Analysis:
- The vulnerable code for CVE-2026-51401 is in src/os_vms.c. [1]
- src/os_vms.c is VMS-specific and is not compiled for Linux builds.
- Record the not-applicable-platform status; no source patch is required.
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-51401
(From OE-Core rev: df8f6b0403190429cc424638e26db1bfd7b9f53e)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Analysis:
- The vulnerable code for CVE-2026-51400 is in src/os_vms.c. [1]
- src/os_vms.c is VMS-specific and is not compiled for Linux builds.
- Record the not-applicable-platform status; no source patch is required.
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-51400
(From OE-Core rev: 7851ee1883615e9d8610c44e97eeb51bafbe9f66)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The --initial-rev option had no selftest coverage. Extend
test_devtool_update_recipe to run update-recipe with --initial-rev
set to the recorded initial revision, which should match the default
output, and to a revision partway through the local commits, which
should export only the commits after it.
AI-Generated: Uses Claude (claude-fable-5)
(From OE-Core rev: c2c94a081d812c4712726cb5fc59b878af600cc0)
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 171af3b2915dd076c8d1b205ff75eac1ebd5a586)
[Adjusted for scarthgap: also takes the cleanup_cmd change to this test
from de635a9bc0 ("mdadm: fetch from git"), which the new steps rely on]
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Since 900129cbdf ("devtool: add support for git submodules") the
--initial-rev option of update-recipe and finish has been broken: the
parse loop in _get_patchset_revs() deliberately skips the recorded
"# initial_rev ." entry from the workspace bbappend when an override
is passed, but the override value itself is never inserted into the
initial_revs dict. For a recipe without submodules the dict therefore
ends up empty and update-recipe/finish fails in patch mode with:
ERROR: Unable to find initial revision - please specify it with
--initial-rev
i.e. passing --initial-rev produces the very error message that
instructs the user to pass --initial-rev. Before 900129cbdf the passed
value simply took precedence over the one recorded in the bbappend.
Seed initial_revs with the override before parsing so the option
behaves as documented again; recorded values are still used for
submodules and for the main repo when no override is given.
AI-Generated: Uses Claude (claude-fable-5)
(From OE-Core rev: ea008fd0d08e13a408e88f54347aee0f8c23fd9c)
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 62abb60b899e63ea6db5c745f4b1b6af0d4b40f1)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
libaio has moved to Codeberg as pagure.io will be closed down shortly.
(From OE-Core rev: 30151c54ac1d729e5ec0778861fb3d843a260d99)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
(cherry picked from commit 237c32e181cd47194c3877d220360d6e6fbb2af8)
[YC: dropped the tag= SRC_URI parameter which does not mean the same
thing as in master. In bitbake=2.8/scarthgap, "tag=" conflicts with
SRCREV instead of checking it against the remote tag. ]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The kickstart reference documents "partition" as a synonym for "part".
wic does not accept it: its parser registers only part, bootloader and
include, so a .wks line beginning "partition" fails with an
invalid-choice error.
The synonym was real while wic used a bundled pykickstart, whose command
table mapped both spellings to one handler. Replacing that with a parser
carrying only the options wic uses kept "part" alone, and the manual was
not updated to match.
AI-Generated: codex/claude-opus 5 (xhigh)
(From yocto-docs rev: a34ca7357403feea970d27909e3529cf18e708d5)
Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3a52e763346647f2edf23dee4ed28ede5ba5c22b)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
When we unpack sstate files, we want to update the mtime+atime of the sstate
object and any sig/siginfo files, both for the files themselves and symlinks.
The logic was getting a bit hard to follow and wasn't entirely consistent with
only a time in some cases.
Clean it up and be consistent for all the files.
(From OE-Core rev: 147004ef60987039372c977e6c2f304a5414f39f)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5213ca88cbec4e86b50d8da1fe4c300ca8f5de17)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: for [YOCTO #15289] ]
Signed-off-by: Paul Barker <paul@pbarker.dev>
If we touch sstatefile, we should also touch any .sig/.siginfo file if we can.
We try and keep them both updated with accesses so one isn't removed without
the other and they stay consistent.
[YOCTO #15289]
(From OE-Core rev: 2bd595a9d95fac64174a25759124a0aa3d0dd001)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cc07895f951140dbbffcf32d3eabf65788cc4d00)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Unusual upgrade for expat to version 2.8.3
This is because there is a lot of CVEs and some are bigger than 20+ commits
so maintaining them is difficult
In new version there are fixes for CVE-2026-50219, CVE-2026-56131,
CVE-2026-56412, CVE-2026-72522 that was not backported yet
No braking ABI changes only 3 functions was added:
3 Added functions:
[A] 'function XML_Bool XML_SetAllocTrackerActivationThreshold(XML_Parser, long long unsigned int)' {XML_SetAllocTrackerActivationThreshold}
[A] 'function XML_Bool XML_SetAllocTrackerMaximumAmplification(XML_Parser, float)' {XML_SetAllocTrackerMaximumAmplification}
[A] 'function XML_Bool XML_SetHashSalt16Bytes(XML_Parser, const uint8_t*)' {XML_SetHashSalt16Bytes}
SONAME name stays the same as it was before - libexpat.so.1
Build all find package that depends on expat:
python3-xml fontconfig python3-xmltodict apr-util libxml-parser-perl exiv2
graphviz libdbus-c++ libwmf log4c neon poco polkit sdbus-c++ sdbus-c++-tools
wbxml2 apache2 lftp unbound wireshark libmusicbrainz mpd gegl
Tested using ptests for python3-xmltodict apr-util libxml-parser-perl
and expat itself
There is already planned expat 2.8.4 release but CVE fix there are small
and thus maintainable
Changelog notes here:
https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes
(From OE-Core rev: 408425eee8d281188a0f8b8e3e535e7c3af99f12)
Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: CVE-2026-72522 was ignored in the meantime, I removed the
CVE_STATUS line]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Backport six commits from upstream glibc to fix CVE-2026-6238.
4ba0b79b95 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
a7b60d23bb resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
cd0db208d5 resolv: Check for inet_ntop failure in ns_sprintrrf
d58415eb17 resolv: Improve formatting of unknown records in ns_sprintrrf
f69b7f95e3 resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
360f352c9a resolv: Declare __p_class_syms, __p_type_syms for internal use
The upstream patch series [PATCH 0/5] contains five commits:
1/5: Update GLIBC-SA-2026-0012 to mention A6 records (doc only)
2/5: resolv: Check for inet_ntop failure in ns_sprintrrf
3/5: resolv: Remove incorrect parts of TSIG handling from ns_sprintrrf
(CVE-2026-5435)
4/5: resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
5/5: resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
For this backport:
- Patch 1/5 is skipped (documentation-only change to advisories,
upstream glibc itself does not backport this to older releases)
- Patch 3/5 (CVE-2026-5435) is already patched in scarthgap sources
- Patches 2/5, 4/5, and 5/5 are backported as:
0028-CVE-2026-6238-0004.patch (inet_ntop failure check)
0029-CVE-2026-6238-0005.patch (buffer overread fix - CVE-2026-6238)
0030-CVE-2026-6238-0006.patch (test case for bug 34033, bug 34069)
However, the test case (tst-ns_sprintrr) from patch 5/5 failed on
scarthgap's glibc 2.39 due to missing prerequisite commits. Three
additional patches were backported to resolve the test failure:
0025-CVE-2026-6238-0001.patch (Declare __p_class_syms, __p_type_syms for internal)
0026-CVE-2026-6238-0002.patch (Fix ns_sprintrrf formatting of class, type values)
0027-CVE-2026-6238-0003.patch (Improve formatting of unknown records in ns_sprintrrf)
CVE-2026-6238 fixes buffer overreads in ns_sprintrrf affecting A6 and
LOC record handling. The vulnerable LOC record handling was introduced
before glibc 2.0, while A6 record handling was added in glibc 2.7.
Reference:
https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/https://nvd.nist.gov/vuln/detail/CVE-2026-6238https://sourceware.org/bugzilla/show_bug.cgi?id=34069
Testing Results:
Before After Diff
PASS 4896 4897 +1
XPASS 4 4 0
FAIL 372 372 0
XFAIL 16 16 0
UNSUPPORTED 224 224 0
Changes in testcases:
testcase-name before after
resolv/tst-ns_sprintrr(new) - PASS
commit - 4ba0b79b95 resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
+PASS: resolv/tst-ns_sprintrr
(From OE-Core rev: 7761a8aaac0703a738a2a4979ddb015157374dcb)
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed patch format]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Peter Marko
Hetvi Thakar
Vijay Anusuri
Devansh Patel
Babanpreet Singh
Rohini Sangam
Jakub Szczudlo (Nokia)
Ross Burton
Trevor Woerner
Paul Barker
Yogita Urade
Richard Purdie
Tim Orling
Deepesh Varatharajan