From 2624b7628ee6131cafb439b6cbf25c9d96b3de43 Mon Sep 17 00:00:00 2001 From: Darsh Kelaiya Date: Wed, 4 Nov 2026 23:29:40 -0800 Subject: [PATCH] ntfs-3g-ntfsprogs: mark CVE-2026-56136 as fixed The three index validation patches already included for CVE-2026-46572 and CVE-2026-42617 also provide the complete CVE-2026-56136 fix [1-3]. Their combined source changes match Tuxera's 2022.10.3 backport linked from the advisory [4]. Add the missing CVE tag to each patch so cve-check recognises the existing fix. [1] https://github.com/tuxera/ntfs-3g/commit/2ead8a3ccf940c0219ffba587fab54e21462b3a5 [2] https://github.com/tuxera/ntfs-3g/commit/dfd1a7c6eb23a22238ec193451fa59c989b4381f [3] https://github.com/tuxera/ntfs-3g/commit/edf2b892356684ca8f2fc5898943c7a9b90ffb80 [4] https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-r66g-c39x-cw95 Signed-off-by: Darsh Kelaiya Signed-off-by: Anuj Mittal --- ...> CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p1.patch} | 2 +- ...> CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p2.patch} | 2 +- ...> CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p3.patch} | 2 +- .../ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb | 6 +++--- 4 files changed, 6 insertions(+), 6 deletions(-) rename meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/{CVE-2026-46572_CVE-2026-42617_p1.patch => CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p1.patch} (97%) rename meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/{CVE-2026-46572_CVE-2026-42617_p2.patch => CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p2.patch} (98%) rename meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/{CVE-2026-46572_CVE-2026-42617_p3.patch => CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p3.patch} (96%) diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p1.patch b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p1.patch similarity index 97% rename from meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p1.patch rename to meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p1.patch index 47121ea9a5..27fc063df2 100644 --- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p1.patch +++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p1.patch @@ -13,7 +13,7 @@ inconsistency. Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this issue. -CVE: CVE-2026-46572 CVE-2026-42617 +CVE: CVE-2026-46572 CVE-2026-42617 CVE-2026-56136 Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/2ead8a3ccf940c0219ffba587fab54e21462b3a5] (cherry picked from commit 2ead8a3ccf940c0219ffba587fab54e21462b3a5) diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p2.patch b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p2.patch similarity index 98% rename from meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p2.patch rename to meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p2.patch index d2d40124fe..ae78336386 100644 --- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p2.patch +++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p2.patch @@ -10,7 +10,7 @@ ntfs_attr_inconsistent() for INDEX_ROOT and from ntfs_index_block_inconsistent() for INDX blocks so callers can rely on the IE stream being well-formed. -CVE: CVE-2026-46572 CVE-2026-42617 +CVE: CVE-2026-46572 CVE-2026-42617 CVE-2026-56136 Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/dfd1a7c6eb23a22238ec193451fa59c989b4381f] (cherry picked from commit dfd1a7c6eb23a22238ec193451fa59c989b4381f) diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p3.patch b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p3.patch similarity index 96% rename from meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p3.patch rename to meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p3.patch index 54bce4f95e..3ff1a46ce8 100644 --- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_p3.patch +++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p3.patch @@ -9,7 +9,7 @@ applies at libntfs-3g/dir.c. Thanks to Alexandro Calo' from Nozomi Networks Labs for the report. -CVE: CVE-2026-46572 CVE-2026-42617 +CVE: CVE-2026-46572 CVE-2026-42617 CVE-2026-56136 Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/edf2b892356684ca8f2fc5898943c7a9b90ffb80] (cherry picked from commit edf2b892356684ca8f2fc5898943c7a9b90ffb80) diff --git a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb index 5d6af2aaf6..e4fe1798dc 100644 --- a/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb +++ b/meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb @@ -9,9 +9,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=59530bdf33659b29e73d4adb9f9f6552 \ SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV} \ file://0001-libntfs-3g-Makefile.am-fix-install-failed-while-host.patch \ file://0001-unistr.c-Fix-use-after-free-in-ntfs_uppercase_mbs.patch \ - file://CVE-2026-46572_CVE-2026-42617_p1.patch \ - file://CVE-2026-46572_CVE-2026-42617_p2.patch \ - file://CVE-2026-46572_CVE-2026-42617_p3.patch \ + file://CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p1.patch \ + file://CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p2.patch \ + file://CVE-2026-46572_CVE-2026-42617_CVE-2026-56136_p3.patch \ file://CVE-2026-46571.patch \ file://CVE-2026-46570.patch \ file://CVE-2026-46569.patch \