From 94a66542efbf554913efcd14428aa2e67fec3b4d Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Sun, 27 Sep 2026 13:39:13 +1300 Subject: [PATCH] unbound: patch CVE-2026-78227 Details: https://nvd.nist.gov/vuln/detail/cve-2026-78227 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../unbound/unbound/CVE-2026-78227.patch | 30 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch new file mode 100644 index 0000000000..b434885a1a --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch @@ -0,0 +1,30 @@ +From 1bec118f61aaf13cc5d1dfbaf1d45e0af8986901 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 16 Sep 2026 09:25:05 +0200 +Subject: [PATCH] - Fix CVE-2026-78227, Use-after-free in DoQ stream output + buffer on reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from + Nankai University, AOSP Lab for the report. + +(cherry picked from commit 7914901915dd46817e7ae9877776d6fb6fc2060e) + +CVE: CVE-2026-78227 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/7914901915dd46817e7ae9877776d6fb6fc2060e] + +Signed-off-by: Ankur Tyagi +--- + services/listen_dnsport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c +index 9b6fb557c..f748070f8 100644 +--- a/services/listen_dnsport.c ++++ b/services/listen_dnsport.c +@@ -4477,7 +4477,7 @@ doq_stream_reset_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id, + "unknown stream %d", (int)stream_id); + return 0; + } +- if(!doq_stream_close(doq_conn, stream, 0)) ++ if(!doq_stream_close(doq_conn, stream, 1)) + return NGTCP2_ERR_CALLBACK_FAILURE; + return 0; + } diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index c8d7c6cdab..1ab81879f2 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -45,6 +45,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-56444.patch \ file://CVE-2026-80225.patch \ file://CVE-2026-81642.patch \ + file://CVE-2026-78227.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"