PipeWire 1.6.8 (2026-07-09)
This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.
Highlights
- Fix a data race in JACK that could cause lost MIDI events in ardour.
- Fix some unbounded memory allocations.
- Various small fixes.
PipeWire
- Avoid some graph recalcs, which fixes a bug when suspending a node
while it is active.
Modules
- Do Content-Length and allocation check in RAOP to avoid OOM errors.
- Fix a potential memory leak in the error path of client-node. (#5348)
SPA
- Fix filter-graph dynamic graph updates.
- Avoid 100% when unplugging a card.
- Fix filter-graph volumes when the filter is loaded inside a node with
hardware volume. (#5344)
- Add normalize and latency options to the SOFA filter. (#5322)
Bluetooth
- Fix a potential leak when transport fails to start.
Pulse-server
- Avoid stack exhaustion via unbounded alloca.
JACK
- Fix a data race in jack_port_get_buffer() when called from concurrent
threads, like in ardour. (#5324)
GStreamer
- Skip invalid crop metadata.
- Avoid crash because metadata listener was registered twice.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6dbf718454)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
PipeWire 1.6.7 (2026-06-18)
This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.
Highlights
- Fix a race issue where some ports would stay silent after a rate change.
- Fix sync regressions between ALSA cards in some cases.
- Small fixes and improvements.
PipeWire
- Fix a scheduler regression where some driver nodes would not run
correctly and cause sync issues. (#5210)
- Fix a race issue with suspend on samplerate changes. It can cause ports
to be silent. (#3547)
Modules
- There are some locking issues in the RT portal, for now reduce the
DBus timeout to something more sane. Also disable portal RT for
pipewire and the pulse server. These are not usually run in a sandbox
and can go directly to RTKit.
- Fix potential incorrect delay in combine-stream.
SPA
- Fix a regression in ALSA period_size calculations. For non-power-of-2
periods, it would in some cases round down a a power-of-2, causing a
mismatch between requested and configured period_size. (#5302)
- Fix a potential segfault when removing a card because of bad ALSA api
usage. (#5255)
- Emit a route param update when card properties change. Otherwise, jack
port updates are not always reflected correctly.
Misc
- Make sure we don't deal with uninitialized spa_dict.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ce604315bc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 6.5.7:
- CurlAsyncHTTPClient now fully resets the curl object before reusing
it. This prevents incorrectly reusing options from a previous request,
specifically including client SSL and credentials used for accessing
proxies.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7c11942641)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
target, native, and nativesdk variants, handle the supported
-mllvm spellings, and only mark the CVE unpatched when the
vulnerable LLVM option combination is explicitly enabled and the
Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
configuration is not affected.
- Hence ignoring/deferred the CVE for now.
Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0eda0f3c55)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Prior to version 2.21, the `radvdump` utility shipped with radvd
contains a stack buffer overflow in the Route Information option
parser.
When processing a crafted ICMPv6 Router Advertisement, `print_ff()`
copies up to 2032 bytes from attacker-controlled packet data into a
16-byte `struct in6_addr` on the stack, overflowing by up to 2016
bytes.
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
CVE-2026-43868:
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.
CVE-2026-43869:
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
This CVE only affects the Java client, which is not built by the recipe. Marked as
'not-applicable-config'.
Upstream commit:
https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66
CVE-2026-43870:
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers
('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability
in Apache Thrift.
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The function uio_line_from_file() fails to close the FILE pointer
when fgets() returns NULL, causing a file descriptor leak.
This can be triggered when reading from /sys files that return
empty content, leading to resource exhaustion over time.
Fix this by using goto-based error handling to ensure fclose()
is called on all exit paths.
Signed-off-by: Qliangw <qili00001@gmail.com>
(cherry picked from commit cd75edf25d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
cca_settings is used without zero initialization, which may
introduce random values and result in invalid nl80211
attributes.
Without this fix, BSS color switch may fail completely and
the feature becomes non-functional. Initialize the structure
before use.
Signed-off-by: Wei Zhang <wei.zhang@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit feb24a676b)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==========
- Issue 2057 - SQL Injection in mod_wrap2_sql via reverse DNS
hostname (CVE-2026-44331).
- Issue 2056 - Incomplete fix for session management with OpenSSL 3.2.x or
later, when using TLSv1.2 or earlier. This complements the fix for
Issue #1963.
- Issue 2098 - Hard quota limits on uploads do not cause SFTP WRITE requests
to fail as expected.
- Issue 2102 - SSH payload length underflow calculation for ETM/ChaChaPoly
algorithms in mod_sftp.
- Issue 2104 - SSH packet with empty payload triggers null pointer dereference
in mod_sftp.
- Issue 2106 - Bad DSA signatures can lead to out-of-bounds read of heap memory
in mod_sftp.
- Issue 2108 - Mismatched RSA/DSA algorithm signatures can lead to null
dereference in mod_sftp.
- Issue 2115 - SFTP request payload length underflow calculation in mod_sftp.
- Issue 2120 - Several modules fail to build using OpenSSL 4.0.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 88de7c1468)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Khem Raj
Wang Mingyu
Markus Volk
Leon Anavi
Peter Marko
Darsh Kelaiya
Jason Schonberg
Deepak Rathore
Roland Kovacs
Qliangw
Shubham Pushpkar
Joao Marcos Costa
Wei Zhang
Mingli Yu