diff --git a/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-55958.patch b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-55958.patch new file mode 100644 index 0000000000..a1f77eb40f --- /dev/null +++ b/meta-networking/recipes-connectivity/wolfssl/files/CVE-2026-55958.patch @@ -0,0 +1,36 @@ +From ea7c289d463c506fe3eb856c5d128b7d0e1799b7 Mon Sep 17 00:00:00 2001 +From: Chris Conlon +Date: Tue, 16 Jun 2026 13:58:52 -0600 +Subject: [PATCH] Renesas TSIP: skip XMEMCPY on MEMORY_E from + tsip_StoreMessage() + +(cherry picked from commit 6ebc379f313769ac49a84be0221c626162ffcfab) + +CVE: CVE-2026-55958 +Upstream-Status: Backport [https://github.com/wolfSSL/wolfssl/commit/6ebc379f313769ac49a84be0221c626162ffcfab] + +Signed-off-by: Ankur Tyagi +--- + wolfcrypt/src/port/Renesas/renesas_tsip_sha.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/wolfcrypt/src/port/Renesas/renesas_tsip_sha.c b/wolfcrypt/src/port/Renesas/renesas_tsip_sha.c +index 0d5957744..d04072397 100644 +--- a/wolfcrypt/src/port/Renesas/renesas_tsip_sha.c ++++ b/wolfcrypt/src/port/Renesas/renesas_tsip_sha.c +@@ -203,10 +203,11 @@ WOLFSSL_LOCAL int tsip_StoreMessage(struct WOLFSSL* ssl, const byte* data, + WOLFSSL_MSG("Capacity over error in tsip_StoreMessage"); + ret = MEMORY_E; + } +- +- XMEMCPY(bag->buff + bag->buffIdx, data, sz); +- bag->msgTypes[bag->msgIdx++] = *data; /* store message type */ +- bag->buffIdx += sz; ++ else { ++ XMEMCPY(bag->buff + bag->buffIdx, data, sz); ++ bag->msgTypes[bag->msgIdx++] = *data; /* store message type */ ++ bag->buffIdx += sz; ++ } + } + + WOLFSSL_LEAVE("tsip_StoreMessage", ret); diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb index f69497a80c..e2bb53a646 100644 --- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb +++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb @@ -18,6 +18,7 @@ SRC_URI = " \ file://CVE-2026-10098-1.patch \ file://CVE-2026-10098-2.patch \ file://CVE-2026-10512.patch \ + file://CVE-2026-55958.patch \ " SRCREV = "1d363f3adceba9d1478230ede476a37b0dcdef24"