 00000000000..0851138ae89
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-11940.patch
@@ -0,0 +1,66 @@
+From 91a9bd79cdbab8f8518c4a5e669b3f19680a2f31 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <stan@python.org>
+Date: Tue, 23 Jun 2026 14:31:38 +0100
+Subject: [PATCH] gh-151558: Fix symlink escape via `tarfile`
+ hardlink-extraction fallback (GH-151559)
+
+CVE: CVE-2026-11940
+Upstream-Status: Backport [https://github.com/python/cpython/commit/27dd970bf6b17ebca7c8ed486a40ab043ed7af8f]
+
+Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
+---
+ Lib/tarfile.py | 3 +++
+ Lib/test/test_tarfile.py | 24 ++++++++++++++++++++++++
+ 2 files changed, 27 insertions(+)
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index 59d3f6e5cce1..83226e907e4b 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -2650,6 +2650,9 @@ def makelink_with_filter(self, tarinfo, targetpath,
+ "makelink_with_filter: if filter_function is not None, "
+ + "extraction_root must also not be None")
+ try:
++ filter_function(
++ unfiltered.replace(name=tarinfo.name, deep=False),
++ extraction_root)
+ filtered = filter_function(unfiltered, extraction_root)
+ except _FILTER_ERRORS as cause:
+ raise LinkFallbackError(tarinfo, unfiltered.name) from cause
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index 759fa03ead70..29719d95b6c1 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -4080,6 +4080,30 @@ def test_sneaky_hardlink_fallback(self):
+ self.expect_file("boom", symlink_to='../../link_here')
+ self.expect_file("c", symlink_to='b')
+
++ @symlink_test
++ def test_sneaky_hardlink_fallback_deep(self):
++ # (CVE-2026-11940)
++ with ArchiveMaker() as arc:
++ arc.add("a/b/s", symlink_to=os.path.join("..", "escape"))
++ arc.add("s", hardlink_to=os.path.join("a", "b", "s"))
++
++ with self.check_context(arc.open(), 'data'):
++ e = self.expect_exception(
++ tarfile.LinkFallbackError,
++ "link 's' would be extracted as a copy of "
++ + "'a/b/s', which was rejected")
++ self.assertIsInstance(e.__cause__,
++ tarfile.LinkOutsideDestinationError)
++
++ for filter in 'tar', 'fully_trusted':
++ with self.subTest(filter), self.check_context(arc.open(), filter):
++ if not os_helper.can_symlink():
++ self.expect_file("a/")
++ self.expect_file("a/b/")
++ else:
++ self.expect_file("a/b/s", symlink_to=os.path.join('..', 'escape'))
++ self.expect_file("s", symlink_to=os.path.join('..', 'escape'))
++
+ @symlink_test
+ def test_exfiltration_via_symlink(self):
+ # (CVE-2025-4138)
+--
+2.54.0
diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb
index d74bdc158b6..e4907154119 100644
--- a/meta/recipes-devtools/python/python3_3.12.13.bb
+++ b/meta/recipes-devtools/python/python3_3.12.13.bb
@@ -44,6 +44,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://CVE-2026-6019_p2.patch \
file://CVE-2025-13462.patch \
file://CVE-2026-4224.patch \
+ file://CVE-2026-11940.patch \
"
SRC_URI:append:class-native = " \
^ permalink raw reply related
* [OE-core][scarthgap 10/33] python3: fix CVE-2026-9669
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
bz2.BZ2Decompressor objects could be reused after a decompression error.
If an application caught the resulting OSError and retried with the same
decompressor, crafted input could cause the decompressor to resume from an
invalid internal state and perform out-of-bounds writes to a stack buffer.
This could crash the process when processing untrusted data.
This CVE has a CVSS 4.0 score of 8.2. The patch (5755d0f08394) is
referenced in the CVEList database.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python/python3/CVE-2026-9669.patch | 96 +++++++++++++++++++
.../python/python3_3.12.13.bb | 1 +
2 files changed, 97 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-9669.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-9669.patch b/meta/recipes-devtools/python/python3/CVE-2026-9669.patch
new file mode 100644
index 00000000000..266c8beef05
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-9669.patch
@@ -0,0 +1,96 @@
+From 5b412e1f7bdb3e0667b2bc8b216ad216d59d8373 Mon Sep 17 00:00:00 2001
+From: Stan Ulbrych <stan@python.org>
+Date: Mon, 8 Jun 2026 11:55:32 +0200
+Subject: [PATCH] gh-150599: Prevent bz2 decompressor reuse after errors
+ (GH-150600)
+
+CVE: CVE-2026-9669
+Upstream-Status: Backport [https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e]
+
+Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
+---
+ Lib/test/test_bz2.py | 15 +++++++++++++++
+ Modules/_bz2module.c | 18 +++++++++++++++---
+ 2 files changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/Lib/test/test_bz2.py b/Lib/test/test_bz2.py
+index cb730a1a46e2..dcbf6a298264 100644
+--- a/Lib/test/test_bz2.py
++++ b/Lib/test/test_bz2.py
+@@ -958,6 +958,21 @@ def test_failure(self):
+ # Previously, a second call could crash due to internal inconsistency
+ self.assertRaises(Exception, bzd.decompress, self.BAD_DATA * 30)
+
++ def test_decompress_after_data_error(self):
++ data = bytes.fromhex(
++ "425a6839314159265359000000000000007fffff000000000000000000000000"
++ "00000000000000000000000000000000000000e0370000000000000000000000"
++ "000000000000000000000000000000000000000000000000000083f3"
++ )
++ bzd = BZ2Decompressor()
++ with self.assertRaisesRegex(OSError, "Invalid data stream"):
++ bzd.decompress(data)
++ # Previously, a second call could crash due to internal inconsistency
++ self.assertFalse(bzd.needs_input)
++ self.assertFalse(bzd.eof)
++ with self.assertRaisesRegex(ValueError, "previous error"):
++ bzd.decompress(b'\x00' * 18)
++
+ @support.refcount_test
+ def test_refleaks_in___init__(self):
+ gettotalrefcount = support.get_attribute(sys, 'gettotalrefcount')
+diff --git a/Modules/_bz2module.c b/Modules/_bz2module.c
+index 97bd44b4ac96..0b0916142f57 100644
+--- a/Modules/_bz2module.c
++++ b/Modules/_bz2module.c
+@@ -114,6 +114,7 @@ typedef struct {
+ typedef struct {
+ PyObject_HEAD
+ bz_stream bzs;
++ int bzerror;
+ char eof; /* T_BOOL expects a char */
+ PyObject *unused_data;
+ char needs_input;
+@@ -453,8 +454,11 @@ decompress_buf(BZ2Decompressor *d, Py_ssize_t max_length)
+
+ d->bzs_avail_in_real += bzs->avail_in;
+
+- if (catch_bz2_error(bzret))
++ if (catch_bz2_error(bzret)) {
++ d->bzerror = bzret;
++ d->needs_input = 0;
+ goto error;
++ }
+ if (bzret == BZ_STREAM_END) {
+ d->eof = 1;
+ break;
+@@ -621,10 +625,17 @@ _bz2_BZ2Decompressor_decompress_impl(BZ2Decompressor *self, Py_buffer *data,
+ PyObject *result = NULL;
+
+ ACQUIRE_LOCK(self);
+- if (self->eof)
++ if (self->eof) {
+ PyErr_SetString(PyExc_EOFError, "End of stream already reached");
+- else
++ }
++ else if (self->bzerror) {
++ // Re-entering BZ2_bzDecompress() after an error can write out of bounds.
++ PyErr_SetString(PyExc_ValueError,
++ "Decompressor is unusable after a previous error");
++ }
++ else {
+ result = decompress(self, data->buf, data->len, max_length);
++ }
+ RELEASE_LOCK(self);
+ return result;
+ }
+@@ -658,6 +669,7 @@ _bz2_BZ2Decompressor_impl(PyTypeObject *type)
+ return NULL;
+ }
+
++ self->bzerror = 0;
+ self->needs_input = 1;
+ self->bzs_avail_in_real = 0;
+ self->input_buffer = NULL;
+--
+2.54.0
diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb
index 72daee1d0ea..de174f7bfdc 100644
--- a/meta/recipes-devtools/python/python3_3.12.13.bb
+++ b/meta/recipes-devtools/python/python3_3.12.13.bb
@@ -46,6 +46,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://CVE-2026-4224.patch \
file://CVE-2026-11940.patch \
file://CVE-2026-11972.patch \
+ file://CVE-2026-9669.patch \
"
SRC_URI:append:class-native = " \
^ permalink raw reply related
* [OE-core][scarthgap 09/33] python3: fix CVE-2026-11972
From: Yoann Congal @ 2026-07-20 17:22 UTC (permalink / raw)
To: openembedded-core
In-Reply-To: <cover.1784567958.git.yoann.congal@smile.fr>
From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
When using the "tarfile" module with a file opened in "streaming mode"
(mode="r|") the tarfile module did not properly handle EOF, making archive
parsing take exponentially longer.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bbd9c82298880ab61b9befea97dfe8a0a4943836)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python/python3/CVE-2026-11972.patch | 60 +++++++++++++++++++
.../python/python3_3.12.13.bb | 1 +
2 files changed, 61 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2026-11972.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11972.patch b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch
new file mode 100644
index 00000000000..36334f247e6
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch
@@ -0,0 +1,60 @@
+From a83ebdb495a9cbd28a03675acdeda235fade90b3 Mon Sep 17 00:00:00 2001
+From: Petr Viktorin <encukou@gmail.com>
+Date: Tue, 23 Jun 2026 15:13:30 +0200
+Subject: [PATCH] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982)
+
+Co-authored-by: Stan Ulbrych <stan@python.org>
+
+CVE: CVE-2026-11972
+Upstream-Status: Backport [https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896]
+
+Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com>
+---
+ Lib/tarfile.py | 4 +++-
+ Lib/test/test_tarfile.py | 16 ++++++++++++++++
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index 83226e907e4b..c0007a78f700 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -516,7 +516,9 @@ def seek(self, pos=0):
+ if pos - self.pos >= 0:
+ blocks, remainder = divmod(pos - self.pos, self.bufsize)
+ for i in range(blocks):
+- self.read(self.bufsize)
++ data = self.read(self.bufsize)
++ if not data:
++ break
+ self.read(remainder)
+ else:
+ raise StreamError("seeking backwards is not allowed")
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index 29719d95b6c1..8aeb2e1b1b9a 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -4480,6 +4480,22 @@ def valueerror_filter(tarinfo, path):
+ with self.check_context(arc.open(errorlevel='boo!'), filtererror_filter):
+ self.expect_exception(TypeError) # errorlevel is not int
+
++ @support.subTests('format', [tarfile.GNU_FORMAT, tarfile.PAX_FORMAT])
++ def test_getmembers_big_size(self, format):
++ # gh-151981: A loop in seek() for streaming files tried to read the
++ # declared number of blocks even at EOF
++ tinfo = tarfile.TarInfo("huge-file")
++ tinfo.size = 1 << 64
++ bio = io.BytesIO()
++ # Write header without data
++ bio.write(tinfo.tobuf(format))
++
++ # Reset & try to get contents
++ bio.seek(0)
++ with tarfile.open(fileobj=bio, mode="r|") as tar:
++ with self.assertRaises(tarfile.ReadError):
++ tar.getmembers()
++
+
+ class OverwriteTests(archiver_tests.OverwriteTests, unittest.TestCase):
+ testdir = os.path.join(TEMPDIR, "testoverwrite")
+--
+2.54.0
diff --git a/meta/recipes-devtools/python/python3_3.12.13.bb b/meta/recipes-devtools/python/python3_3.12.13.bb
index e4907154119..72daee1d0ea 100644
--- a/meta/recipes-devtools/python/python3_3.12.13.bb
+++ b/meta/recipes-devtools/python/python3_3.12.13.bb
@@ -45,6 +45,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://CVE-2025-13462.patch \
file://CVE-2026-4224.patch \
file://CVE-2026-11940.patch \
+ file://CVE-2026-11972.patch \
"
SRC_URI:append:class-native = " \
^ permalink raw reply related
* Re: [OE-core][wrynose 05/17] kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
From: Freihofer, Adrian @ 2026-07-20 17:12 UTC (permalink / raw)
To: yoann.congal@smile.fr, Paul Barker,
openembedded-core@lists.openembedded.org
Cc: Ryan Eatmon
In-Reply-To: <DK3I8NXUCRHK.C3U8MB8K4NZV@smile.fr>
Hi Yoann
Just a confirmation from my side: Taking the 4 patches is the best we
can do. Considering them as a series of bug fixes is right. Getting the
test back-ported is of course nice to have.
Regards
Adrian
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#241413):
> https://lists.openembedded.org/g/openembedded-core/message/241413
> Mute This Topic: https://lists.openembedded.org/mt/120329199/3616858
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe:
> https://lists.openembedded.org/g/openembedded-core/unsub [
> adrian.freihofer@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply
* Re: [OE-core][wrynose 05/17] kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
From: Freihofer, Adrian @ 2026-07-20 17:12 UTC (permalink / raw)
To: yoann.congal@smile.fr, Paul Barker,
openembedded-core@lists.openembedded.org
Cc: Ryan Eatmon
In-Reply-To: <DK3I8NXUCRHK.C3U8MB8K4NZV@smile.fr>
Hi Yoann
Just a confirmation from my side: Taking the 4 patches is the best we
can do. Considering them as a series of bug fixes is right. Getting the
test back-ported is of course nice to have.
Regards
Adrian
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#241413):
> https://lists.openembedded.org/g/openembedded-core/message/241413
> Mute This Topic: https://lists.openembedded.org/mt/120329199/3616858
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe:
> https://lists.openembedded.org/g/openembedded-core/unsub [
> adrian.freihofer@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox