Stay within the 4.23.x stable series (do not touch the sibling
talloc/tdb/tevent/ldb recipes). This picks up two intervening point
releases:
- 4.23.9: bug-fix release (use-after-free in ACL claims/conditions
handling, CTDB read-only record use-after-free/resource leak, RODC
auth fixes, among others).
- 4.23.10: security release fixing CVE-2026-6949 (TSIG/DNS OOB write
crash), CVE-2026-58216 (KDC kpasswd OOB read crash),
CVE-2026-58218 (DNS TKEY cache-flood DoS), CVE-2026-58221 (LDAP
privilege escalation via internal LDB special DNs),
CVE-2026-58222 (LDAP Compare filter used as protected-attribute
disclosure oracle) and CVE-2026-58224 (CTDB protocol
bounds-checking gaps).
- 4.23.11: further bug fixes (DRS memory leak, pthreadpool fork race,
RODC/NTLMv2 trust fixes, CephFS vfs crashes).
All 13 existing patches (including the musl-only pam/getpwent_r ones)
still apply cleanly against 4.23.11 with offset only, no fuzz, so none
needed to be reworked or dropped. LIC_FILES_CHKSUM for COPYING is
unchanged.
Build-verified with cleansstate + full build for qemux86-64.
AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit f971f62ef1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
- a11y: add aria-labels to copy-to-clipboard buttons
- a11y: add skip-to-operations link, banner and main landmarks
- a11y: close Authorization popup with Escape key and backdrop click
- a11y: name and state for dark-mode toggle button
- a11y: restore icon visibility in Windows High Contrast Mode
- a11y: topbar logo and dark-mode toggle visible in HCM
- a11y: use for model titles to convey emphasis semantically
- ci: bump cycjimmy/semantic-release-action to v6.0.0
- ci: fix Trivy security scan and add dependency vulnerability scan
- style: reduce padding on inline code blocks in markdown
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit e0346def92)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The inherited python:filelock mapping does not identify the tox-dev source packaged by this recipe, so filelock CVEs are missed.
Use tox-dev:filelock to match the source identity used by NVD and CNA.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 43fd2c88f1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
In Redis 8.0.x, the build system adds -flto by itself when clang is
used with the default optimization setting. In OE clang builds, the
final link still goes through the cross binutils linker path. That path
does not stage LLVMgold.so, so redis-benchmark link fails with:
x86_64-oe-linux-ld: ../lib/LLVMgold.so: error loading plugin
The failure is not seen with gcc because Redis does not add clang LTO in
that path. Also, changing OPTIMIZATION from the recipe is not a good fit
because it replaces Redis defaults and drops -fno-omit-frame-pointer.
Use Redis documented OPT variable only for clang builds. This avoids
the clang LTO path and keeps the frame-pointer flag. The gcc/default
build is left unchanged.
This local workaround can be removed later if LLVMgold/binutils-plugin
support is available in the toolchain path used by clang LTO builds.
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to the 0.11.5 security release to fix CVE-2026-15370 and CVE-2026-59843 through CVE-2026-59850.
Switch to the official GitLab mirror because the git.libssh.org endpoint no longer provides a usable Git repository for the new release.
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
============
- Python support 3.8+ only
- decompression limited by size and ratio
- decoder foundation to support more compression algorithms
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 69b5baba27)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
libfastjson is missing an explicit link dependency on the math library (libm),
which triggers GNU Indirect Function (IFUNC) resolution failure at runtime.
libfastjson internally calls the modf() math function but modf is optimized via
glibc's IFUNC mechanism. Because libfastjson was compiled without -lm, the dynamic
linker (ld.so) cannot safely resolve this dynamic IFUNC redirection, causing rsyslogd
to immediately crash with a segfault error.
rsyslogd boot error:
| starting rsyslogd ... /usr/sbin/rsyslogd: Relink `/usr/lib64/libfastjson.so.4'
| with `/lib64/libm.so.6' for IFUNC symbol `modf'
| rsyslogd[1311]: segfault at 9c ip
Signed-off-by: Preeti Sachan <preeti.sachan@intel.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The Makefile uses `KERN_MAJ = $(shell uname -r | cut -d . -f1)` to
determine if the kernel version is <7, which enables building vboxvideo.
Therefore, with a host kernel >=7 and a target kernel <7, vboxvideo is
not built and we get this error in vboxsf:
```
| In file included from ../vboxsf/include/iprt/stdarg.h:59,
| from ../vboxsf/include/iprt/types.h:44,
| from ../vboxsf/include/iprt/string.h:43,
| from mount.vboxsf.c:62:
| ../vboxsf/include/linux/stdarg.h:6:9: warning: 'va_start' redefined
| 6 | #define va_start(v, l) __builtin_va_start(v, l)
| | ^~~~~~~~
| In file included from mount.vboxsf.c:44:
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:49:9:
note: this is the location of the previous definition
| 49 | #define va_start(...) __builtin_c23_va_start(__VA_ARGS__)
| | ^~~~~~~~
| ../vboxsf/include/linux/stdarg.h:8:9: warning: 'va_arg' redefined
| 8 | #define va_arg(v, T) __builtin_va_arg(v, T)
| | ^~~~~~
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:54:9:
note: this is the location of the previous definition
| 54 | #define va_arg(v,l) __builtin_va_arg(v,l)
| | ^~~~~~
| ../vboxsf/include/linux/stdarg.h:9:9: warning: 'va_copy' redefined
| 9 | #define va_copy(d, s) __builtin_va_copy(d, s)
| | ^~~~~~~
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:57:9:
note: this is the location of the previous definition
| 57 | #define va_copy(d,s) __builtin_va_copy(d,s)
| | ^~~~~~~
```
If the missmatch is reversed, there is probably a different error.
To fix this we provide the actual target kernel version via the KERN_MAJ
Makefile variable
Note: The kernel version might be empty during parsing (e.g. when using
linux-dummy), therefore `or ''` is needed.
CC: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Khem Raj
Wang Mingyu
Ankur Tyagi
Devansh Patel
Deepak Rathore
Hetvi Thakar
Darsh Kelaiya
Vijay Anusuri
Omkar Patil
Abhishek Bachiphale
Preeti Sachan
Tugrul Kukul
Rouven Rastetter
Peter Marko