Kernel 6.6.151 dropped the drm_fb_helper_alloc_info() declaration as
part of a stable backport, causing vbox_fb.c to fail with:
vbox_fb.c:336:16: error: implicit declaration of function 'drm_fb_helper_alloc_info'
The existing RTLNX_VER_MIN(6,19,0) check can't express this since the
change landed mid-series in 6.6.y/6.12.y/6.18.y. Backport master
commit b249fbbf1b ("vboxguestdrivers: fix
vboxvideo build on kernels lacking drm_fb_helper_alloc_info"), adapted
for the 7.2.8 recipe (which only carries the RTLNX_VER_MIN(6,19,0)
guard upstream).
(cherry picked from commit 0f00f8b9a2)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The recipe builds out of tree with O=${B}, and the kernel's tools/build
writes fixdep .cmd files into ${B} that list the compiler's own headers
by absolute path, version included. When the toolchain changes (gcc
13.4 -> 13.5 here) do_compile reruns in the same ${B}, make cannot find
the old prerequisite and stops:
make[1]: *** No rule to make target '.../recipe-sysroot-native/usr/lib/arm-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/13.4.0/include/stddef.h', needed by '.../spidev_test.o'. Stop.
Empty ${B} before configure, as bpftool does.
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit bd52d9b479)
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The x86 AES SIMD path in absl/hash/internal/hash.cc uses the 64-bit-only
_mm_cvtsi128_si64 and _mm_extract_epi64 intrinsics but is gated only on
__SSE4_2__ && __AES__, so the 32-bit multilib build fails to compile.
Add a patch that requires __x86_64__/_M_X64 for that path, matching the
existing guard in absl/crc/internal/crc32_x86_arm_combined_simd.h.
Upstream-Bug: https://github.com/abseil/abseil-cpp/issues/2176
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
libssh:libssh is the active NVD dictionary CPE and configuration identity
for the packaged libssh source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 48-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit f1c88ff462)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
mariadb:mariadb is the active NVD dictionary CPE and configuration identity,
and is also used by CNA affected data for the packaged MariaDB source.
Deprecated mariadb_project records describe a separate Node.js connector.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the 420-entry CVE report unchanged,
with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 099991739c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE. php:php
is the active NVD dictionary CPE and configuration identity. php_group:php
preserves historical NVD configurations and current authoritative PHP
Security CNA affected data for the same php-src source; it is not an NVD
dictionary CPE.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 731-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4b8eedb7d2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
Use jq_project:jq for the historical NVD dictionary CPE and configuration
identity carrying two jq 1.5 CVEs, and jqlang:jq for the active NVD
dictionary CPE and configuration identity plus CNA affected-data identity
used by the current upstream.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 26-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5d23770adc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
nlnetlabs:ldns is the active NVD dictionary CPE and configuration
identity for the packaged NLnet Labs source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the eight-entry CVE report
unchanged, with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit fe530d55ef)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
avro-c++'s CMakeLists.txt calls find_package(fmt) and only falls
back to fetching fmt 10.2.1 via FetchContent if fmt isn't found.
The recipe never added fmt to DEPENDS, so find_package fallback
is always triggered. The recipe then had to stage it into
${B}/_deps/fmt-src.
oe-core already provides fmt_12.1.0), and avro-c++ only
uses a small, stable part of its API (fmt::format_string,
fmt::format, fmt::formatter<T>) that is unchanged between 10.x and
12.x.
Add fmt to DEPENDS so find_package(fmt) succeeds and avro-c++ links
oe-core's fmt instead, and drop the fmt SRC_URI, SRCREV_fmt and
do_configure:prepend().
Signed-off-by: Sana Kazi <Kazi.S@bmwtechworks.in>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Pick patches mentioning these CVEs in their commit messages.
Note that patch for CVE-2026-4897 introduces CVE-2026-85498.
Also pick additional patch introduced between these commits which
touches the added code so the final patch applies cleanly.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Minor security release.
Refreshed the context of 0003-configure.ac-bypass-autoconf-2.69-version-check.patch
for the 17.11 sources (context/version line only, no functional change).
All other patches apply cleanly and are unchanged.
PostgreSQL 17.11 fixes several CVEs;
see the release notes: https://www.postgresql.org/docs/17/release-17-11.html
Ran ptest on qemux86-64: all tests passed.
Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Anuj Mittal
Mehmet Fide
Peter Marko
Ankur Tyagi
Jason Schonberg
Jaipaul Cheernam
Devansh Patel
Wang Mingyu
Sana Kazi
Viswanath Kraleti
Deepak Rathore
Omkar Patil