From b61a46bd33aaf1c2cdbd3fd2b1621f3a5953a0d2 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Sat, 3 Oct 2026 13:38:37 +0200 Subject: [PATCH] dhcpcd: set status for CVE-2026-56116 Patch [1] mentioned as commit fixing this CVE in NVD or Debian reports is fixing code adding new feature (route advertisment processing) which is also mentioned in the CVE descripiton. That was introduced in commit [2] which is v10.0.7 (>10.0.6) [1] https://github.com/NetworkConfiguration/dhcpcd/commit/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0 [2] https://github.com/NetworkConfiguration/dhcpcd/commit/f1cf924ad691bc1e6bf33013407fbf838fa40fbe (From OE-Core rev: 26acbf957a5aae69afadb40b05e99b26ff92b889) Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb index e6854e1c7f..c32db0adf5 100644 --- a/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb +++ b/meta/recipes-connectivity/dhcpcd/dhcpcd_10.0.6.bb @@ -62,3 +62,5 @@ do_install:append () { } FILES:${PN}-dbg += "${libdir}/dhcpcd/dev/.debug" + +CVE_STATUS[CVE-2026-56116] = "fixed-version: vulnerability was only introduced in v10.0.7"